A privacy calculus model for contact tracing apps: Analyzing the use behavior of the German Corona-Warn-App with a longitudinal user study

Abstract

The SARS-CoV-2 pandemic is a pressing societal issue today. The German government promotes a contract tracing app named Corona-Warn-App (CWA), aiming to change citizens’ health behaviors during the pandemic by raising awareness about potential infections and enable infection chain tracking. Technical implementations, citizens’ perceptions, and public debates around apps differ between countries, e. g., in Germany there has been a huge discussion on potential privacy issues of the app.

Thus, we analyze effects of privacy concerns regarding the CWA, perceived CWA benefits, and trust in the German healthcare system to answer why citizens use the CWA. In our initial conference publication at ICT Systems Security and Privacy Protection – 37th IFIP TC 11 International Conference, SEC 2022, we used a sample with 1752 actual users and non-users of the CWA and and support for the privacy calculus theory, i. e., individuals weigh privacy concerns and benefits in their use decision. Thus, citizens privacy perceptions about health technologies (e. g., shaped by public debates) are crucial as they can hinder adoption and negatively affect future fights against pandemics. In this special issue, we adapt our previous work by conducting a second survey 10 months after our initial study with the same pool of participants (830 participants from the first study participated in the second survey). The goal of this longitudinal study is to assess changes in the perceptions of users and non-users over time and to evaluate the influence of the significantly lower hospitalization and death rates on the use behavior which we could observe during the second survey. Our results show that the privacy calculus is relatively stable over time. The only relationship which significantly changes over time is the effect of privacy concerns on the use behavior which significantly decreases over time, i. e., privacy concerns have a lower negative effect one the CWA use indicating that it did not play such an important role in the use decision at a later point in time in the pandemic.

We contribute to the literature by introducing one of the rare longitudinal analyses in the literature focusing on the privacy calculus and changes over time in the relevant constructs as well as the relationships between the calculus constructs and target variables (in our case use behavior of a contact tracing app). We can see that the explanatory power of the privacy calculus model is relatively stable over time even if strong externalities might affect individual perceptions related to the model.

1. Introduction

With the global pandemic caused by the severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2), digital proximity tracing systems to identify people who have been in contact with an infected person became a hot topic. Technical implementations, citizens’ perceptions, and public debates around apps differ between countries, especially because of differences in the perceived importance of data protection. In particular in Germany, there have been many discussions on different implementations and their architecture (Project, 2020b), i. e. if the approach should be centralized or decentralized. As a result, the German contract tracing app named Corona-Warn-App (CWA) was build with a strong focus on privacy. It is based on the DP-3T protocol which ensures data minimization, prevents abuse of data and the tracking of users (Project, 2020a). The German government along with its associated health institutes promote the use of the CWA, aiming to change citizens’ health behavior during the pandemic by raising awareness about potential infections and enable effective infection chain tracking.

While the discussion on the architecture and possible effects of it was mostly among experts, for a widespread use of the app, the app’s acceptance by ordinary users is of more importance (Voss, 2020). Privacy concerns have been identified as one of the major barriers for the acceptance of contact tracing apps in prior work (Bonner, Naous, Legner, Wagner, 2020, Horstmann, Buecker, Krasko, Kritzler, Terwiel, 2021). The privacy calculus theory, in which individuals make their use decision by weighing privacy concerns and benefits is a suitable framework to explain the citizens’ health behavior related to using the CWA (Dinev, Hart, 2006, Duan, Deng, 2021, Fox, Clohessy, van der Werff, Rosati, Lynn, 2021, Garrett, Wang, White, Hsieh, Strong, Lee, Lewandowsky, Dennis, Yang, 2021, Hassandoust, Akhlaghpour, Johnston, 2021, Meier, Meinert, Krämer, Wagner, Olt, Abramova). The citizens’ decision is of even more importance in countries like Germany where the use of the contact tracing app is voluntary and not enforced by the government. To the best of our knowledge, previous studies on contact tracing apps facilitating the privacy calculus are based on users’ intentions rather than on their behavior. Therefore, we investigated the factors influencing the actual CWA use decisions on an individual level with a sample of 1752 participants (896 CWA users / 856 non-users) and address the question why citizens use contact tracing apps in our conference article presented at ICT Systems Security and Privacy Protection – 37th IFIP TC 11 International Conference, SEC 2022 (Harborth and Pape, 2022). We augment this study by carrying out a second survey with the same participant pool 10 months after the first survey. From the 1752 participants of the first survey (wave 1), 830 participants participated in the second survey (wave 2). The interesting externality which changed between wave 1 and wave 2 was the severity of Covid-19 in Germany. During wave 1 (beginning of 2021) hospitalization and death rates skyrocketed and the pandemic was the main topic covered in the public discourse. During wave 2 (end of 2021) those numbers were significantly lower and the public perception regarding the severity of the infection weakened. Thus, this longitudinal data set enables us to investigate the extent to which this externality influences (a) the perceptions of users and non-users of the CWA with respect to our main variables, i. e., privacy concerns regarding the CWA, perceived benefits of the CWA, and trust in the German healthcare system, and (b) the relationships within the privacy calculus model (i. e., whether the effects of some independent variables on the target variables significantly change over time).

2. Privacy-related decision making and tracing apps

The privacy-related decision making process of users is explained by several approaches and constructs in prior work (Malhotra, Kim, Agarwal, 2004, Norberg, Horne, Horne, 2007, Smith, Dinev, Xu, 2011, Smith, Milberg, Burke, 1996). The privacy calculus is one of the approaches aiming at explaining the role of privacy concerns in use behaviors, such as information disclosure or technology use. It represents a deliberate trade-off made by individuals weighing up benefits and costs (Culnan, Armstrong, 1999, Dinev, Hart, 2006, Laufer, Wolfe, 1977). The calculus assumes that if benefits outweigh the risks (i. e., privacy concerns (Dinev and Hart, 2006)) users tend to engage in the privacy-related behavior. Empirical studies find that privacy risks negatively influence use intentions or behaviors and benefits positively influence the outcome variables (Harborth, Pape, 2019, Krasnova, Spiekermann, Koroleva, Hildebrand, et al., 2010). The deliberate privacy-related decision making by users is questioned in more recent studies, e. g., by extending the original concepts of the privacy calculus with new factors (Dienlin, Metzger, 2016, Kehr, Kowatsch, Wentzel, Fleisch, et al., 2015) or by introducing behavioral biases influencing the trade-off (Dinev, Mcconnell, Smith, 2015, Harborth, Pape, 2020).

Naturally, recent research on Covid-19 apps is sprouting up everywhere. A huge part consists of surveys on the users’ adoption of one or more contact tracing apps, e. g. in Australia (Duan and Deng, 2021), China (Kostka and Habich-Sobiegalla, 2020), France (Altmann et al., 2020), Germany (Altmann, Milsom, Zillessen, Blasone, Gerdon, Bach, Kreuter, Nosenzo, Toussaert, Abeler, Bonner, Naous, Legner, Wagner, 2020, Kostka, Habich-Sobiegalla, 2020, Meier, Meinert, Krämer, Oldeweme, Märtins, Westmattelmann, Schewe, et al., 2021, Pape, Harborth, Kröger, 2021, Wagner, Olt, Abramova), Ireland (Fox, Clohessy, van der Werff, Rosati, Lynn, 2021, O’Callaghan, Buckley, Fitzgerald, Johnson, Laffey, McNicholas, Nuseibeh, O’Keeffe, O’Keeffe, Razzaq, et al., 2020), Italy Altmann et al. (2020), Switzerland (Bonner, Naous, Legner, Wagner, 2020, Wagner, Olt, Abramova), Taiwan (Garrett et al., 2021), the UK (Altmann, Milsom, Zillessen, Blasone, Gerdon, Bach, Kreuter, Nosenzo, Toussaert, Abeler, Horvath, Banducci, James, 2020, Lewandowsky, Dennis, Perfors, Kashima, White, Garrett, Little, Yesilada, 2021), and the US (Altmann, Milsom, Zillessen, Blasone, Gerdon, Bach, Kreuter, Nosenzo, Toussaert, Abeler, Hassandoust, Akhlaghpour, Johnston, 2021, Kostka, Habich-Sobiegalla, 2020). For example, Horstmann et al. found for a sample in Germany that the most common reasons for non-users were privacy concerns, lack of technical equipment, and doubts about the app’s effectiveness (Horstmann et al., 2021). Most of the other studies had similar results and identified privacy concerns as the or one of the main barriers to use contact tracing apps. In particular, people worried about corporate or government surveillance, potentially even after the pandemic (O’Callaghan et al., 2020), leakage of data to third parties (Altmann et al., 2020), exposure of social interactions (Bonner et al., 2020), and secondary use of the provided data (Bonner et al., 2020). However, misconceptions based on widespread knowledge gaps accompany the adoption of contract tracing apps (Pape et al., 2021a).

Several of the mentioned studies on COVID-19 contact tracing apps have used the privacy calculus (Bonner, Naous, Legner, Wagner, 2020, Duan, Deng, 2021, Fox, Clohessy, van der Werff, Rosati, Lynn, 2021, Garrett, Wang, White, Hsieh, Strong, Lee, Lewandowsky, Dennis, Yang, 2021, Hassandoust, Akhlaghpour, Johnston, 2021, Meier, Meinert, Krämer). Some of them combined the privacy calculus with other constructs such as technology acceptance (Duan and Deng, 2021), social influence (Duan, Deng, 2021, Fox, Clohessy, van der Werff, Rosati, Lynn, 2021), or herding effects (Wagner et al., 2021). All studies found significant effects from benefits and privacy concerns on use intentions. However, all of them used self-reported download, install, and (continuous) use intentions as dependent variables. In contrast, our model relies on a quasi-observable factor (use of the CWA or not) which results from sampling participants, thereby, decreasing biases such as the social desirability bias. Furthermore, we refer to trust in the German healthcare system in contrast to trust in app developers (Meier et al., 2021) or service providers (Lewandowsky et al., 2021) since Horvath et al. found that users’ trust in publicly-funded institutions, i.e., the British National Health Service can reduce privacy concerns (Horvath et al., 2020). For the sake of our cross-sectional online survey, we fall back on the original concepts of the privacy calculus – risks, benefits and CWA use – and nest it within the nomological net of the original “antecedents–privacy concerns–outcomes model” (APCO) (Harborth, Pape, 2021, Smith, Dinev, Xu, 2011). We discuss the emerging research model and hypotheses in the next section.

3. Method

We present our questionnaire, data collection and research model in this section. We used the statistical software R (version 4.0.3) for the descriptive analyses and SmartPLS (version 3.3.2)  (Ringle et al., 2015) for the structural equation modeling.

3.1. Questionnaire and data collection

We conducted the study in two waves. The first wave was run in January 2021; the second was run from mid of October 2021 to mid of November 2021. The idea behind the two waves was to collect data from two points of time with different acuteness of the pandemic (cf. Fig. 1 a and Fig. 1b). We chose hospitalization and death rates as politicians in Germany shifted the necessary measures from incidence to those two rates at that time.

Fig. 1.

Hospitalization rate and number of COVID-19 deaths in Germany (Robert-Koch-Institut, 2022).

We adapted the constructs for privacy concerns (PC) and perceived benefits (PB) from prior literature (Champion, 1984, Gu, Xu, Xu, Zhang, Ling, 2017) and applied it to the CWA. Trust in the German healthcare system is based on the construct by (Pavlou, 2003). The use of the CWA is measured with a binary variable indicating whether participants use the CWA (Use=1) or not (Use=0). We conducted a pretest in one class with graduate students and gathered qualitative feedback with respect to clarity of constructs and the questionnaire structure. After this pretest, we conducted the main study with a certified panel provider in Germany (ISO 20,252 norm) which distributed the link to our survey in their panel. The survey was implemented with LimeSurvey (version 2.72.6) (Schmitz, 2015) and hosted on a university server. The survey also contained two attention questions. We removed data from participants failing the attention tests.

Users were informed about the purpose of the study, about the storage location of the survey data and that they stay anonymous as long as they do not reveal their identity within the free texts. However, we used an identifier from the panel provider to link the date for each participant across the two waves. We did not have any further information from the panel provider linked to the identifier. Minors were not allowed to participate. This was ensured by our panel provider and an additional information text before our survey. Participants agreed that their data is used for research and consequent publications. The user study was evaluated by the university’s ethics board and the project has been classified as “ethically acceptable.”

3.1.1. 1. Wave

We sampled the participants of the first wave to achieve a representative sample for Germany with approximately 50% females and 50% males as well as an age distribution following the EUROSTAT2018 census (EUROSTAT, 2021). We also set a quota to end up with half of the sample using the CWA and the other half not using it.

Our resulting sample consists of 1752 participants which is representative for Germany with respect to age and gender. The same diversity can be observed for income and education. We checked the sample for statistically significant differences in income, education, and the distribution of mobile operating systems and only found negligible differences, although some of them were statistically significant but had the same median (Harborth, Pape, 2022, Pape, Harborth, Kröger, 2021). The distribution can be found in Table B.7 in the appendix.

3.1.2. 2. Wave

In the second wave, we could only rely on the participants of the first wave. Therefore, we did not sample using hard quotas but steered participation by sending out invitations to participate in bunches. Each bunch addressed the underrepresented participants to balance the properties use of the CWA, age and gender. For this work, we only considered the participants of wave two (who all participated in wave one also) and did not take participants into account who only participated in wave one. Due to unknown reasons three participants had participated twice in the second wave, but with different answers. Therefore, we excluded them from the analysis. That left us with 830 individuals who were roughly split into two equally sized groups of CWA users and non-users (cf. Table 1). 358 users were using the CWA in both waves, 353 users were not using the CWA in both waves, 50 users stopped using the app and 69 started using the app.

Table 1.

Participant’s use of the CWA over time.

Usage	Wave 1	Wave 2
Users	408	427
Non-Users	422	403
N	830	830

Since we deliberately divided the sample into two approximately equal groups (CWA users and non-users), we need to ensure that the groups are not biased. While we could deliberately sample our participants with regards to age and gender in the first wave so that there is no statistically significant difference between the groups, we need to double check that for the second wave since we did not have that possibility. The reason is simply that we could not know beforehand if users had stopped using the app or previously non-users were now using it. Table 2 lists the demographics of the second wave’s sample.

Table 2.

Participants’ characteristics for age, gender, income and education.

Demographics	N	%
Age
18-29 years	118	14.2%
30-39 years	148	17.8%
40-49 years	166	20.0%
50-59 years	212	25.5%
60+ years	186	22.4%
Net income
500€ – 1000€	76	9.2%
1000€ – 2000€	177	21.3%
2000€ – 3000€	202	24.3%
3000€ – 4000€	145	17.5%
More than 4000€	155	18.7%
Prefer not to say	75	9.0%
Demographics		N	%
Gender
	Female	417	50.2%
	Males	413	49.8%
Education
1	No degree	83	0.4%
2	Secondary school	99	11.9%
3	Secondary school+	278	33.5%
4	A levels	183	22.0%
5	Bachelor’s degree	108	13.0%
6	Master’s degree	146	17.6%
7	Doctorate	13	1.6%

⁺5 GCSEs at grade C and above

For age, we conducted a Shapiro-Wilk test for normality and it is not normal distributed ($P<.001$). Therefore, we used a Wilcoxon rank-sum test to find that there are no significant differences between CWA users and non-users for age ($p=0.87$). We also conducted Pearson’s chi-squared tests and found that age groups ($p=.62$) and gender ($p=.09$) do not reveal a statistically significant difference for users and non-users. However, for income ($p=.002$) and education ($p=.008$) we found the same effect than for the full set of participants, that the groups statistical significantly differ. Income and education are statistically significantly higher for the users compared to the non-users. To evaluate the effect size, we additionally conducted a Kendall’s tau test and found that the correlation between user/non-user and income ($p=.007$, $\tau$=.088) respectively education ($p<.001$, $\tau$=.120) is only small, so we argue that the absolute difference does not have a substantial confounding effect on our later analysis.

631 participants use Android (76.0%), 190 use iOS (22.8%) and 9 stated to use smartphones with other mobile operating systems (OS) (1.0%). This distribution of operating systems is representative for Germany (Statista, 2020). However, in contrast to the first wave, there is a significant difference in the distribution of Android and iOS users between CWA users and non-users ($p=.013$). For CWA users there are roughly four Android users for every IoS user; for non-users the ratio is roughly two and a half to one.

We also calculated mean sum scores for privacy concerns, perceived benefits and trust in the German healthcare system in order to check for differences between CWA users and non-users.

We conducted Shapiro-Wilk tests for normality and Levene’s tests of equal variances for the three constructs and find that they are not normally distributed and do not have equal variances between CWA users and non-users. Due to the non-parametric properties of our data we used the Wilcoxon rank-sum test.

All variables are statistically significantly different between users and non-users (all with $p\ll .001$) with large to moderate effect sizes $r$ for privacy concerns (wave 1: $r=0.566$, cf. Fig. 2 a; wave 2: $r=0.467$, cf. Fig. 2b), perceived benefits (wave 1: $r=0.575$, cf. Fig. 2c; wave 2: $r=0.637$, cf. Fig. 2d), and trust in the healthcare system (wave 1: $r=0.238$, cf. Fig. 2e; wave 2: $r=0.218$, cf. Fig. 2f).

Fig. 2.

Plots for privacy concerns, perceived benefits and trust in the German healthcare system (CWA = 1: CWA users, CWA = 0: CWA non-users) for both waves.

3.2. Research model and hypotheses

We first discuss research hypothesis regarding the change of the three variables privacy concerns, perceived benefits and trust in the German healthcare system over time and then discuss the APCO research model along with its hypotheses.

3.2.1. Analysis of the differences between wave 1 and wave 2

We intentionally conducted the two waves of the survey at times when the pandemic was very acute and seemingly under control to investigate the influence of the pandemic’s acuteness. Given the decrease of the pandemics acuteness, we hypothesize that privacy concerns should remain on the same level since they do not depend on the acuteness of the pandemic:

• 1.Privacy Concerns remain constant.

On the one hand, the perceived benefits of the CWA should decrease since the risk to get infected is lower when the pandemic is less acute. Therefore, we hypothesize:

• 2.Perceived Benefits will decrease from the 1st wave to the 2nd wave.

On the other hand, trust in the German healthcare system should increase when the pandemic is less acute and seems to be under control. Therefore, we hypothesize:

• 3.Trust in Healthcare will increase from the 1st wave to the 2nd wave.

3.2.2. APCO model

We operationalize the “antecedents - privacy concerns - outcome” (APCO) model on an individual level, i. e., excluding factors such as cultural or organizational ones (Smith et al., 2011). We focus on a narrow set of common antecedents on an individual level which are relevant for the case of the Corona-Warn-App. Privacy concerns are operationalized contextually, i. e. focusing on the specific perceptions of individuals related to the CWA. The outcome is the CWA use explained by the privacy calculus including trust in the German healthcare system as an additional antecedent of privacy concerns. Thus, this nomological net is mostly based on the original APCO model (Smith et al., 2011). The resulting research model is shown in Fig. 3 .

Fig. 3.

Research model.

We include four demographic variables as antecedents (age, gender, income, education). The results for the effects of these antecedents in previous studies are inconclusive (Harborth and Pape, 2020b). Prior work finds that older individuals and women are more concerned about their privacy (Huang, Liu, 2012, Yang, 2013). We follow these findings and hypothesize that age has a positive effect on privacy concerns regarding the CWA and that females show higher levels of privacy concerns. Higher levels of education are usually associated with increasing privacy concerns (Lee et al., 2016). However, since the German CWA was build based on privacy by design and can be considered to be privacy friendly, a better understanding of the CWA should reduce privacy concerns (Pape et al., 2021a). Thus, we hypothesize that there is a negative effect of education on privacy concerns (i. e., higher education levels correspond to lower privacy concerns). Similarly, a higher income is hypothesized to have a negative effect on privacy concerns as well (i. e., higher income levels correspond to lower privacy concerns) (Smith et al., 2011). We hypothesize for the demographic variables:

• 4. (a) Age has a positive effect on privacy concerns regarding the CWA.
• (b) Female participants show higher levels of privacy concerns regarding the CWA.
• (c) Education has a negative effect on privacy concerns regarding the CWA.
• (d) Income has a negative effect on privacy concerns regarding the CWA.

Smartphone experience and the experience with the respective mobile operating system is included as control for participants technical experience by including these variables as antecedents of privacy concerns (Harborth and Pape, 2021). We argue that participants with more experience regarding both dimensions have higher privacy concerns as they might have witnessed more privacy-related breaches and attacks on smartphones (Bellman, Johnson, Kobrin, Lohse, 2004, Dinev, Hart, 2005). Thus, we hypothesize:

• 5.Smartphone experience has a positive effect on privacy concerns regarding the CWA.

• 6.Experience with the mobile OS has a positive effect on privacy concerns regarding the CWA.

Individuals’ privacy concerns are generally assumed to have a negative effect on the outcome variables (Smith et al., 2011). In contrast to prior work on the CWA and privacy, we use the actual use decisions of participants instead of behavioral intentions. By that, we avoid biases in our results due to the behavioral-intention gap which is especially pronounced in privacy-related research (Crossler et al., 2013). Thus, we hypothesize:

• 7.Privacy concerns regarding the CWA have a negative effect on the decision to use the app.

Prior work finds that the relation between privacy concerns and behavior is also affected by other factors. The most common rationale is the privacy calculus which is also included in the APCO model. The privacy calculus states that individuals engage in a deliberate trade-off between benefits (of using a technology or disclosing information) and costs (privacy risks which are operationalized by privacy concerns) when making privacy-related decisions (Dinev and Hart, 2006). To account for this trade-off, we include the perceived benefits of using the CWA and hypothesize:

• 8.The perceived benefits of using the CWA have a positive effect on the decision to use the app.

Our last variable in the model is trust in the German healthcare system. We include this variable as trust in general is an important concept to explain privacy concerns and individual behavior (Smith et al., 2011). In general, trust in certain entities alleviates privacy concerns related to these entities. In addition, trust has a direct positive effect on certain use or disclosure behaviors (Harborth, Pape, 2018, Harborth, Pape, 2018, Harborth, Pape, 2019, Harborth, Pape, 2020, Harborth, Pape, Rannenberg, 2020, Karahanna, Gefen, Straub, 2003, Malhotra, Kim, Agarwal, 2004). In the context of the pandemic and contact tracing apps, it can be seen that privacy concerns can be alleviated by users’ trust in certain publicly-funded institutions, such as the British National Health Service (NHS) (Horvath et al., 2020). Our construct covers this partially as we include a more abstract notion of this idea in our model.

• 9.Trust in the German healthcare system has a negative effect on the privacy concerns regarding the CWA.

• 10.Trust in the German healthcare system has a positive effect on the decision to use the app.

4. Analysis of the differences between wave 1 and wave 2

For the analysis of the differences between the two waves, we used signed rank Wilcoxon tests since the differences between the measurements in both waves were not normally distributed for all three variables. Table 3 lists the results. The sample sizes differ from the sizes reported in Fig. 2 since we did not consider participants who stopped using the CWA or started to use it (50 + 69 participants). Since their sample size was too low, we did not conduct signed rank Wilcoxon test for participants changing their behavior. Consequently, the means also slighty differ from the means reported in Fig. 2.

Table 3.

Change of mean and effect size of Wilcoxon signed rank test with continuity correction for all participants ($N=830$), users in both waves ($N=358$) and non-users in both waves ($N=353$). ***, **, * asterisks indicate statistical significance at the 0.001, 0.01 or 0.05 level, respectively.

Variable	All		Non-Users		Users		Result
Privacy Concerns	–0.146$***$		–0.073		–0.217$***$		H1 rejected
	3.56 $\to$3.75		4.75 $\to$4.83		2.37 $\to$2.67
Perceived Benefits	–0.289$***$		–0.170$**$		–0.451$***$		H2 rejected
	3.86 $\to$4.24		2.92 $\to$3.16		4.83 $\to$5.35
Trust in Healthcare	–0.157$***$		–0.175$**$		–0.185$***$		H3 rejected
	4.89 $\to$4.69		4.56 $\to$4.28		5.26 $\to$5.08

We could not confirm any of the hypotheses. H1 stated that the privacy concerns remain at a similar level, but they increased significantly – besides for non-users. H2 stated that with the reduced acuteness of the pandemic the perceived benefits would decrease, but they increased significantly for all users. In the same manner, H3 stated that with the pandemic seemingly under control the trust in the healthcare system would increase, but the means decreased.

5. Results of the structural equation model

An analysis of the measurement model regarding reliability and validity is a precondition for interpreting the results of the structural model Hair et al. (2011). For the PLS algorithm, we chose the path weighting scheme with a maximum of 300 iterations and a stop criterion of ${10}^{-7}$. For the bootstrapping procedure, we used 5000 bootstrap subsamples and no sign changes as the method for handling sign changes during the iterations of the bootstrapping procedure.

5.1. Assessment of the measurement model

Internal Consistency Reliability Internal consistency reliability (ICR) measurements indicate how well certain indicators of a construct measure the same latent phenomenon. Two standard approaches for assessing ICR are Cronbach’s $\alpha$ and the composite reliability. The values of both measures should be between 0.7 and 0.95 for research that builds upon accepted models Hair et al. (2017). Values for Cronbach’s $\alpha$ (0.896, 0.960 and 0.867) and composite reliability (0.903, 0.965 and 0.895) for perceived benefits (PB), privacy concerns (PC) and trust in the healthcare system (TRUST), respectively, are within these suggested ranges for the full model. In line with these findings are the values for wave 1 and wave 2 which indicate reliable models.

Convergent Validity We evaluate convergent validity based on the outer loadings of the indicators of the constructs (indicator reliability) and the average variance extracted (AVE) Hair et al. (2011). The lowest loading of the three constructs equals 0.796 for the full model. Thus, indicator reliability is established as loadings above 0.7 imply that the indicators have much in common, which is desirable for reflective measurement models Hair et al. (2017). Convergent validity for the construct is assessed by the AVE (sum of the squared loadings divided by the number of indicators). The AVEs are 0.706 for PB, 0.864 for PC, and 0.790 for TRUST for the full model. This indicates that the constructs explain significantly more than half of the variance of the indicators, and thereby demonstrates convergent validity. Both convergent validity measures are acceptable for the models of wave 1 and wave 2 as well.

Discriminant Validity We assess the degree of uniqueness of a construct compared to other constructs by investigating the cross-loadings for the single indicators. All outer loadings of a certain construct should be larger than its cross-loadings with other constructs Hair et al. (2011) which is the case for our model. On a construct level, we compare the square root of the constructs’ AVE with the correlations with other constructs. The square root of the AVE of a single construct should be larger than the correlation with other constructs (Fornell-Larcker criterion) Hair et al. (2017). All values are larger than correlations with other constructs, indicating discriminant validity. Prior work proposes the heterotrait-monotrait ratio (HTMT) as a superior approach for assessing discriminant validity Henseler et al. (2015). Values close to 1 for HTMT indicate a lack of discriminant validity. A conservative threshold is 0.85 Henseler et al. (2015) and no value in our model is above the suggested threshold of 0.85 (Table 4 ). We assess if the HTMT statistics are significantly different from 1 with a bootstrapping procedure with 5000 subsamples to get the confidence interval in which the true HTMT value lies with a 95% chance. The HTMT measure requires that no confidence interval contains the value 1. Our analysis shows that this is the case. Both criteria (Fornell-Larcker and HTMT) are also tested for the models of wave 1 and wave 2 and are within the suggested thresholds. Thus, discriminant validity is established for all models.

Table 4.

Heterotrait-Monotrait Ratio (HTMT) for the Full Model.

	AGE	EDU	GDR	INCOME	Sp. Exp.	MOS Exp.	PB	PC	USE
EDU	0.152
GDR	0.012	0.045
INCOME	0.048	0.243	0.088
Smartphone Exp.	0.148	0.052	0.044	0.123
Mobile OS Exp.	0.008	0.002	0.067	0.113	0.676
Perc. Benefits	0.045	0.057	0.051	0.043	0.025	0.018
Privacy Concerns	0.040	0.155	0.035	0.096	0.020	0.027	0.502
USE	0.017	0.151	0.014	0.139	0.078	0.067	0.574	0.554
TRUST	0.064	0.136	0.042	0.068	0.028	0.031	0.481	0.425	0.281

Common Method Bias The common method bias (CMB) can occur if data is gathered with a self-reported survey at one point in time in one questionnaire Podsakoff et al. (2003). We need to test for the CMB since this is the case in our study. We perform a principal component factor analysis in R to conduct the Harman’s single-factor test to address the issue of CMB Podsakoff et al. (2003). The assumptions of the test are that CMB is not an issue if there is no single factor that results from the factor analysis or that the first factor does not account for the majority of the total variance Podsakoff et al. (2003). The test for the full model shows that six factors have eigenvalues larger than 1 which account for 75.72% of the total variance. The first factor explains 34.65% of the total variance. Thus, we argue that CMB is not likely to be an issue in the data set. As

5.2. Structural model assessment and results

We assess collinearity, the level of $R^2$, the path coefficients, the effect size $f^2$, the predictive relevance $Q^2$, and the effect size $q^2$. We address these evaluation steps to ensure the predictive power of the model with regard to the target constructs privacy concerns and use.

Collinearity Collinearity is present if two predictor variables are highly correlated with each other. To address this issue, we assess the inner variance inflation factor (VIF). All VIFs above 5 indicate that collinearity between constructs is present. For our full model, the highest VIF is 1.939. The highest VIF for the model for wave 1 equals 1.970 and for wave 2 it equals 1.968. Thus, collinearity is not an issue in all three models.

Significance and Relevance of Model Relationships Values of adjusted $R^2$ are equal to 16.6% and 40.7% for privacy concerns (PC) and use, respectively for the complete data set. For wave 1, these values are equal to 13.7% and 46.9% for privacy concerns and use, respectively. For wave 2, these values are equal to 17.6% and 41.5% for privacy concerns and use, respectively. For all samples the values show that the model explains almost half of the variance of the CWA usage Hair et al. (2011). The path estimates for our research model (see Fig. 3) are shown in Table 5 for the full sample and the two waves. The sizes of significant path estimates are interpreted relative to each other in the model and under the consideration of the effect sizes $f^2$ for each relation. Thus, a coefficient might be statistically but its effect to low to be considered relevant for the model. This would lead to the assessment, that a hypothesis cannot be confirmed. Based on this, the effects of privacy concerns and perceived benefits on the use of the CWA (confirming H7 and H8) as well as of trust in the German healthcare system on privacy concerns (confirming H9) are strong. Education and income have partially statistically significant weak negative effects on privacy concerns (confirming H4c and H4d). However, both effect sizes are so small that they cannot be considered as relevant in the model (also visible in the $f^2$ effect sizes which are lower than the lowest suggested threshold of 0.02 (Cohen, 1988)). Trust in the German healthcare system has a weak but negative effect on the use of the CWA (rejecting H10). None of the other hypotheses are significant.

Table 5.

Path Estimates (PE) for the Full Sample (N=1,752) and the Sub-Samples for Wave 1 (N=830) and Wave 2 (N=830). ***, **, * asterisks indicate statistical significance at the 0.001, 0.01 or 0.05 level, respectively.

	Path Estimates
Relation	Full	Wave 1	Wave 2	Result
Age $\to$ PC	–0.039	–0.026	0.053	H4a not confirmed
Gender $\to$ PC	–0.017	–0.035	–0.007	H4b not confirmed
Education $\to$ PC	–0.097$***$	–0.096$**$	–0.089$**$	H4c not confirmed
Income $\to$ PC	–0.045$*$	0.063	0.061	H4d not confirmed
Smartphone Exp. $\to$ PC	–0.050	0.022	0.009	H5 not confirmed
Mobile OS Exp. $\to$ PC	0.055	0.016	–0.037	H6 not confirmed
PC $\to$ Use of CWA	–0.378$***$	–0.182$***$	–0.118$***$	H7 confirmed
Perceived Benefits $\to$ Use of CWA	0.395$***$	0.233$***$	0.269$***$	H8 confirmed
Trust in the German Healthcare System $\to$ PC	–0.374***	–0.339$***$	–0.398$***$	H9 confirmed
Trust in the German Healthcare System $\to$ Use of CWA	–0.054$*$	–0.044$**$	–0.053$**$	H10 rejected

Effect Sizes$f^2$ The $f^2$ effect size measures the impact of a construct on the endogenous variable by omitting it from the analysis and assessing the resulting change in the $R^2$ value (Hair et al., 2017). The values are assessed based on thresholds by (Cohen, 1988), who defines effects as small, medium and large for values of 0.02, 0.15 and 0.35, respectively. The effect sizes $f^2$ correspond to the path estimates with medium-sized effects of privacy concerns and perceived benefits on use of the CWA and trust in the healthcare system on privacy concerns (Table 5). These results can be confirmed when analyzing the results of waves 1 and 2 individually, although some effect sizes are slightly smaller (also visible in the path estimates) due to the significantly smaller sample size that was used to calculate the models (1,752 versus 830).

Predictive Relevance$Q^2$ The $Q^2$ measure indicates the out-of-sample predictive relevance of the structural model with regard to the endogenous latent variables based on a blindfolding procedure Hair et al. (2017). We used an omission distance d = 7 with recommended values between five and ten (Hair et al., 2011). Furthermore, we report the $Q^2$ values of the construct cross-validated redundancy approach, since this approach is based on both the results of the measurement model as well as of the structural model (Hair et al., 2017). Detailed information about the calculation cannot be provided due to space limitations. For further information see (Chin, 1998). Values above 0 indicate that the model has the property of predictive relevance. In our case, the $Q^2$ values for the full model are equal to 0.145 for PC and 0.404 for use. Since they are larger than zero, predictive relevance of the model is established.

Effect Sizes$q^2$ The assessment of $q^2$ follows the same logic as the one of $f^2$. It is based on the $Q^2$ values of the endogenous variables and calculates the individual predictive power of the exogenous variables by omitting them and comparing the change in $Q^2$ (Hair et al., 2017). All individual values for $q^2$ are calculated with an omission distance d of seven. The thresholds for the $f^2$ interpretation can be applied, too (Cohen, 1988). The results show that the individual predictive power for hypotheses 4, 5 and 6 is given with medium-sized effects. These results can be confirmed when analyzing the results of waves 1 and 2 individually, although some effect sizes are slightly smaller (also visible in the path estimates) due to the significantly smaller sample size that was used to calculate the models (1,752 versus 830).

5.3. Results of the multigroup analysis

The multigroup analysis enables us to compare whether there are significant changes in the effect sizes for the relationships in our research model over time. Table 6 shows the results between wave 1, where Covid-19 was significantly more critical regarding hospitalization and death rates in Germany, and wave 2, with significantly lower numbers in both dimensions.

Table 6.

Results of the Bootstrap Multigroup Analysis Between Wave 1 and Wave 2.

Relation	Diff. W1 - W2	p-value
Age $\to$ PC	–0.079	0.090
Gender $\to$ PC	–0.027	0.770
Education $\to$ PC	–0.007	0.881
Income $\to$ PC	0.002	0.965
Smartphone Experience $\to$ PC	0.012	0.845
MobileOS Experience $\to$ PC	0.053	0.407
PC $\to$ CWA Use	–0.063	0.004
Perceived Benefits $\to$ CWA Use	–0.035	0.116
Trust in Healthcare System $\to$ PC	0.060	0.214
Trust in Healthcare System $\to$ CWA Use	0.010	0.654

The results of the MGA show that the only significant change over time can be observed for the effect of privacy concerns on CWA use. In the earlier wave 1 the negative effect of users and non-users privacy concerns was significantly higher compared to wave 2. This would indicate that privacy concerns as a barrier of tracing-app adoption became less important over time. This could be partially explained by the extensive media coverage of the CWA in Germany in the earlier time right before and after launch which was often enough rather negative and did not consider the technical aspects which make the CWA a comparably safe contact-tracing app from a privacy and security point of view. However, in the course of time, these discussions faded from the public discourse which might explain the weakened effect of privacy concerns on app use.

In summary, it is interesting to observe that the structural model of the privacy calculus is relatively stable over time although the changes in hospitalizations and death rates represent a massive externality in the context of an app which aims at disease prevention for one self as well as others. For example, the assumption would have been valid that the effect of the perceived benefits on the use decrease over time if the severity of the infection weakens. But this is obviously not indicated by the data and indicate that the relationships in the model are relatively stable over time considering the severity of Covid-19.

6. Discussion

We investigated the impact of privacy concerns related to the CWA, benefits of the CWA and trust in the German healthcare system on the CWA use decision and how these effects change over the course of the pandemic. We used the APCO model (Smith et al., 2011) and the privacy calculus theory (Dinev and Hart, 2006) for the hypothesis development and evaluated them with a longitudinal survey design with 1752 participants in the initial survey (896 users and 856 non-users) and 830 participants in the second survey. To analyze changes over time, we only looked at the participants who participated in both waves, thus having two additional models with 830 participants each.

Our results support the privacy calculus theory and that individuals weigh up risks and benefits as privacy concerns have a statistically significant negative effect and benefits have a statistically significant positive effect on use. We also find that trust in the German healthcare system is the important antecedent of privacy concerns by alleviating them. This confirms our hypothesis and indicates that participants associate trust in the healthcare system with the entities operating the CWA (Robert Koch Institute, part of the healthcare system as it is subordinated to the German Federal Ministry of Health). In this context, is it far more interesting that the direct positive effect of trust on the use cannot be found in the data. The effect is even negative (although the effect size is negligible). The hypotheses related to the antecedents education and income cannot be confirmed since the effect sizes for both effects are relatively small.

The analysis of the relationship of the pandemic’s acuteness to the antecedents shows an ambiguous picture. While all of the hypotheses were rejected, we could observe that the effect sizes for users are significantly larger for privacy concerns and perceived benefits than for non-users. This could be expected since users are more likely to care about properties of the CWA than non-users, and therefore they might follow reports and news about the CWA more carefully. The roughly same effect size for trust in the healthcare system, which is mostly independent of the app supports that reasoning. The most likely reason for the rejection of the hypotheses is that the postulated effects were overlapping with concurrent effects. With about 10 months between the two waves, there were several incidents which may have had a significant effect on the investigated variables. Regarding the privacy-friendliness of the CWA there were on the one hand a significant amount of fake news spread, e. g. claiming that the CWA is creating location profiles (Echtermann, 2021), the Luca app was presented with lots of media attention but unsafe personal storage as well as security problems (LibertiesEU, 2021), regulators had changed their regulations in favor of the Luca app (LibertiesEU, 2021), and politicians were criticized for their lack of transparent communication (Amann et al., 2021). Regarding the perceived benefits, although the public debate around the German CWA was rather critical and the usefulness of the app was questioned on a daily basis (Project, Voss), the CWA seemed to have remained as one of the last counter measures when the health authorities were overburdened and could not track the infections anymore (LibertiesEU, 2021). For the same reason trust in the healthcare system might have decreased, even though the acuteness of the pandemic decreased towards the second wave.

The results of the multigroup analysis, which focuses on the changes of the relationships in the privacy calculus model over time, indicate that the effects on the target variables (privacy concerns and use behavior of the CWA) do not substantially change despite the significantly lower hospitalization and death rates of Covid-19. The only significant change can be observed for the impact of privacy on use behavior. In this instance, the negative effect of privacy concerns on CWA use significantly decreased over time (from an effect size of -0.182 in wave 1 to an effect size of -0.118 in wave 2). This change could be explained by the less aggressive media coverage against the CWA and its privacy issues in later stages of the pandemic when we conducted our second survey (Project, 2020b). Another explanation could be based on a learning and familiarization effect with the CWA. Participants might have become accustomed to the app and actually experienced that reports have exaggerated regarding potential privacy infringements of the app.

Related work on contact tracing app adoption in Germany based on the privacy calculus uses a different set of antecedents of privacy concerns, referred to trust to the app designers and the study used intentions to use the app as a target variable (Meier et al., 2021). However, as in our work, they find statistically significant effects of benefits (positive) and concerns (negative) on intentions. Furthermore, trust has a negative effect on privacy concerns and a positive effect on intentions. Thus, our study with actual use decisions as dependent variable confirms that the privacy calculus is an appropriate tool to explain the CWA use. In addition, the longitudinal survey design adds further substance to the found relationships as the results indicate that all our hypotheses can be confirmed in the second wave as well.

6.1. Limitations

Our work has the following limitations. First, our study covers only the German Corona-Warn-App with all the respective characteristics of this app. Thus, the results are only generalizable to contact tracing apps in other countries to the extent that the population is comparable to the German population and that comparable apps have similar characteristics related to privacy and security aspects. However, even if apps in other countries are technically comparable, other influencing factors such as a positive or negative media coverage, failures in implementation efforts, etc., could still lead to different evaluations of individuals. Second, although we could minimize the effect of biases due to the study design (online questionnaire, self-reported measures) by having an observable dependent variable instead of reported use behaviors or intentions, we still had to rely on self-reported measures for the constructs in our model. Furthermore, our analysis closely followed the original APCO model with its focus on privacy concerns (Smith et al., 2011). Thus, we did not consider interactions between antecedents or other potential relationships between other variables of the calculus such as effects of demographics on the perceived benefits of the CWA. Furthermore, as discussed in the previous subsection, we had concurrent effects between the two waves and therefore, could not isolate the level of acuteness as an influencing factor.

6.2. Future work

The previously described effects could be considered in future work. For example, there were reports that more wealthy households were less affected by the pandemic not only from an economically but also in their daily lives, e. g., by having access to private transportation and enough living space (Miranda, 2020). We would assume that income has a negative effect on the perceived benefits as these households do not profit as much from technical solutions like the CWA. Similarly, the effect of trust in the healthcare system on use decisions could also be mediated by perceived benefits of the app as participants with higher trust in the medical care could be less cautious and do not see the benefits of such apps.

Besides interesting opportunities in extending the model and consider that there could be antecedents for the other variables in the APCO model and privacy calculus, we see the need for analyses of privacy and health behavior apps across countries alongside with analyses of causes for differences in potential privacy perceptions. Furthermore, it would be interesting to investigate to what extent contact tracing apps such as the CWA could induce a change in the health-related behaviors of individuals, e.g., did a notification about a past risk contact change the consequent behavior of individuals by making them more cautious?

Closely related is the question how individuals are influenced by politicians, the public debate, and others in their decision to adopt technologies like the CWA. We argued that these social influences could have been a major driver for the division of the German population into a group which does not believe that there are benefits of such apps and that privacy issues are too severe and into the group which uses the app. Thus, future work could analyze the influences in a more granular way in order to assess the reasons for this division. This is especially important since it has been shown that informative and motivational video messages have very limited effect, but even small monetary incentives can increase the app’s adoption (Munzert et al., 2021). Thus, besides improving the citizens’ knowledge and perception of privacy mechanisms and benefits of the app, future health behavior communication could make use of small monetary incentives, promote the app’s benefits or even try to nudge citizens to use the app.

7. Conclusion

In summary, our work contributes to the current work on contact tracing apps in two ways. First, we provide – to the best of our knowledge – one of the first research findings which rely on an observable outcome variable measuring the actual contact tracing app use decisions of German citizens in a large-scale online survey; thus, avoiding certain biases (e.g., the intention-behavior gap (Crossler et al., 2013)) and providing robust results to rely on for deriving practical recommendations.

Second, by conducting the second survey based on the same participant pool as in the first survey, we contribute to the literature by introducing one of the rare longitudinal analyses in the literature focusing on the privacy calculus and changes over time in the relevant constructs as well as the relationships between the calculus constructs and target variables (in our case use behavior of a contact tracing app). We can see that the explanatory power of the privacy calculus model is relatively stable over time even if strong externalities might affect individual perceptions related to the model.

Third, we practically recommend to consider the importance of appropriate communication strategies by policy makers when releasing health behavior apps, such as the CWA, to a large heterogeneous user base, especially when faced with crises such as a pandemics. We can see high levels of privacy concerns and significantly lower levels of perceived benefits in the group of non-users. In contrast, trust in the healthcare system is almost equal between groups. One possible explanation is that even though the CWA is developed in a privacy-friendly way politicians and media failed to properly explain the app’s functions and data protection measures (e. g., decentralized approach) to the German citizens, and by that lost several millions of potential users. This is not only supported by a study on media coverage which found that governments or politicians were criticized for their lack of transparent communication (Amann et al., 2021). In addition, the public debate around the German CWA was rather critical and the usefulness of the app was questioned on a daily basis (Project, Voss). This implies that there was no real strategy on how to introduce the app to the citizens and advocate it against expectable criticism which needs to be considered in future crises. Our findings regarding the changes over time support this claim about the importance of political and public communication as the negative effect of privacy concerns on use behavior significantly decreased over time. This could be explained by a decline in the aforementioned negative media coverage.

CRediT authorship contribution statement

David Harborth: Conceptualization, Methodology, Data curation, Formal analysis, Writing – original draft, Investigation, Supervision, Funding acquisition. Sebastian Pape: Formal analysis, Writing – review & editing, Funding acquisition.

Declaration of Competing Interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

Biographies

Dr. David Harborth is a Senior Consultant in the Digital Trust and Security Team at Capgemini Invent. Prior to working at Capgemini Invent, he was a postdoctoral researcher at the Chair of Mobile Business and Multilateral Security at Goethe University Frankfurt, Frankfurt am Main, Germany. He received his PhD in information systems (business informatics) in 2021 with the grade summa cum laude. From January to March 2020 he joined the Usable Security and Privacy Group at the International Computer Science Institute (ICSI) and the Berkeley Laboratory for Usable and Experimental Security (BLUES) as a visiting researcher. He published his research in outlets like the International Conference on Information Systems, IEEE International Symposium on Mixed and Augmented Reality, Proceedings on Privacy Enhancing Technologies Symposium or Behaviour & Information Technology.

Dr. Sebastian Pape is a Security & Privacy Manager at Continental. Prior to this, he was a senior researcher working at the Chair of Mobile Business & Multilateral Security at Goethe University Frankfurt. He successfully completed diplomas in mathematics (Dipl.-Math.) and computer science (Dipl.-Inform.) at Darmstadt University of Technology and holds a doctoral degree (Dr. rer. nat.) from the University of Kassel. From 2005 to 2011, he worked as research and teaching assistant at the Database Group (lead by Prof. Dr. Lutz Wegner) at the University of Kassel. From 2011 to 2015, he was a senior researcher and teaching assistant at the Software Engineering for Critical Systems Group (lead by Prof. Dr. Jan Jürjens) at TU Dortmund University. From October 2014 to January 2015, he was a visiting researcher (of Prof. Dr. Fabio Massacci) at the security group at the University of Trento. From October 2018 to August 2019 he was standing in as a professor for business informatics at Regensburg University.

Appendix A. Questionnaire

Demographics

• AGE in years

• EDU Education (no degree, secondary school, secondary school (>5 GCSE), A levels, bachelor, master, doctorate)

• GDR Gender (female, male, divers, prefer not to say)

• INCOME of household (in € : 0.5k-1k, 1k-2k, 2k-3k, 3k-4k, >4k, prefer not to say)

• Smartphone Experience in years

• Mobile OS Experience in years

• USE Corona-Warn-App user (yes/no)

Privacy concerns related to the Corona-Warn-App1

• PC1 I think the Corona-Warn-App over-collects my personal information.

• PC2 I worry that the Corona-Warn-App leaks my personal information to third-parties.

• PC3 I am concerned that the Corona-Warn-App violates my privacy.

• PC4 I am concerned that the Corona-Warn-App misuses my personal information.

• PC5 I think that the Corona-Warn-App collects my location data.

Perceived benefits of the Corona-Warn-App${}^2$

• PB1 Using the Corona-Warn-App makes me feel safer.

• PB2 I have a lot to gain by using the Corona-Warn-App.

• PB3 The Corona-Warn-App can help me to identify contacts to infected individuals.

• PB4 If I use the Corona-Warn-App I am able to warn others in case I am infected with Covid-19.

• PB5 The spreading of Covid-19 in Germany can be decelerated by using the Corona-Warn-App.

Trust in the German healthcare system${}^3$

• TRUST1 The German healthcare system is trustworthy.

• TRUST2 The players acting in the German healthcare system are trustworthy.

• TRUST3 The German healthcare system can cope with the burden of Covid 19 infections.

Appendix B. Additional Tables

Table B.7.

Participants’ characteristics for age, gender, income and education .

Demographics	N	%
Age
18-29 years	371	21.17%
30-39 years	316	18.04%
40-49 years	329	18.78%
50-59 years	431	24.60%
60 years and older	305	17.41%
Net income
500€ - 1000€	160	9.13%
1000€ - 2000€	402	22.95%
2000€ - 3000€	404	23.06%
3000€ - 4000€	314	17.92%
More than 4000€	292	16.67%
Prefer not to say	180	10.27%
Demographics		N	%
Gender
	Female	894	51.03%
	Males	853	48.69%
	Diverse	4	0.23%
	Prefer not to say	1	0.06%
Education
1	No degree	8	0.46%
2	Secondary school	187	10.67%
3	Secondary school+	574	32.76%
4	A levels	430	24.54%
5	Bachelor’s degree	240	13.70%
6	Master’s degree	285	16.27%
7	Doctorate	28	1.60%

⁺5 GCSEs at grade C and above