## 3 Methodology
### Research Hypotheses and Model  
It is worth mentioning that privacy concerns are in general measured at an individual level. However, not all antecedents which we found in the literature survey are measured at the individual level. Some (e.g., culture/climate) are at the organizational or national level [16]. For our selection of the antecedents, we focused on those on an individual level. We develop our research hypotheses in this section. The resulting research model is shown in Figure 2.  
Literature on the effect of prior privacy experiences is unanimous. Privacy is in general a very abstract issue which can lead to an indifference of individuals related to the issue. This is reflected in the quote \"I've got nothing to hide\" [44]. However, if individuals experienced privacy breaches in their past, they know about the possible risks and are more concerned about their privacy [32]:  
1. _Prior privacy victim experiences (VIC) have a positive effect on CFIP._  
Figure 2: Research model. A higher the level of risk propensity indicates a higher risk-aversion. Thus, the more risk-averse individuals are, the more concerned they are supposed to be about their privacy. This hypothesis is supported by our finding in the literature review [31]:  
2. _Risk propensity (RP) has a positive effect on CFIP._  
The results for the effects of the demographic antecedents on CFIP are inconclusive. Past literature indicates that older individuals are more concerned about their privacy than younger ones [26]. We hypothesize that this relation also applies to the case of smartphone games like Pokemon Go. With respect to gender, we follow the rationale in the literature that females are possibly more cautious regarding privacy issues [26; 27]. Furthermore, we argue that more educated players of Pokemon Go are more aware about possible organizational practices with respect to their data and more able to understand associated privacy risks which leads to increasing concerns. Thus, we are in line with the literature indicating a positive effect of education on privacy concerns [24]. As elaborated in Section 2, smartphone experience is not investigated yet to the best of our knowledge. The concept of internet experience from the literature is primarily related to personal computers. We argue that the two antecedents are not comparable with respect to the possibility of defending oneself against attacks. For example, it is nearly impossible to prevent third-party tracking of smartphone applications. However, users with more experience are supposed to have witnessed more privacy-related breaches and attacks on smartphones. Thus, we argue that more years of smartphone experience increase the concerns for information privacy. In summary, we hypothesize:  
3. (a) _Age has a positive effect on CFIP._ (b) _Female players of Pokemon Go show higher levels of CFIP._ (c) _Education has a positive effect on CFIP._ (d) _Smartphone experience has a positive effect on CFIP._  
Literature on CFIP as an independent variable influencing outcomes variables like behavioral intention to use a technology, actual use behavior or willingness to disclose is conclusive with respect to the assumed negative effect. Individuals' privacy concerns are supposed to have a negative effect on the outcome variable, partially mediated by other variables like trust [16]. In our case, the outcome variable (USE) is directly influenced by CFIP. It is important to notice that we also asked for the behavioral intention of playing Pokemon Go, but chose to develop our model with actual use behavior as outcome variable. This decision was made due to findings from the literature indicating that the link between intention and use is not always given in the context of privacy and security [45]. Thus, we hypothesize:  
4. _CFIP have a negative effect on the use behavior of Pokemon Go (USE)._  
There is research showing that the link between privacy concerns and behavior is not as straightforward as it seems.