# Privacy Concerns Go Hand in Hand with Lack of Knowledge: The Case of the German Corona-Warn-App

Sebastian Pape, David Harborth, Jacob Leon Kröger

► To cite this version:

Sebastian Pape, David Harborth, Jacob Leon Kröger. Privacy Concerns Go Hand in Hand with Lack of Knowledge: The Case of the German Corona-Warn-App. 36th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Jun 2021, Oslo, Norway. pp.256-269, 10.1007/978-3-030-78120-0_17. hal-03746031

HAL Id: hal-03746031

https://inria.hal.science/hal-03746031v1

Submitted on 4 Aug 2022

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
# Privacy Concerns Go Hand in Hand with Lack of Knowledge: The Case of the German Corona-Warn-App

Sebastian Pape¹(✉)[0000-0002-0893-7856], David Harborth¹[0000-0001-9554-7567], and Jacob Leon Kröger²[0000-0003-3559-8869]

¹ Chair of Mobile Business and Multilateral Security
Goethe University, Frankfurt, Germany
{sebastian.pape.david.harborth}@m-chair.de

² Weizenbaum Institute, TU Berlin, Germany
kroeger@tu-berlin.de

**Abstract.** The German Corona-Warn-App (CWA) is one of the most controversial tools to mitigate the Corona virus spread with roughly 25 million users. In this study, we investigate individuals' knowledge about the CWA and associated privacy concerns alongside different demographic factors. For that purpose, we conducted a study with 1752 participants in Germany to investigate knowledge and privacy concerns of users and non-users of the German CWA. We investigate the relationship between knowledge and privacy concerns and analyze the demographic effects on both.

Our results indicate that knowledge about the CWA significantly reduces the privacy concerns about it. Non surprisingly, users have far lower privacy concerns than non-users, but they also have more knowledge about the app. We also find a positive significant effect of education and income and a small negative effect of age on the participants' knowledge. Furthermore, we find a significant negative effect of income and education on the privacy concerns. Our study has important implications for political decision-makers aiming at increasing adoption rates for helpful technologies to mitigate the severe effects of the pandemic. Most relevant here is to acknowledge the results regarding education, knowledge, privacy concerns and CWA use and devise effective strategies to reach certain groups in the society which are currently not using the CWA.

**Keywords:** Corona-Warn-App · privacy concerns · privacy literacy · privacy awareness · knowledge

## 1 Introduction

With the global pandemic caused by the severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2), digital proximity tracing systems to identify people who have been in contact with an infected person became a hot topic. There have been many discussions on different implementations and their architecture [7], i. e.
if the approach is centralised or decentralised. This discussion on the architecture and possible effects of it was mostly among experts and the academic world has already done extensive investigations of users' privacy concerns (cf. Sect. 2). However, the role of users' actual knowledge about the app has hardly been studied. For that purpose, we investigate user knowledge and privacy concerns about the Corona-Warn-App (CWA), the digital proximity tracing app in Germany, based on an online survey with 1752 participants.

While the effect of privacy literacy on privacy concerns is not obvious in general [13], this case should be different. In contrast to systems like the one in China, the CWA was built with privacy in mind: It is based on the DP-3T protocol which ensures data minimisation, prevents abuse of data and the tracking of users [6]. Thus, we hypothesize:

H: *Knowledge about the Corona-Warn-App reduces privacy concerns.*

Beyond investigating the relation between knowledge and privacy concerns, we are also interested in demographic effects on both of them, i. e. CWA users and non-users, age, gender, income, education and experience with smartphones.

Section 2 lists related work, Sect. 3 describes the methodology and Sect. 4 the results of our survey. We discuss the results in Sect. 5 and conclude in Sect. 6.

## 2 Related Work

Various large surveys have been conducted to explore individuals' privacy concerns about contact tracing apps during the COVID-19 pandemic – for example, in the US [1, 15, 18, 20, 21, 26, 27, 33], in the UK [1, 2, 17, 19], in Ireland [23], in Australia [30], in France [1], in Germany [1, 3, 18], in Italy [1], in Switzerland [3], and in China [18], including cross-national surveys [1, 3, 18]. A review of 11 recent studies is provided in [22]. One of the few qualitative studies on the topic employs focus group design with 22 participants from the UK [32].

While the majority of participants typically supports tracking technologies for the purpose of containing the pandemic [1, 19, 22], previous studies show that privacy concerns (besides technical problems, general mistrust of technology and lack of perceived personal benefit) remain a major hurdle to user acceptance – many studies even identify privacy concerns as *the* main barrier to the widespread use of contact tracing apps [2, 3, 23, 26, 30, 32]. Simko et al. [27] conducted a longitudinal study over seven months and found that privacy perceptions towards such apps remain relatively stable over time.

Specifically, people were found to worry about corporate surveillance [23], government surveillance [1, 18, 22, 22, 23], identification through mobility patterns [3], leakage of data to third parties or hackers [1, 22, 22, 27, 32], centralised data storage [33], exposure of social interactions [3], secondary data use [3, 20, 27], the risk of discrimination [22, 32], and continuing surveillance after the pandemic [23]. However, survey results have revealed widespread knowledge gaps and misconceptions surrounding the data collected by contract tracing apps [27, 32].

To increase the acceptance of co-location tracking, previous studies recommend a clear reasoning about the trustworthiness of the respective service provider [19],
assurances of data protection [15, 19, 23], sunset clauses (i.e., statements that
data storage is time-limited) [19], and – where relevant – transparency about
data sharing and usage [26, 27]. Privacy concerns can further be alleviated by
users’ trust in certain publicly-funded institutions, such as the British National
Health Service (NHS) [17].

3 Methodology

In this section, we briefly cover the development of the questionnaire, the data
collection and the demographics of our sample.

**3.1 Questionnaire**

We adapted the construct for privacy concerns (PC) from Gu et al. [10] and applied it to the Corona-Warn-App. We calculated polychloric correlation between the five items of the construct and used this matrix to conduct the factor analysis. Polychloric correlations are usually used for categorial variables (as for PC which are measured on a seven-point Likert scale) [16]. The loadings are well above 0.8 with an explained variance of 87.4% and a Cronbachs Alpha of 0.96. This indicates that the five items represent privacy concerns about the CWA adequately.

To measure the knowledge of the participants about the CWA, we developed
questions based on material provided by the official CWA FAQ [5], the Federal
Government in Germany [4] and the Robert Koch Institute [24]. The questions
covered how location data are processed, the functionality of the app, the vol-
untariness of installation and how a positive COVID-19 test result would be
registered. The full questionnaire is listed in the appendix.

**3.2 Data Collection and Demographics**

We conducted the study with a certified panel provider in Germany (certified
following the ISO 20252 norm). The survey was programmed with the survey
software LimeSurvey (version 2.72.6) [25] and hosted on a university server.
We sampled the participants in a way to achieve a representative sample for
Germany. For that purpose, we set quotas to end up with approximately 50%
females and 50% males in the sample as well as a distribution of age following
the EUROSTAT2018 census [8]. Furthermore, we set a quota to end up with half
of the sample using the CWA and the other half not using it.

Our resulting sample consists of 1752 participants. Following EUROSTAT
2018, participants are representative for Germany with respect to age and gender.
The same diversity can be observed for income and education (see Tab. 1). 896
participants use the CWA (51.14%) and 856 do not (48.86%). 1299 use Android
(74.14%), 436 use iOS (24.89%) and 17 stated to use smartphones with another
mobile operating system (0.97%) such as Windows 10 Mobile.

Since we deliberately divided the sample into two approximately equal groups
(CWA users and non-users), we need to check for statistically significant differences
<table><caption>Table 1: Participants' characteristics for age, gender, income and education</caption><thead><tr><th>Demographics</th><th>N</th><th>%</th></tr></thead><tbody><tr><td><strong>Age</strong></td><td></td><td></td></tr><tr><td>18-29 years</td><td>371</td><td>21.17%</td></tr><tr><td>30-39 years</td><td>316</td><td>18.04%</td></tr><tr><td>40-49 years</td><td>329</td><td>18.78%</td></tr><tr><td>50-59 years</td><td>431</td><td>24.60%</td></tr><tr><td>60 years and older</td><td>305</td><td>17.41%</td></tr><tr><td><strong>Net income</strong></td><td></td><td></td></tr><tr><td>500€- 1000€</td><td>160</td><td>9.13%</td></tr><tr><td>1000€- 2000€</td><td>402</td><td>22.95%</td></tr><tr><td>2000€- 3000€</td><td>404</td><td>23.06%</td></tr><tr><td>3000€- 4000€</td><td>314</td><td>17.92%</td></tr><tr><td>More than 4000€</td><td>292</td><td>16.67%</td></tr><tr><td>Prefer not to say</td><td>180</td><td>10.27%</td></tr></tbody></table><table><thead><tr><th>Demographics</th><th>N</th><th>%</th></tr></thead><tbody><tr><td><strong>Gender</strong></td><td></td><td></td></tr><tr><td>Female</td><td>894</td><td>51.03%</td></tr><tr><td>Males</td><td>853</td><td>48.69%</td></tr><tr><td>Diverse</td><td>4</td><td>0.23%</td></tr><tr><td>Prefer not to say</td><td>1</td><td>0.06%</td></tr></tbody></table><table><thead><tr><th>Education</th><td></td><td></td></tr></thead><tbody><tr><td>1 No degree</td><td>8</td><td>0.46%</td></tr><tr><td>2 Secondary school</td><td>187</td><td>10.67%</td></tr><tr><td>3 Secondary school<sup>+</sup></td><td>574</td><td>32.76%</td></tr><tr><td>4 A levels</td><td>430</td><td>24.54%</td></tr><tr><td>5 Bachelor's degree</td><td>240</td><td>13.70%</td></tr><tr><td>6 Master's degree</td><td>285</td><td>16.27%</td></tr><tr><td>7 Doctorate</td><td>28</td><td>1.60%</td></tr></tbody></table>

+5 GCSEs at grade C and above

in the demographics between the groups. This is required in order to rule out confounding influences of these variables on our results. We conducted a Shapiro-Wilk test for normality for all variables and the variables are all not normally distributed. Thus, we conducted Wilcoxon rank-sum tests to analyse whether there are significant differences between CWA users and non-users for these variables. Age and gender show no statistically significant differences since we deliberately sampled our participants with equal distributions with respect to age and gender. There are statistically significant differences between users and non-users of the CWA for the remaining demographics. The income is statistically significantly higher for the users compared to the non-users. However, the median is the same which is why we argue that the absolute difference is not having a substantial confounding effect on our later analysis. The same argumentation holds for education with a median of 4 for users and 3.5 for non-users, smartphone experience in years with a mean 8.77 for users and 8.35 for non-users as well as experience in years with the respective smartphone operating systems (mean 7.85 for users and 7.46 for non-users). The used smartphone operating systems by participants in both groups is roughly similar with significantly more Android users in both groups (about three times more Android users compared to iOS). This distribution of operating systems is representative for Germany [28]. Thus, all differences between groups are – although statistically significant – negligible for our consequent analysis since the absolute differences are relatively small.

## 4 Results

We focus on the investigation of participants' knowledge about the CWA and their privacy concerns. Figure 1a shows the number of correct answers for each
<figure><img src="image_2.png" /><figcaption>Fig. 1: Distribution of Correct Answers to the Knowledge Questions</figcaption></figure>

question. Almost all participants were aware that the installation of the app is voluntary (Q3). Only 75 participants were able to answer all four questions correctly. The distribution of correct answers is shown by the Venn diagram in Fig. 1b. It also shows that only 804 participants were able to answer Q3 correctly. For our further analysis, we build a score for each participant by simply counting the correct number of answers (cf. Fig. 1c).

## 4.1 Analysis of Knowledge and its Relation to Demographics

We investigate the different demographics based on their group properties: i) Binary groups: users and non-users of the CWA, females and males (GDR), and Android and iOS users (OS) ii) Categorical groups: age, income and education iii) Experience: years of experience with smartphones or the mobile operating system are more like continuous variables than categories, although the self-reporting of users required us to gather them in a discrete manner as number of years.

**Binary Groups** We first tested the distributions of scores and the scores of the respective subgroups with Shapiro-Wilk [9, p. 182 ff.] tests for normal distribution. Neither of the (sub)sets is normally distributed ($p < 10^{-15}$). We tested the distributions of scores for homogeneity of variance with Levene's test [9, p. 186 ff.] which shows significant different variances for CWA users and non-users and different genders while there is no significant difference in the variance of different mobile operation system (MOS) users. Table 2 lists the different means for the relevant subgroups. With a Wilcoxon Rank Sum test [9, p. 660 ff.] we found that scores from CWA users and non-users differ significantly (cf. Fig. 2a). The effect sizes ($r$) for different genders and different MOS users were weaker and less significant.

In summary, we consider the differences in the scores of CWA users and non-users as relevant while the differences in the scores of females and males as well as Android and iOS users are existing but negligible.
<table><caption>Table 2: Score for Binary Groups, Levene's Test and Wilcoxon Rank Sum</caption><thead><tr><th>Variable</th><th>Means</th><th>Levene's Test</th><th>Wilcoxon Rank Sum</th></tr></thead><tbody><tr><td>CWA</td><td>non-users: 1.38 users: 2.02</td><td>F(1,1750)=33.45<sup>***</sup></td><td>W=234994<sup>***</sup> r=-0.36</td></tr><tr><td>GDR</td><td>females: 1.66 males: 1.70</td><td>F(1,1745)=6.86<sup>**</sup></td><td>W=365109<sup>+</sup> r=-0.04</td></tr><tr><td>OS</td><td>Android: 1.68 iOS: 1.80</td><td>F(1,1733)=2.69</td><td>W=263020<sup>*</sup> r=-0.06</td></tr></tbody></table>

Significance codes: *** < 0.001 ** < 0.01 * < 0.05 + < 0.1

<figure><img src="image_3.png" /><figcaption>Fig. 2: Distribution of Scores and Privacy Concerns</figcaption></figure>

**Categorical Groups** For age, education and income, we used Jonckheere Terpstra (JT) tests [9, p. 684 f.] to identify a trend between the different (ordered) groups. Table 3 lists the means of the different groups. With increasing age, the score decreases which was confirmed with very high significance (cf. Fig. 2b). For income, we omitted the group of participants who did not reveal their income (180 part., mean 1.594). For the remaining groups, we see the lowest income group as an outlier and starting from the second lowest group, we see a rise of the score with increasing income. The JT test still reveals a significant rise of score with raising income, which gets highly significant if the lowest income groups is also excluded ($p < 10^{-6}$). As one can expect from the means regarding different groups of education, with higher education, the score increases significantly. Unfortunately, the JT test does not allow the calculation of effect sizes.

In summary, we find that the score depends on all three demographics, although we had an outlier for low incomes.

**Experience** Since the years of experience with smartphones or the mobile operation system were not really a categorical variable, we used Spearman's rank correlations [9, p.223 ff.], but could not find a significant relation between score and years of experience with smartphones ($\rho = 0.03$, p-value <0.19) or the mobile operating system ($\rho = -0.01$, p-value <0.64). Additionally to the low significance, the correlation coefficient ($\rho$) is in both relations very close to zero which suggests no significant effect.
<table><caption>Table 3: Score for Categorical Groups and Jonckheere Terpstra Test (JT)</caption><thead><tr><th>Variable</th><th>Means</th><th>JT</th></tr></thead><tbody><tr><td>Age</td><td>18-29: 1.797<br>30-39: 1.743<br>40-49: 1.739<br>50-59: 1.694<br>60-99: 1.534</td><td>572754 ↓<sup>***</sup></td></tr><tr><td>Income</td><td>.5k-1k: 1.781<br>1k-2k: 1.614<br>2k-3k: 1.688<br>3k-4k: 1.748<br>&gt;4k: 1.836</td><td>465749 ↑<sup>*</sup></td></tr><tr><td>Educat.</td><td>1: 1.13<br>2: 1.35<br>3: 1.57<br>4: 1.85<br>5: 1.83<br>6: 1.88<br>7: 1.96</td><td>682572 ↑<sup>***</sup></td></tr><tr><td>Significance codes:</td><td>*** &lt; 0.001</td><td>** &lt; 0.01</td></tr><tr><td></td><td>* &lt; 0.05</td><td>+ &lt; 0.1</td></tr></tbody></table>

<table><caption>Table 4: Concerns for Binary Groups, Levene's Test and Wilcoxon Rank Sum</caption><thead><tr><th>Variable</th><th>Means</th><th>Levene's test</th><th>Wilcoxon rank sum</th></tr></thead><tbody><tr><td>CWA</td><td>non-users: 4.64<br>users: 2.57</td><td>F(1,1750)=11.5<sup>***</sup></td><td>W=622466<sup>***</sup> r=-0.54</td></tr><tr><td>GDR</td><td>females: 3.64<br>males: 3.52</td><td>F(1,1745)=3.82<sup>+</sup></td><td>W=397724 r=-0.04</td></tr><tr><td>OS</td><td>Android: 3.66<br>iOS: 3.31</td><td>F(1,1733)=1.28</td><td>W=312620<sup>**</sup> r=-0.08</td></tr><tr><td>Significance codes:</td><td>*** &lt; 0.001</td><td>** &lt; 0.01</td><td>* &lt; 0.05</td></tr></tbody></table>

## 4.2 Privacy Concerns

In this subsection, we use the same structure for investigating differences between different groups for privacy concerns than in the section before.

**Binary Groups** Again, we first tested the distributions of privacy concerns and the privacy concerns of the respective subgroups with Shapiro-Wilk tests for normal distribution. Neither of the (sub)sets is normally distributed ($p < 10^{-15}$). We tested the distributions for homogeneity of variance with Levene's test which shows significant different variances for the privacy concerns of CWA users and non-users but no significant differences in the variances for the privacy concerns of different genders or different mobile operation system (MOS) users. Table 4 lists the different means for the relevant subgroups. With a Wilcoxon Rank Sum test we find that privacy concerns from CWA users and non-users differ significantly (cf. Fig. 2c). The effect sizes (r) for different genders and different MOS users are weaker and less significant.

In summary, we consider the differences in the scores of CWA users and non-users as relevant while the differences in the scores of females and males as well as Android and iOS users are existing but negligible.

**Categorical Groups** We used Jonckheere Terpstra (JT) tests to identify a trend between privacy concerns and age, education and income. Table 3 lists the means of the different groups. When looking at the means of age, there is no clear trend visible and the JT test does only find a low significance of the trend. For increasing income and education, the means are decreasing. The JT test confirms this trend with very high significance. For income, we again omitted the group of
<table><caption>Table 5: Concerns for Categorical Groups and Jonckheere Terpstra Test (JT)</caption><thead><tr><th>Variable</th><th>Means</th><th>JT</th></tr></thead><tbody><tr><td>Age</td><td>18-29: 3.583<br>30-39: 3.730<br>40-49: 3.551<br>50-59: 3.619<br>60-99: 3.392</td><td>594366 ↓<sup>+</sup></td></tr><tr><td>Income</td><td>.5k-1k: 3.478<br>1k-2k: 3.772<br>2k-3k: 3.710<br>3k-4k: 3.487<br>>4k: 3.046</td><td>523662 ↓<sup>***</sup></td></tr><tr><td>Educat.</td><td>1: 4.60<br>2: 4.06<br>3: 3.82<br>4: 3.43<br>5: 3.42<br>6: 3.21<br>7: 2.68</td><td>520337 ↓<sup>***</sup></td></tr><tr><td>Significance codes:</td><td>*** &lt; 0.001<br>** &lt; 0.01<br>* &lt; 0.05<br>+</td><td>+</td></tr></tbody></table>

participants who did not want to reveal their income (180 participants, mean 3.976). Their mean is higher than those of all other groups which suits the idea that they did not want to reveal their income.

In summary, we find that privacy concerns are related to income and education but hardly related to the different age groups.

**Experience** Similarly to the previous section, we used Spearman's rank correlations, but could not find a significant relation between privacy concerns and years of experience with smartphones ($\rho = -0.01$, p-value <0.54) or the mobile operating system ($\rho = 0.02$, p-value <0.49). Additionally to the low significance, the correlation coefficient ($\rho$) is in both relations very close to zero.

## 4.3 Relationship of Knowledge and Concerns

We tested for the correlation between knowledge (score) and concerns with Spearman's rank correlation rho and found a fairly large correlation coefficient ($\rho = -0.485$) with high significance ($p < 10^{-15}$). The correlation coefficient implies that participants with higher score, i. e. 3 and 4, had significantly less privacy concerns than the participants with lower scores as depicted in Fig. 3a.

We also investigated the relationship between score and privacy concerns for CWA non-users (cf. Fig. 3b) and users (cf. Fig. 3c) separately. As already discussed in the previous subsection, privacy concerns are significantly lower for CWA users compared with non-users. However, Fig. 3 also shows that the relation seems to be stronger for CWA users. We confirmed this finding with Spearman's rank correlation rho, calculated for both of the two subgroups. The correlation coefficient $\rho$ for CWA non-users ($\rho = -0.279$) is smaller than those for users ($\rho = -0.422$), both coefficients derived with high significance ($p < 10^{-15}$).

In summary, a higher knowledge (score in the quiz) correlates fairly well with less concerns regarding the use of the CWA, but the observed effect is stronger for users than for non-users.

# 5 Discussion

While many previous studies in this field do not consider the influence of participant demographics (e.g., [2, 21, 23, 26, 29, 30]), our analysis reveals various
<figure><img src="image_4.png" /><figcaption>Fig. 3: Density of Concerns for different Scores</figcaption></figure>

significant relationships between CWA-related knowledge, privacy concerns and demographic attributes, such as gender, age and income. In this section, we will discuss our findings regarding user knowledge, user concerns, and the relationship between knowledge, concerns and CWA usage, followed by a reflection upon this study's limitations.

## 5.1 Knowledge

We found CWA-related knowledge to be positively associated with participant income and level of education, and negatively associated with age. The outlier for low incomes could be explained by a prevalence of students within this group. No meaningful relation was found between knowledge and gender, MOS, and smartphone experience. These are novel findings as the related studies referenced in section 2 did not examine such relationships between CWA-related knowledge and individual demographic characteristics. Looking at the broader literature on user knowledge and awareness, it should be noted that findings from existing research are often inconclusive about the demographic determinants of digital fluency [31]. As user knowledge plays an important role in CWA acceptance (cf. Sect. 5.3), further research into the influence of underlying socio-demographic factors is needed.

## 5.2 Concerns

Our results suggest that user privacy concerns are inversely associated with income and education. No meaningful relation was found for MOS, gender, age, and smartphone experience. While there are related studies that support our findings regarding gender [15, 17, 18, 27], income [20, 33], MOS [27] and education [18, 20, 33], we also discovered contradictory findings in the literature for gender [19, 20, 33] and age [1, 2, 17]. Zhang et al. [33], for instance, found that female respondents are less supportive of COVID-related surveillance policies, and - in contrast to the lack of correlation in our findings - several studies found that CWA-related privacy concerns are inversely associated with age [1, 2, 17].
Thus, the overall picture here is also inconclusive, suggesting the need for further research. Judging from previous work, the inconsistencies mentioned above could be caused by differences in response behavior between political camps [19, 21] and geographical regions [18, 27]. Our results are representative of the population of Germany, a typical WEIRD society (Western, Educated, Industrialized, Rich, Democratic), and cannot not be generalized to other world regions.

## 5.3 Knowledge vs. Concerns vs. CWA

In our sample, CWA usage was positively associated with user knowledge. Knowledge, in turn, was inversely associated with privacy concerns. These findings are in line with previous studies that identified privacy concerns as a major obstacle to the widespread adoption of contract tracing apps [2, 3, 23, 26, 30, 32] and with research-based calls for transparency and user education as means of improving acceptance rates [19, 26, 27].

## 5.4 Limitations

Our study has the following limitations. First, our results are not generalizable to users of other contact tracing apps in other countries such as South Korea due to the technical architecture of the apps and cultural differences. Second, quantitative studies as ours are based on self-reports of the participants which can be biased due to misunderstandings of questionnaire items or wrong answers. Reasons for wrong answers of participants include, among others, the social desirability bias or a certain mood of the participants during the participation of the survey. Third, the translation of the constructs into German, which were originally developed in English, could be a source of error. This source of error cannot be ruled out when conducting studies in countries with other languages than the one of the original constructs.

# 6 Conclusion and Future Work

We showed a significant relationship between knowledge about the Corona-Warn-App (CWA) and related privacy concerns. We also found significant effects of education and income on knowledge (positive) and on privacy concerns (negative). Gender, preference for Android or iOS, and experience with smartphones or the mobile operating system did neither have significant effects on the knowledge nor on the privacy concerns.

Non surprisingly, users have far lower privacy concerns than non-users, but they also have more knowledge about the app. It is up to future work to establish the causality: Are CWA users more knowing and have less privacy concerns because they use and know the app? Or do knowing users have less privacy concerns and therefore tend to more likely use the app? In particular, in the context of privacy enhancing technologies, trust in the software or the provider has shown to have a significant impact on the users decision to use a certain
technology [11, 12, 14]. Thus, in future work we also aim to consider the users'
perceived benefits of the app and the user's trust into the health system (cf. [17]).

Our results – although assuming no causality – still have important impli-
cations for political decision-makers. Media and misinformation can influence
people’s concerns about the use of the CWA. With the CWA being developed
with a high standard of privacy-preserving principles, one would expect to find a
clear negative correlation (as we found) between knowledge and privacy concerns
about the CWA. Thus, clear information campaigns are needed to avoid confusion
among citizens regarding measures such as the CWA. There was a prolonged
and polyphonic debate about the CWA prior to introducing it in Germany. This
could be one of the reasons for our findings regarding the quiz.

Furthermore, the positive correlation of education and knowledge across users
and non-users points towards the importance of educating individuals about
technology from a young age on in order to enable them to make informed
decisions. The importance of these two implications is strengthened in times of
severe societal stress as we experience it now during the COVID-19 pandemic.
Thus, it is even more important to conduct research as ours and consider the
respective implications in order to create a more resilient society.

Acknowledgements

This work was supported by the Goethe-Corona-Fonds from Goethe University Frankfurt and the European Union's Horizon 2020 research and innovation program under grant agreement830929 (CyberSecurity4Europe).

Bibliography

[1] Altmann, S., Milsom, L., Zillessen, H., Blasone, R., Gerdon, F., Bach, R., Kreuter, F., Nosenzo, D., Toussaert, S., Abeler, J.: Acceptability of app-based contact tracing for covid-19: Cross-country survey evidence (2020)

[2] Bachtiger, P., Adamson, A., Quint, J.K., Peters, N.S.: Belief of having had unconfirmed covid-19 infection reduces willingness to participate in app-based contact tracing. NPJ digital medicine 3(1), 1-7 (2020)

[3] Bonner, M., Naous, D., Legner, C., Wagner, J.: The (lacking) user adoption of covid-19 contact tracing apps—insights from switzerland and germany. In: Proceedings of the 15th Pre-ICIS Workshop on Information Security and Privacy. vol. 1 (2020)

[4] Bundesregierung: Corona-warn-app: Frequently asked questions (2021), https://www.bundesregierung.de/breg-de/themen/corona-warn-app/corona-warn-app-englisch/corona-warn-app-faq-1758636

[5] Corona-Warn-App Open Source Project: Frequently asked questions about the corona-warn-app (2021), https://www.coronawarn.app/en/faq/

[6] DP-3T Project: Decentralized privacy-preserving proximity tracing (2020), https://github.com/DP-3T/documents/blob/master/DP3T%20White%20Paper.pdf
[7] DP-3T Project: Privacy and security risk evaluation of digital proximity tracing systems (2020), https://github.com/DP-3T/documents/blob/master/Security%20analysis/Privacy%20and%20Security%20Attacks%20on%20Digital%20Proximity%20Tracing%20Systems.pdf

[8] EUROSTAT: EUROSTAT 2018. https://ec.europa.eu/eurostat/de/home (2021)

[9] Field, A., Miles, J., Field, Z.: Discovering statistics using R. Sage publications (2012)

[10] Gu, J., Xu, Y.C., Xu, H., Zhang, C., Ling, H.: Privacy concerns for mobile app download: An elaboration likelihood model perspective. Decision Support Systems 94, 19–28 (2017)

[11] Harborth, D., Pape, S.: Examining technology use factors of privacy-enhancing technologies: The role of perceived anonymity and trust. In: 24th Americas Conference on Information Systems, AMCIS 2018, New Orleans, LA, USA, August 16-18, 2018. Association for Information Systems (2018)

[12] Harborth, D., Pape, S.: How privacy concerns and trust and risk beliefs influence users' intentions to use privacy-enhancing technologies – the case of tor. In: 52nd Hawaii International Conference on System Sciences (HICSS) 2019. pp. 4851–4860 (01 2019)

[13] Harborth, D., Pape, S.: How privacy concerns, trust and risk beliefs and privacy literacy influence users' intentions to use privacy-enhancing technologies - the case of tor. ACM SIGMIS Database: the DATABASE for Advances in Information Systems 51(1), 51–69 (01 2020)

[14] Harborth, D., Pape, S., Rannenberg, K.: Explaining the technology use behavior of privacy-enhancing technologies: The case of tor and jondonym. Proceedings on Privacy Enhancing Technologies (PoPETs) 2020(2), 111–128 (05 2020)

[15] Hassandoust, F., Akhlaghpour, S., Johnston, A.C.: Individuals' privacy concerns and adoption of contact tracing mobile applications in a pandemic: A situational privacy calculus perspective. Journal of the American Medical Informatics Association (2020)

[16] Holgado-Tello, F.P., Chacón-Moscoso, S., Barbero-García, I., Vila-Abad, E.: Polychoric versus Pearson correlations in exploratory and confirmatory factor analysis of ordinal variables. Quality and Quantity 44(1), 153–166 (2010)

[17] Horvath, L., Banducci, S., James, O.: Citizens' attitudes to contact tracing apps. Journal of Experimental Political Science pp. 1–13 (2020)

[18] Kostka, G., Habich-Sobiegalla, S.: In Times of Crisis: Public Perceptions Towards COVID-19 Contact Tracing Apps in China, Germany and the US. Tech. rep., Social Science Research Network, Rochester, NY (2020)

[19] Lewandowsky, S., Dennis, S., Perfors, A., Kashima, Y., White, J.P., Garrett, P., Little, D.R., Yesilada, M.: Public acceptance of privacy-encroaching policies to address the covid-19 pandemic in the united kingdom. PloS one 16(1), e0245740 (2021)
[20] Li, T., Cobb, C., Baviskar, S., Agarwal, Y., Li, B., Bauer, L., Hong, J.I., et al.: What makes people install a covid-19 contact-tracing app? understanding the influence of app design and individual difference on contact-tracing app adoption intention. arXiv preprint arXiv:2012.12415 (2020)

[21] Li, T., Faklaris, C., King, J., Agarwal, Y., Dabbish, L., Hong, J.I., et al.: Decentralized is not risk-free: Understanding public perceptions of privacy-utility trade-offs in covid-19 contact-tracing apps. arXiv preprint arXiv:2005.11957 (2020)

[22] Megnin-Viggars, O., Carter, P., Melendez-Torres, G., Weston, D., Rubin, G.J.: Facilitators and barriers to engagement with contact tracing during infectious disease outbreaks: A rapid review of the evidence. PloS one 15(10), e0241473 (2020)

[23] O'Callaghan, M.E., Buckley, J., Fitzgerald, B., Johnson, K., Laffey, J., McNicholas, B., Nuseibeh, B., O'Keeffe, D., O'Keeffe, I., Razzaq, A., et al.: A national survey of attitudes to covid-19 digital contact tracing in the republic of ireland. Irish Journal of Medical Science pp. 1-25 (2020)

[24] Robert Koch Institut: Infektionsketten digital unterbrechen mit der corona-warn-app (2021), https://www.rki.de/DE/Content/InfAZ/N/Neuartiges_Coronavirus/WarnApp/Warn_App.html, only in German

[25] Schmitz, C.: LimeSurvey Project Team. http://www.limesurvey.org (2015)

[26] Sharma, T., Bashir, M., et al.: Eight months into the covid-19 pandemic - do users expect less privacy? University of Illinois preprint (2020), http://hdl.handle.net/2142/109113

[27] Simko, L., Chang, J.L., Jiang, M., Calo, R., Roesner, F., Kohno, T.: Covid-19 contact tracing and privacy: A longitudinal study of public opinion. arXiv preprint arXiv:2012.01553 (2020)

[28] Statista: Marktanteile der führenden mobilen Betriebssysteme an der Internetnutzung mit Mobiltelefonen in Deutschland von Januar 2009 bis September 2020. https://de.statista.com/statistik/daten/studie/184332/umfrage/marktanteil-der-mobilen-betriebssysteme-in-deutschland-seit-2009/ (2020)

[29] Sun, R., Wang, W., Xue, M., Tyson, G., Camtepe, S., Ranasinghe, D.: An empirical assessment of global covid-19 contact tracing applications. arXiv preprint arXiv:2006.10933 (2020)

[30] Thomas, R., Michaleff, Z., Greenwood, H., Abukmail, E., Glasziou, P.: More than privacy: Australians' concerns and misconceptions about the covidsafe app: a short report. medRxiv (2020)

[31] Wang, Q.E., Myers, M.D., Sundaram, D.: Digital natives and digital immigrants. Business & Information Systems Engineering 5(6), 409-419 (2013)

[32] Williams, S.N., Armitage, C.J., Tampe, T., Dienes, K.: Public attitudes towards covid-19 contact tracing apps: A uk-based focus group study. Health Expectations (2020)

[33] Zhang, B., Kreps, S., McMurry, N., McCain, R.M.: Americans' perceptions of privacy and surveillance in the covid-19 pandemic. Plos one 15(12), e0242652 (2020)

All websites were last accessed on February 10th, 2021.
# A Survey Questionnaire

## Demographics

We asked for the following demographics, answer options are listed in brackets:

- Age^y

- Gender (female, male, divers)^n

- Education (no degree, secondary school, secondary school (>5 GCSE), A levels, bachelor, master, doctorate)

- Household income (in €: 0.5k-1k, 1k-2k, 2k-3k, 3k-4k, >4k)^n

- Corona-Warn-App user (yes/no)

- mobile OS (Android, iOS, other)

- Experience with Smartphones^y

- Experience in the mobile OS^y

## Privacy concerns (PC) related to the Corona-Warn-App

The following items are measured with a seven-point Likert scale, ranging from “strongly disagree” to “strongly agree”.

1. I think the Corona-Warn-App over-collects my personal information.

2. I worry that the Corona-Warn-App leaks my personal information to third-parties.

3. I am concerned that the Corona-Warn-App violates my privacy.

4. I am concerned that the Corona-Warn-App misuses my personal information.

5. I think that the Corona-Warn-App collects my location data.

## Knowledge about the Corona-Warn-App

Please mark the correct statements (multiple answers possible).

1. The Corona-Warn-App ...

- collects location data and shares it with local health departments.

- does not collect location data.

- collects location data and shares it with the Robert Koch Institute.

- collects location data and shares it with the Corona-Warn-App operators.

2. The Corona-Warn-App ...

- records risk encounters in "public spaces.

- is a substitute for the official reporting channels required by the Infection Protection Act.

- alerts users to encounters with positive-tested persons within the past 14 days.

- warns the user of positive-tested persons in the vicinity.

3. The installation of the Corona-Warn-App ...

- is voluntary.

- is required by law for all persons who own an appropriate smartphone.

- is required by law for workers who cannot work in a home office.

- is required by law for persons with regular contact with more than 10 people.

4. The registration of a positive SARS-CoV-2 test result in the app is ...

- done by the user via QR code or TeleTAN.

- transmitted automatically by the test laboratory.

- automatically transmitted to the Corona-Warn-App server.

- only transmitted to the Corona-Warn-App server after the user gave consent.

<footnote>^nprefer not to say option y in years</footnote>