Effective training is essential for enhancing users’ ability to detect phishing attempts. Personalised training offers huge potential to more closely align training content with individuals’ needs and skill levels. In an online study, we assigned N=342 participants to personalised training or a random training variant to compare their effectiveness. The personalisation was based on a phishing proficiency score calculated from factors such as detection ability, knowledge, and security attitude. After training, the participants demonstrated greater proficiency, with an increased ability to detect phishing emails and higher security attitudes. These effects were most pronounced in the personalised condition, demonstrating the potential of personalisation to improve training outcomes. Overall, personalised training levelled the playing field, efficiently bringing all groups, regardless of their initial proficiency, to a comparable and desired post-training phishing proficiency level. Finally, we derived recommendations for designing personalised phishing training content and assigning users to suitable training programmes.

With EU-GDPR and related regulations, the respon-sibility to make privacy-related decisions such as to provide informed consent to data handling practices mainly rests with the user. However, current lengthy privacy policies and often deceptive cookie notices rarely facilitate truly informed consent. Related work on privacy icons or structuring privacy policies aims to enhance users' understanding but achieve mixed results. In a between-subjects study with N=379 participants we thus explored the potential of embedding privacy information in visual metaphors and analogies to support informed decision-making. Additionally, we explored whether dynamic feedback helped users understand the implications of their decisions. While both visual and textual information and feedback appeared to support users' understanding of data handling practices and alignment with personal preferences, with no significant differences between conditions, users per-ceived visualizations as more suitable and aesthetically pleasing than text. This indicates potential for using visual contexts to enhance informed consent not only within existing cookie notices but also in emerging tools such as privacy assistants or related privacy-enhancing technologies. Future work should investigate differences to currently deployed solutions and the effect of perceived pleasantness of design variants on users' understanding and decisions.