Commercial Virtual Reality (VR) transforms people’s virtual experiences but introduces deceptive design opportunities that threaten user privacy. Although privacy deceptive patterns on 2D platforms are well-documented, their impacts in VR remain understudied. We surveyed 481 users’ experiences and responses to privacy deceptive patterns across eight commercial VR scenarios. We found that VR deceptive design can exploit both cognitive vulnerabilities and bodily strain, a phenomenon we define as Ergonomic Susceptibility, and that VR’s sensory-rich experiences can make users more likely to accept invasive data disclosure framed as immersion-preserving. Users recognized manipulation but their prior non-VR exposure can foster privacy resignation. Our study shows ergonomics is a critical factor in future privacy-preserving VR design, and urges VR researchers, designers, and policymakers to develop ethical design and privacy management solutions that account for VR’s unique multimodal, immersive, and ergonomic properties, building immersive experiences that respect user privacy and mitigate manipulative data practices.

The rapid growth of artificial intelligence (AI) technologies has raised major privacy and ethical concerns. However, existing AI incident taxonomies and guidelines lack grounding in real-world cases, limiting their effectiveness for prevention and mitigation. We analyzed 202 real-world AI privacy and ethical incidents to develop a taxonomy that classifies them across AI lifecycle stages and captures contributing factors, including causes, responsible entities, sources of disclosure, and impacts. Our findings reveal widespread harms from poor organizational decisions and legal non-compliance, limited corrective interventions, and rare reporting from AI developers and adopting entities. Our taxonomy offers a structured approach for systematic incident reporting and emphasizes the weaknesses of current AI governance frameworks. Our findings provide actionable guidance for policymakers and practitioners to strengthen user protections, develop targeted AI policies, enhance reporting practices, and foster responsible AI governance and innovation, especially in contexts such as social media and child protection.

This study examines how anecdotal stories from friends, peers, and online sources influence non-experts' perceptions and behaviors toward smart home IoT devices.We surveyed 263 participants, collecting narratives that either positively or negatively influenced their perception of IoT devices, which they retold in text and comic formats to encourage deeper reflection.Thematic analysis of the narratives, combined with quantitative survey data, reveals that stories significantly impact trust and willingness to use and adopt IoT devices.Negative stories, particularly those concerning security, privacy, and device unreliability, reduced trust and usage, while positive stories about home safety through monitoring and improved quality of life increased interest in IoT devices.Perceptions of different IoT devices varied based on the themes associated with the stories.The findings highlight the powerful role of storytelling in driving consumer acceptance of technology. CCS Concepts• Human-centered computing → Empirical studies in HCI; • Security and privacy → Social aspects of security and privacy.

Virtual Reality (VR) technologies offer immersive experiences but collect substantial user data. While deceptive design is well-studied in 2D platforms, little is known about its manifestation in VR environments and its impact on user privacy. This research investigates deceptive designs in privacy communication and interaction mechanisms of 12 top-rated VR games and applications through autoethnographic evaluation of the applications and thematic analysis of privacy policies. We found that while many deceptive designs rely on 2D interfaces, some VR-unique features, while not directly enabling deception, amplified data disclosure behaviors, and obscured actual data practices. Convoluted privacy policies and manipulative consent practices further hinder comprehension and increase privacy risks. We also observed privacy-preserving design strategies and protective considerations in VR privacy policies. We offer recommendations for ethical VR design that balance immersive experiences with strong privacy protections, guiding researchers, designers, and policymakers to improve privacy in VR environments.

Extended Reality (XR) technology is changing online interactions, but its granular data collection sensors may be more invasive to user privacy than web, mobile, and the Internet of Things technologies. Despite an increased interest in studying developers’ concerns about XR device privacy, user perceptions have rarely been addressed. We surveyed 464 XR users to assess their awareness, concerns, and coping strategies around XR data in 18 scenarios. Our findings demonstrate that many factors, such as data types and sensitivity, affect users’ perceptions of privacy in XR. However, users’ limited awareness of XR sensors’ granular data collection capabilities, such as involuntary body signals of emotional responses, restricted the range of privacy-protective strategies they used. Our results highlight a need to enhance users’ awareness of data privacy threats in XR, design privacy-choice interfaces tailored to XR environments, and develop transparent XR data practices.

With the increasing popularity of cryptocurrency, many people are interested in cryptocurrency investments, but have so far hesitated. Many others have made investments without adequate preparation. To help interested investors improve their understanding of cryptocurrency and make rational investment decisions, it is important to study their concerns and motivations and to draw upon experienced investors’ experiences and practices. Therefore, we surveyed crypto investors and inexperienced potential investors interested in trading cryptocurrency (n = 395). Our results showed that extreme price volatility is the primary incentive and a substantial obstacle to market participation. Fraud risks, lack of personal funds, insufficient knowledge, and difficulty identifying credible information sources are also common barriers. Our findings highlight the need to build trustworthy exchange platforms and integrate educational features. Based on the reported concerns and experiences, we (1) identify learning components for new investors, and (2) formulate design recommendations for beginner-friendly exchange platforms.

Over the last decade, the free-to-play (F2P) game business model has gained popularity in the games industry. We examine the role of deceptive design during a game's transition to F2P and its impacts on players. Our analysis focuses on game mechanics and a Reddit analysis of the Overwatch (OW) series after it transitioned to an F2P model. Our study identifies nine game mechanics that use deceptive design patterns. We also identify factors contributing to a negative gameplay experience. Business model transitions in games present possibilities for problematic practices. Our findings identify the need for game developers and publishers to balance player investments and fairness of rewards. A game's successful transition depends on maintaining fundamental components of player motivation and ensuring transparent communication. Compared to existing taxonomies in other media, games need a comprehensive classification of deceptive design. We emphasize the importance of understanding player perceptions and the impact of deceptive practices in future research.

Designers are sometimes accused of using deceptive methods to manipulate users' information privacy decisions through "privacy dark patterns." Through semi-structured interviews, we explore the perceptions of 23 design practitioners towards the implementation of "privacy dark patterns" created by other designers. This paper explores designers' perceived responsibilities toward users' privacy and their interpretations of the reasons behind the design implementation. We found a range of empathetic rationales among our participants toward other designers' intentions. An example theme is Designer Followed the Status Quo, where common and widely used privacy interfaces are normalized a practice that is typically viewed as reasonable. Our participants' interpretations of the design intent influenced their self-reported practices for navigating similar design requests. We propose a set of factors that influence privacy design practices, including following conventions and norms, ensuring legal compliance, reliance on established usability standards, perceived benefits to businesses and consumers, and degrees of privacy harm.

Large crowds in public transit stations and vehicles introduce obstacles for wayfinding, hygiene, and physical distancing. Public displays that currently provide on-site transit information could also provide critical crowdedness information. Therefore, we examined people’s crowd perceptions and information preferences before and during the pandemic, and designs for visualizing crowdedness to passengers. We first report survey results with public transit users (n = 303), including the usability results of three crowdedness visualization concepts. Then, we present two animated crowd simulations on public displays that we evaluated in a field study (n = 44). We found that passengers react very positively to crowding information, especially before boarding a vehicle. Visualizing the exact physical spaces occupied on transit vehicles was most useful for avoiding crowded areas. However, visualizing the overall fullness of vehicles was the easiest to understand. We discuss design implications for communicating crowding information to support decision-making and promote a sense of safety.

With privacy-related concepts often abstract and difficult to define, comics can be an effective visual storytelling medium for explaining and raising awareness about privacy. However, existing privacy and security educational comics do not support content creation. To address this, we contribute PrivacyToon, a comic-based authoring tool that leverages concept-driven storytelling and ideation cards to help users create customizable privacy-related visual content. Our exploratory user study with 23 students and teachers shows PrivacyToon’s potential as a creative tool for communicating privacy concepts and stories. Our results show that a wide range of creativity preferences and contexts must be considered when designing systems that integrate ideation card-based design processes.

Understanding users' individual differences may provide clues to help identify computer users who are prone to act insecurely. We examine factors that impact home users' reported computer security behaviour. We conducted two online surveys with a total of 650 participants to investigate the relationship between self-reported security behaviour and users' knowledge, motivation, confidence, risk propensity and sex-typed characteristics. We found that all of these factors impacted security behaviour, with knowledge as the most important predictor. We further show that a user's affinity to feminine or masculine characteristics is a better determinant of security behaviour than using binary male/female descriptors. Our study enabled us to confirm earlier results in the literature in a non-organisational setting, and to extend the literature by studying additional factors and by comparing the relative importance of each factor as a predictor of security behaviour.

We designed the Cyberheroes interactive e-book and conducted a preliminary user study to test its effectiveness in educating children aged 7 to 9 about online privacy risks. Children and parents found the book to be fun and engaging. Our study included pre and post interviews and knowledge assessment. It showed that the interactive e-book successfully improved children's understanding of privacy risks while exhibiting excellent retention in knowledge after one week.

The rise in mobile media use by children has heightened parents' concerns for their online safety. Through semi-structured interviews of parent-child dyads, we explore the perceived privacy and security threats faced by children aged seven to eleven along with the protection mechanisms employed. We identified four models of privacy held by children. Furthermore, we found that children's concerns fit into four child-adversary threat models: child-peers, child-media, child-strangers, and child-parents. Their concerns differed from the five threat models held by the parents: child-peers, child-media, child-strangers, child-technology, and child-self. Parents used a variety of protection strategies to minimize children's exposure to external threats. In reality, however, our results suggest that security and privacy risks from an internal family member or a friend are far more common than harm from outsiders.

Although computer security technologies are the first line of defense to secure users, their success is dependent on individuals’ behavior. It is therefore necessary to persuade users to practice good computer security. This interview analysis of users’ conceptualization of security password guessing attacks, antivirus protection, and mobile online privacy shows that poor understanding of security threats influences users’ motivation and ability to practice safe behaviors. An online interactive comic series called Secure Comics was designed and developed based on instructional design principles to address this problem. An eye-tracking experiment suggests that the graphical and interactive components of the comics direct users’ attention and facilitate comprehension of the information. In the evaluations of Secure Comics, results from several user studies show that the comics improve understanding and motivate positive changes in security management behavior. The implication of the findings to better understand the role of instructional design and persuasion in education technology are discussed.