Examining Caregiving Roles to Differentiate the Effects of Using a Mobile App for Community Oversight for Privacy and Security

A recent Pew Research study (Vogels and Anderson, 2019) reported that most adults in the U.S. have significant knowledge gaps regarding their digital privacy and security. The report suggests a lack of understanding of how third party entities access personal information online (Auxier et al., 2019), making users susceptible to privacy and security breaches. This begs the question of how we might close this knowledge gap? Previous studies have explored solutions involving one party overseeing another, such as organizations using Mobile Device Management systems to secure employee data (Hayes et al., 2020) and parents monitoring teens through mobile online safety apps (Wisniewski et al., 2017). These studies suggested that collaborative approaches, rather than unilateral controls, can offer better privacy protection by fostering collective learning and discussion  (Akter et al., 2022). Crowdsourcing has also been proposed as a method to improve individual’s mobile privacy decisions such as managing app permissions to safeguard personal information (Lin et al., 2012; Ismail et al., 2017; Zhang and Xu, 2016; Liu et al., 2019), though it often lacks reliability (Rashidi et al., 2018). An approach that has shown promise is to leverage the social influence of informal networks to infuse expertise and exert influence on privacy and security decisions (Mendel and Toch, 2017). For example, several studies have shown that people tend to trust and follow privacy advice from their trusted circles, often turning to friends and family for guidance on digital privacy and security topics (Mendel and Toch, 2017; Das et al., 2014a, b).

Therefore, networked privacy researchers have called for community based approaches to co-manage digital privacy and security, where individuals in a trusted community can help one another equally make individual and collective privacy and security decisions (Wan et al., 2020; Chouhan et al., 2019; Aljallad et al., 2019). While this body of research confirms that people often rely on their social connections to inform their digital privacy and security decisions, it has yet to explore how these dynamics shift when relationships involve knowledge imbalances or power hierarchies, such as caring responsibilities for children or older adults. Prior studies (Akter et al., 2022, 2023b; Chouhan et al., 2019; Kropczynski et al., 2021b) have shown how communities often consist of hierarchical (i.e. uneven) levels of expertise and knowledge. Individuals with more expertise often take the role of “caregivers” to provide support and guidance to others who are less tech-savvy (Van Parys, 2019; Correa et al., 2015; Kiesler et al., 2000; Poole et al., 2009). Other individuals in the community are at the receiving end of the privacy and security support (Kropczynski et al., 2021a; Ghaiumy Anaraky et al., 2021), and are thus considered “caregivees”. However, community-based collaborative approaches may not take into account these unequal levels of expertise, as they have been primarily designed to support community members equally, with individuals giving and receiving feedback. Recently, Akter et al. (Akter et al., 2023b) conducted a field study using a community oversight app that allowed individuals in a community to help each other equally and found that users, in general, benefited from using the app. However, their work did not examine the presence or impact of potentially unequal roles within communities.

This paper aims to address this gap, by investigating: 1) how caregivees vs. caregivers differ, 2) how mechanisms designed for collaborative community-based privacy and security support may affect caregivers and caregivees differently, and 3) if there are distinct differences in privacy behaviors between these two groups. To do this, we developed and deployed a community oversight app, called ”CO-oPS” that allows people of a trusted community to review one another’s mobile privacy and security decisions and provide advice and feedback on them. Our primary goal is to investigate how differently caregivers, who provide oversight, and caregivees, who receive the oversight, would be impacted by using the app. By providing insights into the varying effects of the CO-oPS app on these two unequal roles, we expect to gain generalizable knowledge that helps researchers and designers better understand the phenomena of privacy and security caregiving, how privacy-based interventions may effect these groups differently, and how to redesign future privacy-based interventions tailored to the unique needs of caregivers and caregivees. As such, we seek to answer the following high-level research questions:

• •

  RQ1: How do the characteristics of Caregivers versus Caregivees differ?

• •

  RQ2: How do the perceived outcomes of using the CO-oPS app differ based on Caregiving status?

• •

  RQ3: How do the privacy behaviors of Caregivers and Caregivees differ when using the CO-oPS app?

To answer these research questions, we conducted a field study with 22 self-organized groups of 2-6 smartphone users. First, participants within each group reported their pre-existing caregiving relationships by identifying the individual(s) in their community for whom they go to for advice and questions regarding their mobile privacy and security, whom we labeled as caregivers. The rest of the community members were labeled as caregivees. We then had our communities of caregivers and caregivees use the CO-oPS app for four weeks, complete pre-post-study surveys, and participate in optional follow-up interviews. To answer RQ1, we first examined how the caregivers and caregivees are different in terms of their demographic information and power usage - individual’s propensity to maximize the use of technology to its fullest (Sundar and Marathe, 2010). For RQ2, we measured how our caregivers’ and caregivees’ perceptions for community trust (Chouhan et al., 2019), community belonging (Carroll and Reese, 2003; Kropczynski et al., 2021b), community collective efficacy (Carroll et al., 2005; Kropczynski et al., 2021b), and self-efficacy (Bandura, 1982; Kropczynski et al., 2021b) differed and changed after using the CO-oPS app. For RQ3, we measured the between-group differences among the pairs of caregivers and caregivees’ app activities they performed using the CO-oPS app. We also qualitatively analyzed their interview transcripts to further investigate how their perceptions towards the use of the CO-oPS app differed when they provided or received caregiving.

Overall, we found that caregivers reported higher power usage compared to caregivees, with no significant differences based on demographic characteristics (RQ1). For RQ2, caregivers showed higher levels across all pre-study measures—community trust, community belonging, community collective efficacy, and self-efficacy—compared to caregivees. Both groups experienced significant increases in self-efficacy and community collective efficacy in managing mobile privacy and security after using the CO-oPS app, with caregivees showing a significantly stronger increase. For RQ3, tensions arose around the privacy feature of the CO-oPS app, as caregivees expressed concerns about app usage privacy and thus hid a significantly greater number of installed apps, while caregivers viewed this feature as counterproductive to community oversight.

In summary, our study highlights the importance of differentiating caregiving roles in communities for collaborative mobile privacy and security management. It uniquely contributes to networked privacy research by examining collaborative mobile privacy and security management in the context of caregiving in communities to support individuals who need additional help. Specifically, our research: 1) Untangles the behavioral and perceptual differences between caregivers and caregivees when using a community oversight app; 2) Provides empirical evidence of the potential for community oversight to improve caregivees’ decisions on mobile privacy and security; and 3) Offers design recommendations for features aimed at supporting communities in providing and receiving caregiving tailored to the specific needs of individuals.

Community-based Approaches for Privacy and Security
A Pew Research study  (Atkinson, 2015) showed that 77% of U.S. smartphone users have reported downloading different third party mobile apps on their phones. These third party apps access users’ personal and sensitive information  (Anderson, 2015), often without users’ informed consent, as Reardon et al. reported in (Reardon et al., 2019). However, another Pew research study reported that a majority of U.S. adults have significant knowledge gaps and lack understanding of how to control and manage their digital privacy and security (Vogels and Anderson, 2019). Users even find it difficult to understand the language of app permission requests that third party apps prompt before accessing users’ information  (Ferreira et al., 2015) and, therefore, they struggle to decide whether to grant an app permission or not (Kelley et al., 2012). To help individuals with their digital privacy and security, privacy researchers have examined crowdsource-based approaches (Zhang and Xu, 2016; Liu et al., 2018; Lin et al., 2012; Liu et al., 2019) that leveraged the knowledge and information of other users to provide recommendations to users so that they can make informed decisions about their app permissions. For example, Zhang et al. (Zhang and Xu, 2016) proposed a social nudge mechanism that used the idea of visibility of social norms and allowed users to make app permission decisions based on the percentage of other users who approved different data permissions for each installed app. Through an online experiment, they evaluated this interface and found that users mostly perceived this social nudge as a social norm or collective expectation of information sharing, and users tended to approve their apps’ data use when they saw that more users accepted those apps’ permissions.

While these crowdsource-based solutions help individuals by raising their awareness about other users’ mobile privacy practices, they give little consideration to the trustworthiness of the information. Individuals might benefit more if the information comes from expert users who have expertise in mobile app privacy and security. Hence, Rashidi et al. (Rashidi et al., 2018) incorporated this idea of ”expert user” into their permission control framework titled ”DroidNet” which provided users recommendations based on the decisions made by the majority of expert users in the network. However, a large body of research work also demonstrated that individuals learn and change their digital privacy and security behaviors when they become aware of their close trusted circle’s privacy and security practices. For example, Das et al.’s studies (Das et al., 2014b, 2015) demonstrated the effectiveness of ”social proof” - i.e. being able to view how many friends in their social network use a specific security feature - and showed that individuals are more influenced to adopt a privacy and security feature when they witness adoption by others. Redmiles et al. also found that people trust and adopt privacy advice when it comes from their trusted close circles, e.g., family members, friends, and co-workers (Redmiles et al., 2016). In recent work, Mendel and Toch (Mendel and Toch, 2023) conducted a field experiment to evaluate a social support mechanism and found that users relied significantly more on the advice of close connections to learn about mobile security than community volunteers. Identifying the importance of social support in digital privacy and security, networked privacy researchers have investigated collaborative approaches. For instance, Wan et al. (Wan et al., 2020) designed a mobile app, titled AppMoD, to help individuals delegate their mobile privacy and security questions to an advisor - someone in their trusted social network. The advisor had the ability to make app permission decisions on behalf of the user. Chouhan et al. (Chouhan et al., 2019) proposed a community oversight framework to allow individuals in a trusted community, e.g., friends, family members, and co-workers, to help each other make their mobile privacy and security decisions together as a team.

The core idea behind collaborative community-based approaches (Wan et al., 2020; Chouhan et al., 2019; Aljallad et al., 2019) is to empower individuals within trusted communities to practice social support (DiGioia and Dourish, 2005; Das, 2016), enabling them to collaboratively assist one another in making both individual and collective privacy and security decisions. However, as suggested by Akter et al. (Akter et al., 2023b), these mechanisms are most effective when there are disparities in knowledge and expertise within the community, allowing those in need of support with mobile privacy and security decisions to benefit from the guidance of more knowledgeable community members. Despite this, the collaborative community-based mechanisms in the existing literature have not adequately considered the imbalance of expertise, caregiving roles, and the varying needs and perspectives (Badillo-Urquiola et al., 2020; Park et al., 2023) that accompany them. Therefore, the objective of our study was to investigate how these approaches, which treat all community members as equals, may or may not benefit caregivees who require additional support, as well as how they help caregivers support others. To examine these, we developed a collaborative community-based mobile privacy and security management app, CO-oPS, and conducted a study involving 22 groups of caregivers and caregivees who used the app within their groups. In the following section, we present a design overview of the CO-oPS app.

We developed the Android CO-oPS app based on the model of community oversight for privacy and security proposed by Chouhan et al. in (Chouhan et al., 2019). This app allows individuals in a trusted community, e.g., friends, families, and co-workers, to review one another’s apps installed and permissions granted, and provide or seek advice from one another, providing all community members the same interface and functionalities. Our app includes three main categories of features: 1) Co-monitoring, 2) Communication, and 3) Privacy.

Co-monitoring Features: These features allow users to view the list of community members (People page, Figure 1a). Here, they can explore the apps installed on each member’s device through the Discovery page (Figure 1b). For any installed app within the community, users have the ability to review the permissions granted or denied to that specific app on the Permission page (Figure 1c). This feature enables community members to assess each other’s choices regarding mobile privacy and security, facilitating joint learning and feedback. The Permission page displays a comprehensive list of permissions granted or denied to a particular app, alongside the number of community members who have made the same choices. Additionally, it offers users a convenient ”SETTINGS” link, redirecting them to Android Settings, where they can adjust the permissions of their own installed apps.

Communication Features: The communication features keep users connected regarding one another’s decisions, questions, and feedback. Here, users can stay updated on the permission changes made in the community, receive weekly tips, and engage in open discussion or private messaging. For instance, when permission changes are made using the above ”SETTINGS” link, the app automatically generates a post on the Community Feed, as shown in Figure 1d, to inform the entire community. The Community feed also fosters open discussion among community members. Moreover, this feed provides weekly tips to educate users on safe app usage and permissions. For example, one of the weekly tips was “Pay careful attention to the app permission prompts. If the permission is not required for the app to function, consider denying.” Lastly, the People page (Figure 1a) allows one-to-one messaging for asking questions or offering guidance.

Privacy Feature: This feature provides users with the option to control the visibility of their installed apps (Discovery page, Figure 1b), ensuring personal privacy regarding their app usage within the community. By allowing users to hide specific apps, they can selectively choose which ones are visible to others. When an app is hidden on a community member’s device, it becomes inaccessible for review by other community members on the Discovery page. Moreover, the changes made to the permissions of these hidden apps are not posted on the community feed page, further safeguarding the privacy of users’ app-related activities.

The overall goal of our study is to examine the key differences in privacy and security behaviors between the individuals who provide oversight and those who receive when using a community oversight app. To achieve these goals, we recruited 22 small self-organized groups of people (2 to 6 individuals), who knew each other. In total, 101 participants were recruited across these groups, starting with primary contacts who then invited others within their social circles to join. Participants installed and used the CO-oPS Android app for four weeks with their group to exchange support and guidance on their privacy decisions. Participants also completed pre- and post-study surveys and were invited to participate in optional follow-up interviews. The study received approval from the Institutional Review Boards (IRBs) of the universities involved.

Weekly App Tasks: At the beginning of the field study, community members were asked to install the CO-oPS app on their phones and setup their user profiles. A key step in this setup process involved the app launching the Discovery page (Figure 1b) with the prompt: ”Select the apps that you want to hide from your community,” allowing participants to choose which of their apps would be hidden from others. This ensured that participants could hide their installed apps before they became visible to their group members. To this end, we allowed our participants to decide the apps they wanted to hide from their group as we did not want to bias their choices. Each week, our participants received a list of tasks on the home page of the CO-oPS app, where they could check off each task after completion. However, we did not follow up with participants for not completing their tasks, as we wanted them to use the CO-oPS app as they saw fit to provide or receive privacy caregiving from one another. The weekly tasks are presented in Table 1. Upon completing the week-4 tasks and post study survey, participants were each compensated with a $40 Amazon gift card. N=3 participants discontinued after the second week and were compensated with a $20 Amazon gift card. However, we discarded all data collected from those participants who stopped participating.

Follow-up Interviews: At the end of the field study, we invited all participants to optional one-on-one Zoom interviews which allowed us to further explore how they perceived the CO-oPS app features for providing or receiving privacy and security support to/from their communities. N=51 participants volunteered for follow-up interviews, each of whom were compensated with a $10 Amazon gift card. Appendix-B presents the sample interview questions we asked during the interviews. The interview sessions took 40 to 70 minutes to complete, and were audio/video recorded.

Power Usage: In the pre-study survey, we measured participants’ power usage (Sundar and Marathe, 2010), which is defined as their perception of whether they are comfortable with technology in general and are likely to explore all possible features of the technologies they use. In Kropczynski et al.’s work  (Kropczynski et al., 2021b), they demonstrated that the caregivers who support their community in general technology usage had a higher level power usage compared to the caregivees. Therefore, we hypothesize that:

H1: Caregivers will report higher levels of power usage than caregivees.

Community Trust: In both the pre- and post-study surveys, we measured our participants’ perception of community trust. In this study, we created this construct based on the community oversight model framework that Chouhan et al. proposed in (Chouhan et al., 2019). We define community trust as an individual’s perception of trusting their community to keep their personal information, e.g., apps installed, private and to care for them to provide mobile privacy and security advice and guidance. The scale items are provided in Appendix A. Since our caregivees already received mobile privacy and security support from caregivers of their community before participating in the study, we expect caregivees will have more trust on their communities with their app usage information and will rely on others to receive advice and feedback on their mobile privacy and security. Moreover, as both caregivers and caregivees used the CO-oPS app to help each other with their mobile privacy and security decisions, we expect their community trust to increase at the end of the study. Therefore, we hypothesize a main effect of caregiving status prior to using the CO-oPS app, a main effect of the CO-oPS app intervention from pre- to post-study, and an interaction effect between the caregiving status and the CO-oPS app intervention:

H2: a) Prior to using CO-oPS, caregivees will report higher levels of community trust than caregivers, b) Both caregivers and caregivees will report higher levels of community trust after using the CO-oPS app, and c) Caregiving status will moderate the effect of using the CO-oPS app, such that the increase in community trust after using the app will be stronger for caregivees than for caregivers.

Community Belonging scale (Carroll and Reese, 2003) measures an individual’s perception of their importance and the degree to which their opinions are valued within their community. In this study, we utilized the pre-validated version of this scale that was used by Kropczynski et al. in (Kropczynski et al., 2021b). They showed evidence that community belonging did not differ between tech caregivers and caregivees. This is because both caregivees and caregivers needed higher levels of belonging in their community in order to provide or receive technology support from one another. Therefore, our hypothesis for the main effect of caregiving status before using the CO-oPS app is the null hypothesis. However, as our caregivers and caregivees were connected through the CO-oPS app throughout the study duration and worked together to help one another on their mobile privacy and security decisions, we expect their sense of belonging may increase at the end of the study. Also, since caregivees were supported more by their communities through the CO-oPS app, we expect that they will perceive more belonging after the study than the caregivers. Therefore our hypotheses are:

H3: a) Prior to using CO-oPS, there will be no significant difference in community belonging between caregivers and caregivees, b) Both caregivers and caregivees will report higher levels of community belonging after using the CO-oPS app, and c) Caregiving status will moderate the effect of using the CO-oPS app, such that the increase in community belonging after using the app will be stronger for caregivees than for caregivers.

Community Collective Efficacy was defined by Carroll et al. (Carroll et al., 2005) as the capacity of a group or community for collaboratively performing a shared task. In our study, we utilized the pre-validated version of this construct which was used in Kropczynski et al.’s work (Kropczynski et al., 2021b). The community collective efficacy scale assessed how individuals perceived their community’s capacity to work together as a team on mobile privacy and security. Prior studies in the space of technology support (Kropczynski et al., 2021b) showed evidence that caregivers’ community collective efficacy was not different than the caregivees. Our study anticipates that the use of the CO-oPS app by caregivers and caregivees to exchange support and guidance on mobile privacy and security will enhance both groups’ collective efficacy in managing these issues within their community. Additionally, we expect that our caregivees would receive more help and guidance from the caregivers in making their mobile privacy and security decisions through using the CO-oPS app. Therefore, caregivees’ community collective efficacy will become stronger after using the CO-oPS app than the caregivers.

H4: a) Prior to using CO-oPS, there will be no significant difference in community collective efficacy between caregivers and caregivees, b) Both caregivers and caregivees will report higher levels of community collective efficacy after using the CO-oPS app, and c) Caregiving status will moderate the effect of using the CO-oPS app, such that the increase in community collective efficacy after using the app will be stronger for caregivees than for caregivers.

Self-Efficacy was originally defined by Bandura (Bandura, 1982) as an individual’s perceived capacity to perform a task. In our study, we utilized the pre-validated version of this construct, which was used in Kropczynski et al.’s work (Kropczynski et al., 2021b). Their self-efficacy scale measured an individual’s perceived ability to manage their own privacy and security. Their work showed evidence that technology caregivers have higher self-efficacy than caregivees. In our study, since caregivers provided privacy and security support to their caregivees prior to participating in the study, we expect that our caregivers will also have higher self-efficacy for mobile privacy and security than the caregivees. Furthermore, since our caregivees used the CO-oPS app to learn from their community members’ mobile privacy and security behavior and received feedback and guidance from others on their own mobile privacy practices, we expect that our caregivees’ self-efficacy would become stronger after using the CO-oPS app than the caregivers. Therefore, we hypothesized that:

H5: a) Prior to using CO-oPS, caregivers will report higher levels of self-efficacy than caregivees, b) Both caregivers and caregivees will report higher levels of self-efficacy after using the CO-oPS app, and c) Caregiving status will moderate the effect of using the CO-oPS app, such that the increase in self-efficacy after using the app will be stronger for caregivees than for caregivers.

Exploring the Personal Characteristics of Caregivers and Caregivees (RQ1): To investigate the differences in personal characteristics of our caregivers and caregivees, we analyzed their demographic information and the power usage scale that they reported during the pre-study survey. We first categorized our participants as caregivers or caregivees. The individuals whom at least one of their community members reported as the primary person to whom they go to for questions regarding mobile privacy and security, are labeled as caregivers. The rest of the community members whom no one reported as the person they seek mobile privacy and security support from were labeled as caregivees. Next, we investigated whether there were demographic differences between the caregivers and caregivees using chi-square tests. We also measured the difference between our caregivers and caregivees’ power usage. We first used Cronbach’s alpha (Cronbach, 1951) to verify the internal consistency of this construct, which was 0.85. We then conducted aShapiro–Wilk test and found that the sum scores of these two groups’ power usage were not normally distributed ($ps\!<\!.01$). Therefore, we performed the non-parametric Mann-Whitney U test (noa, 2023) between the caregivers’ and caregivees’ responses to the power usage scale.

Exploring the Difference in Perceived Outcomes between Caregivers and Caregivees (RQ2): To explore differences in perceptual outcomes, e.g., community trust, community belonging, community collective efficacy, and self-efficacy between caregivers and caregivees, we analyzed the pre- and post- study survey responses of our caregivers and caregivees. We first verified the construct validity of these measures using Cronbach’s alpha (Cronbach, 1951) and created sum scores to represent each construct. All Cronbach’s alphas were greater than 0.85, suggesting a good internal consistency of our measures. We then conducted Shapiro–Wilk tests to identify whether the sum scores of the constructs were normally distributed or not. Since these were not normally distributed, we used the Aligned Rank Transform (ART) tool to perform non-parametric 2 x 2 ANOVAs (Wobbrock et al., 2011) and post-hoc contrast (ART-C) tests (Elkin et al., 2021) as we anticipated a possible interaction effect between caregiving status and survey completion time. We conducted a 2 x 2 repeated measures ANOVA with mixed design to evaluate how using CO-oPS with the community throughout the study duration affects caregivers’ and caregivees’ community trust, community belonging, community collective efficacy, and self-efficacy. Table 5 presents all these statistical tests for interaction and main effects. The means and standard deviations for all measures are presented in Table 6.

Exploring the Difference in Privacy & Security Behaviors between Caregivers and Caregivees (RQ3): To examine how our caregivers’ mobile privacy and security behaviors were different than the caregivees, we first analyzed our caregivers and caregivees’ CO-oPS app usage data. Due to some technical issues with the CO-oPS logging feature, we could not log the first seven communities’ app activities and so, the app usage data was collected from only the last fifteen communities (N = 35 caregivers and N=33 caregivees). We first prepared our dataset by counting each participant’s specific app activities, e.g., count of apps reviewed, messages sent, permissions denied, and apps hidden. We then conducted Shapiro–Wilk tests and found that the sum scores of these app activities were not normally distributed ($ps\!<\!.01$). We then performed the non-parametric Mann-Whitney U test to identify significant differences between the frequencies of the app activities performed by the caregivers and caregivees (Table 8). We also qualitatively coded the app activity data to examine the types of messages sent (e.g., sought or provided advice, message regarding apps or permissions), types of apps reviewed, apps uninstalled and hidden, and the types of app permissions caregivers and caregivees changed. Lastly, to further explore how differently our caregivers and caregivees perceived these app activities they could perform with the CO-oPS app, we conducted a supplemental qualitative analysis, where we identified themes related to the app activities, but also focused on the differences between our caregivers and caregivees. N=28 caregivers and N=23 caregivees participated in the follow-up interviews. Appendix D presents the codes and illustrative quotations for each app activity theme. Participant’s quotations are identified by their IDs (e.g., C01P1,..C22P6), caregiving status, age, and gender information.

The screening survey briefly introduced the study and the CO-oPS app. After being screened for eligibility, participants were provided a consent form detailing the study, described as an effort to evaluate the use of the CO-oPS app among their self-formed group and understand how community members can help each other with mobile privacy and security decisions. For the teen participants, we required one of their parents or legal guardians to complete the screening survey. If eligible, the parent or guardian then provided consent for their child to participate in the study. The teens themselves received an assent form to agree or deny to participate in our study. On both the consent and assent form, we highlighted the potential benefits of participating in the study as increased awareness of how group members manage app privacy, which might inspire reflection on their personal permission decisions. We also outlined what data will be collected by the CO-oPS app and shared with their group members, and participation could be discontinued at any time. Lastly, we stated that all the data collected would be securely stored in a password-protected Dropbox folder, accessible only to the researchers listed in the IRB. Participants were then asked to forward the screening survey to their social contacts whom they would like to include as their community members in this study.

Table 3 shows community IDs, size, caregiver count, composition (i.e. family, friends, neighbors, coworkers), and proximity of their residences in relation to each other in the community (i.e. same house, neighborhood, town). The size of the communities ranged from 2 to 6, where the majority (68%, N=15) of the communities had five or more members. Most of the communities (64%, N=14) had two to five caregivers, and only 36%, N=8 communities had one caregiver. Most communities (73%, N=16) were composed of families together with other relationships, e.g., friends, neighbors, co-workers. Among these communities, the most common family dyadic relationships were partners (50%, N=11), followed by parent-teen (23%, N=5), parent-adult child (14%, N=3), siblings (14%, N=3), and extended families (14%, N=3). The rest of the communities (N=6, 27%) consisted mainly of friends. Finally, in terms of proximity types, almost all communities (95%, N=21) had most members living in the same house (73%, N=16) or same neighborhood (59%, N=13), but also included members from the same town or out of town.

Community Trust: For community trust, we found a significant main effect for both caregiving status (F(1, 99) = 38.21, p ¡ 0.001) and pre-post study, (F(1, 99) = 13.77, p ¡ 0.001), with no statistically significant interaction (F(1, 99) = 3.51, p ¡ 0.06). This suggests that community trust was higher for caregivers than caregivees prior to using the CO-oPS app (opposite of our hypothesis H2a). Both the caregivers and caregivees reported higher levels of community trust after using the CO-oPS app, supporting our hypothesis H2b. Lastly, the caregiving effect on community trust was not greater in the post-study than in the pre-study, indicating that the positive main effect of using the CO-oPS app on caregivees’ community trust was not stronger than caregivers’. Therefore, our hypothesis H2c was not supported.

Community Belonging: The pre-study community belonging was higher for caregivers than caregivees, with F(1,99) = 26.26, p ¡ .001, suggesting that our null hypothesis H3a was not supported. However, the main effect of the pre-post study and the interaction effect were nonsignificant, suggesting that the increase in caregivees and caregivers’ community belonging from pre-to-post study was not significant. Therefore, both hypotheses H3b and H3c were not supported.

Community Collective Efficacy: For community collective efficacy, there was a significant main effect for caregiving status, F(1, 99) = 92.55, p ¡ .001, indicating that the pre-study community collective efficacy was higher for caregivers compared to caregivees (H4a was not supported). The main effect of pre-post study for community collective efficacy also yielded an F ratio of F(1, 99) = 81.4, p ¡ .001, with a significant interaction, F(1,99) = 18.87, p ¡ .001, suggesting that it increased for both caregivers and caregivees from pre to post study, as illustrated in Figure 2a, and the positive main effect of the use of the CO-oPS app (pre-post study) on community collective efficacy was also stronger for caregivees than for caregivers. So, hypotheses H4b and H4c were supported.

Self-Efficacy: In terms of self-efficacy, we found a significant main effect for both caregiving status, F(1, 99) = 34.73, p ¡ 0.001, and pre-post study, F(1,99) = 108.71, p ¡ 0.001, with a statistically significant interaction, F(1,99) = 30.19, p ¡ 0.001. This suggests that self-efficacy was higher for caregivers than caregivees before the study and increased for both caregivers and caregivers from pre-study to post-study test, as shown in Figure 2b. Also, the positive main effect of using the CO-oPS app (pre-post study) on self-efficacy was stronger for caregivees than for caregivers. This confirms that all three of our hypotheses H5a, H5b, and H5c are supported. Table 7 summarizes the hypotheses tested from our statistical model.

Apps Reviewed: As shown in Table 8, while the median number of apps reviewed by caregivers was slightly higher, we found no significant difference (p = 0.689) between caregivers (median = 10, SD= 16.71) and caregivees (median = 7, SD= 27.43) based on the number of the apps they reviewed. When we further investigated who reviewed whose apps more (Table 9), we found that caregivees’ apps were reviewed more compared to the caregivers’. For example, caregivers reviewed a total count of 141 apps of other caregivers, with an average of 5.6 apps, while reviewing almost twice as many apps from caregivees (total = 263, avg = 10.5). Similarly, caregivees reviewed 278 apps from other caregivees (avg = 13.2), almost twice as much as caregivers’ apps reviewed (total = 144, avg = 6.9).

From our data analysis of the interview, we found that more caregivees felt that using the CO-oPS app with their groups helped them receive valuable feedback. A majority of caregivees mentioned that having other people review their apps helped them identify risky app permissions, which was made possible through the feedback they received from others. For example, C02P2, a 51-year-old male caregivee, said: “It made them [community] see how I manage my apps and their data access. Like, I didn’t give that much thought to my permissions, but they could see what I did and just tell me what I need to fix. This is great because you can be aware of the fishy permissions or the apps you have.” Most caregivees also felt that this feature gave them peace of mind that there was someone else in the community who would watch over their privacy and security. Caregivees frequently mentioned specific caregivers in their community on whom they would rely for mobile privacy and security advice. Having their caregivers included in the CO-oPS app who could keep an eye on their apps and permissions made caregivees less concerned. Interestingly, caregivers felt that this feature that allowed every community member to review everyone else’s apps and permissions helped distribute community responsibility. This is because people often use numerous apps on their phones, and reviewing each of their permissions can be tedious for one person. Here, a few caregivers also mentioned that not all people in a community have the same level of knowledge of recognizing the dangerous permissions, and therefore having multiple people review someone’s apps would be beneficial. For instance, C19P6, 52-year-old female caregiver, said: “ It’s nice, because someone can have multiple feedback and use their judgement whether they keep the permission or not. Also, because some people in the community can not give good feedback, but others can. So, its good to have all people go through and inform.”

Messages Sent: As shown in Table 8, we found no significant difference (p = 0.952) in the total count of messages sent by caregivers (median = 1, SD = 0.8) and caregivees (median = 1, SD = 0.97). However, both caregivers and caregivees sent slightly more messages to caregivees than to caregivers.

Qualitative analysis on the types of messages sent also gave us important insights (Table 10). For example, the majority of the messages sent by both caregivers and caregivees were about the permissions granted. For instance C17P3, 32-year-old male caregiver, sent this message to C17P4, 32-year-old female caregivee: ”your Bofa camera permission is granted which you should denied access.”. Both caregivers and caregivees sent more messages to provide advice, compared to the count of messages sent to seek advice, and there were no differences between caregivers and caregivees’ for this. The qualitative analysis of our interview transcripts gave us further insights into how the caregivers and caregivees overall felt about the CO-oPS app’s messaging feature that facilitated exchanging advice and guidance on their mobile privacy and security. Most caregivers mentioned that initiating discussions about the installed apps of others and granted permissions became easier with the CO-oPS app, even when community members are not close. They often mentioned that they would usually hesitate to start conversations about the apps installed on someone else’s devices. But since the CO-oPS app allowed them to review others’ apps and then communicate their opinion through the messaging feature, it addressed that hesitation. For example, a 28-year-old male caregiver, C06P6, said: “Look, this is really an awkward topic, especially when your community is not your family. You can not just tell someone out of nowhere, hey your x app is accessing microphone. This app has so many features to communicate this awkward topic. So, telling someone about their personal apps and their settings is a bit less difficult with it.” Caregivees, on the other hand, felt that the CO-oPS app made it easy to seek advice and guidance. Interestingly, most of these caregivees said that they either used other messaging tools, e.g., Whatsapp, Facebook Messenger, text message, etc., or just talked in person to ask questions because they utilized those tools for their daily communication or because they lived in same neighborhood or house. However, most of our caregivers still saw value in the in-app messaging feature, as it helped keep the conversation specific to the topic of mobile privacy and security. They often said that using other messaging tools would not help much as the advice given would be lost among their other general conversations. Therefore, they found the messaging feature useful in preserving the advice given on the apps or permissions.

Apps/Permissions Changed: We now describe how our caregivers and caregivees’ mobile privacy and security behaviors changed at the end of the study. We specifically looked into caregivers and caregivees’ permission changes through the CO-oPS app and the changes in their installed app list (Table 11). As illustrated in Table 8, we found no significant differences between the caregivers and caregivees based on both the apps uninstalled (p=0.321) and permissions denied (p= 0.263). Qualitative analysis of the app log data revealed that caregivees mostly uninstalled gaming apps, workout, and dictionary apps, whereas the caregivers uninstalled finance, mobile payment, and shopping apps. Our caregivers mainly denied contacts and microphone permissions, while caregivees mainly denied storage and camera. However, both caregivers and caregivees showed a similar trend in denying location permissions.

During interviews, all caregivees said that comparing their own app permissions with others inspired them to take the initiative and change the permissions. To this end, they often mentioned the CO-oPS feature that allowed users to view the count of community members who allowed or denied the permissions of an app, which helped them learn whether the permissions are necessary for a specific app and then change the permission accordingly. For instance, C12P4, a 25-year-old male caregivee, said: “I can see what kind of permissions they’re getting to their apps and how many. I saw that some of my friends didn’t get permission to Facebook, on their location or something. So I see that in my app, I already give the permission of location. So after seeing that, my other friends haven’t given that permission, I removed my location permission from my Facebook. ” Caregivees also often felt that they learned how to change their app permissions. Here, caregivees often mentioned the CO-oPS app feature that allowed users to easily navigate to the Android settings to turn off/on the app permissions, which enabled them to change the permissions easily. Our caregivees also often said that learning about others’ permission changes encouraged them to make the changes for their own. To this end, they mostly brought up the CO-oPS’ community feed where they would get posts about the app permission changes made by their community members.

Apps Hidden: The CO-oPS app allows users to hide apps from their community members that they do not wish others to know about. Interestingly, we found that our caregivees hid more apps (Median = 11, SD = 21.25) than the caregivers (median = 3, SD = 13.18), and the difference was statistically significant (p = 0.043). In total, 21 caregivees hid N = 192 apps (68.8%), which was approximately double the number hidden by 13 caregivers (31.2%, M = 87). Upon further analysis of the types of apps hidden, we discovered that caregivees predominantly hid social media apps (38%, n = 73), including messaging and video apps such as Instagram, WhatsApp, Youtube, and TikTok, as well as online shopping apps (21%, n = 41) such as Amazon, Walmart, Macy’s, Target, and Kohl’s. In contrast, caregivers mostly hid gaming apps (32%, m = 28) like Pokemon Go, Wordscapes, Clash of Clans, and Candy Crush, and video streaming apps (25%, m = 22) such as Disney+, Netflix, Peacock, and HBO Max. Additionally, both caregivers (15%, m = 13) and caregivees (11%, n = 22) hid financial apps including CashApp, Venmo, Zelle, and various banking apps.

Our qualitative analysis of the interview data gave us insights to further unpack why caregivees hid their apps more than caregivers. In general, caregivees were more concerned about their privacy on their app usage than the caregivers. All caregivees mentioned that the CO-oPS app allowed their community members to review their personal apps that they did not feel comfortable about. Caregivees often mentioned that while they generally liked the idea that others can review their apps and provide feedback, they would still feel uncomfortable sharing their apps with some of their community members. They also often felt uncomfortable when reviewing others’ mobile apps installed, as it was perceived as violating others’ privacy. For instance, C09P2, a 23-year-old male caregivee, said: “The nature of this app is showing what apps we have installed on all devices to everyone else. The nature of the app, also kind of decreases privacy for your own and for others. In sum, individually. But I guess the idea is that you have a group of people you have to have trust somewhat so you can get help. But still it kind of gives a discomfort.” Caregivees also often specifically mentioned that when the community consisted of mixed relationships, their concerns about privacy could be aggravated. For example, they would not want their friends to monitor their family members’ apps or vice versa. For instance C15P2, a 33-year-old female caregivee, said: “You don’t want your friends to be in the same community with your parents. Because you don’t want your parents to see some of your apps or your friends to see some of your other apps, right? So yeah, I guess that was my main concern. … I also feel like I don’t think my friends should be seeing my parents’ apps, either.” Caregivers, on the other hand, expressed concern about this app hiding feature because when caregivees hide their apps it would defeat the primary purpose of the CO-oPS app. Caregivers often brought up the importance of the community members’ personal privacy on their app usage, but they also felt that providing feedback would be challenging if a community member hid most of their apps. To this end, caregivers frequently gave examples of vulnerable members of their families who do not have much expertise of mobile privacy and security, e.g., children, parents, grand parents, etc.

In this study, we examined whether and how collaborative mechanisms for mobile privacy and security support caregiving relationships, and how caregiving status influences the outcomes of using the CO-oPS app. Overall, we found that caregivers and caregivees did indeed have different outcomes, exhibited different behaviors, and ultimately experienced the app in unique ways. In the following, we describe the implications of our findings in relation to previous work and provide recommendations for implementing community-based solutions that support community-based caregiving.

On the other hand, we hypothesized and confirmed that caregiving status differed significantly by power usage (i.e., higher for caregivers). This finding is important in that it serves to validate that individuals’ self-reported perceptions of who provides oversight aligned well with the level of power usage of these individuals, suggesting that caregiving for mobile privacy and security is related to the competence and desire to use technology to its fullest (Namara et al., 2021). This aligns with previous work (Akter et al., 2023b) which found that users often referred to tech savvy members of their community because they were more knowledgeable about mobile privacy and security. Therefore, future research could utilize power usage as a proxy measure to differentiate between caregivers and caregivees for mobile privacy and security within community-based settings – or it could simply ask individuals from whom they receive oversight as we did.

As such, a critically important takeaway is to make sure these technologies for community-based oversight do not unintentionally create oppressive power hierarchies that could harm vulnerable populations. HCI researchers have highlighted the potential pitfalls of surveillance-based technologies among marginalized individuals (e.g., children, older adults, victims of intimate partner violence (c.f.,  (Leitão, 2019; Parkin et al., 2020; Rodríguez-Rodríguez et al., 2020; Slupska and Tanczer, 2021; McDonald and Forte, 2022; noa, 2022)). Therefore, when attempting to protect caregivees from digital privacy and security threats, it is important to assess whether protection is needed from the caregivers themselves. For example, while allowing users to hide apps within CO-oPS provides a safety mechanism against unwanted oversight, caregivees could still be unduly punished for such behavior outside of the app by caregivers who insist on wielding coercive control. One approach for mitigating users’ personal privacy, safety and security concerns is through the careful design of these community-based collaborative mechanisms. Future research needs to find effective ways to increase caregivees’ community belonging and trust to intrinsically motivate them to use the app voluntarily, rather than making community participation compulsory.

Therefore, a key implication of our findings is that future research might find it advantageous to discriminate between study participants in terms of their assigned tasks, so that they are more appropriate for their individual roles. This may resolve the tensions and discomfort that we observed among many of our caregivees when asking them to play the role of a caregiver. Such consideration would likely improve participants’ experience by accounting for differing roles earlier in the design process, rather than post hoc, as was a limitation of our study. Importantly, these findings suggest that the community-based approaches should be designed to support different caregiving roles in heterogeneous communities.

Identifying Caregivers in Communities: Our study examined the differing roles of caregivers and caregivees in community oversight, albeit in a post hoc fashion. To gain deeper insights, future researchers and designers should consider integrating on-boarding features aimed at distinguishing caregivers from individuals primarily in need of care. This could be achieved by prompting community members to self-identify their caregiving roles during the sign-up process. Another approach could involve identifying power users within the community. However, the power use scale utilized in our study comprised 22 items (Sundar and Marathe, 2010), which may pose feasibility challenges for users. Therefore, we recommend utilizing a condensed version of this scale, such as the one developed by Sundar et al. in (Sundar et al., 2016), which consists of 12 items.

Addressing when Caregivers are Absent: In some cases, communities might lack technological expertise needed to provide care. To mitigate this problem, researchers and designers may need to explore ways to infuse external expertise in the community, as suggested by Chouhan et al. in (Chouhan et al., 2019). Another possibility is that rather than bringing external experts into a community, it might be advantageous to educate community members. In real-world settings, some caregivees may eventually learn to take the lead to provide oversight within their communities. Identifying these transitions over time is also important. Therefore, we recommend incorporating smart caregiving detection mechanisms into the application to recognize caregiving behaviors, such as sending messages containing privacy and security advice. This may require the integration of real-time messaging APIs to discern the intent behind messages, such as whether they are intended to seek or offer advice.

Designing for Different Caregiving Roles: We recommend that app designers adopt a nuanced approach when developing community oversight tools to accommodate the distinct roles of caregivers and caregivees, rather than unequivocally treating them as interchangeable entities. Utilizing methodologies such as storyboarding and creating user personas can help to fully understand and address the unique needs and expectations associated with these roles. However, it is imperative to recognize and mitigate potential tensions arising from power dynamics and disparities in privacy and security knowledge. To effectively navigate these complexities, we suggest incorporating methodologies such as value-sensitive design (Friedman et al., 2002) or participatory design  (Spinuzzi, 2005; Muller and Kuhn, 1993), which prioritize the integration of diverse perspectives and values throughout the design process. These methodologies would help facilitate meaningful engagement of all stakeholders, ensuring that the resulting community oversight tools are attuned to the needs and preferences of all users involved regardless of their caregiving roles.

Incentivizing Caregivers to Provide Oversight: Caregivers may encounter a decrease in motivation under some circumstances, especially when they perceive fewer personal benefits or lack close relationships within the community (Akter et al., 2023b; Mendel and Toch, 2023). Therefore, it is important to incorporate reward mechanisms aimed at acknowledging and incentivizing their contributions as proactive digital citizens. Designers should also explore the development of effective nudging mechanisms strategically designed to prompt and encourage caregivers to engage more actively and consistently in providing oversight to their respective communities. For instance, weekly notifications or alerts upon new app installations within the community could prompt caregivers to assume oversight responsibilities. Implementing reward mechanisms, such as badges or points, to incentivize desired behaviors, could also be beneficial. Such interventions need to be carefully crafted to ensure that caregivees can also form a sense of duty and accountability to their communities.

Enhancing Caregivees’ Community Trust and Belonging: Collaborative oversight should include mechanisms fostering caregivees’ trust and community belonging. To do so, we need to explore ways to encourage caregivees to seek advice and guidance from their community so that they feel their privacy and security needs matter and they belong to the community. Implementing features like autogenerated text messages for advice can aid caregivees with effective assistance-seeking. It’s also crucial to ensure these tools make caregivees feel comfortable and connected rather than surveilled or punished. Thoughtful design is essential to co-manage mobile privacy and security, safeguarding caregivees from potential misuse while enhancing their sense of community belonging.

Another potential limitation is the risk of privacy breaches if a community member’s phone is lost or stolen, as this could expose the personal information of the entire community. Additionally, in large communities that include members who may not be close, even though were initially trusted, could potentially become malicious. Future research should investigate the possibility of allowing more granular control over the app-hiding features, enabling community members to selectively turn off sharing with specific individuals. Furthermore, caregivers’ advice and privacy behaviors may sometimes be misleading. In such cases, collaborative approaches need to identify deserving candidates to label as caregivers. Factors such as community members’ power use, the validity of their advice, and their privacy practices could be important considerations for future studies. While we allowed all community members to hide any of their installed apps as they preferred, certain mobile apps carry different security and privacy risks (Reardon et al., 2019; Tandon et al., 2022). For example, caregivees were more likely to hide social media and shopping apps, which might have limited the feedback received for those apps. Future research should explore assigning risk-based weights to the apps installed, making users more aware of the risks associated with hiding certain apps and encouraging them to consider sharing to receive effective oversight. Finally, in this study, we did not measure power use in the post study survey as we did not expect the CO-oPS app intervention to alter individual power usage. In retrospect, heightened self-efficacy might lead to increased power usage. Hence, we recommend that future studies on privacy interventions assess this factor both pre and post-intervention to gauge potential changes in power use.

Collaborative mobile privacy and security approaches often treat all individuals in the community as equal, despite differences in expertise, needs and roles. Our study highlights the need to address these imbalances, as caregivers and caregivees have distinct perceptions and requirements. Our study illustrated the role community oversight can play in helping those who need support and build their self-efficacy and community collective-efficacy. Our findings call for interventions that prioritize increasing caregivees’ community trust and belonging while incentivizing caregivers’ participation in oversight. This approach aligns with our broader goal of developing community-based tools that effectively support mobile privacy and security for all. Future research will focus on refining these tools and exploring innovative strategies to enhance collaboration and address the unique needs of diverse community members.