1 Introduction

In the aftermath of age-marking data leak scandals and in the midst of recurrent data breaches, people appear to be more concerned than ever about the benefits of staying anonymous online (Anant et al. 2020). According to a recent study the large majority of internet users do have security concerns, i.e. they fear possible breaches of their personal data (NortonLifeLock 2020). Current statistics show that such concerns are amply justified as the number of recorded data breaches have skyrocketed in the past few years, going from 157 in 2015 to 1473 in 2019 (Identity Theft Resource Center 2020).

Not only are people trying to protect their personal data from online criminal attacks; increasingly, they are also aspiring to online anonymity, i.e. to be able to surf the web anonymously by completely or partially concealing their identity (Morio and Buchholz 2009; Wallace 2008; Pfitzmann and Köhntopp 2001; Marx 1999).

Desiring anonymity is often stigmatized (Gehl 2016)—frequently by being associated with mean and harmful behavior, such as cyberbullying (Barlett and Gentile 2012), illegal file-sharing (Larsson et al. 2012), and illegal or unethical trade (Morselli et al. 2017). However, online anonymity is a condition coveted by many more than just criminals and wrongdoers.

Since global supremacy has been achieved and established by internet giants (Weiss et al. 2004) such as Facebook, Instagram, Google, and Amazon, issues of online anonymity have become popular and gained wide political, economic, social, academic, and media traction. This is due to the requirement that for such companies to exist and thrive, users’ identities be displayed and their online activities and behaviors be tracked (Zuboff 2015, 2019; Gehl 2016; Stryker 2012; Galperin 2011). Thus, online anonymity has become an ideological struggle and a mindful choice people make to purposefully contest internet players’ invasive, manipulative, and surveilling marketing practices (Zuboff 2015, 2019; Clarke 2019; West 2019; Gehl 2016; Jardine 2016; Maddox et al. 2016).

As a consequence, gaining a deeper understanding of how consumers’ online security concerns can materially hinder such practices and therefore threaten the long-lasting survival of ever more data-hungry business models is paramount and cannot be procrastinated any further.

On these premises, it is no wonder that the market of the so called ‘Privacy Enhancing Technologies (PET), i.e. a wide and heterogeneous family of information and communication technologies (ICTs) designed to reduce, eliminate, or prevent unauthorized processing of users’ personal data to protect their privacy and security (Heurix et al. 2015; Borking and Raab 2001) such as proxy servers, virtual private networks (VPNs), end-to-end secure communications, and anonymization networks like The Onion Router (known as Tor), have recently gained momentum (Kaaniche et al. 2020; Sardá et al. 2019).

Although most of the available technologies are still very hard for ordinary Internet users to master (Shelton et al. 2015; Kang et al. 2013; Borking 2011; Roßnagel 2010), others that are easier to use are becoming popular and their penetration is constantly increasing, both on the demand side (e.g. GlobalWebIndex 2018a) and on the supply side (e.g. Global Market Insights 2020).

Yet, the market hype for these new technologies has not produced an equal hype in user-focused research. A careful analysis of current literature dealing with online anonymizers (reported below) reveals that extant research focuses largely on these technologies’ technical features, and overlooks the role of the users and their use behaviors. As Harborth et al. (2020) have recently stated, despite acceptance that PETs’ wide penetration is tightly connected to a deep understanding of usage behavior, literature to build such understanding is still very scant. In addition, the few studies available to date expose at least three other important research gaps. First, they are generally focused on the specific characteristics that make particular PETs the sole drivers in determining users adopt them. Second, they underestimate intrinsic motivations, as well as others’ influence in prompting users to adopt PETs despite these additional motives often having been demonstrated as paramount in driving other technologies’ use (Shaw and Sergueeva 2019; Alalwan et al. 2017; Herrero and San Martín 2017; Morosan and De Franco 2016; Slade et al. 2015). Third, and most important, despite PET enhancing both online privacy and security (Gan, et al. 2019) and despite users’ concerns about their personal data security is a crucial aspect in fostering the adoption of these technologies (Acquisti and Grossklags 2005; Belanger et al. 2002; Hoffman et al. 1999; Reiter and Rubin 1998), previous research has only focused on privacy concerns while overlooking security concerns.

Acknowledging these gaps, this research answers the following research question: How do users’ concerns for their personal data security affect their intention to adopt PETs? To provide an answer to this question we develop a theoretical framework which combines the Unified Theory of Acceptance and Use of Technology 2 (UTAUT2) (Venkatesh et al. 2012) with literature on users’ attitude towards personal data (Addae et al. 2017) and we test it in a representative consumer-driven community context.

This paper is structured as follows: First it reviews the relevant literature on PETs, based on which it develops the theoretical model and provides justification for the tested hypotheses. This is followed by a methodological section in which we provide information about the research context and give details about the data gathering procedure and the analytical method we used. Finally, we present the findings, a general discussion of the results, the implications, the study’s limitations, and some concluding remarks.

2 Literature review

The term Privacy Enhancing Technology (PET) covers a broad range of technologies and applications that are designed to enhance privacy and data security of both individual (e.g. Kaaniche et al. 2020) and corporate users (e.g. Gan et al. 2019) in their online activities and communications. There are multiple technologies that can be grouped together under the PET label. On the end-user side, in particular, these range from end-to-end secure messaging tools, Virtual Private Networks (VPNs), to anonymization networks and anti-tracking software (ENISA 2016). In particular, communication anonymizers, i.e. online anonymity-granting software and applications, are among the most important users-oriented PETs in circulation (Nia and Martinez 2018; Spiekermann 2005). Despite PETs being as old as the web itself (Fritsch 2007), research has largely focused on their technical features while the role of users has been overlooked (Harborth et al. 2020). As a matter of fact, looking closely at the literature to date reveals three separate research branches in studies on PETs. First, there are studies connected to the branch of economic research, which brings together work aimed at making sense of the PET market’s evolutionary dynamics and at identifying the main technological and economic barriers to the wide diffusion of these technologies (e.g. Caulfield et al. 2016; Borking 2011; Roßnagel 2010; Acquisti 2004; Feigenbaum et al. 2002). Second, connected to the branch of ICT and information system research, there are studies adopting a highly-tech and PET-specific focus meant to evaluate the PET and to illustrate the technical enhancements that can improve their usability and their effectiveness (e.g. AlSabah and Goldberg 2016; Norcie et al. 2012; Fabian et al. 2010; Clark et al. 2007; Whitten and Tygar 1999). Third, connected to the tradition of information system research focused on the end-user, there is a set of studies that try to shed light on the user’s perspective on adopting such technologies. Compared to the first two research streams, this third one is still in its infancy and therefore comparatively smaller. Namara et al. (2020) and Harborth et al. (2020) recently mentioned how surprising it is that empirical research on what motivates users to adopt PETs is still underdeveloped, considering their overall service quality and cost-effectiveness, which dramatically depends on the degree of diffusion they are able to achieve. The few available publications that explain users’ adoption of PETs (or intention to adopt them) have relied on the Technology Acceptance Model (TAM) (Davis 1985) (see Table 1 for an overview), extending this pioneering theory on why people do or do not use technologies, to encompass variables suited to measuring users’ perceptions of PET-specific attributes. These studies include attention to users’ perception of the anonymizer’s ability to grant anonymity (Harborth et al. 2020), users’ feelings of trust toward the technology (Benenson et al. 2014; Krontiris et al. 2015; Harborth et al. 2020), users’ perceived risks (Krontiris et al. 2015), users’ perception of being well informed about how PETs function (Benenson et al. 2014; Krontiris et al. 2015), and users’ awareness of or concerns about their online privacy (Brecht et al. 2011, 2012; Benenson et al. 2014). However, despite the TAM undoubtedly being the most widely used framework to assess users’ actual adoption or intention to adopt certain technologies (see Legris et al. 2003; Turner et al. 2010; Marangunić and Granić 2015 for a review of previous applications of the TAM), it is limited to a small number of variables, mostly perceived ease of use and perceived usefulness, and does not include any variable related to the user-technology interface that can affect the decision to use a technological aid, or not. Therefore, the TAM needs to be adapted and modified to fit the peculiar technical and use-based conditions that might limit or foster the use of technologies (Pizzi and Scarpi 2020; Marangunić and Granić 2015). The result of most recent research being theoretically based on the few variables composing the TAM is that the literature offers just a partial understanding of what determines users’ decisions to turn to PETs. Despite scholars confirming that the decision to use PETs can be influenced by both subjective and social motives, research to date has rarely taken these sources of influence into account. One exception, for example, is Brecht et al. (2011, 2012) who intended to give more centrality to the user than the technology. They used the TAM in tandem with users’ personality traits (McCrae and John 1992), i.e. extroversion, agreeableness, conscientiousness, neuroticism, and openness to experience, as possible determinants of users’ intention to use PETs. Further, Harborth and Pape (2018, 2019), turned to Malhotra et al. (2004) Internet Users Information Privacy Concerns model, that, different to the TAM, includes variables measuring privacy concerns, as well as determinants of such concerns, such as trust and risk beliefs. Namara et al. (2020), in contrast, shed light on some non-utilitarian reasons for users’ decisions to use PETs. In a study based on a sample of VPN users, they found that emotional considerations, such as the strong desire to protect online privacy or fear of surveillance and data tracking, are more likely to explain users’ PET adoption over time than practical-technical considerations (such as technology usefulness and usability).

Table 1 An overview of previous users-focused research on PET adoption
Full size table

Besides the inadequacy of the theoretical frameworks that have mostly been used in current research, the literature to date reports studies focusing on users’ privacy concerns as a reason for adopting PETs (Harborth and Pape 2019; Brecht et al. 2011, 2012), while they neglect security concerns, despite online anonymizers allow users to satisfy both these concerns (Gan et al. 2019). Although privacy concerns could be mistaken for security concerns, and vice versa, they are two different concepts that respond to two different needs (Belanger et al. 2002). Privacy concerns relate to the users’ fear that their data and personal information can be disclosed to unauthorized parties (Chellappa 2008). Security concerns, however, relate to individual perceptions of how relevant and adequate existing technical and legal protective measures are to ensure integrity, confidentiality, and reliability of personal data (Addae et al. 2017). Clearly, the protection of privacy does not necessarily guarantee the protection of security, nor the other way around. For example, the two-factor identification used in home banking services makes transactions more secure, but keeps the identity of the user visible to the bank service provider. The possibility for Facebook users to prohibit others tagging them in pictures is a functionality considered to protect users’ privacy, but it has not affected the security of users’ social profiles. In fact, research has disclosed that users are often willing to sacrifice a part of their privacy in exchange for a higher level of security, and vice versa (Norberg et al. 2007; Dinev and Harth 2006; Acquisti 2004; Culnan and Bies 2003). PETs, however, although primarily designed to achieve anonymity, do also provide higher levels of security. Notably, providers of anonymity-granting technologies emphasize these tools’ ability to protect both privacy and security online (Khan et al. 2018).

Considering the above, our study acknowledges a substantial lack of studies focused on understanding what leads users to adopt PETs or not, also due to the inadequacy of the theoretical tools applied. The study additionally notes a lack of research focused on users’ security concerns as a PET adoption driver. This research draws on a compelling theory of technology adoption (the UTAUT2, Venkatesh et al. 2012) and tests a set of hypotheses coherent with this theoretical device. The following section describes and further reports on the hypotheses developed and tested.

3 Theoretical framework and development of the hypotheses

3.1 Modelling technology acceptance: from TAM to UTAUT2

Research on acceptance and use of technologies has flourished in the last few decades. Scholars have developed, tested, and validated several models to explain why individuals intend or actually do use technological aids such as the above-mentioned TAM (Davis 1985). Being the TAM based on the principal tenets of the Theory of Reasoned Action (Fishbein 1979) and despite being originally conceived to predict users’ acceptance of IS technologies in organizational settings, the TAM has been extensively used to study the adoption of various technologies also in consumer settings, both offline and online (e.g. Lin and Kim 2016; Ha and Stoel 2009; Pizzi and Scarpi 2020). In brief, the TAM postulates that users’ adoption of technology is determined by their attitude towards the technology which, in turn, is affected by the usefulness and the perceived ease-of-use of the technology. The parsimonious nature of the TAM made this model suitable for multiple applications in heterogenous contexts, however it has also been recognized as a constraining drawback which lead some researchers to extend the baseline TAM framework (see e.g. Pizzi and Scarpi 2020). Consistent with these critiques, Venkatesh et al. (2003) developed a unified theory of acceptance and use of technology (UTAUT) suited to explain technology adoption in the organizational setting, which supplemented the TAM. The original formulation of the UTAUT was then followed by the UTAUT 2 (Venkatesh et al. 2012) which, although keeping the theoretical premises of the UTAUT, includes an additional set of variables to make it applicable to the wide range of technologies that are used for non-work-related reasons. The latter technologies, hence, can also be fruitfully applied to the specific case of PET that, despite originally being designed for organizations, are now more often applied by individual internet users (Namara et al. 2020). The UTAUT2 incorporates explanatory variables which simultaneously regard the technical sphere, the user’s intrinsic motivations, and the surrounding social context. For these reasons, the UTAUT2 has extensively proved to be well suited to explain adoption of technological applications in online as well as in mobile settings (Shaw and Sergueeva 2019; Alalwan et al. 2017; Herrero and San Martín 2017; Morosan and De Franco 2016; Slade et al. 2015). In detail, the UTAUT2 assumes that intention to use and actual use of a technology depend on seven main precursors: performance expectancy, effort expectancy, social influence, facilitating conditions (which are all included in the UTAUT), hedonic motivation, price value, and habit (which are UTAUT2 extensions). In particular, performance expectancy and effort expectancy, respectively, refer to the “degree to which using a technology will provide benefits to consumers in performing certain activities” and the “degree of ease associated with consumers’ use of technology” (Venkatesh et al 2012, p. 159). These predictive variables are particularly important in the realm of PETs. These technologies, in fact, tend to be difficult to assess in terms of actual performance (Roßnagel 2010), are in many cases not particularly user-friendly (Roßnagel 2010; Galletta et al. 2004), and are often difficult for consumers to install and configure (Lee et al. 2017). Different to performance and effort expectancy, which cover the technical benefits that the use of a technology brings to its users, the construct of social influence relates to the presence and the impact of social forces in fostering or limiting the adoption of a technology, i.e. “the extent to which consumers perceive that important others (e.g. family and friends) believe they should use a particular technology” (Venkatesh et al. 2012, p. 159). In the case of PETs these social influences have been found and suggested to foster the decision to adopt and use the technologies. Besides appreciating PETs’ technical qualities, users increasingly value and seek online anonymity as a form of consumers’ antagonism to the so-called ‘surveillance capitalism’ (Zuboff 2015, 2019) which has thick subcultural overtones. As such, using PET is now often framed as a way of signifying one’s membership of groups and collectives that through actions resist firms and organizations suspected of using personal data and information for their own profit. As the UTAUT model was originally developed to explain technology adoption in the organizational setting, researchers included facilitating conditions to assess the degree to which an individual believes an organizational and technical infrastructure exists to support them using the system (Venkatesh et al. 2003). Hence, the construct of facilitating conditions, when applied to technologies used for private, i.e. non-organizational, purposes, is equated to the construct of perceived behavioral control found in the theory of planned behavior (Ajzen 1991), or to the construct of self-efficacy in Bandura’s social learning theory (Bandura et al. 1999). This construct, in fact, refers to the person’s belief that he/she is in control of the behavior in question, such as using a technology (Venkatesh et al. 2003).

In addition to these four drivers that prompt technology adoption, i.e. performance expectancy, effort expectancy, social influence, facilitating conditions, Venkatesh et al.’s (2012) UTAUT2 model adds three more drivers, namely hedonic motivation, price value, and habit. Hedonic motivation, which was added to the original formulation of the UTAUT to account for intrinsic and affective motivations in predicting consumer technology adoption, refers to “the fun or pleasure derived from using a technology” (Venkatesh et al. 2012, p. 161). In a recent review of this construct’s complex introduction to UTAUT2-based studies, Tamilmani et al. (2019) found that the large majority of studies supported a significant effect of hedonic motivations on the behavioral intention to adopt a technology.

Using online anonymizers and PETs in general can be fun and entertaining for the end-user (Kang et al. 2013). The use of these technologies in fact requires users to continuously experiment with new tools, to update the existing ones, and interact with other users for problem solving during anonymous navigation or simply to improve enjoyment of the anonymous experience. Price value assesses the consumers’ cognitive trade-off between the perceived benefits of the technology and the monetary costs associated with purchasing and using it. Finally, habit refers to the extent to which people tend to perform behaviors automatically. As Venkatesh et al. (2003) noted, habit should be included as use behavior does not necessarily result from deliberated decisions, but can be a part of taken for granted routines and habits. As with other models designed to explain the phenomenon of technology adoption, the seven constructs composing the full UTAUT2 have rarely all been included in a single empirical study. A recent meta-analysis of empirical research grounded on the UTAUT2 tenets (see Tamilmani et al. 2018a, b), revealed that more than sixty percent of the published studies did not include the habit and the price value construct, and those that did, quite often reported inconsistent effects. Specifically, habit is often excluded in studies referring to new technology and when users are at an early stage of adoption, i.e. before sufficient time has elapsed for users to form a habit in using it (Tamilmani et al. 2018a, b). The variable of price value, in contrast, is excluded because the vast majority of the technologies we investigated do not require any kind of financial contribution from the user. Similarly, since this research focuses on newly established technologies and since it focuses of technologies available to users for free, e.g. Tor or the majority of popular personal VPNs and proxy servers, we excluded the constructs of habit and of price value in developing the framework and its underlying hypotheses. Based on this reasoning we advance the following hypothesis:

H1

Performance expectancy (H1a), effort expectancy (H1b), social influence (H1c), facilitating conditions (H1d), and hedonic motivation (H1e) directly and positively influence users’ intention to adopt PETs.

3.2 Security concerns

A main reason for users wanting PETs is to protect their online anonymity, i.e. to avoid others, such as internet service providers, websites, or social networks to link online behavior to their identity. PETs give users two main benefits related to anonymity: privacy and security. Privacy, refers to individuals’ right to determine for themselves when, how, and to what extent information about them can be transmitted to others. Security is defined as the protection of data against accidental or intentional disclosure to unauthorized persons or entities, or against unauthorized modification or destruction (Udo 2001). As mentioned above, while prior research has investigated the role of privacy concerns in determining the intention to or actual adoption of PETs, there is, as yet, no research focused on security concerns. However, due to the internet now being an integral part of our lives, security becomes the protection of everything we do in the online world, from purchasing goods and services, to browsing history; from remotely managing domestic appliances, to personal data storage; from preventing illegal access to our social networks, to protecting our bank accounts from criminal intrusion. In fact, it is no wonder that previous scholars focusing on technological aids for processing payments (e.g. Morosan and De Franco 2016) or online tax filing (e.g. Carter et al. 2011) used security related constructs as determinants of intention to use these technologies. Thus, in line with previous reasoning and with previous research findings, we expect that the higher the individual’s security concerns, the higher the intention to adopt PETs. H2 is thus put forward as follows:

H2

Security concerns directly and positively influence users’ intention to adopt PETs.

3.3 The mediation of UTAUT2

We have hypothesized the existence of a direct effect between, on the one hand, the constructs composing the UTAUT2, i.e. performance expectancy, effort expectancy, social influence, facilitating conditions, and hedonic motivation, and on the other hand, intention to adopt. We have also hypothesized a positive relationship between security concerns and intention to adopt PETs. Following an approach in line with previous contributions (e.g. Park et al. 2015; Jackson et al. 2013), we now also hypothesize a mediation effect of the considered UTAUT2 variables, in the relationship between security concerns and intention to adopt PETs. The increased consumers’ awareness of security issues, conveyed through enhanced levels of their concerns, extends technological-utilitarian motives and additionally encompasses subjective and social considerations. This is confirmed by, among other things, the proliferation of PET-focused websites, online communities, dedicated forums, and more generally, by the increased media coverage these emerging technologies are gaining. Therefore, the assumption that the relationship between security concerns and users’ intention to adopt PETs can be mediated by a comprehensive set of intrinsic-extrinsic as well as cognitive-affective drivers, such as those included in the UTAUT2, seems to be reasonable and logically supported (Venkatesh et al. 2012). Scholars have in fact found that constructs like the TAM’s perceived usefulness and ease of use—which are substantially identical to UTAUT and UTAUT2’s performance expectancy and effort expectancy—mediate the effects of security concerns (Müller-Seitz et al. 2009) or perceived security (O’Cass and Fenech 2003) on the use or intention to use mainstream Web technologies. Similarly, hedonic motivations have been found to positively mediate the effect between perceived security and adoption of online technologies, such as e-banking solutions (Salimon et al. 2017). Finally, considering that users also turn to social environments like online communities to better define their intrinsic concerns (i.e. for self-discovery purposes, see Dholakia et al. 2004), we further postulate that social influences mediate the effect of security concerns on the intention to adopt PETs. Therefore, we propose the third hypothesis:

H3

Performance expectancy (H3a), effort expectancy (H3b), social influence (H3c), facilitating conditions (H3d), and hedonic motivation (H3e) mediate the direct and positive relationship between security concerns and users’ intention to adopt PETs.

3.4 Accounting for users’ expertise

The moderating role of user expertise on users’ intention or behavior has been theorized, included, and tested in multiple technology acceptance settings (Kim and Malhotra 2005; Venkatesh et al. 2003; Xu and Gupta 2009; Castañeda et al. 2007; Venkatesh et al. 2012). In the specific context of adopting communication anonymizers, accounting for users’ expertise seems to be paramount, given that different users not only understand online anonymity differently, but also seek different strategies for obtaining it (Sardà et al. 2019; Shelton et al. 2015; Kang et al. 2013). Often, especially in computer-mediated communication, users can fall victim to a presumption of anonymity, i.e. they assume they are completely anonymous, even though their data is actually exposed. Different degrees of technical ability and familiarity with the technological context can play differential roles in the use of anonymity-granting technologies (Wallace 2008). Moreover, many non-experienced users lack the required awareness of the threats and the situations that require a security tool (Acquisti and Grossklags 2005). In other words, more experienced users are more likely than the less experienced to have the background and the skills set required to become acquainted with and develop the kind of concern that will assist them in perceiving the efficacy and performance of the technology. Thus, we hypothesize the following:

H4

The relationship between security concern and users’ intention to adopt PETs is stronger for more experienced users than for less experienced users.

H5

The mediation effect of performance expectancy (H5a), effort expectancy (H5b), social influence (H5c), facilitating conditions (H5d), and hedonic motivation (H5e) between security concerns and users’ intention to adopt PETs is stronger for more experienced users than for less experienced users.

All of the research hypotheses presented above are depicted in Fig. 1.

Fig. 1
figure 1

Baseline model and tested hypotheses

Full size image

4 Method

4.1 Data collection strategy

To collect the data, we focused on online communities in which discussions about PETs take place. Such online discussions take place on various websites that are established and managed either by technology vendors, or by users. Among these, Reddit (www.reddit.com) was chosen as the preferable setting for data collection. Due to its typical structure, i.e. divided in multiple interrelated subforums, Reddit allows the researcher to target specific interest groups (Shatz 2015) and to mitigate the recruited respondents’ self-selection bias (Shatz 2016). Further, Reddit is basically a network of communities established, managed, and made active by users without any external party intervention. In this way, supposedly, the platforms become more lively, thus stimulating a higher sense of participation, commitment, and belonging compared to others that are similarly focused on the same issues, but established and managed by technology providers (Pedeliento et al. 2020). The questionnaire we administered was submitted to the communities listed in Table 2, which are all characterized by being closed, moderated, and guided by strict rules and codes of conduct. Any post must be submitted to a gatekeeper before it will be published. Posting surveys and questionnaires is usually banned, with only a few exceptions allowed after a thorough negotiation process with the subforum’s moderators who review and suggest changes to the survey to make it compliant with the community standards. In our case, this process led to a shift from mainstream, data-tracing services like Google Form, which the community members perceive as intrusive, to more privacy and security friendly ones like Survey Monkey (surveymonkey.com) and Block Survey.io (blocksurvey.io). Thus, we used the latter two to collect the data. The moderators granted us access to the requisite communities; in addition to asking for precise details on the research purposes and the researchers’ affiliation, and carefully checking the questionnaire’s content, they explicitly endorsed the data collection, thus granting our data collection legitimacy among the community members. Conducting research about phenomena which can encompass stigmatized activities or hidden actors entails significant technical as well as ethical complications (Barratt and Maddox 2016). Gathering data which depicts internet users’ intention to adopt anonymity-granting technologies means working with participants who are likely to be concerned about the security of their online identities. As one could expect, these participants’ general mistrust and unwillingness to provide and share any kind of information relatable to the self makes data collection difficult. To illustrate this, despite having followed and guaranteed a research protocol aimed at securing the respondents’ anonymity throughout the entire data collection phase, we still encountered some evocative manifestations of suspicion and resistance from target respondents, in comments anonymous users posted beneath our survey, such as “I like to protect my privacy by not filling out online surveys” (User_name1), or “I think the number of people who refuse to fill out this survey would actually make for a useful data point in this study” (User_name2).

Table 2 Reddit’s PETs focused communities we used in data collection
Full size table

4.2 Survey instrument

The questionnaire was structured in two parts. The first part asked for the respondents’ demographic information, such as gender, age, place of residence, profession, and education. These questions asked participants to respond voluntarily, showing consideration and respect for the respondents’ sensitivity to anonymity.

The second part listed a set of observed variables to measure the constructs composing the theoretical framework tested. We drew the variables of the UTAUT2 from Venkatesh et al. (2012) and adapted them to the specific context of PETs. Due to the lack of sufficiently reliable and valid measurement scales in the extant literature, we derived items measuring the latent variable of security concern from the multidimensional Addae et al.’s (2017) Personal Data Attitude (PDA) scale. The usage of a single dimension of the overall measurement scale allowed us to compose a measure of security that minimize conceptual and operational overlap with similar measures of privacy concerns. We measured all the items on a 7-point Likert scale, ranging from 1 (totally disagree) to 7 (totally agree). However, for measuring users’ expertise with PETs we used a self-reported measure of expertise allowing them to choose from a set of three different options: (1) high level of expertise with PETs (more than 12 months of experience using PETs); (2) moderate level of expertise with PETs (from 6 to 12 months of experience using PETs); (3) low level of expertise with PETs (less than 6 months of experience with PETs).

5 Results

5.1 Sample of respondents

We posted the survey to Reddit communities in two waves, to account for the fact that the highest interaction in the subforums typically occurs during the first 24 h after the initial posting (Moyer et al. 2015; Shatz 2015). The first wave resulted in 118 responses. After 14 days, we sent a reminder, resulting in additional 124 additional responses. Although compared to the actual size of the communities the response rate is low (< 1%), it is in line with previous research focused on PET adoption (e.g. Harborth and Pape 2019) and with previous studies conducted on Reddit-based communities (Shatz 2016). Overall, 221 respondents completed the questionnaire. Of these, 18 were discarded because respondents disclosed they have never used anonymizers before, and another five responses were excluded due incomplete data. The final sample of responses, hence, was composed of 198 questionnaires. To avoid non-response biases, we used the technique advocated by Armstrong and Overton (1977), comparing the subject responses received from different communities and different waves. No significant differences were found regarding independent variables or criterion variables.

Table 3 shows the socio-demographic characteristics of our sample: respondents’ average age was 29, while 104 (53%) were male, 38 (19%) female, and 56 (28%) did not declare their gender. We compared this socio-demographic data to that of the population from which it was drawn (GlobalWebIndex 2018b, c) as well as to other samples used in previous research (Spiekermann 2005), and judged our sample to be representative. Notably, the number of respondents who opted not to give demographic information, is relatively high. As previous studies suggest, the investigated population’s significant concern about privacy and security can be considered the main reason why respondents were reluctant to share this information (Harborth et al. 2020). Finally, regarding the level of expertise with anonymizers concerned in the study, the results revealed that the sample of respondents is almost evenly split into two proportionate groups of users. The first declared themselves to have a high level of PET expertise (48% of the sample), named the more experienced users, and the second self-assessed their degree of PET expertise as moderate account or low (52% of the sample), named less experienced users).

Table 3 Description of the sample
Full size table

5.2 Measurement model

To test the hypotheses, we first conducted an exploratory factor analysis (EFA) using the Maximum likelihood procedure with the Direct Oblimin rotation method, and we successively tested the structural equation model analysis (Steenkamp and Baumgartner 1998) with AMOS 23.0 program.

Accordingly, we conducted an EFA to test the convergent and discriminant validity of the adapted conceptual model (Tabachnick and Fidell 2007). Items with low communality scores (< .4) were discarded as they represent problematic items (Field 2013). We then reran a further EFA analysis which produced a simple solution comprising six factors. Most of the items loaded on separate factors with factor loadings exceeding the .4 threshold (Field 2013), with all cross-loadings on other factors being insignificant, so that we conclude there are no convergent and discriminant validity issues in this EFA solution (Fornell and Larcker 1981). This test led us to discard one item from the construct performance expectancy, three items from intention to use PETs, and the full construct of facilitating conditions.

Successively, we ran a CFA to validate the measures and to define the relations between observed and latent variables. We established a six-construct measurement model with the remaining 19 observed variables. The measurement model’s goodness of fit statistics revealed a good fit. The ratio between the Chi square (χ2 = 201.899; p < .000) and degrees of freedom (df = 137) is below 2 (Tabachnick and Fidell 2007) and all other relevant fit indexes overcome the recommended thresholds: RMSEA = .049; CFI = .967; NNFI = .959. The constructs showed excellent internal consistency: Cronbach’s alphas ranged from a minimum of .76 to a maximum of .88. Moreover, the composite reliability (CR) and average variance extracted (AVE) of each construct were above the recommended threshold levels of .6 and .5 respectively (Bagozzi and Yi 1988). The model met the requirements for convergent validity, with each item loading significantly and substantially (above .5) on the expected latent construct (Table 4).

Table 4 Overall CFA for the measurement model
Full size table

Moreover, in order to reduce the risk of common methods bias for data, we employed Harman’s single-factor test (Podsakoff et al. 2003). We estimated a CFA to compare our model to a constrained single-factor model. In case of common method variance, the single latent factor would account for all of the variables. The single-factor fit showed no evidence of common method bias, as it exhibited χ2 = 1066.59 and df = 152. Thus, the measurement model demonstrated significantly improved fit (p < .001).

Finally, following Fornell and Larcker (1981), we assessed the discriminant validity of each construct, by comparing the AVE values with the squared correlations for all pairs of latent variables. As the highest squared correlation is .525 and the lowest related AVE is .679, all pairs of constructs met this condition (Table 5).

Table 5 Correlations among constructs
Full size table

5.3 Structural model

The structural model showed an excellent level of fit: χ2 = 201.899; df = 137; p < .000; RMSEA = .049; NNFI = .959; CFI = .967. The test of the direct relationship between UTAUT2 constructs included in the model and the users’ intention to adopt PETs was supported. In particular, the results show that performance expectancy (H1a), effort expectancy (H1b), social influence (H1c), and hedonic motivation (H1e) are all directly and positively related to users’ intention to adopt PETs. We did not test for the hypothesized relationship between facilitating conditions and users’ intention to adopt PETs (H1d), nor for its mediation effects (H3d and H5d) due to the exclusion of the construct facilitating conditions from the analysis. The results of the structural model (see Table 6) also provided support for H2, i.e. that security concerns and users’ intention to adopt PETs are directly and positively related (ß = .18; p < .01). Moreover, we found that security concerns explain social influence (ß = .45; p < .00), hedonic motivation (ß = .39; p < .00), and performance expectancy (ß = .37; p < .00), but not effort expectancy. Finally, to provide a test of H3, i.e. that performance expectancy (H3a), effort expectancy (H3b), social influence (H3c), and hedonic motivation (H3e) mediate the direct and positive relationship between security concerns and users’ intention to adopt PETs, we followed a procedure of controlling for covariances among mediators to achieve better and more reliable estimates for specific indirect effects. To test for indirect effects, we decided not to use the Sobel Test because it assumes a symmetric distribution of the indirect effect and therefore would lead to biased results. Rather, we applied MacKinnon’s (2008) procedure which consists in computing a 95% asymmetric confidence interval for each specific indirect effect using PRODCLIN software (MacKinnon et al. 2007). As Table 7 shows, social influence and hedonic motivation mediate the relationship between security concern and users’ intention to adopt PETs. Hence, H3c, and H3e are supported. The data, however, did not support the hypothesized mediation of performance expectancy and effort expectancy. Hence, we rejected H3a and H3b which gives only partial acceptance of H3.

Table 6 Standardized direct effects
Full size table
Table 7 Standardized indirect and total effects of security concern on intention to adopt PETs
Full size table

5.4 Multigroup analysis

Besides testing for direct and indirect effects of the theoretical model specified in this research, we also tested additional hypotheses based on the users’ level of expertise. In detail, we found that the relationship between security concern and users’ intention to adopt PETs is stronger for more experienced users than for less experienced users (H4), and that the mediation effect of performance expectancy (H5a), effort expectancy (H5b), social influence (H5c) and hedonic motivation (H5e) between security concerns and users’ intention to adopt PETs is stronger for less experienced users than for more experienced users. The structural equation model made it possible to control for the covariance between the mediator and thus to obtain more reliable estimates for specific indirect effects. We tested indirect effects applying MacKinnon’s (2008) procedure by using PRODCLIN software (MacKinnon et al. 2007).

The measurement model estimated for the two groups independently (more and less experienced) demonstrated a good fit with the data, both for the more experienced (χ2 = 221.261; p = .00 df = 137; RMSEA = .081; CFI = .904; NNFI = .880), and for the less experienced (χ2 = 167.616; p = .03; df = 137; RMSEA = .047; CFI = .971; NNFI = .964). To test whether the two samples show the same factor pattern, we ran the configural invariance test, that showed a good fit (χ2 = 338.951; p = .00 df = 274; RMSEA = .046; CFI = .941; NNFI = .926). In order to verify that the interpretation of item measurement between more and less experienced users is the same, we tested the metric invariance. In this case, the results also showed a good fit (χ2 = 410.258; p = .00; df = 287; RMSEA = .047; CFI = .936; NNFI = .926) and the univariate χ2 incremental value reveals that the probability value is higher than .05.

Finally, we conducted a test of structural invariance to verify that a structural model specified in one sample (e.g. more experienced users), replicates in a second independent sample from the same population (e.g. less experienced users). In particular, we started by testing H4, i.e. that the relationship between security concern and users’ intention to adopt PETs is stronger for more experienced users than for less experienced users. The results show that this relationship is significant only for more experienced users (ß = .43; p < .00), while it is not statistically significant for the group of less experienced users (ß = .04; p > .05). We then proceeded to test the mediation effect of the retained UTAUT2 variables, i.e. performance expectancy (H5a), effort expectancy (H5b), social influence (H5c), and hedonic motivation (H5e) in the relationship between security concerns and users’ intention to adopt PETs. The results show that while the relation between security concerns and users’ intention to adopt PETs is significant and non-mediated for more experienced users, this relationship, contrastively, is fully mediated by social influence and hedonic motivations for the less experienced users. The mediation effect of the other variables included in the model, i.e. performance and efforts expectancy, are non-significant, so that we find only partial support for H5 (see Table 8).

Table 8 Standardized indirect and total effects of security concern on intention to adopt PETs for more experienced and less experienced respondents
Full size table

6 Discussion

This study expands the still nascent user-focused research aimed at understanding what may drive and what may obstacle end-user’s acceptance and subsequent adoption of more popular PETs like communication anonymizers. In particular, it has been designed to address an overlooked phenomenon in the PET-related domain, that is related to how users’ security concerns affect their intention to adopt PETs. The results show that the predictive power of the UTAUT2 model (Venkatesh et al. 2012) holds even when the intention to use PETs is of concern. All of the constructs we retained, namely performance expectancy, effort expectancy, social influence, and hedonic motivations, were found to be significantly and positively related to users’ intention to adopt PETs. Even though previous research has already proven that technical considerations are pivotal in determining the acceptance of these technologies (Harborth et al. 2020), our findings provide the very first empirical evidence that, at least at the intentional stage, social and hedonic aspects are equally taken into account by PET adopters. Recall that, differently to the originally specified model, we discarded the construct facilitating conditions (which is a constitutive part of both the UTAUT and the UTAUT2), as it failed the EFA. Indeed, this construct, with its underlying meaning is operationalized in such a way that it overlaps with both the UTAUT’s effort expectancy and the TAM’s ease of use (Venkatesh et al. 2003), and has for this reason similarly been discarded in other empirical research focused on similar technological contexts (Shawn and Sergueeva 2019). A possible explanation for the statistical inconsistency of the facilitating conditions construct in our results could lie in the fact that the construct includes the extent and type of support provided to aid technology use, and the fact that despite being around for a while, this kind of support has only limitedly been rolled out (especially compared to other technologies). In contrast, our results reveal that security concerns do prompt users’ intentions to adopt PETs for both more and less experienced users, which confirms the motivational role of the “personal threat model,” making it one of the key reasons for users’ turning to anonymous browsing (Kang et al. 2013). As the frequency with which episodes of online security violation rises, individuals’ concerns about the possibility that third parties will encroach on and manipulate their personal data increases. Thus, a growing share of internet users take precautions. The general finding, however, that these technologies should be perceived as useful, easy to use, as well as socially accepted and enjoyable by the end-user is not very informative per se (Shawn and Sergueeva 2019). Therefore, we sought a theoretical explanation as to why constructs composing the UTAUT2 could be considered as mediators of the relationship between security concerns and intention to adopt PETs. The analysis revealed that while two of the UTAUT’s core constructs, i.e. performance expectancy and effort expectancy, do not play any significant mediating role in this relationship, the others, i.e. hedonic motivation and social influence, do mediate the relationship. The perceived enjoyment, pleasure, or fun derived from using these applications (condensed in the hedonic motivations construct) together with social pressure that relatives, colleagues, or peers exert (described by the latent variable of social influence), significantly influence the individual’s choice to adopt the technology. Also, they have the power to amplify the primary reason for users turning to PETs, i.e. to address their security concerns. These findings support the view that online anonymity-granting technologies have a function and associated meanings that go beyond their technical/utilitarian features to additionally encompass others that relate to the social as well as the individual sphere (Wallace 2008). Nevertheless, we identified important differences between the groups. The results of the multigroup analysis of more and less experienced users clearly show that the effect of security concerns on the users’ intention to adopt PETs is tightly connected to the relative degree of users’ technological expertise. In detail, security concerns are significant and direct drivers of users’ intention to adopt PETs, that are limited to the cluster of more experienced users. For this group of respondents, the results did not support the hypothesized mediation of the UTAUT2 constructs in the relationship between security concerns and intention to adopt PETs. Therefore, based on the results, we can infer that for more experienced users, the will to achieve a solution to their security concerns is a sufficient condition prompting their decision to use online anonymizers. This category of users, in fact, is likely to possess the technological knowledge and technical expertise required to master these technologies, making other conditions, especially those related to hedonic and social aspects related to technology use, less important. Using online anonymizers is not easy at all, and their adoption requires a higher level of technical knowledge than regular internet users have; they can make online navigation slower, more challenging, and less spontaneous. Differently stated, security concerns have such an important role in experienced users’ needs hierarchy that per se they justify turning to these technologies, regardless of whether they meet their performance and effort expectations, and no matter whether they are enjoyable or socially acceptable.

In the case of less experienced users, the relation between security concerns and intention to adopt PETs was found to be fully mediated only by social influence and hedonic motivations. Thus, for those less experienced, security concerns alone are not sufficient to explain their intention to adopt. These users need support to understand the risks and implications of a potential misuse of their personal data and of the tools they can apply to achieve higher levels of security. Differently stated, the likelihood of less experienced users adopting a PET is connected to the technology’s ability to satisfy their hedonic needs, as well as to the social acceptance and legitimacy these technologies have among others.

Owing to the importance of social forces in fostering users’ willingness to adopt PETs, it is little wonder that several online communities and discussion forums have recently emerged. The aim of these communities is not limited to familiarizing people with how to use technologies, but also—and perhaps foremost—to evangelize others regarding the importance of protecting their online lives and their online security. These communities, in fact, often tend to focus on security concerns by emphasizing the ideology that underpins online anonymity rather than on the technical means users’ can leverage to achieve higher levels of online privacy and security. This, we contend, is perhaps the main reason why less experienced users rate social influences as more relevant than more experienced ones do.

6.1 Practical implications

This article’s findings have several managerial implications addressed at two different target audiences. The first are firms that have an online presence, i.e. that have entirely online business models and/or that conduct a part of their business operations online. The second are firms whose business is to develop, distribute, and sell PETs. For the former, our results suggest that they should pay increasing attention to issues concerning the felt online security of their prospective and actual consumers. The more the internet’s penetration in people’s lives increases, the more security issues will assume importance. Security hence will play an increasingly important role in driving consumers’ purchasing choices and—for this reason—is expected to affect new product and new business development, as well as business communication and advertising. The use of anonymizers in particular, can seriously endanger the long-term survival of those data-driven companies that need to collect and analyze a large number of consumers’ behavioral and traffic data to take decisions and to predict future scenarios. Companies like Google, Amazon, Facebook, and other tech-giants could sustain serious damage if internet users were to turn to online anonymizers en masse, as they would necessarily have to find new ways of monetizing internet traffic. Problems could also emerge for companies selling their goods and services via online channels if they are unable to assure the highest levels of security to prevent cyber-attacks and cyber fraud that could discourage consumers from purchasing online. Again, the more online security concerns attract general attention, the higher the likelihood that consumers will place security at the top of their priorities list. Besides continuing to develop and adopt technologies and systems aimed at increasing online security, it is important that managers develop a strategic communication focused on security issues. This can be shaped to reassure consumers of the security of their online data, information, and identities, and could even represent a key selling point to differentiate their own offering vis-à-vis that of competitors.

Regarding PET developers, the findings underline the importance of evaluating both intrinsic and extrinsic motivations as main determinants of the intention to adopt online anonymizers. We thus recommend that developers seriously consider the effects of hedonic motivation and social influence in prompting users to adopt these technologies, while putting less emphasis on technology-specific issues that will possibly be taken for granted once the online anonymizers have increased their penetration and become widely diffused. On a tactical level, we suggest that PET developers attend more to the level of engagement that users can experience by using PETs, for example by underlining the fun and entertainment installing, using, and updating an anonymizer offers. Also, they should play a more active role in influencing the social debate on online security to emphasize how useful PETs can be. Differently stated, we suggest these companies should act as ideological proselytizers (Holt 2006) that stand beside communities and social movements committed to making the internet a more secure and less surveilled place. This could be especially effective for PET developers targeting less experienced consumers who are more likely to be convinced to use anonymizers if they are perceived as entertaining, as well as socially accepted and endorsed. To these aims, developing new communities and movements or supporting existing ones, regardless of whether they are online or off-line, with a focus on online security, can be an effective way for managers to shape the social debate on these issues, thereby also serving their own profit and interest.

6.2 Limitations and further research

The results and the implications of this article should be read with certain limitations in mind. The first limitation relates to the sample that we used in the study. We collected the data from a community of users that have a fair level of expertise on PETs. Therefore, we need further to test the validity of our proposed empirical model on a sample of respondents characterized by very low technological readiness and a lower level of familiarity with online anonymizers than our sample. This could be of great importance if PET is to achieve higher rates of penetration and mass-market diffusion, as shedding more light on ‘regular’ users would attend to the ones that need to be engaged and convinced of the value anonymizing can bring. The second limitation pertains to the methodology we used in our study. We relied on quantitative methodologies because they allow for collecting a large amount of data with relatively low effort; however, the using a qualitative methodology could be fruitful to complement our findings and delve deeper into some issues that we still do not fully understand. For example, although our findings show that social influence plays a major role in users’ intention to adopt PETs, we still know very little about what these social forces are and how they shape the environment that most likely fosters and eventually boosts adoption. A third limitation relates to the number of variables and of mediating variables we used. Despite the UTAUT2 being well suited to provide solid insight on what motivates users’ adoption or intention to adopt technologies, it remains limited to a finite number of variables and does not exclude the possibility that other factors can influence intention. Finally, the substantial lack of moderating variables in the model we tested should be recognized as a limiting concern. The UTAUT2 model generally implies the use of moderators such as age, gender, and expertise; nevertheless, while we took expertise into account, we did not include age and gender because managers of the communities we targeted for data collection did not allow us to request this kind of information as it was deemed to be too intrusive in a user community highly concerned about privacy and security. Thus, we cannot indicate whether age and gender affect the hypotheses we tested. In addition, it has to be noted that the moderating variable of expertise used was a self-reported measure. Despite the characteristics of the respondents included in the sample, i.e. people that share a common interest in PETs usage, allow minimizing the risks implicit in the usage of self-reported measures of expertise, biases that may stem from the usage of such measures (e.g. social desirability bias, Crowne and Marlowe 1960) cannot be neglected and require to be outlined especially for the sake of results’ generalizability.

7 Conclusion

Internet and web-based technologies’ increased role in our lives is attracting a great deal of attention, especially regarding the security and privacy related risks implied in using the internet for communication, purchasing, and work-related reasons. This explains the multiple technologies that consumers currently can use to achieve higher levels of online anonymity and greater online security. These technologies fall under the umbrella label of PETs—privacy enhancing technologies—that, despite gaining momentum, according to the current literature are still rarely investigated and poorly understood.

This paper confirms that extant research tends to focus on privacy and neglects issues related to online security. With the aim to fill existing gaps in the emerging literature, our research was designed to gain understanding of how users’ security concerns affect their intention to adopt PETs. To achieve this aim, we developed a theoretical framework based on the UTAUT2, tested a set of underlying hypotheses, and compared the suggested model’s predictive validity by also accounting for users’ expertise. The results we report suggest that despite UTAUT’s variables predicting intention to adopt PETs, their most important role is one of mediating the relationship between security concerns and intention to adopt PETs, with special reference to the group of users that have lower levels of expertise. However, due to the wide global diffusion of PETs, the need for further investigation of motives prompting users to adopt such PETs remains.