Individuals’ privacy concerns and adoption of contact tracing mobile applications in a pandemic: A situational privacy calculus perspective

Abstract

Objective

The study sought to develop and empirically validate an integrative situational privacy calculus model for explaining potential users’ privacy concerns and intention to install a contact tracing mobile application (CTMA).

Materials and Methods

A survey instrument was developed based on the extant literature in 2 research streams of technology adoption and privacy calculus. Survey participants (N = 853) were recruited from all 50 U.S. states. Partial least squares structural equation modeling was used to validate and test the model.

Results

Individuals’ intention to install a CTMA is influenced by their risk beliefs, perceived individual and societal benefits to public health, privacy concerns, privacy protection initiatives (legal and technical protection), and technology features (anonymity and use of less sensitive data). We found only indirect relationships between trust in public health authorities and intention to install CTMA. Sex, education, media exposure, and past invasion of privacy did not have a significant relationship either, but interestingly, older people were slightly more inclined than younger people to install a CTMA.

Discussion

Our survey results confirm the initial concerns about the potentially low adoption rates of CTMA. Our model provides public health agencies with a validated list of factors influencing individuals’ privacy concerns and beliefs, enabling them to systematically take actions to address these identified issues, and increase CTMA adoption.

Conclusions

Developing CTMAs and increasing their adoption is an ongoing challenge for public health systems and policymakers. This research provides an evidence-based and situation-specific model for a better understanding of this theoretically and pragmatically important phenomenon.

INTRODUCTION

The nature and scale of the coronavirus disease 2019 (COVID-19) pandemic make digital tracing necessary for the mitigation of one of the most widespread and deadly pandemics the world has ever seen. Between April and June 2020, several countries, including Australia, India, and the United Kingdom, rolled out official contact tracing mobile applications (CTMAs). There are also other countries, most notably Brazil and the USA, as well as several technology vendors, including Google and Apple in a joint effort, that have expressed their intentions to release COVID-19 contact tracing technologies.¹ As an example of the critical applications of public health informatics in the system response to COVID-19,² the purpose of a CTMA is to automate the laborious process of contact tracing, in which public health authorities (PHAs) seek to control the spread of COVID-19 by identifying people who have been in contact with an infected person and then providing users with information regarding testing and self-quarantine. CTMAs can provide healthcare workers and government officials with data necessary not only to flatten the curve of infections and hospitalizations, but to also understand the spread of the virus—an important insight for mitigating future viral outbreaks. Nevertheless, it is not clear how well adopted the CTMAs will be.

Given the recent privacy-loss events involving mobile apps and geolocation services,³ privacy advocates have elevated their message, including warning citizens about the dangers associated with apps designed to aid in the fight against COVID-19.^4,5 These warnings, combined with the general desire for privacy shared by most mobile users, jeopardize the efficacy of CTMAs—but how, and to what extent? Convincing individuals to participate and install these applications is a hurdle for PHAs and tech providers (eg, Apple, Google). Individuals must install one of these applications to become part of the system. Computer modeling by the University of Oxford showed that a CTMA could be effective in combating the spread of COVID-19, if nearly 60% of the population installed and used it (Wright, 2020⁶). However, many individuals may not adopt the applications because of privacy concerns - Singapore's contact tracing app was reportedly adopted by only 10%-20% of the population,⁷ and despite the initial enthusiasm and 40% download target, as of June 2020, the COVIDSafe app had been adopted only by around 25% of Australians.⁸ Low adoption rates will inevitably erode the value of the system.⁹

Extensive research has been conducted on the adoption of information technologies (ITs), and various influencing factors have been investigated in this decision process.^10,11 Researchers have examined individuals’ attitudes, beliefs, perceptions, effort and performance expectancies, and social influence related to adoption in various healthcare contexts.^12–14 However, despite their importance, especially in the context of public health systems, the role of privacy concerns and perceived benefits (shared societal and individual benefits) have not received enough empirical attention in this research stream. This study aims to extend the existing literature and theoretical frameworks of information privacy in IT adoption by exploring the role of technological, legal, and social factors that affect privacy concerns, and perceptions of risks and benefits in the context of CTMA adoption. More specifically, we ask the following questions:

• Research Question 1: Do the perceived benefits (individual or societal benefits) that come from using CTMA alleviate individuals’ concerns regarding the risk of using these apps?

• Research Question 2: Do individuals’ information privacy concerns and their trust (or lack thereof) in PHAs influence their intention to install contact tracing apps?

• Research Question 3: Do technology features (sensitivity of collected information, and anonymity options) and privacy protection initiatives (technical and legal privacy protection measures) affect individuals’ adoption decisions?

This study aims to answer these research questions by leveraging elements of situational privacy calculus theory and incorporating appropriate constructs and measures relevant to an individual's perspective when assessing potential CTMA installation.

SITUATIONAL PRIVACY CALCULUS

This privacy-related decision-making process is referred to as a privacy calculus¹⁵ and has been studied extensively across a number of contexts, including mobile applications,¹⁶ health care,^15,17 and e-commerce.¹⁸ The privacy calculus perspective argues that individuals deliberately anticipate and weigh the privacy-related risks and benefits of information disclosure when they are faced with a situation that needs the provision of private information.^19–21 Within this literature, the conventional thought is that the privacy calculus is relatively stable, with similar risk–reward circumstances leading to similar privacy-related decision-making outcomes. However, more recently, the consensus among scholars is that privacy is situational and varies significantly from situation to situation.²² Given the unprecedented circumstances presented by the COVID-19 pandemic, we believe that the contemporary, situational privacy calculus perspective is most appropriate for our study.

Based on this background, we apply and contextualize privacy calculus theory to understand the situational trade-off between privacy-related risks and benefits in the important and unique context of CTMA installation (related to COVID-19) and its potential shared benefits toward public health, thereby strengthening and contributing to our theoretical understanding of the privacy calculus’ nomological network. A list of previous studies on privacy calculus centering on privacy concerns is presented in Supplementary Table 1.

Table 1.

Demographic information of participants

Demographic information		Frequency	Percentage
Gender	Female	547	63.9
	Male	306	35.7
	Rather not say	3	0.4
Age	18-34 y	86	10
	25–34 y	116	13.6
	35–44 y	187	21.8
	45–54 y	141	16.5
	55–64 y	182	21.3
	≥65 y	144	16.8
Education	Some school, no degree	32	3.7
	High school graduate	179	20.9
	Some college, no degree	283	33.1
	Bachelor’s degree	261	30.5
	Master’s degree	60	7
	Professional degree	31	3.6
	Doctorate degree	10	1.2
State (we report on only the top 10 U.S. states in terms of frequency)	Florida	87	10.2
	California	66	7.7
	New York	61	7.1
	Texas	59	6.9
	Ohio	44	5.1
	Pennsylvania	43	5
	North Carolina	41	4.8
	New Jersey	30	3.5
	Georgia	27	3.2
	Virginia	27	3.2

RESEARCH MODEL AND HYPOTHESES DEVELOPMENT

Our research model (Figure 1) is based on the privacy calculus theory, which suggests that both perceived benefits and potential risks affect individual decisions. We complement this model by incorporating a large body of research on the adoption and use of technology—see Burton-Jones, Stein¹⁰ for a review. Moreover, in line with calls for a paradigm shift in this stream,^11,23 we explicitly focus on contextualized theories and digital technology features to explain IT adoption.

Figure 1.

Proposed research model.

In the CTMA context, measuring behavioral intention, as a proxy for actual behavior, is justified²⁴ because of the very limited rollout of CTMA in most of the countries. Populations in these countries have not yet faced the decision of whether to install a CTMA; therefore, one cannot yet identify their actual behavior about using a CTMA. In the following subsections, the research hypotheses are constructed around different theoretically and practically important constructs that directly or indirectly affect behavioral intention to install a CTMA.

Privacy calculus

In the privacy calculus theory, perceived privacy risk is the degree to which individuals believe there is a potential for loss associated with the release of personal information.^19,21 The other construct, perceived benefit, encompasses a wide range of financial and nonfinancial rewards in return for personal information.²⁵ Based on this distinction, we modeled perceived benefits as a second-order construct comprising individual benefits (eg, improving one’s living and working efficiency and effectiveness) and societal benefits (eg, protecting the public health and lifting the restrictions on economic activities). In the context of CTMA, we expect these 2 types of benefits to be in alignment. The main source of conflict, however, is the trade-off between these benefits and CTMA privacy risks, such as government surveillance and misuse of personal data. This trade-off is the main determinant of the willingness or intent to provide personal information through a CTMA. Thus, following the well-established privacy calculus model, we hypothesize the following:

Hypothesis 1: Risk beliefs negatively influence individuals’ intention to install CTMA.

Hypothesis 2: Perceived benefits positively influence individuals’ intention to install CTMA.

Risk determinants

We define CTMA privacy concerns as individuals’ perceptions of the consequences of sharing information through a CTMA.¹⁹ Based on Malhotra et al’s²¹ model, privacy concerns impact trust and risk, which, in turn, shape the tendency to share personal information.²⁴ In the CTMA context, trusting beliefs refer to the degree to which individuals believe that the PHA releasing and controlling a CTMA is reliable in guarding their personal information collected through a CTMA.^26,27 Similarly, we define risk beliefs as perceptions that the release of personal information on a CTMA will expose it to potential data loss or misuse.²⁸ Drawing on this framework, we model CTMA information privacy concerns as having a positive effect on risk beliefs and a negative effect on trusting beliefs. Additionally, as individuals perceive a PHA controlling a CTMA as being trustworthy with their data, their beliefs about the risk associated with sharing contact tracing data with that PHA will dissipate. Finally, previous studies have shown that trusting beliefs directly affect behavioral intention to adopt technology.²⁹ Hence, we expect that the more individuals trust the PHA with their contact tracing data collected through a CTMA, the more likely they will be to adopt the app. Thus, we hypothesize the following:

Hypothesis 3: Information privacy concerns negatively influence individuals’ trusting beliefs.

Hypothesis 4: Information privacy concerns positively influence individuals’ risk beliefs.

Hypothesis 5: Trusting beliefs negatively influence individuals’ risk beliefs.

Hypothesis 6: Trusting beliefs positively influence individuals’ intention to install CTMA.

Privacy protection initiatives

We have integrated the most pertinent factors shown to influence the perception of trust, and proposed that trusting beliefs of individuals are a function of expected outcomes of privacy protection initiatives, namely legal influences (regulatory expectations), and privacy protections. Trust is an important aspect in any relationship, in which the trustors cannot directly control the actions of the trustees (eg, PHAs), and as a result, there will be potential negative consequences if a party fails to deliver its promises.³⁰ Therefore, it is critical to investigate the determinants of trustors’ beliefs.³¹

The regulatory affairs enforce the type of personal information that firms are allowed to collect from individuals, as well as the methods that stored personal information would be protected against misuse.³² In a similar vein, privacy protection consists of technical practices and solutions that aim to protect online privacy.³³ Such privacy protection tools include privacy policy statements and the provision of privacy-enhancing mechanisms.³⁴ Trust can only exist if an individual believes that the trustees have the ability and initiatives to fulfill the promised services at the expected quality.³¹ In the context of CTMA, if individuals believe that the trustees (PHAs) have appropriate protection privacy practices, as well as compliance with privacy regulations, they are more likely to trust in PHAs, in order to share their personal information. Thus, we hypothesize the following:

Hypothesis 7: Regulatory expectations positively affect CTMA individuals’ trusting beliefs.

Hypothesis 8: Privacy protection positively affects CTMA individuals’ trusting beliefs.

Technology features

We focus on 2 technology design choices, anonymity and information sensitivity, with impacts CTMA users’ privacy concerns. Anonymity is defined as the ability to conceal an individual’s real identity.³⁵ Anonymity, typically determined by technology features,³⁶ can lead to less fear of social disapproval, surveillance, and evaluation.^25,37 Similarly, in the context of a CTMA, we expect that if individuals believe they can interact with the system anonymously, they will have less concern for privacy.

The second technology feature in our model is the use of sensitive information in a CTMA. We adopt Dinev et al’s³⁵ definition of information sensitivity as a personal information attribute that informs the level of discomfort an individual perceives when disclosing specific personal information to a specific external agent (ie, a CTMA). In general, sharing more sensitive information with mobile apps causes individuals to be more concerned, because if the shared information is disclosed to third parties, they must deal with potentially harmful consequences (eg, identity theft).³⁵ For example. when a mobile app requests access to the device’s GPS location, individuals pay more attention before granting such permission.^38,39 Given the importance of anonymity and information sensitivity features, in Google and Apple’s proposed contact tracing technology, users maintain full anonymity and do not need to register their personal information. Also, most of the proposed CTMAs use less sensitive (Bluetooth) proximity data as opposed to more sensitive (GPS location) data, despite the arguably higher precision and effectiveness of location data for contact tracing. Hence, we hypothesize:

Hypothesis 9: Anonymity negatively influences information privacy concerns.

Hypothesis 10: Information sensitivity positively influences information privacy concerns.

Technology adoption

In addition to privacy-related factors, we included in our model a set of constructs found to be powerful predictors of behavioral intention to adopt a technology. Performance expectancy is measured in our proposed situated privacy calculus model using the contextualized perceived benefits construct. Next, in line with Wang and Benbasat,⁴⁰effort expectancy is labeled as perceived effort and the latter’s measures are adapted. Given the importance of voluntariness of the adoption (vs. an adoption mandated by the government or workplace), we followed Moore & Benbasat’s⁴¹ seminal study and included voluntariness as a predictor of behavioral intention to install a CTMA. We also include social influence because, in situations that involve potentially adopting an emerging technology, consumers often rely on mimetic behavior and word of mouth to inform their decisions about whether to do so.^42,43 Finally, based on the context (experimenting with mobile apps), we included personal innovativeness with IT.⁴⁴ Hence, based on the extant body of literature, we hypothesize:

Hypothesis 11: Social influence positively influences individuals’ intention to install CTMA.

Hypothesis 12: Personal innovativeness positively influences individuals’ intention to install CTMA.

Hypothesis 13: Perceived effort negatively influences individuals’ intention to install CTMA.

Hypothesis 14: Voluntariness negatively influences individuals’ intention to install CTMA.

RESEARCH DESIGN

To the research model (Figure 1) and its hypothesized relationships, we conducted a field survey of the U.S. citizens who may or may not choose to install a CTMA on their smartphones. The respondents were provided with general information on how CTMAs work along with a schematic representation. The survey was distributed via Qualtrics, resulting in 1528 responses, of which 856 responses remained after a few filtering questions ensuring participants had not already installed a CTMA on their smartphones, an attention check, and the removal of incomplete responses.

We developed the survey using previously validated measurement items that were operationalized with multiitem scales. A 7-point Likert scale with anchors ranging from 1 (strongly disagree) to 7 (strongly agree) was used to measure all of these key constructs. All the constructs of the measurement model were first-order reflective constructs with the exception of privacy concerns and benefits, which were treated as reflective second-order constructs. Measurement items included a few reverse-coded items to address the negative/positive connotation and associated bias. A pretest and pilot study were conducted to examine the appropriateness of the survey scales on a sample of 45 individuals. Participant recruitment was achieved by utilizing the services of a market research company—a professional panel service—that directed respondent panel members to our web-based survey. The data were collected in the U.S. between May 4 and 7, 2020. The resulting measurement items are presented in Supplementary Table 2.

DATA ANALYSIS AND RESULTS

We used partial least squares structural equation modeling (PLS-SEM) through SmartPLS 3.0 software (SmartPLS, Palo Alto, CA) to assess the research model from a predictive perspective and used the latent variable scores in a follow-up analysis.⁴⁵PLS-SEM is an appropriate approach for large complex models with many latent variables.⁴⁶ This study followed the state-of-the-art guidelines proposed by Hair et al⁴⁵ to assess measurement and structural models. The demographic descriptions of our sample of 853 individuals across 50 U.S. states are provided in Table 1.

Given the pragmatic importance of the dependent variable in this study, we report a histogram of the respondent’s intention to install a CTMA. As evident in Figure 2, a large proportion (35%) of our sample expressed extremely low or very low levels of behavioral intention to install a CTMA.

Figure 2.

Histogram of the respondent’s intention to install a contact tracing mobile application (CTMA).

Measurement model assessment

The reliability and validity of the measurement model were tested through the evaluation of loadings, internal consistency, convergent validity, and discriminant validity.⁴⁵ According to Hair et al,⁴⁵ all the items reported a loading greater than 0.708 except VOLU2 and SOINF1, which were subsequently removed from the measurement model. The assessment of internal consistency and convergent validity is presented in Table 2.

Table 2.

Convergent validity testing

Construct	Item	Standard loading of each item	Cronbach's alpha (α)	Composite reliability	Average variance extracted
Anonymity	ANON1	0.875	0.927	0.953	0.871
	ANON2	0.963
	ANON3	0.958
Awareness	AWAR1	0.916	0.917	0.947	0.857
	AWAR2	0.934
	AWAR3	0.927
Collection	COLL1	0.909	0.945	0.961	0.860
	COLL2	0.904
	COLL3	0.954
	COLL4	0.940
Control	CONT1	0.787	0.761	0.857	0.666
	CONT2	0.820
	CONT3	0.840
Information sensitivity	SENS1	0.887	0.877	0.924	0.802
	SENS2	0.917
	SENS3	0.883
Intention to install a CTMA	INT1	0.975	0.981	0.986	0.946
	INT2	0.982
	INT3	0.982
	INT4_R	0.951
Perceived effort	PEFF1	0.940	0.939	0.961	0.891
	PEFF2	0.959
	PEFF3	0.932
Personal innovativeness	INNO1	0.862	0.841	0.901	0.752
	INNO2	0.840
	INNO3	0.899
Privacy protection	PRIP1	0.856	0.910	0.931	0.711
	PRIP2	0.944
	PRIP3	0.813
	PRIP4	0.894
Regulatory expectations	REGU1	0.902	0.878	0.924	0.803
	REGU2	0.877
	REGU3	0.908
Risk beliefs	RISK1	0.937	0.962	0.971	0.868
	RISK2	0.926
	RISK3	0.947
	RISK4	0.930
	RISK5_R	0.919
Social influence	SOINF1	0.569	0.891a	0.933	0.822
	SOINF2	0.928
	SOINF3	0.842
	SOINF4	0.929
Societal benefits	SOCB1	0.948	0.967	0.977	0.914
	SOCB2	0.957
	SOCB3	0.964
	SOCB4	0.954
Trusting beliefs	TRUS1	0.910	0.956	0.966	0.850
	TRUS2	0.937
	TRUS3	0.932
	TRUS4	0.904
	TRUS5	0.925
Utilitarian benefits	UTIB1	0.903	0.937	0.953	0.801
	UTIB2	0.925
	UTIB3	0.923
	UTIB4	0.819
	UTIB5	0.900
Voluntariness	VOLU1	0.643	0.838	0.863	0.681
	VOLU2	0.731
	VOLU3	0.976
	VOLU4_R	0.706

For internal consistency, the values of Cronbach’s alpha and composite reliability should be between 0.7 and 0.95. The evaluation of these estimates indicated that all of the constructs were within acceptable thresholds. Convergent validity can be assessed through the evaluation of average variance extracted values that should be above 0.5 for each composite.⁴⁵

^aCronbach’s α, composite reliability, and average variance extracted were calculated after removing SOINF1 and VOLU1.

CTMA: contact tracing mobile application.

Discriminant validity was tested based on the newly introduced criterion for establishing discriminant validity in PLS-SEM known as the heterotrait-monotrait criterion.⁴⁵Cross-loadings of the items and heterotrait-monotrait_0.85 tables are provided in Supplementary Tables 3, 4 and 5.

Structural model assessment and hypothesis

Structural model evaluation includes evaluating collinearity among the exogenous constructs, examining the significance and relevance of path coefficients, and checking the model’s predictive accuracy and relevance model.⁴⁵ The results of the structural model's evaluation are presented in Figure 3.

Figure 3.

Structural model results. *P < .05, **P < .01, and ***P < .001. n.s: not significant.

All hypotheses were supported, except for hypothesis 6, on the positive association between individuals’ trusting beliefs and their intention to install a CTMA (path coefficient [β] = 0.052, P = .113). In terms of the explained variance provided by the research model, the privacy-related constructs (trust beliefs, risk beliefs, and benefits) and non–privacy-related constructs (personal innovativeness, voluntariness, perceived effort, and social influence) were able to explain 75% of the variance in individuals’ intention to install a CTMA. The predictive relevance (Q²) of intention to install a CTMA was obtained using a 2-stage approach with a value of 0.755, confirming the model had predictive relevance.⁴⁷ Overall, our extended model demonstrates strong explanatory power by explaining 75% of the variance in behavioral intention. It compares well with similar studies in other contexts. For example, Lazard et al’s¹³ and Or et al’s⁴⁸ models explained 41% and 53.9% of the variance in behavioral intention to use patient portals and web-based self-management technologies, respectively.

Five control variables, namely age, sex, education, media exposure, and past invasion of privacy, were tested. Individuals’ age had a positive significant relationship with their intention (β = 0.036, P < .05), indicating that older people are more inclined than younger people to install a CTMA. The remaining control variables had no significant relationships with the intention to install a CTMA. To reduce the potential for common method bias, we followed procedural guidelines established in the literature that are presented in Supplementary Table 5.

Post hoc analysis

We conducted multigroup analysis on age and sex to detect any significant differences in path coefficients of hypothesized relationships. The parametric test results indicate that there are significant differences in relationships between privacy concerns, trusting beliefs, and risk beliefs, as well as the relationship between voluntariness and intention among female and male groups. Findings indicate that female respondents are more worried about their privacy. In addition, the findings reveal the significant differences in relationships between anonymity and privacy concerns, as well as risk beliefs, voluntariness, and intention to install a CTMA among younger and older respondents. The younger respondents are more concerned about their anonymity and voluntariness rights regarding CTMA installation. The results of post hoc analysis are presented in Supplementary Table 6.

DISCUSSION

Toward understanding the situational privacy calculus that individuals associate with the adoption of CTMAs in the fight to control the COVID-19 pandemic, we extended the existing privacy calculus models and found a range of individual, legal, and societal factors that carried weight. To the best of our knowledge, the previous studies^21,22,49,50 have not investigated the individual, legal, and social factors affecting individuals’ intentions in an integrated framework. In terms of how the perceived benefits associated with CTMAs could help in limiting any risk potential adopters may also associate with the apps, we found that they had a significant mitigating impact. Previous researchers^22,49 have also discussed the situational trade-off of privacy-related risks and benefits and reported the significant role of perceived benefits in individuals’ disclosure intention. This is likely the least surprising finding of this study in that it is consistent with the tenants of privacy calculus^49–51 yet it still tells us a lot about the situational thought process of CTMA adopters amid the COVID-19 pandemic. In this situation, there are clearly privacy risks being associated with the CTMAs, but their benefits are also clear and serve as a distinct motivation for intentions to install the CTMAs.

Interestingly, trust in PHAs was a significant factor in shaping the intentions of potential CTMA adopters to install the apps, but its influence was limited to the extent to which it was able to reduce the risks associated with the CTMAs. This tells us that PHAs have limits to what they can effectively promote. Constituents of PHAs are perhaps conditioned to expect information concerning their well-being and use it to help gauge their unique risk–benefit perspectives. This finding is in line with the findings of previous studies from various contexts that show that individuals’ trusting beliefs play a critical role in shaping their risk beliefs.^21,24,52 However, our findings suggest that PHAs should develop trust among their constituents, not to motivate CTMA adoption, but rather to aid in the reduction of risk that they may associate with the apps. Any intentions for CTMA installation that individuals gain for the apps will be formed as an indirect consequence of such risk reduction.

This study’s findings also suggest that the information privacy concerns and trusting beliefs potential CTMA adopters have in their PHAs are direct products of the technology features of the CTMAs and the privacy protection initiatives of the authorities, respectively. In terms of trusting beliefs, the strongest influence was from perceptions of privacy protection. Similar to the findings of previous research,^21,24,52 we found that as an individual’s feeling that their privacy will be protected increases, so too does their trust in the PHA’s ability to handle their sensitive personal data. This likely helps explain why information sensitivity was by far the most important determinant of information privacy concerns. As the sensitivity of the information provided to a CTMA increases, so too does a potential CTMA adopter’s concern for its privacy. It has also been widely recognized in the literature that the type of information collected and used by third parties affects the level of individuals’ perceived discomfort and privacy concerns.^21,34,35,50 Perhaps most interesting is the direct positive influence that regulatory expectations had on trusting beliefs. Prior research has also suggested that the implementation of privacy regulations helps to directly or indirectly increase individuals’ trust and reduce their privacy concerns.^34,35

IMPLICATIONS FOR RESEARCH AND PRACTICE

This research contributes to our understanding of determinants of privacy in crisis-driven situations, such as the current COVID-19 pandemic. Opportunities to explore and test models specific to privacy calculi in times of dire circumstances are rare, and this study provides a unique, timely perspective for understanding privacy as a situation-specific phenomenon; a perspective that has not yet been fully embraced within the academic community. Indeed, rather than approaching privacy as a stable, global concern, our findings point to a more specific, situational calculus that encompasses the influence of an individual, legal, and societal nature.

In times of crisis, we find an IT adoption privacy calculus that is focused on the agencies that seek to provide guidance and support for the public well-being through their recommendations for the adoption of a particular technology; yet, within this calculus, a premium is placed on how well the agencies are able to alleviate the risks associated with their adoption recommendations. The implications of this to researchers are that the technological features of a tool designed for public consumption are as important as ever, but how the public agencies that promote its use are able to gain the trust of their constituents is paramount to its adoption. Scholars should, therefore, extend their focus to include environmental factors, such as social influence, regulatory pressures, and previous experiences with privacy loss that underlie the technology adoption and appropriately weigh their influence.

The findings of this study also contribute to explaining the range of individuals’ decisions in adopting CTMA. These decisions result mainly in shared public health benefits rather than individual benefits. The findings of this study also provide public health agencies with a validated list of factors influencing individuals’ privacy concerns and beliefs, enabling them to systematically take action to address these identified issues. For example, our results confirmed the importance of regulatory protection expectations by individuals in shaping their CTMA adoption decision. This finding reaffirms the importance of the recently proposed U.S. bill to regulate CTMA to protect privacy.⁵³ A similar law was also passed in Australia, where strict penalties of up to 5 years of jail are established for those who collect, use, disclose, or decrypt CTMA data for any purpose other than contact tracing.

CONCLUSIONS, LIMITATIONS AND FUTURE RESEARCH

In this study, we contextualized and validated privacy calculus theory in the context of an adoption decision of an emerging technology (CTMA) that presents unique privacy concerns to individuals in a pandemic. Our model provided an empirical analysis of the role of technology features, privacy protection initiatives, privacy concerns, risk beliefs, and individual and shared benefits in bringing about individuals’ intention to install a CTMA. The results of this study provide strong support for the influence of risk beliefs and benefits on individuals’ intention to install a CTMA but not a strong support for a direct impact of trust beliefs on individuals’ intention.

A limitation of this research is its orientation at a single point in time. Owing to the progressive nature of the COVID-19 pandemic and our interest in conducting this research at the time of the introduction of COVID-19 CTMAs, we were not able to test how the progression of a treatment or vaccine would influence the adoption intentions or if the adoption decisions are market-driven. As the global and local economies start to recover, would people be more or less inclined to adopt CTMAs, and what economic factors would they look to in helping form that decision? These are all time-related insights that this study was unable to pursue but that future researchers should consider. The World Health Organization has referred to contact tracing as “the backbone of the response.”⁵⁴ The adoption of CTMAs is no silver bullet to defeat COVID-19 but can have consequential importance in a country's public health response along with measures such as testing and isolating.⁵⁵

AUTHOR CONTRIBUTIONS

FH conceived of and designed the project and was responsible for data acquisition, analysis, interpretation, and writing. SA contributed to model development, research design, data acquisition, writing, and editing. ACJ made contributions to theoretical development, data interpretation, contribution writing, and editing. All authors made substantial contributions to the revision and gave approval for the final version of the manuscript to be published and agree to be accountable for all aspects of the work in ensuring that questions related to the accuracy or integrity of any part of the work are appropriately investigated and resolved.

SUPPLEMENTARY MATERIAL

Supplementary material is available at Journal of the American Medical Informatics Association online.

CONFLICT OF INTEREST STATEMENT

The authors have no competing interests to declare.