Investigation on users’ resistance intention to facial recognition payment: a perspective of privacy

Abstract

Despite the convenience of facial recognition payment (FRP), many consumers hesitate to use FRP. Drawing on the antecedent-privacy concern-outcome (APCO) macro model, this study investigates antecedents of privacy concerns and privacy fatigue in the context of FRP and how privacy concerns and privacy fatigue influence user’s resistance intention of FRP. A mixed-methods is used to address these issues. A semi-structured interview is first used to identify the antecedents of privacy concerns and privacy fatigue for facial privacy information. According to the research results, we develop research hypotheses and build the research model. By analyzing survey data from 394 respondents using Amos, this study finds that privacy experience, privacy control, privacy policy effectiveness, peer influence, and reputation significantly influence users’ privacy concerns for facial privacy information; in addition, privacy experience, privacy control, and negative media exposure significantly influence users’ privacy fatigue. Moreover, privacy concerns and privacy fatigue are significantly related to users’ resistance intention to FRP.

Introduction

With the rapid development of information technology, the payment methods are becoming increasingly diversified. Some new payment methods have emerged, such as fingerprint payment and facial recognition payment (FRP) [1]. Over past few years, FRP has become one of the most popular payment methods among Chinese people due to its convenience and efficiency [2]. Unlike other payment methods, people can complete payment only through facial recognition. Consumers can pay for products or services even if their phones are turned off. However, the number of FRP users is not as high as expected. Iimedia [3] reported that the number of FRP users was 61 million in 2018. This is partly because people may also be confronted with serious threats to their privacy facial information which service providers ask them to provide [4]. For instances, the BBC has reported that a law professor at Tsinghua University, resisted providing her facial privacy information for facial recognition, saying it would cause serious consequences if the information was leaked1. Additionally, Xinhua News Agency reported that some online black industry practitioners resold illegally obtained facial identity information and “photo activation” online tools on e-commerce platforms, which also brought trouble to the users of FRP.2 Moreover, several cities, including San Francisco, Orlando and Somerville, have banned facial recognition technology to prevent misuse of personal facial information.3 Privacy issues have been one of the biggest obstacles to the spread of FRP.

It is common that facial information is one of the most important biological information and is an important part of identity authentication [5]. When your facial information is accessed by other people or organizations, they can easily know your age [6], gender [7], and appearance. Since payment information is bound to facial information, the leakage of facial information may also lead to property loss. But when people are using FRP, the service provider can legally access and store the users’ facial privacy information for free [8]. Although some large FRP service providers have made a commitment to privacy protection, there were still some contingencies of information leakage caused by wrong operation or illegal operation [9]. As many people worry about privacy leaks, they may refuse to provide their facial information. Meanwhile, constantly being asked for access and dealing with privacy-related issues may make people feel exhausted and powerless because of the lack of proper management of their privacy information [10]. Therefore, they are more likely to refuse to use FRP to avoid being frequently asked for facial privacy information.

Against this background, a question needed to be explored is why consumers are reluctant to use FRP. Based on the existing literature, we identify two key factors to influence consumers’ intention to use FRP, privacy concerns and privacy fatigue [11]. Privacy concerns refer to people’s fear of the adverse consequences due to the misuse of their private information [9, 12]. It has been confirmed to affect consumers’ intention to disclose information across various contexts [13–15]. Additionally, privacy fatigue refers to the fact that consumers are bored and tired of privacy-related information [16], which is seen as an additional influential factor of the intention to use FRP. In the age of Internet, we often hear about privacy-related issues. The deluge of privacy issues in the news and frequent requests for privacy permissions can be annoying. Consequently, privacy fatigue may be an important factor influencing consumers’ intention to disclose facial information [10]. Although FRP has gained popularity in recent years, research on facial privacy in this context is still limited. Even though a recent study has explained the impact of privacy concerns and perceived risk on users’ resistance intention to FRP [2], we have no idea of domain-specific antecedents of privacy concern. To address the research gaps, this study employs antecedent-privacy concern-outcome (APCO) macro model [12] as the theoretical lens to investigate privacy concern and privacy fatigue in the context of FRP. Two research questions are as follows:

RQ1: What factors influence privacy fatigue and privacy concerns of user’s facial information?

RQ2: How do antecedents influence privacy fatigue and privacy concerns, and subsequently influence user’s response to facial recognition payment?

Our study is grounded on APCO model that indicates the relationship among antecedents, privacy concerns and users’ resistance intention [12]. A mixed-methods is used to answer the above research questions [17, 18]. To answers RQ1, we conduct a qualitative study to explore the antecedents of facial privacy concerns and privacy fatigue in the FRP setting and then build our research model. To answer RQ2, we conduct a quantitative study to empirically test research hypotheses.

This study makes theoretical contributions to the research on facial information privacy. First, our work enriches existing studies on privacy issues by identifying domain-specific antecedents of privacy concerns and privacy fatigue in the context of FRP from three levels, i.e., society, individual and organization level. Second, this study extends APCO model to the context of FRP and adding privacy fatigue to the APCO macro model. Third, a mixed-methods is used in this study, which offers a new insight for future empirical research.

The rest of this study is organized as follows. First, we discuss the literature review on FRP, information privacy and APCO model. Then we present our research methods, data analysis and results analysis. Finally, this study is concluded with theoretical and practical implications, limitations, and suggestions for future directions.

Literature Review

The literature review is divided into three parts. The first part will discuss the research related to facial recognition and FRP. The second part will define facial information privacy and review related works about information privacy. In the third part, we employ APCO model as the foundation of the research framework to explain the relationship among antecedents, facial privacy concerns, privacy fatigue and users’ resistance intention.

Facial recognition and FRP

Facial recognition technology has a long history. Galton [19] initially proposed that facial information could be used for personal identification [20]. In the last 30 years, research into automatic facial recognition technology has reached a climax. With the rapid development of facial recognition technology, it is increasingly used in the payment industry, and this phenomenon has attracted considerable attention from academic researchers. For instance, Morosan focused on hotel facial recognition systems and found that performance expectancy, trust in organization, and positive anticipated emotions influenced users’ intentions [21]. Gao developed econometric models to analysis usage of FRP, and found that the social presence and herd effect have a significant influence on consumers’ usage intention to FRP [22]. Moriuchi conducted an empirical study and found that consumers would rather use a biometric payment system in stores than online and self-efficacy has a moderating effect on users’ willingness to use [23]. Ciftci focused on costumers’ usage intention at quick-service restaurants and indicated that perceived performance expectancy, social influence, and trust in the system significantly and positively affect customer usage intention to FRP based on the unified theory of acceptance and use of technology (UTAUT) [24]. Existing studies advance our knowledge concerning FRP usage intention. However, research on why people resist to use FRP from the perspective of privacy concern is rather limited. Some studies just pointed out that FRP technology is at risk of revealing personal facial information, and raised questions about the protection of personal facial information [25]. As a result, people tend to refuse to use FRP. So, this study focuses on users’ resistance intention to FRP from the perspective of privacy protection.

Information privacy

Information privacy attracted increasing attentions from scholars [12, 26–28]. In the field of e-commerce, information privacy has become a hot topic. In the research about share-economy, Ursin focused on information privacy protection in data sharing time [29]. When it comes to e-government, Agozie investigated the relationship between privacy information transparence and privacy fatigue, and found that privacy information transparency has significant positive effect on both cynicism behavior and emotional exhaustion [30]. In the context of social media, James examined individuals’ perceptions of the risk which their online social networks activity caused to others’ information [31]. Yu found perceived risk and privacy concerns can influence people’s information disclosure intention based on Elaboration Likelihood Model (ELM) [32].

Privacy issues have become more prominent in the Internet age. Various private information like payment information, location information and facial information may be destroyed. Cellary explained why the methods that Visible Internet accepted to protect payment information privacy cannot be applied to Unseen Internet, and showed directions of possible solutions [33]. Krishen conducted a mixed-methods study to explore users’ perceived fairness to location information privacy when they use location-based services. And the study indicated that with higher internal locus of control, higher attitude toward the communication, and lower level of privacy concern, people will pay more attention to the fairness perceptions of privacy-related policies [34]. Xu extended the privacy calculus model and investigated the influence of compensation, industry self-regulation, and government regulation on individual privacy decision making in location-based services [35].

Privacy concerns have been proved to have a significant impact on people’s willingness and behavior such as reducing information disclosure or resistance [9, 10, 12]. Studies have shown that privacy concerns lead people to take a series of protective measures to deal with the possible consequences of privacy problems, for example, they may sue the company to protect their personal information, make negative comments on the company, or even refuse to use the service [13, 14, 36]. Privacy fatigue has the impact on user behavior through different ways. Frequent requests for privacy information and permissions can lead to weariness and exhaustion [10]. Unlike privacy concerns, studies have shown that fatigue prompts users to react negatively to privacy issues or cut off the service for staying away from privacy issues [37]. Therefore, a combination of privacy concerns and privacy fatigue may be the reason why individuals refuse to use services that require private information. It can be observed that most previous studies pay attentions to privacy information like ID number, home address, bank account, etc. The unique features of facial information may challenge these results from different contexts. In addition, the antecedents of both privacy concerns and privacy fatigue need to be explored further.

APCO macro model

The antecedent-privacy concern-outcome (APCO) macro model proposed by Smith provides a theoretical framework to explain the relationship between antecedents of privacy concerns, privacy concerns and outcome of privacy concerns [12]. In this model, antecedents of privacy concerns include privacy experience, privacy awareness, personality differences, demographic differences and culture/climate. And outcomes contain behavior, trust, regulation, risks/costs. This model is a mix of various disciplines [13], such as information system [14], human behavior [38, 39], marketing [40, 41]. Dienv improved the APCO model by adding level of effort, peripheral cues, biases, heuristics, misattribution to the influence on privacy calculus and behavioral reactions [42].

APCO model has been widely used in different research contexts to investigate privacy concern, such as social media and sharing-economy [12]. For example, Lakton investigated information privacy in social networks and found that privacy experience and gender have a significant influence on privacy concerns and privacy concerns, risk, benefit and enjoyment can affect users’ continuance intention [43]. Li employed APCO model to study information privacy in electric scooter sharing platforms and indicated that privacy experience, privacy awareness, usage regularity and geographic regularity can affect users’ privacy concerns for payment information and location information, and users’ privacy concerns finally have a positive effect on users’ information privacy protective response [13].

Method

The mixed-methods combines quantitative study and qualitative study, and can be used to investigate some phenomenon that qualitative or quantitative study alone can’t completely, reasonably, comprehensively explains [11, 17, 18, 44, 45]. The mixed-methods has the advantages of both qualitative and quantitative, and can provide richer and more reliable conclusions. [46]. Therefore, we employed a mixed-methods to explore facial information privacy in the FRP context. The qualitative study consists of interview, coding and results analysis, while the quantitative study tests the assumptions and model generated by qualitative analysis results [47]. Based on previous studies with mixed-methods, the process of this approach is shown in Fig. 1.

Fig. 1.

mixed-methods approach

Qualitative study

Qualitative study in our approach aims to deeply explore the antecedents of facial privacy concerns and privacy fatigue for modeling.

Data collection

The semi-structured interview method is used to collect data. Two researchers interviewed our participants. Each interview data was taped and converted into a transcript [48]. The interview of this approach is divided into three parts. In the first part, the interviewees introduce their basic information, including age, educational background and experience of using FRP. In the second part, the interviewees were asked about the factors influencing their facial privacy concerns and privacy fatigue. In the third part, we ask questions based on participants’ answers to supplement the interview materials [49].

We took a random sample of people who had used FRP. In order to ensure that the interview data is accurate, we asked them about their FRP experience during the interview. We transcribed each interview in real time and every interview was anonymous to avoid potential informant bias. Besides, according to Eisenhardt [50], all of researchers have been trained to react to responses for avoiding giving guidance to interviewees. In the end, we collected 22 interview data in total which was encoded A1-A22. Among them, there are 14 female respondents and 8 male respondents, and most of them are aged between 20 and 30 with a bachelor’s degree or above.

Qualitative data analysis and results

First, we summarized the collected interview data into interview documents [51] And then, we analyze the interview documents by Grounded theory three-stage coding [52]: open coding, axial coding, selective coding. We complete the data coding as shown below:

(1) Open coding: In this process, we extracted all the phrases about facial information privacy concerns and privacy fatigue, divided them into meaningful segments, and conceptually classified, compared and marked them.

(2) Axial coding: Firstly, we sorted through the documents and examined the relationship between each category and phenomena. Secondly, we examined whether the actual studies support this hypothetical relationship. Finally, we organized the initial concepts into higher-order categories [51].

(3) Selective coding: We developed a clear story line at a conceptual level and tried to explain the initial results with APCO model. The quantitative study will be used to further analyze the qualitative results.

We show the results of our analysis in Tables 1 and 2, where all of the representative quotations were mentioned by multiple people. The data analysis process identified seven antecedents of facial privacy concerns: privacy experience, privacy awareness, privacy control, privacy policy effectiveness, reputation, peer influence, and negative media exposure. And it also identified four antecedents of privacy fatigue: privacy experience, privacy awareness, privacy control, and negative media exposure.

Table 1.

Common’s example for privacy concerns

Associated Constructs	Common’s example
Privacy experience Privacy awareness Privacy control Privacy policy effectiveness Reputation Peer influence	A4: “If I had experienced a privacy invasion, I would have been more concerned about privacy and would have taken proactive measures to deal with it.” A16: “My roommate has used my facial information to pay, if it is someone else, I am worried.” A22: “I know about facial privacy issues, and I think what if it happened to me, so there’s some concerns.” A2: “If I had heard about privacy issues, I would have known more, and I would have been more concerned.” A3: “I don’t know how the collected facial information is used and it really worries me.” A9: “The collected information is not available, but I would like to know how it is stored and used, so I am concerned.” A10: “Privacy policies can provide security, when you run into problems, also can find the basis, can alleviate concerns.” A2: “What worries me is that service providers collect too much facial information without disclosing how to use them.” A8: “I might feel less secure with a different service provider because the influence of the service provider would affect my concerns.” A1: “I am not very concerned about my facial information, because Alibaba is the service provider.” A7: “If they met facial privacy invasion, I was worried, because I was afraid to facial privacy invasion will also happen to me.”
Negative media exposure	A13: “Other people’s worries, that kind of thinking will be transmitted to myself, will make me feel privacy issues are still quite difficult to deal with.” A1: “I would be worried if I saw facial information leaked in the news media.” A6: “I worry about the same thing happening to me or the people around me.”

Table 2.

Common’s example for privacy fatigue

Associated Constructs

Common’s example

Privacy experience Privacy awareness Privacy control Negative media exposure

A22: “When dealing with privacy issues, there were some very complicated and troublesome operations, after which I don’t want to manage it.” A4: “I took some steps, but it didn’t work, and it made me tired.” A4: “Sometimes I am very tired, because do not know how to deal with privacy issues.” A21: “I learned a lot from Tiktok about how to protect privacy, which alleviates my privacy fatigue. A17: “I want to control my facial information but I can’t, so I feel tired.” A3: “I don’t want the app to have access to my information, I felt tired when the facial payment app tried to obtain my facial information through the microphone and camera.” A21: “When I see a news story about a privacy disclosure, I will skip it quickly.” A6: “Negative media exposure can change my attitude toward privacy issues and add to my fatigue.”

Privacy experience means that when a person has been subjected to privacy invasion or related experiences, his perception of facial information privacy will be more sensitive and he will be more concerned about facial privacy leakage [53, 54]. However, the tedious experience of dealing with privacy issues can make people feel tired and reduce the desire to deal with them again [55]. Privacy awareness means one has the knowledge of privacy issues, privacy protection and the organization’s privacy practices [56]. Those with the relevant knowledge are better able to understand the consequences of disclosing their privacy than those who do not. At the same time, constant attention to facial privacy can cause them to worry more. If they don’t understand the organization’s privacy practices, they will feel helpless when faced with privacy issues. The third one is privacy control, meaning the degree of people’s willing to have access to their private information [57]. When they don’t know what’s going on with their facial information, they show concern about this. The service providers’ reputation also affects people’s attitude. Specifically, people will choose the organization which has better reputation [54]. People in society are also influenced by those around them, we call this phenomenon peer influence [58]. Negative media exposure means news media coverage of a privacy breach, or criticism of a service provider. And it can heighten people’s facial privacy concerns [59] and encourage privacy fatigue. Therefore, we selected privacy experience, privacy awareness, privacy control, privacy policy effectiveness, reputation, negative media exposure and peer influence as the antecedents of privacy concerns. And privacy experience, privacy awareness, privacy control and negative media exposure influence privacy fatigue. Besides, we divided seven antecedents into three levels: social level, organization level and individual level and the research model is shown in Fig. 2.

Fig. 2.

Research model

Quantitative study

Hypotheses development

Based on the results of qualitative study, we conducted a quantitative study on the relationship among antecedents, facial privacy concerns, privacy fatigue, and users’ resistance intention to use FRP.

People who have been the victim of privacy invasion may have stronger concerns when it comes to facial information privacy [9]. In other words, the privacy experience influences consumers’ attention to facial privacy issues and those who have not experienced a privacy invasion are not be aware that it may happen to them [60]. Previous studies have shown that accumulated privacy experience and negative emotion can lead to increase the level of privacy concerns, and then increased resistance intention [61]. In the context of FRP, users were asked to provide their facial information. For people who have already experienced privacy invasion, they will consider whether providing facial information will make them the victim of another facial privacy violation, so they act more concerned than others. However, people who have experienced privacy problems or failed to deal with privacy issues may choose to stay away from what’s bothering them. The following hypotheses are proposed:

H1a. Privacy experience has a positive effect on privacy concerns for facial information.

H1b. Privacy experience has a positive effect on privacy fatigue.

Privacy awareness means having the knowledge of privacy issues and an organization’s privacy measures and practices [12]. People with a high level of privacy awareness can clearly understand the importance of personal facial information and the consequences of privacy leakage, so they will have a stronger concern about facial information. For example, consumers who are unaware of name removal operations tend to be less concerned about privacy than those who have a strong awareness of their privacy [62, 63]. People know that facial information is tied to their payment information and identity information, so they are more careful about giving facial information. Similarly, if there is a lack of knowledge about privacy, you will feel powerless when faced with privacy issues. We therefore state the following hypotheses:

H2a. Privacy awareness has a positive effect on privacy concerns for facial information.

H2b. Privacy awareness has an opposite effect on privacy fatigue.

The control of personal information privacy is a method of privacy protection, and privacy control reflects people’s desire to control private information like knowing how facial information is being collected and processed. In the context of FRP, privacy controls mean that users want to know how information about their facial information is being collected [64], used and shared. Studies have shown that many people want to control their own private information, which also reflects their concern about private information [57, 65–67] In addition, long periods of attention and dealing with privacy-related issues can cause fatigue, and high levels of privacy control are more likely to cause privacy fatigue. So, we assert:

H3a: Privacy control has a positive effect on privacy concerns for facial information.

H3b: Privacy control has a positive effect on privacy fatigue.

Privacy policy effectiveness is defined by FTC’s Fair Information Practice Principles (FIPPs) focusing on core privacy principles [68]. And FIPPs divided privacy policy to five dimensions: notice, choice, access, security, and enforcement [69]. Notice is that an organization needs to publicly state its privacy policy before collecting personal information [70]. And choice refers to providing users with a choice after informing them what personal information they will collect and how they will use it. Access means that the privacy policy should allow users to access their stored personal information for the purpose of checking its completeness and accuracy. [71]. Security is that privacy policies should reflect the protection of information, and enforcement is the need for organizations to strictly enforce their privacy policies [69]. Previous studies have shown that privacy policies are important to users’ privacy decisions, and that effective privacy policies can help reduce users’ privacy concerns [72, 73], and in this study we will classify policy effectiveness as an antecedent at the organizational level. The following hypotheses is proposed:

H4: Privacy policy effectiveness has an opposite effect on privacy concerns for facial information.

The reputation of the service provider is an indicator of the comprehensive service provider’s ability, scale, behavior, product and service expertise, social characters, attitude towards customers, communication ability, etc. [74]. What the users are concerned about is how the FRP service providers deal with their privacy information, and they take the providers’ scale and ability as the guarantee, and the attitude of the service providers as the dependence [75]. According to the previous studies, providers’ reputation can directly influence users’ privacy concerns and indirectly influence users’ attitudes through trust [54, 76]. We also use it as an antecedent at the organizational level. So, we state the following hypothesis:

H5: Reputation has an opposite effect on privacy concerns for facial information.

Peer influence refers to the impact of privacy concerns of people around or peers on a target user. We study it at the social level, because peer influence involves social communication, social influence and herd psychology [58, 77]. Peer influence can be either positive or negative for privacy concerns. For example, people may reduce their concerns about facial privacy because people around them do not pay attention to privacy issues, or they may become worried because of the concerns of people around them [78]. According to our qualitative study, majority of interviewees expressed concerns about privacy and also said they would be more concerned due to their peers’ concerns. Therefore, in this study, peer influence refers to the impact of peer privacy concerns on target users’ emotions. According to the previous studies, the temporal organization of people’s behavior on social platforms is influenced by the behavior of their peers [79], friends who have already made a purchase also increase people’s pressure to make a purchase [80]. Therefore, we state the following hypothesis:

H6: Peer influence has a positive effect on privacy concerns for facial information.

Negative reports and social news about the service providers will lower people’s impression of the service providers, which will lead to the associated negative news when using FRP [59]. Besides, negative media exposure can also make users feel like the facial information privacy invasion is happening to them. In recent years, more and more people are paying attention to privacy issues, which means that negative news reports about privacy issues will attract a lot of eyes. For example, companies such as Apple and Facebook have received criticism and complaints in recent years for mishandling customer information [81, 82], and these can lead to distrust and worry. Similarly, the deluge of negative media exposure about privacy has created not just anxiety, but boredom. Some respondents mentioned that they now skip news about privacy. The following hypotheses is proposed:

H7a: Negative media exposure has a positive effect on privacy concerns for facial information.

H7b: Negative media exposure has a positive effect on privacy fatigue.

Smith explains and measures privacy concerns from seven perspectives [9]: collection, unauthorized secondary use (internal), unauthorized secondary use (external), improper access, errors, reduced judgment, combining data. In the context of FRP, collection means users worry about their facial information being collected and stored by service providers [83]. Unauthorized secondary use represents unauthorized use of facial information for another purpose, either within or outside the organization [83]. Improper access means that facial information is easily viewed and accessed by someone else who is not authorized to do so and errors is the loss or disclosure of facial information due to improper operation or error [9]. Because of the fear of this happening, users will be less willing to pay with their faces. Numerous studies have demonstrated the impact of privacy concerns on users’ behavior and intentions [60, 84], The latest research shows privacy concerns’ influence in marketing consumer research [85, 86], app uses [87], medical treatment and health [88] and e-government [89].

It’s not just privacy concerns, but weariness and fatigue over privacy issues that have an impact on users’ attitudes. For example, users can become tired or even resistant when they are frequently exposed to privacy issues or asked for privacy rights [10]. We think of the powerlessness and boredom that comes with privacy fatigue [15, 16]. Once efforts to solve privacy issues fail to achieve the desired results, users will also generate a mismatch between the benefits and efforts, resulting in privacy issues fatigue and disengagement [90, 91]. On the other hand, in the face of demands for privacy and the possible consequences of privacy disclosure, fatigue makes people want to get rid of privacy and cut off services [92]. For instance, respondent A21 mentioned “I don’t want to see privacy related topics anymore, and I don’t want to read the privacy statement contract provided by the app. When I encounter those, I usually just quit (the app)”. Similarly, respondent A3 also mentioned that he felt tired when the facial payment app tried to obtain his facial information through the microphone and camera. Some users who suffer from privacy fatigue will choose to stay away from services requiring information privacy rather than compromise and cynicism due to low sunk costs of abandon [15, 93]. So, when users have a high level of privacy fatigue, they have enough reason to choose not to use the FRP. Therefore, we state the following hypotheses:

H8: Privacy concerns for facial information have a positive effect on users’ resistance intention.

H9: Privacy fatigue has a positive effect on users’ resistance intention.

Our hypotheses are shown in Fig. 3.

Fig. 3.

Hypotheses development

Data collection

We distributed online questionnaires by wjx.com, which is an extremely popular data collection platform in China. Before the questionnaires were sent out, 11 randomly selected volunteers were invited to fill in the questionnaire. According to the results, they all took more than 74s to answer the questionnaire, so the results from participants whose answer time was less than 60s would be excluded. We applied random sampling and collected 588 pieces of data from July 20 to July 31. Among these responses, 194 were excluded because of multiple repeated selection or short response time. We finally got 394 pieces of valid data, and the response rate of the online survey is 67.0% (> 50%), which is acceptable [94].

This online survey was conducted in China, so we first translated all the original items from English into Chinese. In order to ensure the accuracy of the questions, we invited 12 users with experience of FRP to check whether the questionnaire items can be understood. Next, we made some modifications to the questionnaire items according to their suggestions. Finally, we re-translated the Chinese questionnaire into English to determine the consistency of the two versions.

Measures

We conduct an online survey to verify our hypotheses. We measure most constructs using existing scales. Privacy experience was measured using two items from Yuan [54]. And we measured privacy awareness using two items from Xu [35]. We measured privacy control using three items from Malhotra [64] and privacy policy effectiveness using two items from Chang [69]. Negative media exposure is measured by two items from Cheng [11]. FRP service providers’ reputation is measured by two items from Yuan [54]. We adapted three items from Xu [35] to measure facial privacy concerns. Privacy fatigue was measured using two items from Choi [10], and resistance intention was measured by three items from Mittelstaedt [95]. Since few studies focused on the impact of peer influence on privacy attitudes, the scale of peer influence is designed by ourselves. We used five-points Likert scales ranging from 1 (strongly disagree) to 5 (strongly agree) in each scale. All items are presented in Appendix 1.

Sample characteristics

Of the 394 respondents, 52.3% were male and 47.97% were female, and the gender ratio is relatively balanced. Most respondents were aged 20–40 years. Those with a bachelor’s degree were in the majority, accounting for 77.67%. The demographics of respondents are shown in Table 3.

Table 3.

Demographics of respondents

Demographics	Frequency	Percent (%)
Gender Male Female Age < 20 20–29 30–39 40–50 > 50 Education High School or below Bachelor’s degree Master’s degree	211 189 44 117 129 71 33 22 306 61	52.03 47.97 11.17 29.69 32.74 18.02 8.38 5.58 77.67 15.48
Doctor’s degree or above Usage frequency 0–3 times 4–6 times 7–10 times More than 10 times	5 276 44 21 53	1.27 70.05 11.17 5.33 13.45

Quantitative data analysis and results

In this section, measurement model and structural model will be performed. Structural Equation Modeling (SEM) using maximum likelihood estimation was applied to explore the hypothesized research model. And SEM was considered as an appropriate method for investigating the hypothesized relations between multiple independent and dependent variables. In specific, this study focused on APCO model and tried to explain the relationships between various variables, which is suitable for covariance-based (CB) SEM [96]. So, we used CB-SEM via SPSS and Amos 24 to conduct a statistical analysis. In addition, the sample size collected in this study also meets the requirements of CB-SEM (> 200) [97]. Before the analysis, we examined the normality of the data distribution. All items’ skewness and kurtosis values (shown in Table 4) are less than 3. Q-Q plots are satisfactory and Shapiro-Wilk test results also meet the criteria of significance, indicating that data is almost normally distributed [98, 99]. It suggests that the data is suitable for Amos analysis.

Table 4.

Confirmatory factor analysis for measurement model

Construct	Items	Factor Loading	Skewness	Kurtosis	Cronbach’s α		CR	AVE
Privacy experience (PE) Privacy awareness (PA) Privacy control (PC) Privacy policy effectiveness (PPE) Reputation (RE) Peer influence (PI) Negative media exposure (NME) Privacy concerns (PCON) Privacy fatigue (PF)	PE1 PE2 PA1 PA2 PC1 PC2 PPE1 PPE2 RE1 RE2 PI1 PI2 PI3 NME1 NME2 PCON1 PCON2 PCON3 PF1 PF2	0.793 0.862 0.817 0.806 0.715 0.866 0.880 0.902 0.924 0.934 0.721 0.920 0.779 0.949 0.928 0.902 0.926 0.836 0.737 0.825	0.179 -0.001 -0.650 -0.318 -0.860 -0.474 -0.417 -0.290 -0.409 -0.406 -0.097 -0.211 -0.113 -0.059 -0.106 -0.418 -0.496 -0.606 0.057 -0.236	-0.217 -0.540 0.293 -0.056 0.803 -0.379 -0.171 -0.282 0.987 0.935 -0.185 -0.158 0.076 0.338 0.289 -0.304 -0.085 0.096 -0.027 -0.413		0.812 0.794 0.767 0.885 0.927 0.842 0.936 0.918 0.760	0.814 0.686 0.794 0.659 0.772 0.631 0.885 0.794 0.927 0.863 0.850 0.658 0.937 0.880 0.919 0.790 0.759 0.612
Resistance intention (RI)	RI1 RI2 RI3	0.941 0.760 0.756	-0.200 0.336 -0.418	-0.690 -0.106 -0.596		0.857	0.862 0.678

Exploratory factor analysis

Before conducting exploratory factor analysis, we used Kaiser-Meyer-Olkin (KMO) measure and Bartlett’s test of sphericity for sampling adequacy. According to the results, KMO measure of sampling adequacy is 0.846(> 0.6) and the significance Bartlett’s test of sphericity is 0.000, which indicates well suited to factor analysis [100, 101]. We conducted exploratory factor analysis on 23 items and extracted 7 principal factors which could basically reflect these 23 items. Additionally, these 7 factors can explain 75.04% of the variance. The results of exploratory factor analysis show that all items are bearing the corresponding factors and consequently reflects the discriminant and convergent validity [57].

Measurement model

First, measurement model is tested. The results of the reliability and convergent validity of model are shown in Table 4. The results show that the values of Cronbach’s alpha and composite reliability (CR) of all constructs exceed 0.7, indicating the reliability of the model is acceptable [102]. Loadings of factors corresponding to corresponding constructs are above 0.7 and the average variance extracted (AVE) is above 0.5, indicating that convergence validity is satisfied [102]. Table 5 shows the result of discriminant validity and the correlation coefficient between each variable. According to the result, the square roots of all AVE on the diagonal are greater than the correlation coefficients between all constructs [103], suggesting the discriminant validity is satisfied.

Table 5.

Discriminant validity

	NME	PI	PA	PCON	PC	PE	PF	PPE	RI	RE
NME	0.938
PI	0.423	0.811
PA	0.418	0.468	0.812
PCON	0.396	0.539	0.535	0.889
PC	0.321	0.389	0.681	0.610	0.794
PE	0.386	0.367	0.553	0.600	0.500	0.828
PF	0.325	0.265	0.406	0.380	0.431	0.473	0.782
PPE	-0.140	-0.119	-0.172	-0.354	-0.165	-0.406	-0.179	0.891
RI	0.273	0.330	0.360	0.586	0.404	0.409	0.421	-0.218	0.823
RE	-0.139	-0.180	-0.106	-0.186	-0.098	-0.337	-0.142	0.593	-0.125	0.929

The indicators of model fit are shown in Table 6. According to the results, the values of indicators of measurement model meet the recommended values (CFI = 0.947 > 0.9, TLI = 0.945 > 0.9, NFI = 0.906 > 0.9, IFI = 0.948 > 0.9, GFI = 0.901 > 0.9, RMSEA = 0.054 < 0.08, SRMR = 0.0689 < 0.08, χ²/df = 2.14) [70, 104, 105]

Table 6.

Model fit

Indicator	Value	Standard
CFI GFI NFI IFI TLI RMSEA	0.947 0.901 0.906 0.948 0.935 0.054	> 0.9 > 0.9 > 0.9 > 0.9 > 0.9 < 0.08
SRMR	0.0689	< 0.08

Structure model

The estimated results are shown in Fig. 4. The results showed that privacy experience was significantly related to privacy worry and privacy fatigue, and thus H1a and H1b were accepted. Privacy awareness was not significantly related to facial privacy concerns and privacy fatigue, and thus H2a and H2b were rejected. Privacy control had a significant influence on facial privacy concerns and privacy fatigue, thus H3a and H3b were accepted. Privacy policy effectiveness was negatively related to facial privacy concerns, supporting H4. The reputation of the service provider had a positive effect on the facial privacy concerns, and thus H5 was reversely supported. Peer influence had a positive effect on privacy concerns, and thus H6 was supported. Negative news coverage had no significant impact on privacy concerns but had a significantly positive influence on privacy fatigue, and thus H7a was accepted and H7b was rejected. Both facial privacy concerns and privacy fatigue had a positive influence on resistance intention, and thus H8 and H9 were accepted. According to the result, 29% of the variance in privacy fatigue, 59% of the variance in privacy concerns for facial information, and 40.4% of the variance in users’ resistance intention can be explained by exogenous variables. And the percentages of variances were above 0.10, which suggested a satisfactory model [106].

Fig. 4.

Structure model Note: ^***p < 0.001; ^**p < 0.01; ^*p < 0.05; n.s: not significant

Table 7.

Effect overview

Effect	Standardized weight	p value	Result
PE→PCON PA→PCON PC→PCON PPE→PCON RE→PCON PI→PCON NME→PCON PE→PF PA→PF PC→PF	0.270 -0.035 0.341 -0.228 0.131 0.296 0.058 0.292 0.047 0.213	0.00 0.647 0.00 0.00 0.012 0.00 0.209 0.00 0.637 0.023	Supported Rejected Supported Supported Reversely support Supported Rejected Supported Rejected Supported
NME→PF PCON→RI PF→RI	0.125 0.498 0.232	0.044 0.00 0.00	Supported Supported Supported

Discussion and conclusion

In this section, we will summarize the findings of the research, and present the theoretical and practical implications of this paper. Finally, we will conclude the deficiencies and prospects of this study.

Research findings

First, to answer of RQ1 “What factors influence privacy fatigue and privacy concerns of user’s facial information?”, we conducted a semi-structured interview. We found seven antecedents which cause users’ privacy concerns for facial information in the context of FRP. Among them, we divided privacy experience, privacy awareness and privacy control into individual level antecedents. Privacy policy effectiveness and service providers’ reputation are at the organizational level. Peer influence and negative media exposure belong to the social level. At the same time, we have discovered four antecedents of privacy fatigue: privacy experience, privacy awareness, privacy control and negative media exposure. Based on the results of the qualitative analysis, we developed 13 hypotheses and established the research model.

Second, to answer RQ2 “How do antecedents influence privacy fatigue and privacy concerns, and subsequently influence user’s response to facial recognition payment?”. We developed a research model based on APCO model and the results of qualitative study. Research results showed that privacy concerns for facial information and privacy fatigue have a significant positive effect on users’ resistance intentions. And each antecedent has a different impact on privacy concerns and privacy fatigue. According to the results, privacy experience, privacy control, reputation and peer influence have a positive effect on users’ privacy concerns for facial information and privacy policy effectiveness has a opposite effect on users’ privacy concerns. In addition, privacy experience, privacy control and negative media exposure have a positive effect on users’ privacy fatigue.

Third, according to research results, privacy awareness has no significant impact on privacy concern for facial information and privacy fatigue. A plausible explanation is that individuals who are aware of privacy issues are more likely to find a way to protect their private information from risks and threats [107]. As a result, they don’t get too worried or tired about facial information privacy issues [108, 109]. Besides, contrary to our hypothesis, service providers’ reputation negatively influences privacy concerns. The major FRP service providers in China are large enterprises dominated by Alibaba and Tencent. It is no exaggeration to say that they hold the private information of almost all Internet users in China. From the consumer point of view, these two companies have the power and incentive to sell consumers’ personal data for financial gain, which are more likely cause social panic and consumer concerns. Negative media exposure also has no significant impact on privacy concerns for facial information. One possible explanation is that people are so skeptical about the authenticity of media exposure that they don’t empathize with events. As a result, some news reports that may appear false to consumers are not enough to cause their concern their facial information privacy. Moreover, individuals who are tired of privacy issues may experience feelings of boredom rather than empathy in response to negative media exposure.

Theoretical implications

The findings of this study provide several theoretical contributions. First, previous studies have focused on location privacy in sharing transportation and property privacy in payments. Compared with them [10, 13, 14], this study expanded the research range and took facial information privacy as the research object, so as to prepare for future research on facial information privacy. In this study, facial privacy information is proposed and empirical research is carried out, and we hope that it can receive the same attention as payment information and location information, which contributes to existing studies on privacy issues. Besides, this study addresses this research gap by developing a theoretical model to investigating the relationships between antecedents, privacy concern, privacy fatigue and users’ response to FRP.

Second, we employed APCO model into the study of facial information privacy. Based on previous studies [11, 14, 44] that raised the APCO model or used it to investigated privacy issues in social media or location-based service, we extended the application of APCO macro model to FRP context and conducted an empirical study to prove the effectiveness of APCO model in the FRP context. This study finds several domain-specific antecedents of privacy concerns and privacy fatigue in the e-payment context. Compared with previous studies based solely on individual reasons [9, 12, 42], this study measures the influence of antecedents from individual level, organization level and society level so that we can understand more comprehensively how privacy concerns and privacy fatigue develop. Meanwhile, privacy concerns and privacy fatigue have some common antecedents, and both of them at a high degree will lead to users’ resistance intention, so it is necessary to add privacy fatigue into the APCO model to better explain its impact on users’ behavior. The influence of privacy fatigue is also significant in many contexts, and we believe that the modified APCO model can more effectively explain the influence of antecedents on individuals’ intention and behavior [10, 30]. Therefore, this study contributed to the literature of APCO and expanded the application scenarios of APCO model.

Third, we conducted a mixed-methods study. Few previous studies have focused on antecedents of privacy concerns in the FRP context. As far as we know, Liu et al. adopted an online survey to investigate users’ resistance intention on FRP by integrating the factors in privacy calculus theory [2]. However, this study only examines antecedents that are frequently verified in various context, and several domain-specific antecedents of FRP are not been found. So, we identify key antecedents by conducting semi-structured interview, which is suitable for exploring novel and theoretical underpinning fields [17, 18, 44, 46]. And based on the results of qualitative analysis, we obtained the antecedents confirmed in previous studies, and also identified several new antecedents such as peer influence and reputation.

Practical implications

Our study has some practical implications. According to our research, concerns and fatigue about facial privacy can lead users to resist facial recognition payments, and we explore the antecedents from the perspectives of individuals, organizations, and societies, providing a reference for FRP service providers, and news media. First, for the individual level, privacy control plays a significant role in the influence of privacy concerns and privacy fatigue. In order to avoid users’ anxiety and fatigue about facial privacy, service providers should provide better channels to satisfy users’ desire to control facial privacy and let users feel that they can master the storage and use of personal facial information. For example, service providers should give users the right to access their historical operation of facial information in the system. In addition, the service provider should not only have the right to access user facial information, but also undertake the obligation to protect users’ privacy, upgrade and improve the risk control system, and promise not to conduct unauthorized operations, and should conduct regular security checks on the database system to avoid unauthorized third-party operations that may bring bad privacy experiences to users.

Second, for the organization level, it is necessary for service providers to ensure the effectiveness and completeness of privacy policies because the effectiveness of privacy policies has a significant impact on users’ privacy concerns. On the one hand, service providers need to make privacy policies easy to understand, rather than putting users to sleep with lengthy statements. In order to make users better understand the privacy policy of FRP, service providers can extract key points in the privacy policy as a short privacy statement. Users can choose to view a short or full privacy policy on the FRP app. And on the other hand, FRP service providers need to have complete privacy provisions and make sure they are implemented effectively so that users feel secure about providing their facial information. Moreover, setting a channel to communicate with users for get feedback and improve privacy policy according to their suggestions is vital for the platform.

Third, for the social level, peer influence can also exacerbate privacy concerns, and negative exposure of privacy issues can make people tired and resistant based on the research findings. The news media should choose the key privacy issues to report, and should not attract users’ attention by exaggeration or intimidation, so as to avoid excessive anxiety and resistance. Media are suggested to set up a column on privacy issues, so that users in need can browse relevant news. Moreover, it is necessary to report negative news with specific preventive measures, and provide suggestions for individuals to adopt. When the concerns and fatigue of facial privacy information in the society are gradually reduced and people’s facial information can be reasonably protected, FRP can be better promoted and give full play to its advantages. This research on users’ resistance intentions also gives them an inspiration on how to promote FRP. In addition, this research could provide many business and social implications regarding the privacy behavior part of users’ facial recognition payment which could be encouraged to increasing in the COVID-19 influenced period to help protect health and safety.

Limitations and future research

Our study has several limitations. Firstly, the antecedents of privacy concerns and privacy fatigue are limited in the context of FRP, and may not be able to be generalized to other contexts. So, future study could investigate users’ behavior in other payment environment. Secondly, this study was conducted in China, and the respondents were limited to Chinese FRP users, so the results may not be valid in other cultural contexts. Future study could conduct surveys in different regions or countries.

Appendix 1: Measurement scales

Construct	Item	Content	Resource
Privacy experience	PE1	I was a victim of facial privacy invasion.	[54]
	PE2	I believe that my facial privacy was invaded in by other people or organizations.
Privacy awareness	PA1	I am aware of the privacy issues and practices in FRP.	[35]
	PA2	I follow news and developments about privacy issues and privacy violations regarding FRP.
Privacy control	PC1	My control of personal facial information lies at the heart of facial privacy.	[64]
	PC2	I believed that facial privacy is invaded when control is lost or unwillingly reduced as a result of FRP.
Privacy policy effectiveness	PPE1	With the privacy policy, I believe that my facial information will be kept private and confidential by service providers.	[69]
	PPE2	I believe that the privacy policy posted by service providers are an effective way to demonstrate their commitments to privacy.
Reputation	RE1	This service provider of FRP has a good reputation.	[54]
	RE2	This service provider of FRP has a reputation for offering good products or services.
Peer influence	PI1	I feel like people around me are worried about facial information disclosure and infringement in FRP.	Self-developed
	PI2	People around me remind me to protect my facial information from being leaked or infringed.
	PI3	People around me pay attention to the protection of their facial information.
Negative media exposure	NME1	I often heard or read about the negative news of the company who provides FRP services during the last year.	[11]
	NME2	I often heard or read about the negative news about facial information disclosure during the last year.
Privacy concerns	PCON1	I am concerned about providing my facial information because it could be leaked and used in a way I did not foresee.	[35]
	PCON2	I am concerned about my facial information that is recorded on FRP because it could be used to identify me.
	PCON3	I am concerned that unauthorized parties could use my facial information to impersonate me.
Privacy fatigue	PF1	I am tired of facial privacy issues.	[10]
	PF2	It is tiresome for me to care about facial privacy.
Resistance intention	RI1	I will try NOT to use FRP.	[95]
	RI2	I will NOT use FRP in the future.
	RI3	I will NOT use FRP if I have alternatives.

Declarations

Datasets

The data that support the findings of this study are available from the corresponding author upon request.