# Towards a Broadening of Privacy Decision-Making Models: The Use of Cognitive Architectures

Yefim Shulman

► To cite this version:

Yefim Shulman. Towards a Broadening of Privacy Decision-Making Models: The Use of Cognitive Architectures. Marit Hansen; Eleni Kosta; Igor Nai-Fovino; Simone Fischer-Hübner. Privacy and Identity Management. The Smart Revolution: 12th IFIP WG 9.2, 9.5, 9.6/11.7, 11.6/SIG 9.2.2 International Summer School, Ispra, Italy, September 4-8, 2017, Revised Selected Papers, AICT-526, Springer International Publishing, pp.187-204, 2018, IFIP Advances in Information and Communication Technology, 978-3-319-92924-8. 10.1007/978-3-319-92925-5_12. hal-01883617

HAL Id: hal-01883617

https://inria.hal.science/hal-01883617

Submitted on 28 Sep 2018

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Towards a Broadening of Privacy Decision-Making Models: the Use of Cognitive Architectures

Yefim Shulman¹[0000-0002-3163-9726]

¹Tel Aviv University, Tel Aviv 6997801, Israel
efimshulman@mail.tau.ac.il

**Abstract.** Over the last decades, people's behaviour and attitudes towards privacy have been thoroughly studied by scholars, approaching the issue from different perspectives. To address privacy-related decisions, it is necessary to consider aspects of human cognition, employing, for instance, methods used in Human-Computer Interaction and Information Science research. This paper analyses findings and contributions of existing privacy decision-making research, and suggests filling gaps in current understanding by applying a cognitive architecture framework to model privacy decision-making. This may broaden the range of factors and their relationships that can be integrated into the models of privacy decisions, beyond those in existing decision models.

**Keywords:** Decision Making, Privacy, Model, Cognitive Architectures, ACT-R

## 1 Introduction

Privacy issues have been a matter of growing importance for individuals, as well as for business entities and regulators.

The key element in privacy-related interactions with technology is the end-user (i.e., data subject), who is entitled to make, supposedly well-informed, choices about how to deal with one's own personal information. For the most part, decisions concerning privacy are decisions of people giving or revoking their consent. These decisions are imposed on the users whenever they desire to interact with an information service, as well as with some more traditional services.

Other, more particular, decisions can result from the users' initiative (e.g., requesting deletion of their personal information, instituting changes in the data they have shared or in the way the system is allowed to process it, requesting a report on their privacy status, etc.). Such decisions are not usually forced upon the users, and they can be made by users without prior notifications and requests from systems or data holders. Therefore, to address these important issues, it is useful to be able to model human behaviour, when it comes to making decisions on privacy-related interactions.

This paper investigates the state-of-the-art in privacy decision-making literature and suggests the use of ACT-R (Active Control of Thought – Rational) modelling framework to bridge the identified gaps and provide for a better understanding of people's information disclosure behaviour.
Section 2 introduces the current stage of research and outlines and compares main approaches in privacy decision-making. Section 3 introduces the field of cognitive architectures, discusses applicability and potential contributions of models constructed with ACT-R framework. Section 4 provides concluding remarks and challenges of proposed modelling paradigm.

# 2 Research on Privacy-Related Decision-Making Models

Section 2.1 provides an outline of the literature selection process. In Section 2.2 I discuss identified approaches and theories, traversing privacy decision-making research. Section 2.3 gives more attention to the literature on the privacy calculus, which prevails in the state-of-the-art literature on privacy decision-making. Section 2.3 contains further comparisons of the state-of-the-art research and discusses opportunities for improvement.

## 2.1 Literature Selection

As the first step, I identify the existing literature on privacy-related decision-making that should form the body of work, through which we parse in this paper (see Table 1). In my approach, I relied on the guidelines by Webster and Watson [58].

<table><caption>**Table 1.** The outline of the selection process</caption><thead><tr><th>Selection Criterion</th><th>Restriction Properties</th></tr></thead><tbody><tr><td>Main Sources Databases</td><td>Google Scholar, Scopus, Web of Science</td></tr><tr><td>Venue Locations</td><td>Not restricted</td></tr><tr><td>Journals / Conferences</td><td>Not restricted</td></tr><tr><td>Disciplines</td><td>Not restricted</td></tr><tr><td>Amount of Citations</td><td>Not restricted</td></tr><tr><td>Status</td><td>Published or "to-appear-in" state</td></tr><tr><td>Versions priority</td><td>First: Official publication<br>Second: Final edition from an author's website<br>Third: Proceedings version and pre-print</td></tr><tr><td>Date of publication</td><td>Not restricted</td></tr><tr><td>Search terms</td><td>"model", "privacy", "decision", "making"</td></tr><tr><td>Exclusion criteria</td><td>"mental models"<br>Court decision-making and legal cases<br>Papers written not in the English language<br>Medical disclosure and other papers related to rules, procedures, regulations, instructions and orders</td></tr><tr><td>Additional sources</td><td>Lists of references in the relevant papers.<br>Lists of mentions of the relevant papers.</td></tr></tbody></table>
For the review I used broad multi-disciplinary databases. I included papers that did not draw significant attention from other scholars over the years. It was important for the purposes of this paper to try and highlight all the ideas applied to study privacy decision-making that had been tested so far.

## 2.2 Approaches and Theories in Privacy-Related Decision-Making

Researchers have studied human decision-making from a psychological and economic standpoints, using a variety of models, based on classical economics (i.e., expected value and expected utility theory) and its generalized extensions, as well as behavioural economics (see Fig. 1).

Acquisti, Taylor and Wagman [1] discuss how privacy has been being regarded as an economic good and provide an explanation on how individuals' informed decisions about their privacy are being hindered, because of asymmetry of the information available to people, when they make privacy-related decisions.

Behavioural economics is a permeant theme in the more recent papers (e.g., Adjerid and Peer [2]; Dinev, McConnell, and Smith [10]; Dong, Jin, and Knijnenburg [12]; etc.). Arguably, it may be applicable for modelling human decisions in privacy-related interactions as an instance of decision-making under risk. Barberis [6] provides multiple examples of how it has been used to model decisions in areas spanning from finance and insurance to understanding betting markets, pricing, consumption-saving decisions, etc.

Overall, I identified 40 papers on user decisions on online privacy. Nine papers reported surveys, positions, system prototypes, case-studies or user-study experiments and did not deal with model development. They are still included in this paper, representing the current developments in the subject domain. The outline of the families of theories and frameworks used so far is presented in Table 2.

<figure><img src="image_2.png" /><figcaption>**Fig. 1.** The relations of approaches to modelling decision-making in Economics</figcaption></figure>
<table><caption>**Table 2.** Theories and Frameworks in privacy decision-making literature</caption><thead><tr><th>Theories and Frameworks</th><th>Relying Papers</th></tr></thead><tbody><tr><td>Privacy Calculus, in conjunction with Theory of Reasoned Action (TRA) and Theory of Planned Behaviour (TPB)</td><td>Knijnenburg and Kobsa; Dinev et al.; Dong et al.; Kehr, Kowatsch, Wentzel, and Fleisch; Zhu, Ou, van den Heuvel, and Liu; [10, 12, 23, 26, 60] etc. –</td></tr><tr><td>TRA and (or) TPB, excluding Privacy Calculus</td><td>Majority of papers is based on privacy calculus approach or its extensions, see Section 2.2 for more detailed discussion</td></tr><tr><td>Bounded rationality and Generalised Expect Utility</td><td>Pu and Grossklags; Kehr et al.; Zhu et al. [23, 42, 60]</td></tr><tr><td>Behavioural Economics</td><td>Dinev et al.; Adjerid and Peer [2, 10]</td></tr><tr><td>Cognitive Scarcities</td><td>Veltri and Ivchenko [53]</td></tr><tr><td>Social Identity Theory, Social Exchange Theory</td><td>Koohikamali et al.; Shih, Lai and Cheng [27, 47]</td></tr><tr><td>Five Factor Model</td><td>Egelman and Peer; Koohikamali et al.; Ross et al. [13, 27, 45]</td></tr><tr><td>Machine Learning (Decision Trees, Cluster Analysis, Classification)</td><td>Dong et al.; Ghosh and Singh; Lee and Kobsa [12, 17, 32]</td></tr><tr><td>Technology Acceptance Model</td><td>Kim, Ferrin and Rao [25]</td></tr><tr><td>Hofstede's Cultural Dimensions Theory</td><td>Krasnova, Veltri and Günther [30]</td></tr><tr><td>Mathematical Economics: Classic Decision Theory</td><td>Griffin, Rajtmajer and Squicciarini [20]</td></tr><tr><td>Optimization Theory</td><td>Griffin et al. [20]</td></tr><tr><td>Graph Theory</td><td>Mahmood, S. and Desmedt, Y.; Pu and Grossklags [36, 42]</td></tr><tr><td>Game Theory</td><td>Mahmood, S. and Desmedt, Y.; Panaousis, Laszka, Pohl, Noack and Alpcan [36, 40]</td></tr><tr><td>Markov Decision Process</td><td>Venkitasubramaniam [54]</td></tr><tr><td>Expectancy Theory</td><td>Hann, Hui, Lee and Png; Keith, Thompson, Hale, Lowry and Greer [21, 24]</td></tr><tr><td>Conjoint Analysis</td><td>Hann et al. [21]</td></tr><tr><td>Fuzzy Logic</td><td>Zhu et al. [60]</td></tr><tr><td>Stimulus-Organism-Response (S-O-R) Model</td><td>H. Li, Sarathy and Xu [33]</td></tr><tr><td>Protection Motivation Theory</td><td>Y. Li; Z. Wang and Liu [34, 57]</td></tr><tr><td>Social Contract Theory</td><td>Malhotra, Kim and Agarwal [37]</td></tr><tr><td>Elaboration Likelihood Model</td><td>Dinev et al. [10]</td></tr><tr><td>Valence Framework</td><td>Dinev and Hart; Kim et al.; Eling, Krasnova, Widjaja and Buxmann [8, 15, 25]</td></tr><tr><td>Experience Sampling Method</td><td>Lee and Kobsa [32]</td></tr><tr><td>Prototype Willingness Framework</td><td>Van Gool, Van Ouytsel, Ponnet and Walrave [51]</td></tr></tbody></table>
Altman-Westin privacy, privacy concerns and attitudes constructs are the underlying theories in most of the reviewed papers. Since they are not directly related to model development, they are not mentioned in Table 2.

Looking at applied theories and frameworks, we can infer that, in general, research on privacy decision-making can be divided by subject areas into four major methodo-logical groups: (1) most pronounced so far, an information science approach with the privacy calculus and its extensions; (2) a psychological, social and information sci-ence approach beyond the privacy calculus; (3) a mathematical-economic approach; and (4) a machine learning approach.

The overwhelming majority of research is based on the privacy calculus and its ex-tensions. Hence, I deem appropriate to “detach” this bulk of research from subject-wise division and discuss this theory in more detail in the following Section 2.3. We return to the grand comparison and analysis of existing approaches in Section 2.4.

## 2.3 Privacy Calculus Modelling Approach

Multiple empirical and methodological studies on privacy decision-making draw from economic constructs such as expected utility theory, employing the privacy calculus (e.g., in Malhotra et al. [37]; Hann et al. [21]; Xu et al. [59]). Their results provide insights for understanding the “privacy paradox” and individuals’ attitudes towards privacy-related preferences and decisions, and contribute to the assessment of privacy concerns.

Dinev and Hart [9] attempt to measure privacy concerns and estimate dependencies between factors and privacy constructs (“concerns of information finding” and “concerns of information abuse”). Later, Dinev and Hart [8] provide more ground for the use of an extended privacy calculus, showing that, at least for the example of e-commerce, Internet trust and personal interest can outweigh privacy concerns constructs. After employing common statistical methods of dimensionality reduction and supervised learning in the first work, structural equation modelling in the second, and joined by other researchers, a bigger collective of authors investigates privacy perceptions and develops a theoretical framework for understanding Internet privacy attitudes (Dinev, Xu, Smith and Hart [11]), with an empirically developed structural model attesting to the validity of proposed constructs.

In a set of studies of privacy-related issues in social networking services, Krasnova et al. [28, 29] turn to the privacy calculus and produce structural models to investigate Internet users' privacy concerns and motivations regarding personal information disclosure. The former research develops and justifies categorisation of privacy concerns, and, then, tests it against self-disclosure dimensions to explore inter-relations between defined privacy concerns and postulated self-disclosure strategies. The latter paper commences in an attempt to build a model of self-disclosure in social networking services. Exploratory in nature, this paper identifies factors of self-disclosure, noting, however, that “(...) other factors beyond those investigated in our study can also have an impact on individual self-disclosure” (Krasnova et al. [29], p. 123).

Krasnova et al. [30] account for users’ mental patterns and uncover cultural implications of privacy attitudes and behaviour. Here the authors address individualism and
avoidance of uncertainty as two (out of commonly adopted five) cultural factors of
self-disclosure that seem most relevant in terms of social networking services. The
paper, as recognised by the authors, is limited in the scope of possible influencing
effects. The model itself abstains from considering spatial and temporal factors, as
well as cognitive effects and biases at the point of making a decision.

Keith et al. [24] apply the privacy calculus to show that consumer age is not a sig-
nificant factor in decisions on online self-disclosure, and the relationship between
decisions on personal information disclosure and the intention to disclose such infor-
mation is weak, while still statistically significant. More practical conclusions reveal
that privacy-concerned users do not necessarily properly understand the link between
first- and second-order privacy risks of the same nature. Notwithstanding, authors
admit that their research “does not account for a consumer’s long-term intentions or
disclosure behaviour” and “privacy calculus might be better modelled as a sub-theory
within a larger framework aiming to elucidate how long term information disclosure
relationships form.” (Keith et al. [24], p. 1172). Moreover, the researchers name
Kahneman and Tversky’s Prospect Theory as a better way than the existing rational
privacy calculus for accounting for bounded rationality and obtaining an insight on
privacy-related decision-making. Lastly, another take-away from the paper is a seem-
ingly valid point favouring exploration of possible non-linearity of relationship be-
tween perceived benefits and risks in self-disclosure decisions.

More and more attempts are made to extend the privacy calculus, apart from the
aforementioned works (e.g., Y. Li [34]). A paper by Wang et al. [56] is one successful
example. The research probes extending the privacy calculus with more psychological
factors and adds evidence of the importance of contextual factors in privacy decision-
making. Relying on a structural model, the authors argue that users value benefits
more than risks. The need for cognition effect has been studied, showing a significant
relationship with risks and a non-significant relation with benefits.

The vast majority of decision-making models powered by the privacy calculus
were built with expected utility or expected value in their core. To scrutinise decision-
making behind disclosure in exchange for personalisation of services in e-commerce,
Zhu et al. [60] introduce a rank-dependent generalised expected utility model. The
authors run their mathematical model through a set of simulations for users with dif-
ferent levels of privacy concerns and companies with different reputation.

## 2.4 Comparison and Discussion

The existing theoretical body of research behind privacy decision-making draws from various subject areas. Let us look closer at the approaches scholars used to study privacy decision-making. Overall, achievements and limitations of the existing models, grouped by prevailing approaches, are represented in a comparative Table 3.

Li [34] designs a decision-making matrix, based on an elaborate overview of ap-
proaches and theories used in privacy research, and on the derived concept of a “dual-
calculus model”, which is defined as a combination of privacy- and risk-calculi for
decision-making in privacy-related issues.
<table><caption>**Table 3.** Summary of approaches to studying privacy decision-making</caption><thead><tr><th colspan="3">Approaches</th></tr><tr><th>Problems and measures</th><th>Motivations</th><th>Limitations</th></tr></thead><tbody><tr><td colspan="3"><strong>Information Science and (Extended) Privacy Calculus</strong></td></tr><tr><td><strong>Problems addressed:</strong><br>users' personal information disclosure decisions in online environments: mobile applications, social networks, e-commerce, location tracking, personalisation and recommendations in online services; study of the "privacy paradox".<br><br><strong>Methods:</strong><br>linear regression; structural equation modelling (SEM); confirmatory factor analysis (CFA); exploratory factor analysis (EFA); systematic review and deduction; empirical studies; induction.<br><br><strong>Determinants (factors):</strong><br>perceived risks, benefits, trust, and control; personal interest; privacy concerns; satisfaction; antecedents (experience; culture; context; personality, etc.); information sensitivity.</td><td><strong>Achievements:</strong><br>formulation and explanation of "Antecedents – Privacy Concerns – Outcomes" (APCO, Dinev et al. [10]) pathway of observable decision-making on practice.<br><br><strong>Advantages:</strong><br>1. Mature methodology.<br>2. Findings are coherent between multiple studies.<br>3. Empirically enabled research approach.<br>4. Results easily tested and verified in practice.<br>5. Uncovers relations between factors.</td><td>1. Sample bias in surveys and experiments.<br>2. External validity of the experiments can be challenged.<br>3. Scope of factors is usually restricted.<br>4. Perceptions are often studied in isolation from how they are being translated to behaviours.<br>5. "Stimuli – Thought effort – Action" assumption, that is challenged by certain advancements in psychology and behavioural economics.<br>6. Inter-temporal nature of privacy trade-offs is overlooked.</td></tr><tr><td colspan="3"><strong>Psychology, Social Science and Information Science beyond Privacy Calculus</strong></td></tr><tr><td><strong>Problems addressed:</strong><br>users' personal information disclosure decisions in online environments: mobile applications, social networks, e-commerce, online services preferences; study of the "privacy paradox".<br><br><strong>Methods:</strong><br>multiple regression; principal components analysis; EFA; CFA; SEM; empirical studies.<br><br><strong>Determinants (factors):</strong><br>personality traits; affect; familiarity; social identity; cognitive load; motivation; etc., sometimes in conjunction with privacy calculus</td><td><strong>Achievements:</strong><br>testing and explanation of effects of personality, cognitive load, environment, ethics and culture on intentions to disclose personal information.<br><br><strong>Advantages:</strong><br>1. Empirically enabled research approach.<br>2. Results easily tested and verified in practice.<br>3. Uncovers relations between factors.<br>4. Explains roles of social, cultural and psychological effects in privacy decision-making.</td><td>1. Sample bias in surveys and experiments.<br>2. External validity of the experiments can be challenged.<br>3. Compromise between quantification capability of factors and practical applicability of models.<br>4. Models do not usually possess predictive capability.<br>5. Models are not particular: do not account for individual differences.<br>6. Models explain intentions rather than behaviours.</td></tr><tr><td colspan="3"><strong>Mathematical Economics</strong></td></tr><tr><td><strong>Problems addressed:</strong><br>(sub)optimal decision strategies; privacy-utility trade-offs; privacy-utility-profit trade-offs; decisions' payoffs; decision-making under budget re-</td><td><strong>Achievements:</strong><br>mathematical formulations of privacy-constrained decision-making; utility calculation formulae-<br>tions;</td><td>1. Models do not account for factors that cannot be expressed in terms of costs, benefits, risks, expected utility, probability of success, agent profit.</td></tr></tbody></table>
<table><thead><tr><th colspan="3">Approaches</th></tr><tr><th>Problems and measures</th><th>Motivations</th><th>Limitations</th></tr></thead><tbody><tr><td><strong>Methods:</strong><br>SEM; game simulations; Markov<br>process simulations; dynamic pro-<br>gramming; ANOVA; cluster analysis.<br><strong>Determinants (factors):</strong><br>valences; outcomes; risks; time;<br>population.</td><td>rational privacy decision-<br>making formulation.<br><strong>Advantages:</strong><br>1. Outstanding theoretical<br>rigour.<br>2. Applicable for building<br>macromodels.</td><td>2. Prone to quantification<br>problem and reliability<br>problem, when behaviour-<br>istic or cognitive exten-<br>sions attempted.<br>3. Real-world applicability<br>may pose a challenge.</td></tr><tr><th colspan="3">Machine Learning</th></tr><tr><td><strong>Problems addressed:</strong><br>predicting users' behaviour;<br>identifying influencing determinants.<br><strong>Methods:</strong><br>decision trees; clustering; classifica-<br>tion.<br><strong>Determinants (factors):</strong><br>metadata; location; data holder prop-<br>erties; contextual factors, etc. Any<br>quantifiable features.</td><td><strong>Achievements:</strong><br>privacy attitudes predic-<br>tions;<br>decisions on personal<br>information sharing pre-<br>dictions.<br><strong>Advantages:</strong><br>1. Depending on data<br>properties, models can<br>always be constructed to<br>have better-than-random<br>level of predictive power.<br>2. Predictions may be<br>modelled for decisions<br>with almost arbitrary set of<br>determinants.</td><td>1. Models are not descrip-<br>tive.<br>2. Models are not extend-<br>able factor-wise.<br>3. Is not suitable for mod-<br>elling human intelligence.<br>4. Models are sample-<br>bound and data-hungry.<br>5. High level of abstrac-<br>tion from nature: factors<br>lack explainability.<br>6. Reasoning behind<br>decisions cannot be in-<br>ferred.<br>7. Decision-making pro-<br>cess is not modelled.</td></tr></tbody></table>

Researchers try to probe privacy decision-making beyond privacy calculus as well. In that way, Van Gool et al. [51] base their research of disclosure behaviour in adolescents on a Prototype Willingness Model<fnref n="1" />. The authors study adolescents' relationship disclosure in online social networks, and they manage to show that said self-disclosure is a product of an analytical reasoned process, which can be more or less influenced by the situational context. Li, Sarathy, and Xu [33] adopt the S-O-R paradigm<fnref n="2" /> in their attempt to model privacy-related decision-making. The authors find that decisions regarding personal information disclosure depend on impressions that users internalize during the first interaction with a website that prompts the users for said decisions to be made.

Mahmood and Desmedt [36] carry out an attempt to develop mathematical models of privacy, which results in devising a game theoretical model (stochastic almost combinatorial) and a graph theory model (attack and defence multigraphs with certain

<footnote n="1">¹ Prototype Willingness Model (PWM) is a framework from the family of so called “dual-processing models”. It operates under the assumption that there are two paths of decision-making: a reasoned path (rational), and a social reaction path (heuristics-based). PWM was developed by M. Gerrard, F. X. Gibbons and their colleagues. It was aimed to be used for health studies, originating in Gibbons and Gerrard [18].</footnote>

<footnote n="2">² Stimulus-organism-response (S-O-R) model postulates that environmental factors affect cognitive reactions in organisms, thusly affecting behaviour (Mehrabian and Russell [39]).</footnote>
simplifications). The researchers argue that users cannot always be careful and thor-
ough, due to bounded rationality and limitations of working memory.

Egelman and Peer [13] study privacy decision-making from a psychological stand-
point. The authors consider the influence of such factors as personality dimensions on
online privacy concerns and self-disclosure behaviour. As a result, they argue that
individual differences are better predictors of decisions than the personality traits
approach, testing their hypothesis against the Five Factor Model<fnref n="3" />.

Koohikamali et al. [27] extend the modelling literature by addressing self-
disclosure with the premises of Rest’s ethical decision-making model<fnref n="4" />. In contrast
with majority of research concerned with self-disclosure, the authors attempt to model
decisions about disclosure of personal information about others. They show that dis-
closure about others is driven by the attitudes towards social network sites and con-
cerns about others’ privacy, and is not influenced by the social norms.

Griffin et al. [20] formulate a mathematical model, acknowledging behavioural
economics arguments and presumably able to predict privacy decisions. Through
treating user behaviour as an optimization of comfort with sharing and perceived
control, the model reconciles maximization of perceived user control and costs asso-
ciated with providing that control by social networks. Validation and testing is needed
to evaluate the quality of the model.

Eling, Krasnova, Widjaja and Buxmann [15] take an inductive approach to build a
decision-making model, linking trust in a service provider and intrusiveness of re-
quested information to highlight the decisional calculus proposed in their paper. Alt-
hough the authors manage to obtain (and corroborate with an experiment) a depiction
of the cognitive process underlying the decisions about application acceptance, the
paper does not proceed to construct a cognitive model behind situational decision-
making. Overall, decisional calculus, unveiled in Eling et al. [15], is in line with the
privacy calculus.

Ghosh and Singh [17] provide one of the use cases for applying machine learning
to build a predictive model of privacy concerns. Feeding phone usage metadata, re-
fined through classification algorithms, they manage to achieve enough accuracy (for
their classification design) to predict users’ privacy attitude category.

As particularly mentioned, most authors admit the limitations in their sets of influ-
encing factors; unaccounted possible relations between factors, risks and benefits; and
unexplored effects of cognition. Such usually unaddressed aspects may include the
momentary awareness of privacy issues, the current level of fatigue and (or) mental
workload, attention span and sense-making of privacy indications, and other mental
effects (e.g., information overload, cognitive laziness, etc.).

<footnote n="3">³ Five Factor Model (FFM, also “Big Five Personality Traits”) is a tool used to describe aspects of individual personality through five dimensions (or traits): Extraversion, Agreeableness, Conscientiousness, Neuroticism, and Openness to Experience. Modern version of FFM, mentioned by Egelman and Peer [13] and used by some other studies discussed in the current paper, refers to a work by Digman [7].</footnote>

<footnote n="4">⁴ Here the authors are referring to Rest's Four Component Model (Rest [44]). Determinants of ethical behaviour in that model include: ethical sensitivity, moral judgment, moral motivation and moral character.</footnote>
Additionally, there is a discussion on the more convenient ways to convey privacy-
related information to the individuals. As suggested by Wang et al. [55] regarding
mobile applications, privacy notices requesting self-disclosure from users, inade-
quately reflect the scope of privacy intrusion or request unreasonable amounts of self-
disclosure. In a survey comparing the effect of fine-grained privacy indications to the
effect of coarse-grained ones Eling, Rasthofer, Kolhagen, Bodden and Buxmann [16]
hypothesise that more concrete privacy indications may influence users' willingness
to disclose information. In a controlled experiment Egelman, Tsai, Cranor and Ac-
quisti [14] demonstrate that the temporal aspect of privacy indications impacts the
acceptable amount of costs that users are willing to bear to preserve their privacy.

The issue of defining a better way to communicate privacy-related information to assist users' decision-making is addressed in Bal et al. [4, 5]. Reflecting upon “privacy consequences” and echoing the problematic nature of “second-order privacy risks” with the aforementioned Keith et al. [24], the researchers argue that communicating privacy outcomes from privacy-related actions to mobile users should facilitate better decisions.

3 Opportunity for Future Research: Cognitive Architectures

In order to include various effects of internal and external factors influencing deci-
sion-making<fnref n="5" />, as well as different interdependencies, we can try a broader model of
cognition – one that simulates dynamic cognitive processes as functions in a system,
consisting of input and data acquisition, memory, attention, decision-making, and
output generation. The modelling of complex cognitive phenomena is widely and
rigorously addressed in cognitive architectures. Most notable and well-established
examples of cognitive architectures in use include ACT-R, SOAR, LIDA and EPIC.<fnref n="6" />

SOAR and LIDA focus on artificial general intelligence (Samsonovich [46]). SOAR specialises on task execution and problem-solving, providing software agents with spatial reasoning, anticipation and real-time strategy definition. LIDA has been applied to create software agents replacing human operators in certain tasks, but lacking visual and auditory input modalities and being limited in terms of learning capabilities (Ramamurthy et al. [43]). EPIC is poised as a framework for human-system interactions simulation, assisting in the development and validation of systems interfaces. Another example – 4CAPS – has been used to describe behavioural patterns in neuropsychology related to executive functions of cognitive control (Just et al. [22]).

When it comes to privacy decision-making, the research model should be able to simulate dynamic cognitive processes as functions in complex systems, comprised of elements accounting for input and data acquisition, memory, attention, decision-making, and output generation. One of the most well-established cognitive architectures, which offers sufficient flexibility of application, is the ACT-R framework.

<footnote n="5">⁵ E.g., cognitive load, highlighted in Veltri and Ivchenko [53], or selective attention mechanisms, shown to be instrumental in reducing distraction effects (Lavie, Hirst, De Fockert and Viding [31]).</footnote>

<footnote n="6">⁶ See in more detail, for example, in Lieto, Chella and Frixione [35].</footnote>
Section 3.1 introduces ACT-R in the field of human decision-making. Section 3.2 discusses possible contributions of ACT-R to privacy decision-making, and provides a comparison of ACT-R with the modelling approaches discussed in Chapter 2.

**3.1 The ACT-R Modelling Framework**

ACT-R is one of the most detailed frameworks for modelling perception, procedural cognition and decision processes (Anderson et al. [3]). As argued by Gonzalez and Lebiere [19], there are numerous benefits to the modelling of economic decision-making by using cognitive architectures, where ACT-R outcompetes its rivals, being in possession of a “more realistic characterization of the flexibility and adaptability of human behavior” (p. 26).

Attempts have been made to create a comprehensive integrated theory to approach modelling of the recognition heuristics and judgments (Marewski, Pohl and Vitouch [38]). Here the authors address issues of an “ecological model of decision-making”, pointing out how scarce the research is on real-world decisions with utilizing “sense of prior encounter”. Thomson, Lebiere, Anderson and Staszewski [50] argue that modelling paradigms (Taatgen, Lebiere and Anderson [48]) enabled in ACT-R, namely instance-based learning, can be applicable to modelling intuitive decision-making. Authors manage to show that by using this cognitive architecture it is possible to implement risk aversion in learned (not forced) strategy choice. Veksler, Gray and Shoelles [52] demonstrate that the ACT-R framework can be used to implement human decision-making arising from “associative learning”, not involving an a-priori notion of rewards and punishments.

Overall, the theoretical background and existing body of empirical research indicate that using ACT-R to model human decision-making can attain new value over the so far prevalent approaches. ACT-R is capable of modelling long-term (both declarative and procedural) and working memory functioning, perception and logic processes and, as shown by Peebles and Banks [41], it is suitable for dynamic decision-making, even though with certain limitations.

**3.2 ACT-R: Applicability and Discussion**

Aforementioned features may help to build a model that can accommodate the context, in which the decisions are made, including but not limited to, simulating momentary awareness, as well as the individual's attention and judgment processes, and other cognitive functions.<fnref n="7" /> Additionally, incorporating the Cumulative Prospect Theory to model deviations from rational micro-economic decision-making with the ACT-R architecture seems as plausible as it may prove fruitful.

A summary of modelling opportunities enabled in ACT-R is outlined in Table 4.

<footnote n="7">⁷ The importance of these factors is shown in numerous empirical studies – for example, see above H. Li et al. [33]; or Veltri and Ivchenko [53], who show that cognitive scarcity has a negative effect on the disclosure of personal information, raising the volume of disclosed information.</footnote>
<table><caption>**Table 4.** Comparison of modelling capabilities of the identified approaches and the ACT-R functionalities.<fnref n="8" /></caption><thead><tr><th>Feature</th><th>Privacy calculus</th><th>Beyond privacy calculus</th><th>Mathematical Economics</th><th>Machine learning</th><th>ACT-R</th></tr></thead><tbody><tr><td>Behaviour predictive capability</td><td>Provided</td><td>Possible</td><td>Not provided</td><td>Provided</td><td>Possible</td></tr><tr><td>Behaviour descriptive capability</td><td>Possible</td><td>Provided</td><td>Provided</td><td>Not provided</td><td>Limited</td></tr><tr><td>Behaviour models based on human intelligence</td><td>Limited</td><td>Provided</td><td>Not provided</td><td>Not provided</td><td>Provided</td></tr><tr><td>Extendibility, scalability</td><td>Limited</td><td>Limited</td><td>Possible</td><td>Not provided</td><td>Possible</td></tr><tr><td>Individual decisions</td><td>Not provided</td><td>Possible</td><td>Not provided</td><td>Possible</td><td>Provided</td></tr><tr><td>Indication properties</td><td>Not provided</td><td>Possible</td><td>NA</td><td>Limited</td><td>Provided</td></tr><tr><td>Learning behaviour</td><td>NA</td><td>NA</td><td>NA</td><td>Provided</td><td>Provided</td></tr><tr><td>Personal traits</td><td>Possible</td><td>Provided</td><td>Limited</td><td>Possible</td><td>Provided</td></tr><tr><td>Cognitive effects</td><td>Limited</td><td>Possible</td><td>Limited</td><td>Possible</td><td>Provided</td></tr><tr><td>Environmental effects</td><td>Limited</td><td>Possible</td><td>Limited</td><td>Possible</td><td>Provided</td></tr><tr><td>Temporal outcomes</td><td>NA</td><td>NA</td><td>Provided</td><td>NA</td><td>Possible</td></tr><tr><td>Causal (exploratory) models</td><td>Provided</td><td>Provided</td><td>Not Provided</td><td>Provided</td><td>Limited</td></tr><tr><td>Executive functions</td><td>NA</td><td>NA</td><td>NA</td><td>NA</td><td>Provided</td></tr><tr><td>Practical application</td><td>Possible</td><td>Possible</td><td>Limited</td><td>Provided</td><td>Provided</td></tr></tbody></table>

It should be clearly stated, that, beyond any doubt, I am not denying the existing body of research all its achievements in formulation of the initial understanding of antecedents of privacy decision-making, and the inter-relations of various factors. As we have seen, though, with other approaches, their applicability can be limited by their theoretical background and, oftentimes, by the goal of each particular study. Additionally, each study usually does not allow for broader generalisations or – to the other extreme – particularisations (true for most of the mathematical economic models).

ACT-R may be capable of contributing to the field of human decision-making entailing privacy consequences in several ways. Consider a situation:

“A person X with a fatigue F in a situation S with environmental noise E, surrounded by the amount of people N, while exercising an activity A, is asked to disclose information M and receives a warning W with the properties T.” What will be the X’s response?

<footnote n="8">⁸ Evaluations: *not applicable* (NA, feature is irrelevant in a given approach); *not provided* (feature is not enabled); *limited* (feature is enabled for each particular study; single use); *possible* (feature can be enabled with additional effort or study; should be specifically addressed); *provided* (feature is usually enabled “by design”).</footnote>
The comprehensiveness of the ACT-R modelling framework theoretically allows us to model the entire problem space of this situation. It makes it possible to come up with specific predictions about individual decisions of people, usually described by person-specific sets of features.

The extendibility of the ACT-R framework should help with building models in stages. Starting up with a certain simplistic basis of privacy-concerned decision-making, new features can be gradually added to account for additional effects and factors of the situation, extending its complexity.

Scalability of the ACT-R framework may be used to “switch off” chosen features impacting decisions. That can shed light on some emergent effects and interactions between features, which might have been left obscured and unexplored otherwise.

Features like the learning process, larger sets of user characteristics, attention mechanism, fatigue dynamics and cognitive capacity, task-distraction conflict, environmental noise, and others are extremely cumbersome to address with other approaches. These features, including their inter-dependence, can be addressed with ACT-R in a more structured and explicit, less demanding fashion. With ACT-R we may tackle problems like:

- studying effects of factors in different combinations with each other;

- modelling non-linear relationships in people's perceptions of costs, benefits and risks of personal information disclosure;

- studying human privacy decisions in different mental states;

- modelling decisions made by users with different privacy attitudes according to various attitude taxonomies;

- accounting for intertemporal nature of privacy-related decisions;

- incorporating lower-level mental processes into the picture;

- comparing different models within ACT-R framework against each other.

Overall, at the current stage of developments in the field of privacy-concerned decision-making, we have obtained substantial knowledge about antecedents and factors of users' disclosure behaviour. Thus, based on what we have learnt so far, it may be possible, in principle, to build a decision-making model with the ACT-R framework, which should be able to contribute new knowledge and provide better understanding of situational privacy-concerned decision-making under various restrictions.

# 4 Conclusion

This paper provides an attempt to identify gaps in the current stage of research exploring users' decision-making with privacy considerations. The state-of-the-art models of decision-making under privacy restrictions show limitations attributed to their levels of flexibility, practical applicability, and comprehensiveness. A possible idea to overcome some limitations of existing models is proposed in the current paper. This idea of using cognitive architectures may also be a solution that can advance our understanding of human decision-making regarding such a “fuzzy” issue as privacy.
However, the mapping of the behavioural economics approach and (or) extended privacy calculus to decision-making onto the ACT-R cognitive architecture creates major challenges. Economic modelling does not provide a generalised method for defining the costs and benefits for every problem. Additional problems that should be resolved in order to apply, for instance, Cumulative Prospect Theory include: determining the reference point, from which gains and losses can be defined; quantifying the benefits and costs of personal information disclosure; and devising a justified probability weighting.

Simultaneously, ACT-R modelling can be a challenge in and of itself, as it is developed to be a comprehensive architecture, simulating human cognitive processes at large. To be successful in developing an ACT-R model, one needs to apply domain-specific knowledge to the architecture and conduct a proper scoping of the problem to be resolved. Of course, the biggest challenge “is that it takes a substantial intellectual commitment to learn to understand models of a particular architecture and to learn to construct models” (Taatgen and Anderson [49], p. 699).

Accompanied by empirical validation, the implementation of the ACT-R cognitive architecture in the field of privacy will be a major challenge that can help privacy research, as well as enrich the ACT-R modelling methods.

## Comments and Acknowledgements

I gratefully acknowledge the suggestions from my Ph.D. advisor, Professor Joachim Meyer.

This paper is a part of the author’s Ph.D. research on “Modelling Responses to Privacy-related Indications”. The research is conducted under and supported by the Privacy & Us innovative training network (EU H2020 MSCA ITN, grant agreement №675730).

## References

1. Acquisti A, Taylor C, Wagman L (2016) The Economics of Privacy. Journal of Economic Literature 54(2):442-492. doi:10.1257/jel.54.2.442.

2. Adjerid I, Peer E, Acquisti A (2016) Beyond the privacy paradox: Objective versus relative risk in privacy decision making.

3. Anderson JR, Bothell D, Byrne MD et al (2004) An integrated theory of the mind. Psychol Rev 111(4):1036.

4. Bal G, Rannenberg K User Control Mechanisms for Privacy Protection Should Go Hand in Hand with Privacy-Consequence Information: The Case of Smartphone Apps.

5. Bal G, Rannenberg K, Hong JI (2015) Styx: Privacy risk communication for the Android smartphone platform based on apps' data-access behavior patterns. Comput Secur 53:187-202.

6. Barberis NC (2013) Thirty years of prospect theory in economics. The journal of economic perspectives 27(1):173-195.

7. Digman JM (1990) Personality structure: Emergence of the five-factor model. Annu Rev Psychol 41(1):417-440.
8. Dinev T, Hart P (2004) Internet privacy concerns and their antecedents-measurement validity and a regression model. *Behaviour & Information Technology* 23(6):413-422.

9. Dinev T, Hart P (2006) An extended privacy calculus model for e-commerce transactions. *Information Systems Research* 17(1):61-80.

10. Dinev T, McConnell AR, Smith HJ (2015) Research Commentary—Informing Privacy Research Through Information Systems, Psychology, and Behavioral Economics: Thinking Outside the “APCO” Box. *Information Systems Research* 26(4):639-655.

11. Dinev T, Xu H, Smith JH et al (2013) Information privacy and correlates: an empirical attempt to bridge and distinguish privacy-related concepts. *European Journal of Information Systems* 22(3):295-316.

12. Dong C, Jin H, Knijnenburg BP (2015) Predicting Privacy Behavior on Online Social Networks. In: Anonymous ICWSM, p 91-100.

13. Egelman S, Peer E (2015) Predicting privacy and security attitudes. *ACM SIGCAS Computers and Society* 45(1):22-28.

14. Egelman S, Tsai J, Cranor LF et al (2009) Timing is everything?: the effects of timing and placement of online privacy indicators. In: Anonymous Proceedings of the SIGCHI Conference on Human Factors in Computing Systems ACM, p 319-328.

15. Eling N, Krasnova H, Widjaja T et al (2013) Will you accept an app? Empirical investigation of the decisional calculus behind the adoption of applications on Facebook.

16. Eling N, Rasthofer S, Kolhagen M et al (2016) Investigating Users' Reaction to Fine-Grained Data Requests: A Market Experiment. In: Anonymous System Sciences (HICSS), 2016 49th Hawaii International Conference on IEEE, p 3666-3675.

17. Ghosh I, Singh VK (2016) Predicting Privacy Attitudes Using Phone Metadata. In: Anonymous Social, Cultural, and Behavioral Modeling: 9th International Conference, SBP-BRiMS 2016, Washington, DC, USA, June 28-July 1, 2016, Proceedings 9 Springer, p 51-60.

18. Gibbons FX, Gerrard M (1995) Predicting young adults' health risk behavior. *J Pers Soc Psychol* 69(3):505.

19. Gonzalez C, Lebiere C (2005) Instance-based cognitive models of decision-making.

20. Griffin C, Rajtmajer S, Squicciarini A (2016) A Model of Paradoxical Privacy Behavior in Online Users. In: Anonymous Collaboration and Internet Computing (CIC), 2016 IEEE 2nd International Conference on IEEE, p 206-211.

21. Hann I, Hui K, Lee ST et al (2007) Overcoming online information privacy concerns: An information-processing theory approach. *J Manage Inf Syst* 24(2):13-42.

22. Just MA, Varma S (2007) The organization of thinking: What functional brain imaging reveals about the neuroarchitecture of complex cognition. *Cognitive, Affective, & Behavioral Neuroscience* 7(3):153-191.

23. Kehr F, Kowatsch T, Wentzel D et al (2015) Blissfully ignorant: the effects of general privacy concerns, general institutional trust, and affect in the privacy calculus. *Information Systems Journal* 25(6):607-635.

24. Keith MJ, Thompson SC, Hale J et al (2013) Information disclosure on mobile devices: Re-examining privacy calculus with actual user behavior. *International Journal of Human-Computer Studies* 71(12):1163-1173.

25. Kim DJ, Ferrin DL, Rao HR (2008) A trust-based consumer decision-making model in electronic commerce: The role of trust, perceived risk, and their antecedents. *Decis Support Syst* 44(2):544-564.

26. Knijnenburg BP, Kobsa A (2013) Making decisions about privacy: information disclosure in context-aware recommender systems. *ACM Transactions on Interactive Intelligent Systems (TiiS)* 3(3):20.
27. Koohikamali M, Peak DA, Prybutok VR (2017) Beyond self-disclosure: Disclosure of information about others in social network sites. Comput Hum Behav 69:29-42.

28. Krasnova H, Günther O, Spiekermann S et al (2009) Privacy concerns and identity in online social networks. Identity in the Information Society 2(1):39-63.

29. Krasnova H, Spiekermann S, Koroleva K et al (2010) Online social networks: why we disclose. J Inf Technol 25(2):109-125.

30. Krasnova H, Veltri NF, Günther O (2012) Self-disclosure and privacy calculus on social networking sites: The role of culture. Business & Information Systems Engineering 4(3):127-135.

31. Lavie N, Hirst A, De Fockert JW et al (2004) Load theory of selective attention and cognitive control. J Exp Psychol: Gen 133(3):339.

32. Lee H, Kobsa A (2017) Privacy preference modeling and prediction in a simulated campuswide IoT environment. In: Anonymous Pervasive Computing and Communications (PerCom), 2017 IEEE International Conference on IEEE, p 276-285.

33. Li H, Sarathy R, Xu H (2011) The role of affect and cognition on online consumers' decision to disclose personal information to unfamiliar online vendors. Decis Support Syst 51(3):434-445.

34. Li Y (2012) Theories in online information privacy research: A critical review and an integrated framework. Decis Support Syst 54(1):471-481.

35. Lieto A, Chella A, Frixione M (2017) Conceptual Spaces for Cognitive Architectures: A lingua franca for different levels of representation. Biologically Inspired Cognitive Architectures 19:1-9.

36. Mahmood S, Desmedt Y (2013) Two new economic models for privacy. ACM SIGMETRICS Performance Evaluation Review 40(4):84-89.

37. Malhotra NK, Kim SS, Agarwal J (2004) Internet users' information privacy concerns (IUIPC): The construct, the scale, and a causal model. Information systems research 15(4):336-355.

38. Marewski JN, Pohl RF, Vitouch O (2011) Recognition-Based Judgments and Decisions: What We Have Learned (So Far). Judgment and Decision Making 6(5):359-380.

39. Mehrabian A, Russell JA (1974) An approach to environmental psychology. the MIT Press.

40. Panaousis E, Laszka A, Pohl J et al (2015) Game-Theoretic Model of Incentivizing Privacy-Aware Users to Consent to Location Tracking. In: Anonymous Trust- com/BigDataSE/ISPA, 2015 IEEE, vol 1. IEEE, p 1006-1013.

41. Peebles D, Banks A (2010) Modelling Dynamic Decision Making with the ACT-R Cognitive Architecture. Journal of Artificial General Intelligence 2(2):52-68. doi:10.2478/v10229-011-0009-1.

42. Pu Y, Grossklags J (2014) An economic model and simulation results of app adoption decisions on networks with interdependent privacy consequences. In: Anonymous International Conference on Decision and Game Theory for Security Springer, p 246-265.

43. Ramamurthy U, Baars BJ, SK D et al (2006) LIDA: A working model of cognition.

44. Rest JR (1986) Moral development: Advances in research and theory.

45. Ross C, Orr ES, Sisic M et al (2009) Personality and motivations associated with Facebook use. Comput Hum Behav 25(2):578-586.

46. Samsonovich A (2012) Comparative table of cognitive architectures. BICA Society.

47. Shih H, Lai K, Cheng T (2017) Constraint-based and dedication-based mechanisms for encouraging online self-disclosure: Is personalization the only thing that matters?. European Journal of Information Systems 26(4):432-450.
48. Taatgen NA, Lebiere C, Anderson JR (2006) Modeling paradigms in ACT-R. Cognition and multi-agent interaction: From cognitive modeling to social simulation:29-52.

49. Taatgen N, Anderson JR (2010) The past, present, and future of cognitive architectures. Topics in Cognitive Science 2(4):693-704.

50. Thomson R, Lebiere C, Anderson JR et al (2015) A general instance-based learning framework for studying intuitive decision-making in a cognitive architecture. Journal of Applied Research in Memory and Cognition 4(3):180-190.

51. Van Gool E, Van Ouytsel J, Ponnet K et al (2015) To share or not to share? Adolescents' self-disclosure about peer relationships on Facebook: An application of the Prototype Willingness Model. Comput Hum Behav 44:230-239.

52. Veksler VD, Gray WD, Schoelles MJ (2013) Goal-Proximity Decision-Making. Cognitive Science 37(4):757-774. doi:10.1111/cogs.12034.

53. Veltri GA, Ivchenko A (2017) The impact of different forms of cognitive scarcity on online privacy disclosure. Comput Hum Behav 73:238-246.

54. Venkitasubramaniam P (2013) Decision making under privacy restrictions. In: Anonymous Decision and Control (CDC), 2013 IEEE 52nd Annual Conference on IEEE, p 4693-4698.

55. Wang N, Wisniewski P, Xu H et al (2014) Designing the default privacy settings for facebook applications. In: Anonymous Proceedings of the companion publication of the 17th ACM conference on Computer supported cooperative work & social computing ACM, p 249-252.

56. Wang T, Duong TD, Chen CC (2016) Intention to disclose personal information via mobile applications: A privacy calculus perspective. Int J Inf Manage 36(4):531-542.

57. Wang Z, Liu Y (2014) Identifying key factors affecting information disclosure intention in online shopping.

58. Webster J, Watson RT (2002) Analyzing the past to prepare for the future: Writing a literature review. MIS quarterly:xxiii.

59. Xu H, Luo XR, Carroll JM et al (2011) The personalization privacy paradox: An exploratory study of decision making process for location-aware marketing. Decis Support Syst 51(1):42-52.

60. Zhu H, Ou CX, van den Heuvel W et al (2017) Privacy calculus and its utility for personalization services in e-commerce: An analysis of consumer decision-making. Information & Management 54(4):427-437.