[Paper Review] Risk Perceptions for Wearable Devices

Linda N. Lee, Serge Egelman+2 more|arXiv (Cornell University)|Apr 22, 2015

Privacy, Security, and Data Protection25 references12 citations

TL;DR

This study presents the first large-scale user survey (n=1,782) on risk perceptions for wearable devices, analyzing 72 data types across four recipient types to rank privacy and security concerns. It finds that video capture and financial data are perceived as most sensitive, and users rate wearable risks similarly to physical dangers like using a lawnmower, highlighting the need for user-centered security and privacy design in emerging wearable platforms.

ABSTRACT

Wearable devices, or "wearables," bring great benefits but also potential risks that could expose users' activities with- out their awareness or consent. In this paper, we report findings from the first large-scale survey conducted to investigate user security and privacy concerns regarding wearables. We surveyed 1,782 Internet users in order to identify risks that are particularly concerning to them; these risks are inspired by the sensor inputs and applications of popular wearable technologies. During this experiment, our questions controlled for the effects of what data was being accessed and with whom it was being shared. We also investigated how these emergent threats compared to existent mobile threats, how upcoming capabilities and artifacts compared to existing technologies, and how users ranked technical and nontechnical concerns to sketch a concrete and broad view of the wearable device landscape. We hope that this work will inform the design of future user notification, permission management, and access control schemes for wearables.

Motivation & Objective

• To understand user perceptions of security and privacy risks associated with wearable devices, which are rapidly becoming ubiquitous.
• To identify and rank the most concerning data types and recipients (e.g., friends, strangers, advertisers) that users associate with wearable devices.
• To compare emergent wearable risks with existing mobile and physical-world risks to contextualize user concerns.
• To inform the design of future permission systems, access controls, and user notification mechanisms for wearables based on user-centric risk perception.
• To provide a foundational understanding of user priorities in privacy and security to guide responsible development of wearable technology.

Proposed method

• Conducted a large-scale online survey with 1,782 Internet users to assess perceived concern for 72 wearable-related risk scenarios.
• Used a Likert-scale rating (1=indifferent, 5=very upset) to quantify user concern for each scenario, controlling for data type and recipient.
• Adopted a methodology inspired by Felt et al. (2011) on smartphone risks and Fischhoff et al. (1978) on general risk perception for scenario design.
• Compared perceived risks of wearables to those of smartphones and physical-world risks (e.g., lawnmowers) to calibrate user perceptions.
• Collected open-ended responses to identify non-technical concerns and inform future research directions.
• Analyzed data to rank risks by sensitivity and recipient type, and assessed correlations between user preferences and risk perception.

Experimental results

Research questions

• RQ1 Which data types captured by wearable devices are perceived as most risky by users, and how does this vary by recipient (e.g., friends, strangers, advertisers)?
• RQ2 How do users perceive the risks of wearable devices in comparison to existing mobile and physical-world risks?
• RQ3 What non-technical concerns do users report regarding wearable devices beyond security and privacy?
• RQ4 To what extent do user perceptions of risk align with actual threat severity, and how can this inform access control and notification design?
• RQ5 How do demographic and behavioral factors influence user risk perception for wearable technologies?

Key findings

• Video capture and financial data were ranked as the most sensitive data types, with high user concern across all recipient types.
• Users perceived risks from wearable devices similarly to physical dangers—facial recognition was rated as risky as using a lawnmower, indicating strong emotional salience.
• The risk perception of data sharing with strangers was significantly higher than with friends or family, highlighting the role of trust in perceived risk.
• Participants expressed strong concern about non-technical issues such as social embarrassment, distraction, and loss of control, which were frequently mentioned in open-ended responses.
• Perceived risk was consistent across demographic groups, suggesting broad alignment in privacy concerns despite varying backgrounds.
• The study confirms that user perceptions of risk can guide the design of permission systems and access controls, even when users are unfamiliar with specific threats.