Assessing risks in online information sharing

The volume of personal information, accessible online about individuals is unprecedented. Such information may be pieced together by others, to create a more detailed picture of a person, exposing them to potential harms, such as employment loss, unwanted attention, fraud, and more. In this context, relevance is contextual, situational and dependent, based on the risk it poses to the subject. In this paper, we explore this risk-based notion of relevance with the following questions in mind: How well can individuals identify and judge risks associated with online personal information? And, to what extent does this change individuals’ awareness of their own information-sharing practices?
In a user study, 243 participants were tasked with browsing fabricated online profiles to identify potential “risky” posts in one of two scenarios regarding either Identity Theft or Reputational Damage. On average, 72.2% of participants identified at least one risky post. However, only 23.7% identified dependent posts that taken together substantially increased the risk of identity theft or reputational damage. Further, participants reported greater awareness of potential risks that could arise from their own, and/or their friends’ information sharing practices. Our findings suggest that when relevance is dependent on combining separate pieces of information to reveal risk, participants struggle to identify these cumulative revelations. Moreover, our study highlights that when participants perform tasks that feature personal information, it can lead to positive and negative experiences; changing their perceptions and increasing awareness about their own information behaviours while also raising concerns around their routine online practices.