The purpose of this article was to collect data on the behavioural influence of subjective norms, information security awareness and threat appraisal. This entailed collecting and thematically analysing secondary data obtained from a variety of academic databases as part of a scoping review. These databases included ScienceDirect, Taylor & Francis, Oxford Academic and the AIS Senior Scholars Basket, which include journals like the European Journal of Information Systems, Information Systems Journal, Information Systems Research and MIS Quarterly. A scoping review is generally used to identify and map available evidence as it relates to a topic of interest (Munn et al. 2018). This required a series of structured searches using phrases such as information security awareness, threat appraisal, subjective norms, Facebook privacy settings and social media. After screening the titles and abstracts, 42 articles were thematically analysed, as illustrated in the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) diagram shown in Figure 1.

As part of the analysis process, a series of thematic maps were created, one for each of the propositions. This process also involved a more focused review and rereading of the 42 articles – a common practice when conducting thematic analysis (Bowen 2009). Such rereading not only illuminates prominent themes that were not apparent during the initial screening process (Joffe 2012) but also enables researchers to recognise specific patterns. In turn, these patterns may become categories to guide analysis within identified themes. For example, it is reasonable to assume that most (if not all) of the selected studies employed specific research methods. These methods of analysis may become one such analysis category. This entire process was conducted inductively so as to emphasise the researcher’s understanding of the broader phenomena pertaining to the use of Facebook privacy settings (Braun & Clarke 2006). A deductive approach was deemed inappropriate for this study, given that the objective of the article was to develop the research model and not to test it using statistical means. As part of the inductive analysis a five-phased approach was used, as outlined by Braun and Clarke (2006). These phases are described as follows:

As part of phase 1, the articles were read in detail to develop an overall understanding of the core aspects (influence of subjective norms and information security awareness) of this study. In phase 2, interesting codes were identified based on the nature and the additional behavioural understanding gained after executing phase 1.

Following this, several codes were collated into candidate themes. Phase 3 culminated in the development of three candidate themes, namely threat appraisal, normative influence and the influence of information security awareness. Using these candidate themes as a starting point, phase 4 further refined these themes by removing extraneous coded extracts. This culminated in the formal specification of three thematic maps (see Figure 2 for one example). It is from these thematic maps that the resultant propositions were developed (i.e. as part of phase 5).

This study utilised both the TPB and PMT. Ajzen (1985), who developed the TPB, conceptualised the strength of intention as an immediate antecedent of behaviour (Kautonen, Van Gelderen & Fink 2015). Thus, the TPB is based on the assumption that most human behaviour takes place as a result of intent, as influenced by personal attitudes, subjective norms and PBC (Grimes & Marquardson 2019; Ham, Jeger & Ivković 2015).

Within the context of this study, attitude is defined as the extent to which an individual either positively or negatively value the use of Facebook privacy settings. Subjective norms is defined as the social pressure that influences whether an individual will make use of the Facebook privacy settings. Information security awareness is defined as the extent to which an individual is aware of the privacy threats that their personal information is exposed to. Protection motivation theory, on the other hand, proposes that behavioural intentions are motivated by the processes of both threat and coping appraisal (Rogers 1975). Note that this study only argues in favour of the behavioural influence of threat appraisal. In this context, threat appraisal necessitates judging the severity of and the vulnerability attached to not making use of Facebook privacy settings. For example, if a Facebook user determines that their level of self-efficacy is particularly high, they may forgo the privacy settings because they believe they are adequately equipped to ameliorate future threats (i.e. misuse of personal information). Additionally, PMT has been found to adequately explain individuals’ behavioural intention to engage in protective actions (Ifinedo 2012).

The research model for this study merges these two theories by arguing the influence of threat appraisal, specifically in terms of the role played by fear appeals in the appraisal process. In other words, the research model posits that it is likely that an individual will increase their knowledge of (in terms of avoidance) specific threats as they become aware of vulnerabilities. For example, a Facebook user may wish to find out how they can avoid inadvertently sharing personal information because they fear that it may be misused.

This combination of theoretical constructs not only contributes theoretically but also enables researchers to evaluate the role of fear appeals (one part of threat appraisal) within the context of Facebook privacy settings. The integration of subjective norms further increases the explanatory power of the research model (Tsai et al. 2016). Having said this, other studies have also combined these two theories (Grimes & Marquardson 2019; Ifinedo 2012).

The process by which individuals weigh up the costs and benefits of using privacy settings can also be explained by deterrence theory (DT) or simply cost–benefit analysis, both of which involve a cognitive process of weighing up the potential costs and benefits of enacting specific behaviour (Min & Kim 2015). More specifically, DT is based on the belief that sanctions affect an individual’s intention to participate in deviant behaviour, depending on the sanction severity, celerity and certainty of the particular behaviour (Abed & Weistroffer 2016). As such, individual behaviour is assumed to be driven by some punishment associated with not performing the required behaviour. Because the use of Facebook privacy settings cannot be enforced, theories that imply forms of sanction (such as DT) are not deemed relevant in this context.

Research provides evidence of two distinct sub-types of social norms, namely subjective and descriptive norms (Lapinski & Rimal 2005). Descriptive norms are those perceptions of the behaviour that an individual’s peers are enacting. As such, they describe a behaviour that has taken or is taking place. Conversely, subjective norms are those behaviours believed to be desired by an individual’s peers (Kautonen et al. 2015). Subjective norms therefore assume that individuals are more likely to enact a behaviour that they believe is desired or expected by their peers (Saeri et al. 2014).

Both descriptive and subjective norms are believed to drive an individual’s behaviour towards social acceptance (Min & Kim 2015). Such acceptance even takes place to the extent that individuals may adjust their norms if they differ from the normative required behaviour. These adjustments may reinforce or counter the normative behaviour depending on how closely individuals identify with their peers (White et al. 2009). If, for example, an individual’s peers do not place much emphasis on sustainability, they may avoid associated behaviours.

It should be noted that although subjective norms influence behaviour, they depend on the user population (and use case) in question. For example, subjective norms have been found to significantly influence game use but not the use of blogs (Baek, Kim & Bae 2014). Because the use of games and blogs includes voluntary settings, Baek et al.’s argument relates to how strongly individuals perceive general behavioural rules to exist within these contexts. Individuals might perceive sanctions to exist if normative behaviour is not followed in gaming, which is not the case when using blogs.

From a social media perspective, subjective norms have been found to affect the problematic use of Facebook, specifically amongst adolescents (Marino et al. 2016). Some research suggests that this is the result of adolescents being more concerned about having their personal information accessed by people who hold immediate power over them (i.e. parents or teachers) (Boyd & Hargittai 2010). To substantiate the latter, Foltz Newkirk and Schwager (2016) found that although subjective norms positively influenced Master of Business Administration (MBA) students’ intention to use social media privacy settings, they exerted a relatively weak influence on intent.

Previous research has reported mixed outcomes regarding the behavioural influence of subjective norms; specifically, whether it negatively or positively influences intent. Whilst some research has found subjective norms to be the weakest predictor of intention (Ham et al. 2015; Min & Kim 2015), other studies have concluded that they have a significant influence on intention (Grimes & Marquardson 2019) and that they shape not only behavioural intentions but also the subsequent behaviour of an individual (Chung & Rimal 2016). This discrepancy in the literature may depend on the type of behaviour under consideration, the individual involved or how closely the individual identifies with significant others (White et al. 2009). It may also depend on perceptions regarding the perceived costs of non-conformance (Min & Kim 2015). Previous studies also suggest that norms are only meaningful to the extent that individuals perceive that their violation will result in some punishment or repercussion (e.g. the misuse of their personal information) (Chalub, Santos & Pacheco 2006). Given the discussion thus far, the following proposition is made:

The literature is replete with evidence that information security awareness influences behaviour as a form of control (hence substituting it for PBC in this article). The more aware and knowledgeable a user becomes with regard to possible privacy threats, the more control they might wish to have in this regard, one such control mechanism being the Facebook privacy settings. The authors therefore argue that individuals can only take adequate protective measures once they have been made aware of the threats associated with exercising no control over their personal information (Öʇütçü, Testik & Chouseinoglou 2016). If users are not aware of the tools to protect them against threats (i.e. misuse of personal information), they will not acquire the requisite knowledge to adopt effective protective measures. Instead, these users may be unaware that Facebook provides them with tools such as the Privacy Checkup tool. This may lead to protective behaviours being enacted under false assumptions of security (Golbeck & Mauriello 2016), which may increase overall vulnerability. This affects not only these individuals but also their peers (i.e. the bidirectional relationship indicated by the dotted lines in Figure 3). Conversely, it stands to reason that if a Facebook user acts on the information received from peers (therefore increasing awareness), they may develop intentions to use the privacy settings. In doing so, this individual also inadvertently influences their peers to enact the same protective behaviour.

Although the bidirectional relationship between an individual’s attitude towards privacy and awareness is not argued in this article, it plays a vital role when viewing the use of privacy settings holistically. In other words, the behavioural influence of the various theoretical constructs proposed by this study does not affect the intended use in a mutually exclusive manner. In general, awareness has been found to contribute to the behaviour of individuals in several contexts. Park, Kim and Park (2017) found that awareness of patient privacy amongst nursing students has a significant impact on behaviours to enact protective behaviour when considering the security of patients’ personal information. Within the context of this article, awareness is assumed to have the same effect on the use of privacy settings.

Therefore, information security awareness measures the extent to which users are informed about their privacy on social networking sites, as well as the extant privacy problems, policies, violations and procedures (Zlatolas et al. 2015). Uninformed users fail to evaluate the privacy risk and information disclosure benefits rationally and thoroughly. As a result, lack of awareness is viewed as a root cause of information security incidents (Safa et al. 2018). Grimes and Marquardson (2019) found that if a user does not perceive any threats arising as a result of a particular action or behaviour, no protective measures will be taken. Therefore, in order to promote more secure online behaviour, as mentioned, users first need to be made aware of both the threats associated with the disclosure of personal information and the tools available to protect against those threats (e.g. privacy settings).

In industry, awareness programmes have been implemented to improve users’ compliance and promote secure user behaviour. Bauer et al. (2017) indicate that a user’s level of policy knowledge affects their intentions to comply with such policies. Businesses like Facebook have also begun relying on privacy policies as a self-regulatory mechanism in an attempt to reassure users that their personal information is secure (Benson, Saridakis & Tennakoon 2015).

Conversely, in a study by Govani and Pashley (2014), it was found that even though 84% of participants were aware that they could change their privacy settings, only 48% actually used these settings. Additionally, respondents did not change their privacy settings even after being educated on how to do so. Users therefore seemingly accept that their personal information will be misused, regardless of whether they enact protective behaviour (i.e. Facebook privacy settings). Respondents’ awareness and the consequent privacy concerns only resulted in the adoption of protective behaviour if they have had a negative experience in this regard. As such, knowledge, awareness and especially experience are seen to directly influence the intention to adopt protective behaviour such as Facebook privacy settings. The authors of this article therefore argue that:

The authors also argue that that the adoption of protective behaviour goes beyond merely making users aware. They posit that the acquired knowledge (via awareness) has to be personally relevant if individuals are to respond appropriately (Marett et al. 2019). Additionally, the individual should be willing and able to respond effectively.

Because PMT is concerned with how and why individuals decide to adopt protective behaviour (e.g. adopting privacy settings), the authors argue that it will also influence the extent to which such protective behaviour is enacted. This stems from the fact that an individual’s threat appraisal involves the measurement of the perceived vulnerability and the severity of the threat. Therefore, if an individual does not perceive a threat to be particularly severe (because of their level of knowledge and awareness), they may forgo using privacy settings. Previous research has found user perceptions to be particularly important when facing decisions relating to protective behaviour – especially within the context of fear appeals (Johnston et al. 2016). It is believed that should threat appraisal produce a sufficient amount of fear, the individual will be more likely to enact protective behaviour. This means that their level of fear – as a result of threat appraisal – may influence their intention to use privacy settings.

Similar to Hanus and Wu (2016), this study focuses on both awareness and threat appraisal as antecedents to the intended use of Facebook privacy settings. Hanus and Wu’s (2016) study also demonstrates that it is not enough for users to be aware of the threats associated with a particular behaviour. Users are also influenced by their perceptions of how vulnerable they may be in this regard. The same applies to the countermeasures used to address the perceived threats. As such, awareness alone does not help promote secure behaviour, which is why the model proposed in this article also theorises the behavioural influence of threat appraisal.

Several recent studies have found evidence that attests to the behavioural influence of threat appraisal. For example, Strycharz et al. (2019) found that threat appraisal (specifically perceived severity) significantly influenced respondents’ intentions to turn off personalisation in terms of the ads they are exposed to. Similarly, Feng and Xie (2019) found that respondents’ control over privacy settings significantly influenced their intention to use virtual try-on (i.e. of clothing) apps. The additional controls enabled respondents to perceive themselves to be less vulnerable to threats. Vishwanath, Xu and Ngoh (2018) found that perceived threat severity significantly influences both expressive privacy and information privacy. Additionally, perceived vulnerability was found to influence accessibility privacy. Ernst, Pfeiffer and Rothlauf (2015) also found threat appraisal to exert a significant and positive influence on the intention to use the privacy settings, specifically in terms of selectivity in connections, refusal and setting strictness. Whilst a heightened threat appraisal is associated with fear (Grimes & Marquardson 2019), a user can only evaluate a risky situation if they are aware of the risks. The authors of this article therefore propose:

This article followed all ethical standards for a research without direct contact with human or animal subjects.