Manotipya, Paweena, M.S. May 2019 Computer Science Children's Online Privacy from the Parents' Perspective: Challenges and A

MANOTIPYA, PAWEENA, M.S. MAY 2019 COMPUTER SCIENCE

CHILDREN’S ONLINE PRIVACY FROM THE PARENTS’ PERSPECTIVE:

CHALLENGES AND A POSSIBLE SOLUTION (89 pp.)

Thesis Advisor: Kambiz Ghazinour

There is much evidence exists that a considerable number of users are either unaware of the side- effects of sharing personal information online or lack adequate knowledge about their rights or means concerning protecting their privacy. This becomes even more disturbing when we realize the vulnerability of children’s information in social media environments. Their information is often posted online by their parents or guardians, resulting in a compromise in privacy. In this thesis, the study is separated into two phases, the first of which is a survey to understand parents’ perceptions of children’s online privacy. The second phase is based on the points learned in the first phase, to use a game-based learning in an attempt to educate parents when sharing their children’s information online. The initial findings demonstrate that although parents and guardians might have a certain level of awareness and knowledge about their children’s online privacy, their actions in some cases still violate their children’s privacy. In addition, parents are unaware of the long-term impact for creating their children’s digital footprints. The results of the survey and the game participation show that parents need to be more aware of their actions when sharing children’s personal information, photos and videos on any social media platform. In addition, more needs to be done to develop tools or educate parents on methods to protect

children’s online privacy as the advancement of technology and increasing privacy violation cases on vulnerable groups of people become more and more complex.

CHILDREN’S ONLINE PRIVACY FROM THE PARENTS’ PERSPECTIVE:

CHALLENGES AND A POSSIBLE SOLUTION

A thesis submitted

To Kent State University in partial

Fulfillment of the requirements for the

Degree of Master of Science

Paweena Manotipya

May, 2019

Except for previously published materials

Thesis written by

Paweena Manotipya

B.A., Chulalongkorn University, 1996

B.A., Concordia University, 2011

M.L.I.S., McGill University, 2013

M.S., Kent State University, 2019

Approved by

Kambiz Ghazinour , Advisor

Javed Khan , Chair, Department of Computer Science

James L. Blank , Dean, College of Arts and Science TABLE OF CONTENTS

TABLE OF CONTENTS………………………………….………………………...v

LIST OF FIGURES…………………………………….………………….….…….vii

LIST OF TABLES…………………………………….…………………….…....…ix

DEDICATION……………………………………….…………………….….…….x

ACKNOWLEDGEMENTS……………………….…………………………..…….xi

CHAPTERS

I. INTRODUCTION……………….………………………………….1

Introduction………………………………………………………….1

Research Objective…………………………………………………..4

Research Contributions…………………………………………...... 5

II. BACKGROUND……………………………...... 6

Current Stage of Children’s Online Privacy

in Social Media Services……………………...... 6

Evidences and Cases………………………………….…………...... 7

III. RELATED WORKS……………………….……………………….11

Understanding Parents’ Online Behaviors………………………….11

Laws and Legitimate Perspective…………………………………..17

Recommended Systems Researches………………………………..20

IV. PROPOSED WORKS………………...………………….…………27

Parents’ Actions………………………………………….…………27

Survey Questions……………...…………………….……...27

v Survey Method…………………………………..……...... 28

Survey Results…………………………………..……...... 28

Gamification Approach…………………...………………………38

Game-Based Learning………….…………………………38

Introducing to Social Sim Parents…………….…………..39

Game Propositional, Design and Implementation….……..41

V. DATA COLLECTION AND DATA ANALYSIS…………...... 53

Research Approvals…………………………………………...…..53

Research Participants………………………………………...... 53

Amazon Mechanical Turks workers……………...... …..…53

Volunteer Participants…………………...…………….…..54

Social Sim Parents Data Analysis……………………………..…..54

VI. CONCLUSION AND FUTURE WORK…………….……..…….64

Results and Main Findings…………………………………..…….64

Limitations and Future Work………………………………..…….67

REFERENCES………………………………………...... 69

APPENDICES

A. Children’s Online Privacy Survey Questions…………...……….…….74

B. Social Sim Parents Post-Survey Questions………………...... …….86

LIST OF FIGURES

Figure 1.1 Popular social media services that youth registers and

parents are aware of………………………………………….4

Figure 3.1 Images of the Momo Challenge hoax…………………………20

Figure 4.1 Percentage of parents opened/created profile on behalf of

their child……………………………………………………30

Figure 4.2 Parents’ knowledge of opt-out option…………………………31

Figure 4.3 Parents’ knowledge of remove option………………………...32

Figure 4.4 Parents’ online behavior in different age group on sensitive

topics………………………………………………………..33

Figure 4.5 Children’s information shared on social media services in

all age group………………………………………………...36

Figure 4.6 Social Sim Parents Simulation Model………………………...45

Figure 4.7 Social Sim Parents’ Scores Flow……………………………..46

Figure 4.8 Example of JavaScript code on post content, privacy setting

and opt-out page……………………………………………..47

Figure 4.9 Example of sentiment analysis scoring detection……………...52

Figure 5.1 Photo choices for scenario -1: buying a new home and kid’s

first day at school……………………………………………56

Figure 5.2 Photo choices of scenario -2: Toilet training and discipline…….58

Figure 5.3 Photo choices of scenario -3: Children’s achievement and

vii

vacation rewards……………………………………………59

Figure 5.4 Photo choices of scenario - 4: Children’s academic performance

issues and mental health issues………………………………60

Figure 5.5 Photo choices of scenario - 5: Child is diagnosed with ADHD

and Learning Disabilities (LD) ………………………………61

Figure 6.1 Percentage of overall participants’ satisfaction after playing

the game………………………………………………….....65

viii

LIST OF TABLES

Table 4.1 Children report complaints to their parents on various topics…………..35

Table 4.2 Example of score measurement for privacy setting page ………………49

Table 4.3 Example of score measurement on photos chosen……………………...50

Table 4.4 The 5 scenarios given to participants for them to post

and select photo choice…………………………………………………51

Table 5.1 Score range and risk level………………………………………………62

Table 5.2 Summary of data collection from simulation…………………………...63

DEDICATION

To my precious daughter, Maeya Anne-Marie MacKinnon,

my motivation and strength to conduct this thesis

for a better future for her generation

To my parents in Thailand, Prasit and Patcharin Manotipya,

for being my best role models

and supporting me with your unconditional love

Thank you for believing in me

I am grateful every day to have all of you in my life

I could never have become the person today

without all of your faith, love and encouragement.

ACKNOWLEDGEMENTS

I would like to express my deepest gratitude to my advisor, Dr. Kambiz Ghazinour, for having faith in me and for offering me this opportunity to achieve my dream in the field of computer science two years ago. I am grateful for his continuous support of my thesis research, and for his greatest generosity, patience, motivation and immense knowledge. His valuable guidance and insight encouraged me to be successful today. I could not have imagined completing this thesis without his persistence and encouragement.

I also would like to express my gratitude towards my thesis committee members,

Professor Angela Guercio and Professor Xiang Lian, for their insightful guidance, comments and encouragement towards my thesis research.

In addition to my advisor and the committee members, my sincere gratitude also goes to

Professor Marianne Martens, Associate Professor and MLIS Program Coordinator, School of

Information Science, who provided insightful guidance and assisted me to successfully conduct the first phase of this research experiment.

Last but not the least, my sincere thanks to my fellow labmates at the Advanced

Information Security and Privacy Lab (AISP), for their encouragement, stimulating discussions, food for thought, emotional support, and the sleepless nights we were working together to meet deadlines.

It has been a delight and privilege to fuse together research with faith and support from all of you. Thank you for your inspiration and for being a part of my journey in this thesis paper.

Paweena Manotipya

April 10th, 2019, Kent, Ohio.

CHAPTER 1

INTRODUCTION

1.1 Introduction

The world is changing rapidly toward a digital era with worldwide accessibility to the internet. As personal computers, tablets and mobile phones become part of everyday life, searching and sharing information is easier and more accessible than ever before. The most popular category in the World Wide Web is social media; it comes in many forms, including social networks, mobile applications, web-based pages, blogs, chat apps, and even social gaming.

According to the website Statista, in 2017, 2.46 billion people used a form of social networking, and this number is expected to increase to approximately 3.02 billion users by 2021 [1].

Although the increasing number of social media users is expected to come from countries with larger population like China and India, North American countries currently have the highest penetration rate of social networks with 70 % of the population has at least one social account

[1].

Social media platforms are used in various purposes and levels, from personal interests to business opportunities and government regulations. Among those users, parents and caregivers are one of the biggest groups that use social media daily. According to a survey conducted by the

Pew Research Center, they not only use social media for personal matters, but also post and share information related to their family, including children [2]. Parents use a variety of social media platforms and see social media as a source of useful information and as parenting tools

1 when it comes to family related issues. They even get emotional support from their social network. The most popular social media services among parents are Facebook, Pinterest,

LinkedIn, Instagram, and Twitter, respectively [2]. However, fewer parents reveal that they feel uncomfortable when the content of their family members is in social media. Most parents also do not mind the content posted about their children by other family members or caregivers on social media [2].

Although parents use popular social media platforms, their children seem to favor slightly different services from their parents. From the survey conducted for this thesis, which will be discussed in Chapter 4, the popular social media platforms among the youth that are known by their parents, are ranked as: Facebook, Instagram, Snapchat, YouTube/YouTube Kids,

WhatsApp, and Game Applications (see Figure 1.1 popular social media services among young people). Most parents are aware of their children’s existing social network applications; however, they do not monitor their children’s online behavior. According to the American

Academy of Pediatrics’ research on children and adolescents’ interaction on social media platforms [2], a noticeable number of children and teenagers have Internet access (40%), and one-third of them have access in their own bedroom. For them, computer time accounts for up to

1.5 hours per day, half of which is spent on social networking, playing games, or viewing videos, along with access of social media sites from their cell phones. The need for social media monitoring in children and adolescents has become necessary, and parents are the integral part of this social awareness.

Despite all of the news on social media and technology available, not only do parents need to keep up with the latest social media tools, they also have to understand the legislation that governs their use, such as the Child Online Privacy Protection Act (COPPA) in the United

States. These laws attempt to regulate young people’s participation in social media sites, protect their privacy, and limit how much personal information is shared. In this thesis, the major finding is that parents are either unaware of these laws or choose to ignore them. In addition, 45% of online twelve-year-olds report using a social networking site, according to a study conducted by the Pew Research Center [2]. The study by Boyd et al. found that 50% of parents reported that their children are using Facebook even if they are minors; furthermore, many accounts were created by parents for their children [3]. As the number of social media users increases at all ages, it is expected that children’s online privacy is at risk and needs to be monitored and protected.

There is also evidence on the lack of knowledge when parents and children are on social media and share their personal information online. One of the most common items users are unaware of concerns the opt-out option, or how to properly remove personal information once it is posted or shared with social media sites. Although most social media services have their privacy policies in place and display terms and conditions to their users prior to using the service, most people still do not know how to opt-out or remove their information after using the services. Some parents do not know that they can set parental control for their children’s devices, as explained later in the experiment of this research This includes those who claimed not to know how to do so. The fact that even parents lack awareness and knowledge about online privacy, is even more problematic for children and young adults. Most people share their personal information online either directly or indirectly; however, they do not understand the consequences of their actions. One of the major types of privacy violation that is common and popular is posting photos that reveal their identity such as photos of ID cards (like driving licenses, healthcare cards, etc.) The information in these kinds of posts containing names,

3 addresses, date of birth, etc. which are critical, as digital thieves can use them to commit crimes and (in severe cases) stalking and violating the victim’s security.

Figure 1.1 Popular social media services that youth registers and parents are aware of it

1.2 Research Objective

This research is an attempt to both understand parents’ perspectives about children’s online privacy, and to use effective tools to educate parents on how to mitigate the risk of violating their children’s privacy when sharing information on social media platforms. The motivation comes from observing social media users’ behaviors and studying research related to children’s privacy. There are many attempts from developers to control inappropriate content or to provide systems that alert users of such content; however, not many studies suggest effective approaches to educate parents on these safeguards. The survey part of this thesis, is the evidence

4 of how parents’ actions and online behavior can have side-effects on their children’s privacy, whereas the gamification part of this thesis educates parents by showing them consequences of their actions when choosing to post information related to their children online. The results from the survey led to the design of a social simulation game for parents, and the feedback from the game can be used to enhance parents’ awareness and knowledge to see the consequences of the choices they post or share. The ultimate goal is to demonstrate a real world situation of what could happen to them and their children, with the hope that parents will be more careful of their online behavior that could negatively impact their children in the long run.

1.3 Research Contributions

This thesis contributes to the area of online privacy preservation and awareness for a vulnerable group of users (children), and adding to the literature as follows:

• Survey questions were designed to suit global users with a variety of demographic

locations, cultures and background. As participants are from 53 countries around the

world, the findings are extremely diverse.

• By using survey questions to parents, it attests to the existing privacy issues and reveals

more challenges which leads to a proposed solution.

• The new approach of using social media simulation to educate parents has been

introduced.

• The data collection and analysis from both the survey and the gamification provide

insight for developers as well as parents.

CHAPTER 2

BACKGROUND

2.1 Current Stage of Children’s Online Privacy in Social Media Services

The degrees of privacy violation in social media platforms can be viewed in different damage levels, from personal concerns on individual privacy and security, to legitimate legal and regulatory levels. It is also crucial to acknowledge that the level of damage depends on the group or people dealing with the consequences. Children and young adults are identified as one of the vulnerable groups of users when it comes to the online community due to inadequate knowledge about their rights, and maturity. This is an important point, especially since they have become an increasingly significant part of online community; the number of young people using social media services has increased [1], whether by their own accounts or by those created by adults.

According to research conducted by the Pew Research Center, children and young adults are sharing more and more of their personal information on their profiles. Although they may set their profiles to be accessible for only ‘friends’, they share with large networks of their friends.

In addition, most teen social media users admitted that they do not care much about third-party access their data [4]. This lack of knowledge and awareness emphasizes the tendency of young people to be victimized or to be easily exploited by negative entities in the online community.

Although most parents, family members, and caregivers are proud of their children and their accomplishments, they are also unintentionally putting children’s online privacy at risk by sharing more and more of their information in various forms of social media. This thesis focus is only on privacy violation based on the online behavior of parents.

2.2 Evidence and Cases

Digital Footprint

Children today have the tendency to have an online existence even before birth.

According to a study conducted by AVG Internet Security company [6], some parents create their children’s digital footprint even at the time of their pregnancy by sharing sonogram pictures on social media services. Most mothers with children under 2 upload images of their newborn babies frequently; many of them even uploaded an antenatal scan online. Although many mothers create a profile for their newborn babies, some of them give the babies e-mail addresses.

It is expected that the majority of children born in this digital age will have the full cycle of their digital footprint starting by the time they are 2-years-old, continuing throughout their lifetime. It is especially important to note that the existing profile of those children are created by parents without the children’s consent, meaning that those children do not have a chance to protect their own privacy before the time they are mature. A study by the University of Michigan’s Health

System [5] shows that the majority of parents share potentially embarrassing information about their children on social media. The study also finds that about 51% of parents provide information that could lead to an identification of their children’s locations at any given time, and about 27% of parents shared potentially inappropriate photos of their children. It is crucial to recognize that some children may not desire to share such information at all when they reach adulthood, and that children might have an interest in entering adulthood free to create their own digital footprints [5]. Given that such information can be more harmful to children than useful,

7 most parents are still not aware of the consequences of their posts, or even aware of the risks to their children’s privacy and safety.

The term “Sharenting” [3], [5] is used to simplify the actions of parents when posting or sharing their children’s personal information while on social networks. A study by Stienburg [3] discusses an in-depth legal analysis of the conflict between the role of parents as gatekeepers of their children’s personal information and as narrators of their children’s personal stories. The research shows several cases of how parents’ online behavior can interfere with their children’s rights to control their own digital footprints. Some of the cases include times when parents were seeking support from a community or their networks with similar experiences about their children’s health conditions; parents revealed their children’s names, detailed symptoms, school names, recommended clinics, etc. Upon sharing this information, their fellow social network friends were more likely to share this information by forwarding it to others or expanding the chat to a blog or another chat group. Some parents started activities such as selling T-Shirts or fundraising in their community to help out parents who have children with health issues. Those parents used technology not only to discuss their life matters, but those of their children without any concerns of the consequences from disclosing sensitive information of their children.

Digital Kidnaping

Another common case is known as “Digital Kidnapping” [3] when parents post a few photos of their cute children, and strangers save those photos to use on their feeds as if they are their own children. This type of digital theft can be very difficult to investigate unless someone happens to come across the profile of that stranger. Another online stranger danger type can occur when strangers save, alter and post photos of undressed children who are in the bathtub, in potty training, etc. on websites, the source of the pictures coming from the parents themselves

[3]. The inappropriate photos of children are not only humiliating but can also lead to the case of pedophile sites, stalkers, or even bullies. These incidents are potential crimes and can affect children’s welfare and mental health later in their lives.

Third-party Data Brokers Using Children’s Information for Business

The information that parents post online about their children on social media sites has become very valuable in the business world. Data brokers can gather information online and create mini profiles of these children, then sell them to third-party businesses such as spammers, malware distributors or even government agencies [3]. This is because the children’s merchandise market has a huge value with high demands. Those profiles can be continually expanded throughout the children’s lifetimes. This is because when parents posted contents, photos or videos of their children on social media, most of the time the children’s first names were mentioned, along with dates of birth which allow viewers to predict the exact age of the person and easily create a profile of that individual.

The False Beliefs

There are many aspects of online communities that can mislead parents with false perceptions. Some parents trust social media providers, as they have policies about users’ privacy and security, thinking that whatever they post about their children should be safe and thus protected by default. Unfortunately, this is not the case when parents themselves are the ones providing the information to the online world. For instance, Facebook, Instagram and

Snapchat have restricted the age of users to be at least 13 years old; however, parents can create profiles for their children and start posting images and videos online. In addition, some parents lack the knowledge of online security that the information shared about their children will be

9 seen only to selected audiences as they set. Parents see social media providers such as Facebook allowing users to choose who can have access to each post and disclosure and assume that the information will be limited to the chosen audiences. In reality, this information has the potential to be widespread because the selected audiences can save and repost information in other platforms or locations [3]. The AVG Internet Security Company digital abuse study [7] also mentions that most people who disclose their information online are not aware of the retention of the shared data on the internet: that “what goes online, stays online”. Therefore, parents who share potentially improper information or overshare children’s data on social media might create a threat to their children’s digital footprints and future reputations that lasts a lifetime.

CHAPTER 3

RELATED WORKS

3.1 Understanding Parents’ Online Behaviors

The Joy and Challenges of Parenthood

Many studies attempting to understand parents’ online behavior show evidence that most parents know the drawbacks of sharing children’s information online; however, they continue anyway due to a variety of reasons. A study from the University of Michigan’s Health System

[5] explained parents’ online behavior regarding children’s data disclosure as influenced by ‘the joy of parenthood’. Apparently, parents in the digital age encounter the benefits of sharing information in social media community as well as facing its challenges. Parents (as well as caregivers) are usually proud and are urged to share precious moments of their children with the world. Many parents and other family members, especially grandparents, find children’s photos and videos to be too cute to keep to themselves. Because of this desire to communicate, sharing any concerns online can be beneficial to parents seeking helpful information for their parenting issues. Parents who have young children (aged 0-4) tend to seek information from social media users who are more experienced parents. They are willing to trust information from people in social media who share similar experiences, even though they recognized the potential pitfalls of oversharing children’s information [5]. Most mothers (as well as some fathers) discuss their child’s health and parenting methods on social media, sharing pictures of kids’ pretend plays, their meltdowns, and even pictures in the bathtub adorn Facebook walls, while diaper-donning

11 toddlers dancing to the likes of Beyonce and Taylor Swift accumulate YouTube views. Countless blogs also share stories about everything from potty training to preschool struggles [5].

In a recent study conducted by two professors from the University of Florida’s College of

Medicine [8], a significant point of awareness among children is revealed toward their parents’ online behavior. In one of the example cases, a six-year-old boy asked his mother as soon as she snapped a shot of him acting silly, “Are you going to post that on Facebook”. As the mother replied, “Yes, I think I will”, the boy immediately asked, “Can you not?” [8]. Many young people, including preschoolers and adolescents, notice that many photos of themselves that were taken from parents are most likely to be shared in social media sites. It is very tempting for parents to share what they find joyful about their children with others, and many parents do so without asking for their children’s permissions [8]. The article “When Kids Realize Their Whole

Life Is Already Online” [13] demonstrates a serious concern of children’s digital footprints that parents have created for them much longer ago than they realize. Moreover, children feel frustrated knowing that many of their personal writing stories and school performances or sport scores are available publicly to be viewed, and that all the information about themselves has been posted seemingly without their consents [13]. In a very recent story [28], the actress Gwyneth

Paltraw exchanges an argument with her 14-year-old daughter on her Instagram account, demonstrates a serious concern that young adults are aware about their presence online on their parents’ social media channels without their consent, even though the photo that the actress posted on her feed does not reveal any personal information of her daughter or even her daughter’s clear face. However, the daughter of the actress indicates as a replied post soon after her mother posted a photo, ‘Mom, we have discussed this, you may not post anything without my consent.’ [28].

Although it is suggested for parents to respect their children’s rights for sharing their photos online, fewer parents have that awareness and consistently follow that advice. The authors discussed that one of the reasons that the trend of sharenting continues to increase is because most children will likely never experience problems related to what their parents share.

On one hand, many parents from this study also commented that for most families, sharing their new additions’ stories with the world is a journey and, like any other journey, sometimes it goes wrong but most of the time things turn out alright. On the other hand, some parents take more extreme measures, and decide that the best route for them is not to share at all, while some parents use invitation-only photo sharing platforms, designed so that only selected audiences have access to those photos.

Although some parents are aware of the risks sharing their children’s data online, significant sources of children’s online information come from parents’ feeds over social media platforms. Many cases exist where parents’ posts had a negative impact on their children’s privacy and safety, such as misuse of children’s information by stranger danger, online harassment, and cyber bullying. For instance, this study references a survey of an online child pornography site conducted by an Australian government that revealed a shocking truth about the sources of materials. About half of the 45 million images found on the site had initially been posted and shared by parents on social networks like Facebook and Instagram). Most of the photos are innocent, as they are daily scenes of children playing. However, they were accompanied by explicit, inappropriate comments [8]. Although sharing the joys and challenges of parenthood and documenting children's lives publicly has become a social norm, the potential risks to children’s privacy and security also need to be addressed.

Popular Sharing Topics

Parents today have experiences and control over their own security and privacy while being online; however, there is still a huge learning curve on sharing certain contents of their children’s lives on social networks. The paper “Sharenting' trends: Do parents share too much about their kids on social media?” [5] describes the parents’ online behavior of sharing their children’s photos and data in five common topics: getting children to sleep, nutrition and eating tips, discipline, daycare/preschool, and behavior issues. Many parents find that sharing these experiences with their networks helps them worry less and gain a sense of community. These networks bring parents together in newer and larger networks, allowing them to commiserate, trade ideas and tips, share feelings, pride, advice, and assure one another that they are not alone

[5]. Moreover, most mothers who have young children from ages 0-4 seek information from social media users who are more experienced parents. They are willing to trust information from people in social media who share similar experiences, even as they recognize the potential pitfalls of oversharing children’s information [5].

A research paper conducted by scholars from New York University [7] discusses parents’ online behavior on posting children’s photos alone. By doing so, the majority of parents in the study fail to conceal related critical information such as dates of birth, full names, genders, locations, etc. In addition, fewer parents consider the consequences of revealing their children’s faces, full names, and related information prior to posting them. The photo sharing trend on social media sites is one of the largest issues, as children’s photos have become the targets of mockery and cyberbullying. Recent evidence of this can be found on Facebook groups that collect young children’s photos and make fun of ‘ugly babies’ [5].

Another popular topic on which parents share a significant amount of children’s information is behavior and health issues. Some parents share about their children’s mental health, and others post detailed information regarding their children’s medical conditions [3]. In one of the examples [9], a mother starts to write a story about her son who is diagnosed with autism on a Blog. She then continues to share stories about her feelings, her husband’s feelings and their lives in daily feeds. She is very proud of receiving feedback from other parents that her stories will not only promote autism awareness, but also autism acceptance in the community [9].

This mother, along with other parents, gather together and share their experiences facing disabilities at home via the online community called ‘The Mighty,’ as well as a similar Facebook group [9]. Parents use technology and social networks to overcome their obstacles, receiving some parenting tips with a lower cost than going to see consultants or pediatricians.

Unfortunately, social networks have both benefits and risks to children’s security and privacy, and parents need to be more thoughtful about what information of the children they disclose online. In some ways, documenting children’s health issues publicly can cause more harm to their lives than good. Moreover, parents who share their children’s health condition benefit from these posts more than their children, as they get useful information, feel as though they are not alone, and receive emotional support from others [10]. The downside is that some parents use their children’s stories to express their frustrations or attempt to heal themselves.

Some of them include hashtags like ‘#Anxiety’ or ‘#depressed’ in their feeds to get more similar stories and expand their online community with those who have a lot in common with them [10].

However, not all parents who encounter disabilities at home favor sharing their children’s stories. Some of them use the same social media platform (for instance, ‘themighty.com’) to attack parents who share children’s empathetic stories by creating pages with hashtags ‘pity

15 party writing’, ‘mommy martyrs’, ‘inspiration porn’ or ‘cripplingthemighty’ [9]. Most protesters describe the act of sharenting on children’s health on the internet to be ‘disgraceful’ for those young ones and that parents should not speak for them. It raises concerns for some parents after being criticized or knowing that they will be criticized. It also demonstrates strong evidence that parents can have different views of sharing stories of their children in social media, although blogs and pages about children’s health continue to increase and draw attention to those online communities [12].

Social Acceptance

In the clinical report conducted by the American Academy of Pediatrics, “The Impact of

Social Media on Children, Adolescents, and Families,” it describes that one of the strongest motivations of being on social media services is social acceptance. Young people have strong motivation to use social media platforms for several advantages, including staying connected with friends and family, making new friends, searching useful answers for their questions, sharing photos and videos, and showing off their talents as well as an opportunity for community engagement [11]. Most of the time, children and young adults use social media sites for seeking the attention of a larger community by allowing public viewers to have access to their profiles.

This is also valid for parents who are not worried about online privacy, that they will set their profile to be accessible to the public [5]. The number of ‘Like’, ‘Share’, ‘Followers’ and

‘Comments’ become the major reason for social media users to overshare to the public instead of keeping their posts private to selective audiences. Many parents who seek information or desire to expand their networks are more likely to open their profile ‘public’ or not setting privacy settings to only friends.

The article “Humiliating Children in Public: A New Parenting Trend?” [14] makes a case that parents are garnering Internet fame for posting images and videos of their children holding up signs in public places detailing their misbehaviors. Although this kind of discipline aims for behavioral change through public shaming and may receive much negative feedback from others, these parents still garner admiration from the public, with many parents sharing such posts to seek public support [3]. However, it is critical to emphasize that online discipline is more disrespectful and humiliating to children, not to mention that parents are building an indelible digital footprint that will follow those children into their adulthood [3][14].

3.2 Laws and Legitimate Perspective

COPPA Compliance

Children and adolescents are considered vulnerable groups because of their lack of maturity and life experience [11]. For the online community, Congress created the Children’s

Online Privacy Protection Act (COPPA), which prohibits websites to collect information from people younger than 13 without parental permission. Today, most social media providers have adopted COPPA regulations, limiting their services to users 13 and older. However, many social media platforms continue to not have an age restriction, some of which are sites such as Disney and Club Penguin which are targeted to preadolescents and younger children [11]. It is up to parents and caregivers to evaluate and monitor social media sites for their children, as well as being active role models in using social media services appropriately. Moreover, the American

Academy of Pediatrics (AAP) encourages online users to respectfully follow the age restriction.

The report [11] reveals that some adolescents, and some parents who create a profile for their children, commonly provide a false age in order to open up an account. It is important that

17 parents strongly adopt this practice rather than send mixed messages about deceiving, so that online safety is the main concern being emphasized.

The study published in the Emory Law Journal [3] discusses the conflict of individual’s rights when children and parents have different interests. Courts and law enforcers often place a higher value on the interests of parents, family members, and authorities in exercising control over a minor’s judgement. In several cases related to minors, the court has focused on parents’ rights to raise their children as they see fit; however, children have gained protection to their privacy under both Constitutional and international laws [3].

School Grounds

While courts and law enforcers may favor parents and guardians over the interests of children., the study [3] also mentions other forms of authority figures that have control over children’s interests. For instance, when minors engaged in any sort of behavior, such as

Inappropriate Displays of Public Affection (IDPA) in a school environment, the administrators were obligated to notify the parents despite the minors not wishing to share this information with their parents. Courts also recognized that the school’s interests in following state law was legitimate. Moreover, because it often turns out that the final decision made is not what the minors see as best for themselves, the authoritarian view of state action gives little value to minors’ own voices [3].

Potential Threats

Many studies reveal the variety of potential threats to children’s online privacy in different levels. Despite the challenges of diverse family backgrounds, cultures and geolocation differences, young social media users share many common risks, including cyberbullying, online

18 harassment, sexting, pedophile sites, depression over social network acceptance, digital footprints, digital kidnapping, digital theft, and fraud or overwhelming advertisement [11].

Among those threats, sexting and cyberbullying are the most impactful threats that cause both physical and mental health issues in minors. Young people who have access to personal devices can experience sexually explicit messages, images or videos. This type of threat usually occurs among teenagers, up to 20% of whom have either sent or posted nude or seminude images or videos of themselves. Some of those teenagers who engaged in sexting have been threatened or charged with child pornography under juvenile-law demeanors, in addition to school suspensions [11].

Although the terms online harassment and cyberbullying have been used interchangeably, they are quite different and have different levels of impact to the victims. Online harassment is not as common as physical harassment, whereas cyberbullying is common and can happen to any young people online. Cyberbullying can cause profound mental health issues including depression, anxiety, severe isolation, lower self-esteem, and emotional distress, any and all of which could lead to suicide [11].

As the number of social media platforms increases, more sites are experiencing security issues and having difficulty monitoring it in real-time. For instance, YouTube Kids recently received reports on potential crime content (“YouTube Kids videos found with suicide instructions” [17]). The video clip mentioned contains only 9 seconds of instruction on how to properly slit your wrists, and most parents cannot monitor such videos closely or quickly enough.

Although YouTube Kids has sent out a promising statement promoting a safer online experience for kids by explaining that they use a mix of filters, user feedback and human reviewers to keep

19 the videos in YouTube Kids family friendly, no system is perfect and inappropriate videos can slip through [17].

Similarly, ‘The Momo Challenge’ that has been around recently all over WhatsApp,

Facebook, Twitter and YouTube, targets young children and schoolers to do a killing challenge

[18]. According to the article, this type of challenge game (passing from one player to another in their social networks) aims at encouraging young people to self-harm and eventually commit suicide. The challenge tasks start small then escalate to violent acts very quickly, with most of the victims being asked to provide photos or videos as proof of their achievements [18]. Officials in multiple countries believe Momo’s final challenge leads to suicide and the game is rumored to be linked to at least three recent cases of minors who killed themselves in Argentina, Colombia and India [18].

Figure 3.1 Images of the Momo Challenge game. These have millions of views on YouTube and are believed to lead to self-harm or suicide for young people, although some say it is an Internet hoax.

3.3 Recommended Systems Researches

COPPA Filters

A recent research article, "‘Won’t Somebody Think of the Children?’” Examining

COPPA Compliance at Scale"[15] reveals shocking findings on a large number of social media applications on the Android operating system that (potentially) violate COPPA regulations. This research examines 5,855 of the most popular free children’s apps from the U.S. Google Play

Store that use third party SDKs, causing loopholes for children’s privacy protection. Moreover, many companies that have been certified as COPPA-compliant under various ‘Safe-Harbor’ programs show the prevalence of potential COPPA violations because they still collect geolocation data and contact data without verifiable parents’ consent. Developers and third-party services must follow certain rules when using legitimately collected PII. One example is that PII collected from children cannot be used for profiling such as behavioral advertising or cross- device tracking without parental consent [15]. Although many SDK systems offer configuration options that adopt COPPA regulations (section 5) by disabling tracking and behavioral advertising, 19% of children’s apps were found to collect identifiers or other personally identifiable information (PII) via SDKs whose terms of service outright prohibit their use in child-directed apps [15]. In addition, most of the apps in this research do not use configuration options or propagate them incorrectly across mediation SDKs; therefore, many of them still collect identifiers or other information that reveal the users’ identification against child-directed apps.

The researchers in this study [15] used a new dynamic analysis framework to monitor actual program behavior in real-time and at scale. Their testing platform was able to examine how often and under what circumstances apps and third-party libraries access sensitive resources

21 guarded by permissions. They also use Android’s UI/Application Exerciser Monkey (the

“Monkey”) as a bot tool to automate and parallelize the execution of apps by simulating user input. With the first large-scale dynamic analysis of children’s apps, they were able to identify several concerning violations and trends. A few examples include when apps share things like location or contact information without consent or personal information without applying reasonable security measures; potential non-compliance by sharing persistent identifiers with third-parties for prohibited purposes; and ignorance or disregard for contractual obligations aimed at protecting children’s privacy. Overall, 50% of the 5,855 child-directed apps analyzed were found to be potentially violating COPPA [15].

Interestingly, the responses from the industry and developers to show efforts on preserving children’s privacy and preventing COPPA violations have proven to be less effective.

Google, for example, enforces COPPA compliance by offering the Designed for Families program. It requires children’s apps developers to be certified and compliant with COPPA information. Google also uses its own policies to enforce developers to prohibit apps from transmitting the privacy-preserving Android Advertising ID (AAID) in parallel with other determined identifiers. However, the research reveals that sending non-AAID identifiers is rampant among Android apps and, from the study’s testing, up to 39% of children’s apps still

(potentially) engage in COPPA compliance violation [15].

Parental Control Approach, Do Parents Need Rules?

Among the attempts to study methods on protecting children’s online privacy through parents, some studies suggested parental control approach as one of the solutions. In the research article, “Social Network Monitoring Application for Parents with Children Under Thirteen” [16],

22 scholars conducted a survey in Thailand in an attempt to find evidence on under-thirteen social network users. The survey targeted large audiences with 1,800 participants, including primary, middle and high school students as well as their parents. In this research, the survey questions aimed at finding out what type of information young children and their parents shared on their social media platforms. Although this research was examined in a specific culture where schoolers have access to internet and personal devices at a young age, it could also reflect potential risks as it studies some of the future trends for personal devices and online users worldwide. The information that the participants shared publicly included their profiles that revealed their official names or nicknames and their mobile phone numbers. The majority of students aged between 6 and 12 already owned at least one account on a social network site, and

35% of primary school students shared their real home address on their public profile pages.

Those who shared their mailing addresses were not aware that they were automatically geo- tagged, and they often accepted strangers into their friend lists. In addition, most of the parents participating in the survey admitted that they did not acknowledge that their children had an account on a social media service at all, with only a few parents monitoring their children’s online behavior regularly [16]. From this survey’s findings, the researchers proposed a new method to offer parental control platforms as a solution for children’s online security and privacy. They created a mockup social network on a mobile application using the Android software development kit (SDK). In this network, the features worked similarly to those on

Facebook, including the ability to hide some information as a Facebook message, and a public message where everyone can see it as a Facebook new feed [16]. They provided application authentication features through usernames and passwords, including proof of relationship with the child, and security through token keys. The pre-alpha stage was tested by twenty parents and

23 twenty children who were assigned to use the stimulation program within forty-eight hours. The children were given a URL for their account and they had to provide input, while parents installed the controlled application with a login credential to monitor their children’s online behavior in the mockup platform. Most parents showed satisfaction of the concept that they could observe their children’s online activities [16]. However, the researchers neither explain in detail the criteria they were asking for in their satisfaction survey nor provide details on the effectiveness of the mockup program.

Another study on integrating technology and family life, “Not at the dinner table: Parents' and children's perspectives on family technology rules” [19] reveals an interesting aspect on how families seek common grounds when it comes to online behavior. The study launched a survey involving 249 parent-child pairs across the U.S. to understand the type of technology rules that modern families currently use in their household. They found that although parents and children tried to set rules on using technology (especially on mobile devices and tablets) at home, parents themselves also struggled to set and abide by the rules they set for themselves [19]. Children also voiced that parents also need rules while being online and should respect children’s rights prior to sharing their stories or information. One of the open-ended descriptions of ‘rules for parents generally-as reported by children’ revealed children’s concerns about the information parents share on social media. Moreover, the taxonomy of technology rules for parents showed that most parents expect other parents to do “No sharing information about children without explicit permission: Don't post anything about me without asking me” and “Allow children to make their own decisions about their technology use: Let kids have their private time on social media without their interference.” [19]. Although this study explicitly discusses technology usage in a family context wrapped around the privacy of young children that warrants the attention of

24 parents, it suggests that parental control concepts are also crucial for children’s well-being, and that children’s online activities still need to be monitored frequently [19].

Best practices informed by Public Health and Child Development Professionals

The research [3] describes best practices that should not be seen as rules but rather as suggestions for parents while being in an online community. A few suggestions mentioned include the following: parents should familiarize themselves with the privacy policies of the sites with which they share; parents should set up notifications to alert them when their child’s name appears in a Google search result; parents should consider sometimes sharing anonymously; parents should use caution before sharing their child’s actual location; parents should give their child “veto power” over online disclosures, including images, quotes, accomplishments, and challenges; parents should consider not sharing pictures that show their children in any state of undress; and parents should consider the effects that sharing can have on their child’s current and future sense of self and well-being [3]. These recommendations aim at educating parents to consider the objects of their disclosure, their children’s present and future perceptions, and preventing any security issues that may come from inviting the world into their children’s lives without first obtaining informed consent [3].

The role of pediatricians

In most studies about children’s online privacy, pediatricians’ comments and suggestions are the integral part of children’s well-being that parents take into account. The research [11] describes the role of pediatricians as a unique position to educate families about both the complexities of the digital world and the challenging social and health issues that young users experience. In specific situations such as bullying, popularity and status, depression and social anxiety, risk-taking, and sexual development, pediatricians should encourage families to

25 understand potential threats and face the core issues of the crisis. In addition, they should advise parents to talk to their children and adolescents about their online behavior and the specific issues that children can encounter online, as well as advise parents to keep up with technology or being aware of what technology or platforms their children are using. Moreover, pediatricians can discuss with families the need of regular family meetings on online topics, privacy settings, and inappropriate posts. It was advised that such meetings should focus on healthy behavior rather than punitive actions. However, it was also suggested that pediatricians encourage parents

to understand the importance of supervising their young ones face-to-face rather than remotely monitoring with a ‘net-nanny’ software [11]. Pediatricians who have websites or blogs should provide families with reputable online resources to expand their knowledge such as “Social

Media and Sexting Tips” from the AAP, the AAP Internet Safety Sites or the AAP public education site, Healthy Children.org, and create a section in their website that provides useful links to social media that is appropriate for different age groups [11].

Even though many studies attempt to educate parents by providing guidelines and suggestions to parents, it is ultimately up to the will of the parents to strictly follow those suggestions or guidelines. It is critical to emphasize that a large number of parents still lack awareness and knowledge on children’s online privacy issues and effective approaches on educating parents need to be adopted in an online society.

CHAPTER 4

PROPOSED WORKS

4.1 Current Stage of Parents’ Online Behavior on Children’s Privacy

Although parents are being told more about the consequences of oversharing their children’s stories and information on the Internet, there are still increasing privacy violation cases caused by parents and family members. Many cases occur in various cultures or different laws, yet the consequences are very similar in most cases. In order to understand what parents require or struggle with, 24 survey questions are created and given to parents to verify key conflicts of interest that they struggle with as well as their concerns on current issues on which they need to be informed.

4.1.1 Survey Questions

The proposed work was divided into two phases; the survey questions to understand and demonstrate current stages of parents’ online behavior, and the game-based simulation to educate parents about online privacy. The survey questions were designed to identify levels of knowledge and awareness about online privacy that parents in different geo-locations and cultures obtain, and knowledge about their children’s online behavior. Moreover, it collected data on some similarities about parents’ online traits that might be the indicators to parenting trends that deal with children’s online privacy preservation. In addition, these questions were also designed based on four objectives: awareness, knowledge, parents’ actions, and solutions, respectively. The survey questions (see Appendix A for the complete survey questions), targeted parents around the world with children aged 0-17, making this survey a reflection of diverse 27 cultures and backgrounds. Because of this, the study was anticipated to be subjective depending on the community participants live in. The social media services listed on the survey are

Facebook, Instagram, Snapchat, Twitter, YouTube/YouTube Kids, Skype, Reddit, Telegram,

WhatsApp, Viber, LINE, WeChat, LinkedIn, Tango, Google products, Weibo, Musical.ly,

Pinterest, Blogger, Signal, and Game applications. These sites our chosen since they are popular and have users around the globe.

4.1.2 Survey Method

The 24 survey questions were created in the Qualtrics data collecting platform in both multiple choice and text options. It collected data from participants by providing an anonymous link to be posted in the Amazon Mechanical Turks site (MTurks) to validate credentials and authentication of participants. The survey received 1,300 responses from parents in fifty-one countries from seven continents; North America, Central America, South America, Asia-Pacific,

Middle-East, Europe and Australia.

4.1.3 Survey Results

Generally, Facebook is the number one social media service that parents around the world have accounts with and also have access to their child’s account. It is also a popular social media platform that most young adults use to connect with the world, followed by

YouTube/YouTube Kids, WhatsApp, Instagram, Snap Chat and various game applications, respectively. The top ten information that parents with children in all age group shared are 1.

Gender; 2. Name/Family name; 3. Date of Birth/age; 4. Photos/Videos of themselves; 5. E-mail address; 6. Photos/Videos of family members/pets; 7. School name; 8. Favorite genre/sports/activities; 9. Family status; and 10. Mailing address/location/zip code. From these information, parents also included children’s information through their own stories in their feeds.

Initial Findings from Parents Who Have Children Aged 0-5

Although the overall responses showed that parents with children in this age group were highly concerned about their children’s online privacy, their awareness and knowledge on this topic was not so promising. 58% of parents with young children up to five years old shared their great concerns about their children’s privacy; however, parents themselves shared their children’s personal information online such as names, gender and dates of birth (age), and some even created social media accounts for their children (see Figure 4.1 for the percentage of parents creating profile for children). This information, especially date of birth and gender, are identifier data that most parents obviously are not aware of. Moreover, parents in this particular age group also disclosed that they posted and shared photos, videos or information about their child on their social media accounts, as well as tagging children’s photos and videos to family and friends. In fact, this group of parents made up the majority of parents who have shared their children’s information on social media platforms (73%). Although they did not use parental control on their devices because this age group is apparently too young to browse by themselves, many parents admitted that they actually have no idea how to set up parental control in their devices. However, this issue is also common for parents who have children in other age groups.

Figure 4.1 Percentage of parents opened/created profile on behalf of their child.

The majority of parents who have children aged six to ten stated that they were ‘Not

Concerned’ about online privacy, although they started to monitor their child’s online activities or devices regularly. According to the responses from parents in this age group, some children at this age start to register and request to be members of game applications and social media services like YouTube/YouTube Kids, WhatsApp, Signal, and Musical.ly, and have their own social media accounts. Therefore, parents have started to monitor their children’s online activities regularly and have set up parental control on the devices because they find it is too dangerous to leave their children using social media services without supervision. In contrast, parents rarely discussed the dangers of being online with children at this age group, simply because they assumed that children aged six to ten are too young to understand it. In addition, parents did not know if their child’s information appears elsewhere without their consent. They also revealed that they have to seek information from their child’s network to find out if the photos, videos or information were misused, as their children did not share this information directly with them. In this particular age group, parents began to receive peer pressure to open

30 social media accounts for their children, sharing and tagging photos and videos on their accounts to family members and friends.

Despite the fact that parents have experience using social media platforms and are perceived to be keen about surfing on the world-wide-web, their knowledge on social media functionalities was surprisingly inadequate, especially on the options to ‘opt-out ‘and ‘remove’ personal information (see Figure 4.2 for responses of opt-out and Figures 4.3 for responses of remove information). The majority of parents did not opt-out information, and even did not know these options exist, let alone not knowing how to do so. However, parents gained more experience and became more aware of how to remove personal information or how to set parental control on devices when their children reached the ages in which they can browse and use devices by themselves.

Figure 4.2 Responses of opt-out information

Figures 4.3 Responses of remove information

Initial Findings from Parents Who Have Children Aged 11-13

Parents who have children aged 11-13 showed the most concern about online privacy

(59.59 %), compared with parents in different age groups. The reasons parents begin to be very concerned about online privacy is because both parents and children have their own personal devices (mostly tablets and mobile phones) that are used daily, making it very challenging to monitoring activities frequently. In addition, parents who have older children, especially adolescents aged eleven to thirteen continue to have peer pressure on using social media services to share their children’s stories. On the positive side, parents set up parental control in their children’s devices, and monitor and talk to their children regularly about the dangers of social media (see Figure 4.4 for parents’ online behavior trends in different age groups). Most parents with children in this age group care about their children’s rights and privacy and believe that it is the right thing to set parental control in particular websites and the child’s devices so that they do not become exposed to inappropriate content. However, many parents in this group would like to set up parental controls but did not know how to do so, with many of them admitting that they

32 trusted their children because their children knew about the internet than they do. These trends continue to occur when adolescents reach age 14-17. Unfortunately, it shows that parents did not have the knowledge when they entered into parenthood and have not been willing to obtain this knowledge as their children grow.

Another aspect of children’s accessibility to online content shows the potential risk of children’s online privacy violation. Children in this age group start to show demands on using certain social media services and online applications, as the majority of parents report that their children have access to their online account and/or credit card (e.g. iTunes, PayPal) for purchasing games and music.

Figure 4.4 Parents’ online behavior in different age group on sensitive topics

Initial Findings from Parents Who Have Children Aged 14-17

Parents with children in this age group showed concern about their children’s privacy; however, they did not interfere as much with their children’s online activities as those in younger age groups. As children reach young adulthood, parents do not view their social media activities

33 regularly anymore and the children no longer need parents to open social media accounts for them. The survey shows that although parents did not monitor each activity their children do online, they still kept an eye on some activities such as what their children posted, as well as liked and tagged photos and videos of themselves. As some parents become friends in their children’s networks, they automatically monitored some online activities which they think are enough and appropriate for keeping privacy between parents and young adult children. In addition, although parents with children in this age group still shared their children’s stories on the parents’ account, they shared children’s personal information less than those in an earlier age group.

4.1.4 Key Findings

Issues on awareness and knowledge about online privacy

From the parents’ perspective, online privacy in social media services is very subjective and confusing, especially between the owner of data and the data collector. Although most parents stated that they care about online privacy when asked at the very beginning of the survey, they also said they do not think social media services request too much information from their users. Moreover, when asked at the very end of the survey ‘Do they think/believe there is such a thing as online privacy?’, the majority of parents admitted that no such online privacy exists, or they did not know if it has ever existed. This perception can be interpreted as if parents today may have a lack of understanding about the definition of online privacy, or that they do not have enough knowledge to clarify what kind of information is (potentially) harmful to their own privacy as well as that of their children. Most parents of all age groups (73%) revealed that they posted/shared photos, videos or information about their child online, and that almost 90% of those parents shared them on their own social media accounts. Many parents also considered the

34 popularity of social media sites over ratings/reviews when signing up for the services. In addition, they did not consider privacy on dissemination of user information prior to signing up for the service at all, as fewer parents cared if social media providers have a policy that states where the data is going to be used.

It is worth considering that many parents seemed to be very positive about online experiences because the majority of parents (62%) never received any complaint about related online activities from their children, and never received notifications or reports that their children’s information, photos, or videos had been used elsewhere without their consent.

However, out of those who indicated that they received complaints, most of these came from an overabundance of advertisements, spam and fraud (see Table 4.1 for children’s complaint topics and percentage). Interestingly, among those complaints, children also experienced cyberbullying more and more as they grew (children age 14-17 have the highest percentage), and children from ages 6-14 reported that they were the target of being approached by strangers.

Table 4.1 Children report complaints to their parents on various topics

1 Receive too many advertisements 43% 2 Spam, Fraud 39% 3 Receive too many mass mailings 33% 4 Approach by unknown users 32% 5 Cyberbullying 27% 6 Their information/photos have been used somewhere else or by strangers 15%

Sensitive Data Disclosure

The information that the survey participants (parents and their children) shared over the internet contains sensitive, identifiable information, especially names and family names, dates of birth, genders and e-mail addresses. As the information is defined as sensitive data in the field of

Data Security and Privacy (including name, gender, date of birth and zip code) [21], it is more

35 likely that users who share this information with a high visibility level can be identified easily and have security and privacy issues. The survey results (see Figure 4.5 for children’s information shared on social media services) reveal the fact that some of the information came from their first legal documents such as school IDs, driving licenses, social security numbers and passport information.

Figure 4.5 Children’s information shared on social media services in all age group

Given that parents have a certain awareness and knowledge about data needing to be maintained private, such as financial information and legal documents, some parents still shared those data either directly or indirectly online. In most cases, they trusted the privacy policy of social media providers and ‘hoped’ that their account or information would not be compromised.

When asked, “which information would you prefer NOT to provide social media services?”, the top five that most parents chose included credit card information, driver’s license, passport information, social security number and financial account (iTunes, PayPal or similar). However,

36 identifier data such as gender, date of birth or zip code ranked last. It showed that even parents who are perceived as experienced adults and should have knowledge about their own security and privacy protection can be lured to sharing data that looks very simple and insensitive when in fact it is highly sensitive for identifying an individual.

While parents share their own stories online as well as those of their children, most parents stated their concerns over items over which they could not control, such as their children’s information disclosure done by the minors themselves. When asked ‘what changes would you suggest to social media services regarding security and privacy policies?’, the majority of parents at all age groups (57 %) preferred social media service providers to allow them to have access on their children’s posts and chat history. Fifty-five percent of the parents also shared concerns about the purpose of the data used in the online world, as they prefer social media sites to have a clear statement on how their information or their children’s information is going to be used and would like the privacy policy to be written in a clear and concise manner so that they can easily read and understand it before collecting data. However, only 29% of parents shared concerns on data retention that they are not aware of, including how long their data or their children’s data would remain in the database.

From these survey findings, the issues that today’s parents encounter and that interfere with their children’s online privacy can be identified as the following;

• Parents’ awareness about their own information as well as their children’s information

disclosure

• Parents’ awareness on monitoring whether their information and their children’s

information are used and kept as promised in the privacy policy, or if it appears

elsewhere

• Parents’ awareness on the retention of their data in social media platform (how long their

data will be retained in the database

• Parents’ knowledge about the definition and scope of online privacy and how to protect

their rights and those of their children in an online community

• Parents’ knowledge on what kind of data is sensitive or potentially at-risk of being stolen

or identifiable for attackers

• Parents’ knowledge about social media policy and features such as privacy settings,

parental control settings, opt-outs and data removal options

• Parents’ knowledge on the consequences of oversharing information (digital footprints,

identity theft, digital kidnaping, and misuse of data)

4.2 Gamification Approach

From the software developer’s point of view, there are many ways to improve users’ online privacy. Besides building barriers and setting privacy policies that enforce social media services to comply with laws and regulations, one of the solutions is working with users by educating them to protect their own security and privacy. Since the users (in this case parents) obviously lack adequate knowledge, developers can build tools or platforms that allow parents to learn and experience worst-case scenarios and understand the consequences when their data in social media sites has been compromised. It is suggested [20] that one effective learning method is through entertainment instructions (game) that provide regular feedback about their performance, resulting in deep learning. A game-based learning experiment emphasizes that a

user can learn a great deal and motivate them to want to learn with high achievement when set in a serious game environment such as a real-life situation [20].

4.2.1 Why Use Game-Based Learning?

Many studies dedicated to a game-based learning approach demonstrate positive outcomes with users’ learning in various aspects. One of the positive aspects is a higher level of user engagement to entertainment instruction than the traditional learning instruction. Besides, a serious game environment can promote learning and motivation, provided it includes features that prompt learners to actively process the educational content [20]. It is essential to emphasize that game-based learning not only stimulates the users to learn but also provides instant feedback through steps/levels, incentives/rewards and scores of their performances. In addition, learning through games is memorable and can teach deeper learning when the challenges are meaningful to players or when they provide contents that they can relate to in their own lives.

The impact of game based-learning

The study [20] discusses the impact of entertainment instruction through a game (or a game-based learning approach) that might be effective in facilitating learner’s skill development.

Moreover, many studies, including ‘Cognitive Benefits of Digital Games for Older Adults’ [23] describe the benefits of game-based learning that are effective to learners of all ages, not just for younger learners. Game-based learning also supports multiple cognitive abilities, including learning new strategies, and adapting to new ideas and change [23]. While games have a reputation as a tool for learning in many studies and literatures, using simulations also shows evidence as an effective supporting tool for learning [24]. Games and simulations are widely used to serve different learner groups, including underserved learners, learners with skill needs and informal learners seeking to learn from experiences. Besides these reasons, games and simulations that aim to highlight specific knowledge result in positive outcomes and a strengthening of motivation for learners to be more and more engaged in the given tasks or

39 challenges [24]. As learners highly engage in the challenges, the instruction becomes memorable and meaningful to learners.

4.2.2 Introduction to Social Sim Parents

As the findings from the first phase of the survey demonstrated the need for parents to be more aware of their online behaviors as well as the lack of knowledge on protecting their own privacy and their children’s privacy, the proposed work in this thesis was focused on advocating parents using the game simulation to mimic their online environments, showing the consequences of their behavior using a scorecard. The ultimate goal of this simulation was to educate parents through direct experience when they chose to share sensitive data and photos that have a potential risk of privacy violation, including reasons why those choices could lead to negative outcomes.

Social Sim Parents is a web-based simulation that aims at raising awareness and knowledge for parents, guardians, or family members who have minors (including expected babies and children aged 0-17) in their family. The concept of imitating a social media interface and using scenarios to educate participants was used as the theme of this experiment, targeting a specific audience (in this case, parents or guardians). This online web-based game consists of five parts;

1. Welcome page or instruction: this prompts participants on information about the purpose

of this research, credentials, and how to start the game

2. Profile page: this contains query boxes that the participants can choose to fill in

3. Steps 1-5 (or levels): this contains scenarios in each step for participants to choose how

they post contents, along with the photo option

4. Score card: provides feedback for participants’ performance on each step with the

number of total Likes, total scores, reasons, and privacy risk level (see Figure 4.9 for an

example of the scorecard)

5. Post-survey after playing the game: participants provide feedback of their experiences

from this experiment

4.2.3 Game propositional, Design and Implementation

Social Sim Parents is designed to examine the parents’ awareness and knowledge about information shared on their social networks; therefore, the design of the game is similar to a social media web interface. However, features are designed to facilitate users with simple tasks and a few descriptions about scenarios.

Game logic and design

The Social Sim Parents simulation logic consists of various game elements and the relationships between game elements. Game elements or game attributes that make up Social Sim Parents combine with theme, purpose, tasks, conflicts, scenarios, levels or steps, rewards (Like, scores) and feedback of user performance in the scorecard. However, as this educational game is content-based, there is not much of a strategy or chance component. Each component or attribute connected to one another to make the game flow and lead to the next step. The game logic as defined in the paper ‘Propositional game logic’ [25] involves the system or mechanism and syntax of the game that enable players to do or not to do certain things in the game system. By knowing the game’s logic, players can use it to win the game (or achieve the goal) to their advantage. For instance, Social Sim Parents allows players to move to the next step only if they choose and post at least one photo. On the other hand, the game system also allows players to

41 opt-out of information that they provided earlier, giving them a chance to improve their privacy scores.

The contents conducted in Social Sim Parents were created from the results of the first batch of the experiment: issues on sensitive data sharing, lack of awareness, and knowledge about online privacy. The participants or players will be tested on their awareness and knowledge on sensitive data sharing throughout the game. They will also be challenged to choose photos that were given to them to evaluate their level of awareness and knowledge on what information is contained in the photos, having an impact in each photo choice they select.

However, as this game is the experiment for a thesis paper, there are many elements that can be improved upon and extended in future works, such as a variety of contents to cover all aspects of privacy and security issues, measurement methods, features and aesthetics.

While the game requires a good game design in order to motivate or appeal to players, it is also essential to consider the quality of instruction. Therefore, educational game design can be extremely challenging, as it has the tendency to be less entertaining with heavy text contents.

Moreover, no existing study extensively justifies the measurement of privacy awareness or knowledge instruction in what can be considered good enough or appropriate enough for online privacy and security preservation. Moreover, there is no effective tool for users to properly detect privacy violation or constantly remind users of the consequences. Similarly, there is also no measurement method on ethical perspective of what action is right or wrong, as it is both highly subjective and controversial. Many studies demonstrate evidence of negative outcomes and cases after users have already been attacked by strangers, digital thieves or hackers; however, there is no proven effective suggestion from either developers or users in preventing attacks from happening, unless there is no ‘user input at all; in other words, no information sharing on the

42 internet, which is rarely the case. This issue could be a very interesting and challenging future research topic for future researchers to explore.

In the second experiment, the Social Sim Parents simulation is designed to be an initial, effective tool to demonstrate the worst-case scenario outcomes when participants decide to share, choose and post sensitive contents and photos. Therefore, each step is filled with deceptions in query boxes to thoroughly reflect how parents should be cautious about their own privacy as well as their children’s data that can be extracted in different forms. Each query box, as well as each photo, are tied with scores and Like, depending on how negative or positive the outcomes could be. This type of learning instruction is referred to as authentic learning [26], as it uses examples of real-world experiences as tasks (or challenges) to educate learners for meaningful and practical instruction.

The irony of privacy protection: conflicts of interest between developers and users

Regarding the rationale of this educational game, Social Sim Parents refers to the Data

Privacy Taxonomy [21] as the guideline to design the theme and contents. The measurement method of this game design is in line with four domains: 1) purpose; 2) visibility; 3) granularity; and 4) retention of data and information from participants.

For the purpose of data collection and usage, most social media platforms collect the users’ personal data for the intention of single use or reusing that data either on their own service or sharing them with subsidiary or business partners. Moreover, some of the data requested from users has no intention to be used or is not related to the social media site, such as complete address, complete date of birth, health condition or access in a phone book. However, the majority of online users are not aware of the purpose of social media service providers in collecting that personal information and do not know the value of data they decided to provide.

The visibility part has been more comprehensive for users, as it usually appears more frequently on the wall or newsfeed. The common icons including ‘Public’, ‘Friends’, ‘Friends of friends’, ‘Only me’, and ‘Friends except…’ on Facebook, are typical representatives of privacy settings for visibility. Most social media users are familiar with these icons; however, not every social media service uses the same user interface and may not be as easy for users to set their visibility level properly or as they prefer to be seen. In addition, some popular social media services like Instagram will set the users’ visibility as ‘Public’ by default, and it will remain

‘Public’ until the users change their visibility setting in their account page. The Social Sim

Parents game addresses this domain and weight visibility of data as an important element of the privacy awareness level.

The granularity of data refers to the level of detailed information, provided that the greater the granularity, the deeper the level of detail [21]. Most of the time users are not aware or do not know and are even careless about the granularity of their personal data being collected in social media platforms, simply because granularity is neither shown nor announced in the privacy policy. The detailed level or amount of information that users share over the internet can be gathered and can identify an individual, depending on the specificity of the data collected.

Social Sim Parents emphasizes the level of depth and amount of data sharing that can be found in various forms, including profile page, posts, photos, videos, hashtags, query boxes or drop-down boxes.

As for the retention of data in social media sites, most social media service providers have a privacy policy in place and indicate the users’ rights to maintain their own retention of information. In reality, most people do not take ownership or keep track of the retention of their existing data provided and stored in the provider’ database. In fact, most existing data in social

44 media stays in the server or database indefinitely without any requests to be removed from the users. Moreover, as the level of detailed data is collected cumulatively over time, the retention of data is more likely to be extended for the service providers’ advantage. However, Social Sim

Parents does not address the retention domain, as the participants’ data will not be reused or recurring like on actual social media sites. In fact, the database in this simulation does not collect all data, and only intends to retain some of the participants’ data in a closed environment and for specific purposes such as scoring and tracking the amount of data sharing.

As described earlier in the four domains of data privacy taxonomy, Social Sim Parents is designed to emphasize the essential components of these elements. It is interesting and ironic that, in order to educate participants to be more aware of the dangers and level of risks in sharing their personal information online, the best way to educate them is to create a platform for them to experience those dangers first-hand and learn through direct experiences and scoring feedback.

Figure 4.6 Social Sim Parents Simulation Model

Figure 4.7 Social Sim Parents Scores Flow

Game implementation and resources

As Social Sim Parents is a web-based simulation and imitates social media platforms, the interface shares a similar layout to popular social networks such as Facebook. However, the mock up game does not contain all of the features or functionalities of actual social media services. In fact, this game only addresses key features that have relevance to children’s information disclosure, including the amount of data disclosed, appropriate language used in post contents, and photos that reveal identifiable information.

The game is written in the Java Script language and uses the Herogu website (heroguapp) as a webhost to run the experiment (see Figure 4.8 for example of JavaScript data codes). All photos used in this game come from the internet (mainly from Google and Bing images). There

46 are two parts of data collection: the first part is data from the game such as identifier data in the profile page, posts, reasons for selecting the photos, and scores; and the second part is the post- survey or satisfaction survey after the participants played the game to see their levels of awareness and knowledge. The database to store data from the game is created using Google

Spreadsheets, whereas the post-survey is conducted separately in a Qualtrics platform (see

Appendix B for the post-survey questions).

} // Calculate post sentiment currentPost.post.text = post_message; var Sentiment = new sentiment(); currentPost.post.score = Sentiment.analyze(post_message).score;

// Set sharing score base on privacy buttons if (sharing === "public-share") { // Public currentPost.privacy.mode = "public"; currentPost.privacy.score = -5; } else if (sharing === "friend-share") { // Friends currentPost.privacy.mode = "friends"; currentPost.privacy.score = -3; } else { // Only me currentPost.privacy.mode = "onlyme";

currentPost.privacy.score = 0; }

// This is to check number of post and number of step // and apply to a new step or new post

if (current_step < 5) { current_post_num = 0; current_step += 1; start_step(current_step, 0); } else { // Summarize score if it's the last step // Detect opt out page ..... start_opt_out(); }

Figure 4.8 Example of JavaScript code on post content, privacy setting and opt-out page

Rules and Scoring

This web-based, mock-up social network game was designed to be a simple game with simple rules. Each user or participant is given the starting score of 100 points, and it is reduced according to the level of risk and amount of data shared. Participants simply click START to begin their task, then it prompts the player to the INSTRUCTION page and log-in page. In order for participants to move forward to the next step, they need to sign-up prior to accessing the game, similar to existing social media services. Once the player clicks SIGN-UP, it prompts participants to the PROFILE page where they need to enter information in order to move on to the next step. The query boxes on the PROFILE page are optional, with the exceptions of the e- mail address and password that need to be filled in to sign-in and access the game. The information provided on the profile page in each query box has its score running as soon as the participants provide any input (-1 for any input that they decide to provide), along with the

PASSWORD query box, which also has a restriction for scoring. The rationale for this step is to evaluate how much information the participants choose to provide to social media services; if they put any strings or integers into the boxes, they will lose points that run in the background accordingly (see Table 4.2 and Table 4.3 for the example of score measurement). In contrast, if the player decides to put information only in the mandatory fields (with red stars on the top right corner of the query box), their points remain unchanged. The negative scores in this page also include length of password; if it contains less than eight characters, it will be considered as not secure. However, the data that participants provided in each box can be random or false data, as there is no authentication feature tied with this system. Scores are measured based on the granularity level of data and security level if there is a high chance of the account being compromised, whereas the number of Likes is based on the levels of both visibility and

48 granularity. The ranking of total Likes and total Scores can be from numbers 0 - 5. The total Like score only adds +1 as positive reinforcement to share data for high visibility as the tendency of having more friends or followers, along with the likelihood of having photos chosen with positive feedback. In contrast, players will receive a Like score of -1 if they set their visibility of posts or photos only to be seen to themselves. On the ranking of scoring, the positive rate ranks between +1 to +5, and the negative rate ranks from -1 to -5. However, as the risk level is measured by only three levels (low, medium and high), scores are determined by three numbers: a low risk is -1, a medium risk is -3, and a high risk is -5. Meanwhile, the positive photos or contents that show positive outcomes or are secured will be rated as +5 (see example in Table

4.3).

The next step after the profile page is the PRIVACY SETTING for their profile. In this step, scores are tied in each click; however, scores are varied based on the visibility level of their profile. There are ‘Tips’ for players in regard to the options of visibility level.

Table 4.2 Example of scores measurement for privacy setting page

Table 4.3 Example of score measurement on photos chosen

After the profile page, participants will be prompted to STEP 1, which contains a scenario, post and photo options. STEPS 1-5 have a level of difficulty by scenarios that need participants’ judgement and decision making; for instance, step 1 is a scenario about buying a new house and their child’s new school; that does not require a critical thinking level or judgement. STEPS 2-3 become more complex with information related directly to their children that require participants’ attention to choose the photos and post carefully. STEPS 4-5 demonstrate severe cases that require serious and careful attention from participants, as they could reveal information or photo about their children (see Table 4.4 for the scenarios to evaluate participants’ post and photo choices).

Table 4.4 The five scenarios given to participants for them to post and select photo choice

STEPS SCENARIOS

STEP- You just bought a new house and would like to tell your networks about your good 1 news. Your kids also just start their first day at school or daycare.

STEP- Your child reaches the age that needs to be toilet trained. You also want to teach your 2 child other disciplines since the child has started to disobey your house rules and disrespects others in public space.

STEP- Your kid receives some achievements (winning a scholarships/getting driving 3 license/getting accepted to a nice school or university) and you want to share the news with others. You are very happy and want to reward your kid and family by taking them on a nice vacation)

STEP- You learn that your child starts to complain about going to school. His/Her academic 4 performance also drops dramatically. You suspect that your child may involve in some kind of bullying or cyberbullying or learning difficulties, but you are not so certain about the causes.

STEP- You find out that your child is diagnosed with Learning Disabilities and ADHD. You 5 have to bring your child to receive therapy once a week.

Sentiment Analysis for text-based in post query box

The scoring section in the Social Sim Parents simulation also involved text-based analysis. As this research intends to evaluate the appropriateness of contents that parents choose to describe each scenario that relates to their children, it is essential to have a system to detect positive and negative language used in the posts. The Sentiment Analysis dictionary [27] is the tool used in this experiment to identify positive and negative English words using Natural

Language Processing to show scores in each step. This tool is effective for this research, as most posts are short sentences with clear single words and fewer misclassifications of sentences or words (see Figure 4.9 for an example of the sentiment analysis scoring detection). This is important, since some English words can have multiple meanings in different contexts. For example, the word ‘unpredictable’ is positive in the context of the thriller genre, but negative in 51 other contexts. Using the Sentiment Analysis dictionary has some limitations on the accuracy using this automated tool, and on authenticity when described in contexts. However, the

Sentiment Analysis dictionary is the best practice to date for detecting and evaluating both negative and positive English words.

Figure 4.9 Example of sentiment analysis scoring detection

CHAPTER 5

DATA COLLECTION AND DATA ANALYSIS

5.1 Research Approvals

As this thesis involves collecting data from human subjects, it is critical to send a proposal of research methodology and receive approval documents from a board like the Kent

State University - Institutional Review Board (IRB) prior to conducting the research. The research conducted in this study using human participants was approved under Social &

Behavioral Research, as a Level-1 project.

5.2 Research Participants

The data used in this study was gathered from two sets of participants. The first experiment that examines parents worldwide was conducted using a Qualtrics survey in the form of multiple choice and text questions, and the second experiment was a web-based game created for this thesis, along with follow-up survey questions. The data set from the first experiment came from Amazon Mechanical Turks workers, whereas data set from the second experiment was collected through social networks from volunteers.

5.2.1 Amazon Mechanical Turks (MTurk) workers

The number of participants in the first batch of this study was nearly 1,400 responses; however, only 1,300 responses were considered high-quality results. The data set collected from

53 the MTurk workers, besides the survey questions, includes the country of residence, parental status, and their child’s age. They were requested to submit the survey questions to the following link in Qualtrics platform : https://kent.qualtrics.com/jfe/form/SV_55NxrzMou71r8DH.

Approved workers in this batch received 0.50 USD as compensation for their responses.

5.2.2 Volunteer Participants

In the second experiment of this research, the game created is an external link with more complex tasks requiring high-quality responses. Therefore, the participants were volunteers who are parents and members of social media services such as Facebook, Instagram and LinkedIn, as well as some direct e-mail invitations. The data collected from this group of participants include parental status, gender, their child’s age, their privacy setting and country of residence. Among nearly ninety attempts, the second batch of this study received sixty-five quality responses, those participants who completed both the game and the survey feedback. These participants were parents from ten countries; the USA, the UAE, Australia, India, Canada, China, Estonia, the

United Kingdom, Thailand and Italy. Participants in this second experiment joined the game via the following link: https://ancient-earth-20794.herokuapp.com/. The post-survey was in a

Qualtrics platform but could be accessed through a hyperlink at the end of the game

(https://kent.qualtrics.com/jfe/form/SV_aaXyvB5HreyoQgR).

5.3 Social Sim Parents Simulation Data Analysis

Personal data disclosure

The Social Sim Parents simulation has a total of fifty-two query fields, including sixteen query boxes on the sign-up page, twenty opt-in query boxes on the favorite page, and sixteen clicks and posts in Steps 1-5. Google spreadsheets were used as a tool for keeping data from those query fields. As some identifier data (for instance, date of birth and addresses) are sensitive

54 data that participants should be more aware of sharing with any social media sites, it is necessary to make all the query fields available even though it is optional to see how much personal data people agree to provide so that they can have access to the service. The more they key in the data, the more negative their scores, despite the accuracy of the data itself.

From the profile page, 60% of participants provided a complete Date of Birth which is considered a high risk for identifying an individual. However, some of them chose to provide only partial data such as only the month and year, or date and year; this reduced the risk level to be easily identified. In addition, participants in this experiment seemed to be well-aware of their privacy, as 22% of them chose not to provide their date of birth at all. Another key identifiable data that negatively affected scores was the address; unfortunately, 64% of the participants agreed to provide their complete address with their zip code in the query boxes.

In addition, among the 16 query boxes on the sign-up process, 80% of the participants in this study provided input in every field, even though it is optional. Some participants provided invalid data to conceal their identity and just make sure that they filled in the mandatory field in order to move on to the next page. However, it affected their privacy scores as soon as they decided to put something in the query boxes.

In the privacy setting page, the percentage between visible to ALL and visible to NONE is surprisingly similar. 44% of parents in this study restricted their visibility level to ‘Only me’, while 40% set their profile as ‘Public’, and the rest chose to share with ‘Friends’.

Posts and Photos data

In each level of task performances, participants were evaluated using posts and photos available as choices for them to choose from. They were asked to choose a photo of their interest

55 according to the scenario in each step, provide a reason why they picked their photo, and post content along with the chosen photo.

For the first scenario that intended to stress the importance of sharing their address or information relating to their home and their children’s school environment, the majority of participants chose photos considered ‘high risk’ for the privacy level (photo #3). When asked to provide reasons for their photo choice, some said, ‘It shows the house and my family all in one’ or, ‘It’s a nice family picture to tell people about the new home’. They were not aware of showing the faces of their family members online and revealing the characteristics of their home.

Moreover, 3% of them chose to show the house number (photo #1), which is considered high- risk, just because they liked the lamp photo. However, many participants who chose photos with a low risk level (photos #2 and #6), also indicated their concerns about revealing the house number and the faces of their children on the internet.

Figure 5.1 Photo choices for scenario -1: buying a new home and kid’s first day at school

The second scenario intended to address the dangers of showing children’s photos in the state of undress, children’s faces and attitudes that can be embarrassing for them. Participants

56 had a variety of preferences when it comes to disciplining their child; however, their photo choices still fell in the category of medium risk. The majority of parents preferred to show their children’s photos in action, such as toilet training (photo #10) or at the playground (photo #13).

Parents who chose a photo of a child toilet training provided reasons such as ‘I don’t want a pic of them on the potty but this one is cute’ or ‘I would choose this because I would want a cute picture and not a nude one. There's pedophiles everywhere’. There were also quite a number of participants who chose photo #13 (also medium risk because it shows the child’s face and their misbehavior or bullying) because they related it to their childhood. Another photo that a few parents referred to as one with good discipline is photo #15 (medium risk). The reason this photo is considered medium risk is because people can still identify the child, and recognize that he is in time-out, which can be humiliating to the child later in life. However, parents do not see this photo negatively or think that it can bring any harm into their child’s life, as the reasons that most parents prefer to post this photo is because they ‘might get good tips on how to discipline my children from friends & family’ or ‘It's not dangerous to post that my son needs some quiet time’.

It is essential to recognize that some parents are not aware of the consequences of the photos they choose and continue to post negative impact photos that might not be relevant or meaningful but entertaining for them. This is the case of photo #14 (although labeled as low risk), most parents who chose this photo provided the same reason: ‘it’s funny’.

Figure 5.2 Photo choices of scenario -2: toilet training and discipline

In the third scenario, participants were asked to deal with sensitive data disclosed in all kinds of legal documents or information that can be extracted from the photos. Most participants shared the same idea and choice by choosing photo# 20 (medium risk) without considering the detail in the photo that reveals the house number. The reason that most parents picked this photo was because ‘This one is funny and personal to share’ and best described their child’s achievement, while looking joyful at the same time. They did not have a problem showing the child’s face or his action that can be interpreted as ‘silly’. On the other hand, photos that are categorized as high-risk, such as photos #18, #19, and #23, had not been chosen by any parents. Only a few participants who liked the photos of the Taj Mahal or the airplane picked photos # 21 and #22, respectively, because of their personal preferences. However, they were not aware of the fact that the photo of them being at such a well-known attraction, reveals information such as exact location, city, country, and the number of family members with you, information that a digital thief can use to estimate how far you are or how many days you will be away from home.

Figure 5.3 Photo choices of scenario -3: Children’s achievement and vacation rewards

In the Step 4 scenario, participants had to choose a photo related to their child’s issues, both academic performances and potential bullying. Many parents posted photos #28 and #32 for various reasons. Some of them perceived photo #28 as less dramatic compared to the other photo choices; here, some said, ‘remind me of myself’ and ‘my child looks depressed and he is keeping it to himself please advices’. Parents also used this type of photo to seek support from the community, even though it may reveal the child’s emotional distress.

The second popular photo was #32 because many parents explained that this photo demonstrated the current stage of their child: ‘lower study in my baby’, ‘showing disinterest’ or

‘showing no interest in study’. It can be interpreted that many parents expect to discipline their child online, reflect the truth, or seek agreement in their social networks. However, this photo is not a risky choice as it does not show the child’s identity, nor does it reveal any personal information or academic failure reports.

Figure 5.4 Photo choices of scenario - 4: Children’s academic performance issue and

mental health issues

The last scenario was an example of parents sharing the health and well-being conditions of their child both directly and indirectly on the internet. Each photo shared data relating to a health topic in different levels. Eighty percent of parents in this study chose photo #40, providing interesting reasons for doing so. Many comments from parents who selected the photo of the mother and son without showing his face explained that ‘sometimes a hug is all that he needs’,

‘to encourage myself to fight for my child’, or ‘This one is positive and gives good feelings to my friends’. Parents in this study demonstrated their concerns on the identity disclosure of their child under this scenario, as none of them selected photo #34 or photo #38, both of which contained identifiable data.

Figure 5.5 Photo choices of Scenario 5: The child is diagnosed with ADHD and

Learning Disabilities (LD)

Opt-In and Opt-Out data

In an attempt to evaluate parents’ knowledge on what type of data can be opted-in and opted-out from the system, the FAVORITE page was created with twenty checked-boxes, and introduced at the beginning of the game. As the purpose of this feature is to educate participants on the data type that they can select to perform such action, the last page of the game before the scoring feedback reminded participants to opt-out some data that they provided earlier if they wished to. This feature had no scores rewards; however, the database kept records if they decided to opt-out some boxes (YES), or if they decided to leave the information as no change

(NO). Seventy-five percent of parents in this study did not opt-out information in this page while performing the task; yet, they informed researchers later in the post-survey that this feature made them understand and know ways to opt-out data on a social media platform.

Risk Levels and Total ‘Likes’

The combination of scores flowed from many query fields, leading to total risk scores at the end of the game. These scores also included negative or positive language used in the post query boxes that were generated by the Sentiment Analysis dictionary automated tool. Score ranges and risk levels are displayed in the following table:

Table 5.1 Score range and risk level

Score range Risk level

-0 to 49 High Risk

50 to 69 Medium Risk

70 to 100+ Low Risk

The majority of participants in this game were highly concerned over their privacy as well as their children’s privacy (low risk), while only 8% fell into the high risk category, and

31% were in the medium risk range. While scoring was tied with many attributes, the number of

Likes was tied solely with the level of visibility (public, friends, only me). Forty-four percent of participants set their visibility level on both profile and posts as ‘Only me’, making the number of Likes lower than expected. This can be explained as an awareness of the game’s purpose: to examine their knowledge about online privacy; therefore, participants were more cautious and thus restricted their privacy settings to be less visible and accessible.

Table 5.2 Summary of data collection from simulation

Data Sharing Risk Level Percentage Complete Date of Birth High 60% Provided only MM-YYYY Low 4% Provided only DD-YYYY Medium 6% Provided NONE (date of birth) Low 22% Complete address with zip code High 64% Provided number of children they have Medium 90% Visibility-Public High 38% Visibility-Friends Medium 16% Visibility-Only me Low 44% Selected high-risk photos High 5% Selected medium-risk photos Medium 68% Selected low-risk photos Low 27% Posts received negative scores High 10% Posts received neutral score (0) Low 52% Posts received positive scores Low 38%

CHAPTER 6

CONCLUSION AND FUTURE WORK

6.1 Results and Main Findings

Results from post-survey

In order to evaluate the effectiveness of the Social Sim Parents simulation, nine post- survey questions were created in the Qualtrics survey platform and linked to the game for participants to provide their feedback (see Appendix B: Post-Survey Questions). Forty-six percent of participants in this experiment had children aged 0-5, followed by those with children aged 6-10 (34%), 11-13, and 14-17, respectively. Among sixty-five parents who participated in the simulation privacy game, most of them declared that their knowledge about online privacy was ‘VERY GOOD’ prior to playing the game. A small percentage of parents in this experiment claimed their knowledge was either ‘EXCELLENT’ or ‘UNAWARE’. However, the number of parents who claimed their knowledge on this topic dramatically increased to ‘EXCELLENT’ rose after they played the game (16% before to 27% after). No one claimed that their knowledge was ‘POOR’ or ‘UNAWARE’ after finishing the simulation.

When asked about their level of awareness about online privacy reflected in their score cards, many parents stated that they were aware of those potential risks ‘REGULARLY’. The majority of these parents paid very close attention to the ‘Personal Information Disclosure’ issue while they were performing their tasks, rather than worrying about the number of ‘Likes’ received. However, 18% of the participants disclosed that scoring affected their photo choices and motivation to finish the task. Other than the topic on personal information disclosure and

64 scoring, some parents shared concerns over their post contents and photo choices. However, when addressing the overall satisfaction from a learning perspective, most parents said that they were ‘Satisfied’ (43%), and ‘Very Satisfied’ (22%). The percentages between ‘Can be better’ and ‘Raising Awareness’ were at around the same level; fewer participants pointed out that this game was ‘Confusing’ (see Figure 6.1 for percentages of overall satisfaction).

In the question about the opt-out option, most participants indicated that they knew how to opt-out information after playing the game. However, some percentages of participants were still not sure if they knew what the opt-out was, and they did not know how to opt-out information at all after performing the task in this simulation.

Figure 6.1 Percentage of overall participants’ satisfaction after playing the game

Main findings on learning outcomes, concerns and changing of online behavior

From the two experiments, there are a few major findings that need to be addressed in this study when addressing the domain of social media users’ behavior and their thinking

65 processes. Firstly, most participants successfully raised their levels of awareness about online privacy after participating in the social media simulation. They shared their comments when asked, ‘Will this game change your online behavior?’ as the following examples:

‘Yes, some of the reasons make me realize that I have to be more careful about showing

my kids' face and actions’

‘Yes, I have to be very clear what I share and What I don't share. Lot of information get

how to handle privacy policy in all kind of online activities.’

‘Yes, it's very useful to how to protect personal information and also aware of potential

risk from who thief other details for malpractice actions’

‘Well, it’s certainly given me some food for thought. And yes, I’d like to think it will.

Thank you, that was interesting!’

‘I will be more aware of showing people's faces online’

‘yes absolutely, this is very nice game and very interesting to find the game. I select my

opinion image and write some quotes and post to my friends....’

‘Yes. It gave me the instruction that we should take care about our children’

‘Definitely. I learned what information to be shared to whom’

‘It may make me think twice before I post pictures from now on’

‘Yes, after playing this game I found the risk factor about our personal details’

Secondly, there is evidence that sometimes people do not post what is relevant to the photo, whether the photos are provided for them or their own photo choices. This is because some participants provided reasons when they picked a choice; when limited to only one photo for one post, they chose pictures based on what fits the expectation of the audiences. For example ‘This one is positive and gives good feelings to my friends’ , ‘It's good photography and

66 powerful’, or ‘ To let friends & family know that my child starts new school so they can wish her well.’ In addition, some of them even chose random photos that reminded them of their past experiences rather than what actually happened at the moment (or regarding the given scenarios).

People can post things with hidden messages or implied meanings such as metaphors, poems, sarcasm, or idioms that need to be interpreted. Therefore, posting contents can be very subjective or irrelevant.

Thirdly, from the learning outcome perspective, parents in this study did not demonstrate significant change of their knowledge about oversharing personal information after playing the game. From the sign-up page until the opt-out page, participants still had learning curves on how to remove and opt-out existing information that they agreed to share, even when provided with a reminder statement. This observation can be interpreted in many aspects, whether it causes confusion by user interface, learners’ limitations, or unclear instruction. Overall, the fact that the majority of participants indicated that they know how to opt-out information after playing this simulation provided positive feedback for this study and should encourage researchers to improve the methods of creating tools for learning to be more effective in the near future.

6.2 Limitations and Future Work

The Social Sim Parents game has some limitations in many aspects. The design of user interface, game flow, instruction, variety of photo choices, and aesthetic aspects can be modified and improved to better stimulate the participants to be more engaged in the tasks and feel entertained at the same time. Moreover, contents as well as challenges of the game should be an integral part of game design right from the beginning.

Another area that is an integral part of this simulation is the evaluation criteria and measurements on privacy risk, as they were unclear on what number should be the appropriated portion to determine low risk, medium risk and high risk. There are some risk factors, or indicators such as stolen identity, fraud, or life safety that can be referred to as high-risk; however, there are many types of photos and contents in grey areas that could be categorized as medium risk. Such a categorization method can be challenging for accurate measurement.

The Sentiment Analysis dictionary also has limitations on accuracy when used in various contexts, as the automated tool still in the process of development. Machine learning today has a very promising future for closing gaps in many industries; therefore, it is hopeful that the

Sentiment Analysis database will continue to be improved upon with time.

All in all, as the project had limited time and resources, it can be improved upon in future work to make the game more attractive and effective. It is important to take all of these limitations into account for software developers when it comes to improving their tools for users.

In addition, the educational game can be highly engaging when it prompts the players to see scores and consequences (such as a stolen identity or an account being compromised) while playing; thus, real-time simulation can be one of the best improved features to be developed for educating not only parents but also any audiences in the future.

REFERENCES

[1] Statista. “Number of social media users worldwide from 2010 to 2021 (in billions)”. Social

Media Statistics & Facts. July 2017. [Online]. Available : https://www.statista.com/topics/1164/social-networks/

[2] Maeve Duggan, Amanda Lenhart, Cliff Lampe, and Nicole Ellison. "Parents and social media”. Pew Research Center (July 2015): 1-37.

[3] Stacey. B Steinberg. Sharenting: Children's Privacy in the Age of Social Media. Emory Law

Journal, (2017), 66(4), 839-884.

[4] Mary Madden, Amanda Lenhart, Sandra Cortesi, Urs Gasser, Maeve Duggan, Aaron Smith, and Meredith Beaton. "Teens, social media, and privacy." Pew Research Center 21 (2013): 2-86.

[5] University of Michigan Health System. "'Sharenting' trends: Do parents share too much about their kids on social media?." ScienceDaily. ScienceDaily, 16 March 2015. [Online]. Available : www.sciencedaily.com/releases/2015/03/150316092805.htm

[6] AVG Technology. “Digital Birth: Welcome to the Online World.” Business Wire. October

2010. [Online]. Available : www.businesswire.com/news/home/20101006006722/en/Digital-

Birth-Online-World

[7] Janice Gatti. “A thin line: 2009 AP-TVT digital abuse study”. MTV. September 2009.

[Online]. Available : www.athinline.org/MTV-AP_ Digital_Abuse_Study_Executive_Summary. pdf.

[8]. Tara Haelle. "Do Parents Invade Children’s Privacy When They Post Photos Online?." NPR.

(2016). [Online]. Available: https://www. npr. org/sections/health- shots/2016/10/28/499595298/do-parents-invade-childrens-privacy-when-they-post-photos- online

[9] Lauren S Jordan. “Writing for the Mighty, for My Son, and with My Son”, Washington Post.

(January 2016). [Online]. Available : https://www.washingtonpost.com/news/parenting/wp/2016/01/06/writing-for-the-mighty-for-my- son-and-with-my-son/?utm_term=.9a3bdd4c4939

[10] Amy Quintal. “When You Need to Help Yourself Before You Help Your Child”, THE

MIGHTY. (January, 2016). [Online]. Available : http://themighty.com/2016/01/when-you-need- to-help-yourself-before-you-can-help-your- child/.

[11] Gwenn S O'Keeffe, and Kathleen Clarke-Pearson. "The impact of social media on children, adolescents, and families." Pediatrics 127.4 (2011): 800-804.

[12] Matthew Davis, Sarah Clark, Dianne Singer, Amilcar Matos-Moreno, Anna Kauffman, and

Katrease Hale. "Parents on social media: Likes and dislikes of sharenting." CS Mott Children’s

Hospital, University of Michigan Health System 23.2 (2015).

[13] Taylor Lorenz. “When Kids Realize Their Whole Life Is Already Online”. The Atlantic.

Technology. 20 February 2019. [Online]. Available : www.theatlantic.com/technology/archive/2019/02/when-kids-realize-their-whole-life-already- online/582916/

[14] Lisa Belkin. “Humiliating Children in Public: A New Parenting Trend?”, HUFFINGTON

POST (4 October 2013). [Online]. Available : http://www.huffingtonpost.com/lisa- belkin/humiliating-children-to-teach-them-_b_1435315.html

[15] Irwin Reyes, Primal Wijesekera., Joel Reardon., Amit Elazari Bar On., Abbas

Razaghpanah., Narseo Vallina-Rodriguez., and Serge Egelman. “Won’t Somebody Think of the

Children?” Examining COPPA Compliance at Scale." Proceedings on Privacy Enhancing

Technologies 2018.3 (2018): 63-8.

[16] Santisarun, Phakpoom, and Sirapat Boonkrong. "Social network monitoring application for parents with children under thirteen." 2015 7th International Conference on Knowledge and

Smart Technology (KST). IEEE, 2015.

[17] Ed Pyne. “YouTube Kids videos found with suicide instructions”. Gray News. ABCNews

WBKO. 26 February 2019. [Online]. Available : https://www.wbko.com/content/news/YouTube-Kids-videos-found-with-suicide-instructions-

506386831.html

[18] Allyson Chiu. “The ‘Momo Challenge’: A sinister threat to young people or an urban myth?” Morning Mix, The Washington Post. (September 2018). [Online]. Available : https://www.washingtonpost.com/news/morning-mix/wp/2018/09/05/the-momo-challenge-a- sinister-threat-to-young-people-or-an-urban-myth/?utm_term=.9f5ba7fff59c

[19] Alexis Hiniker, Sarita Y. Schoenebeck, and Julie A. Kientz. "Not at the dinner table:

Parents' and children's perspectives on family technology rules." Proceedings of the 19th ACM conference on computer-supported cooperative work & social computing. ACM, 2016.

[20] Erhel Séverine, and Eric Jamet. "Digital game-based learning: Impact of instructions and feedback on motivation and learning effectiveness." Computers & Education 67 (2013): 156-

167.

[21] Ken Barker, Mina Askari, Mishtu Banerjee, Kambiz Ghazinour, Brenan Mackas,

Maryam Majedi, Sampson Pun, and Adepele Williams. "A data privacy taxonomy." British

National Conference on Databases. Springer, Berlin, Heidelberg, 2009.

[22] Giani Petri, and Christiane Gresse von Wangenheim. "How games for computing education are evaluated? A systematic literature review." Computers & education 107 (2017): 68-90. 72

[23] Robyn Schell and David Kaufman. "Cognitive Benefits of Digital Games for Older

Adults." Proceedings of the 8th International Conference on Computer Supported Education.

SCITEPRESS-Science and Technology Publications, Lda, 2016.

[24] Sara I De Freitas. "Using games and simulations for supporting learning." Learning, media and technology 31.4 (2006): 343-358.

[25] Rohit Parikh. "Propositional game logic." 24th Annual Symposium on Foundations of

Computer Science (sfcs 1983). IEEE, 1983.

[26] Kay Burke. How to assess authentic learning. Corwin Press, 2009.

[27] Bing Liu. "Sentiment analysis and opinion mining." Synthesis lectures on human language technologies 5.1 (2012): 1-167.

[28] Ellie Woodward. “This Instagram Exchange Between Gwyneth Paltrow And Her Daughter

Has Sparked A Debate About Privacy”. BuzzFeed News (March 26, 2019). [Online]. Available : https://www.buzzfeed.com/elliewoodward/gwyneth-paltrows-daughter-apple-photo-no- consent?utm_source=dynamic&utm_campaign=bffbbuzzfeednews&ref=bffbbuzzfeednews

APPENDIX A

CHILDREN’S ONLINE PRIVACY SURVEY QUESTIONS (PHASE 1)

APPENDIX B

SOCIAL SIM PARENTS SURVEY QUESTIONS (PHASE 2)