A Multi-Theoretical Study on Privacy and Security in Consumer IoT Usage Behavior Through PMT, TAM, and RPT

1. Introduction

The Internet of Things (IoT) refers to a networked system that connects physical objects, such as appliances, sensors, and robotic devices, to the Internet through defined communication protocols and information-sensing technologies. This interconnectivity facilitates data exchange and interaction, enabling functions such as smart recognition, positioning, tracking, monitoring, and autonomous control [13]. In essence, IoT allows devices to communicate with each other over the Internet, often without human intervention.

Although the term “Internet of Things” was first coined in 1999 [3] and gained mainstream popularity around 2011, IoT’s conceptual roots date back to the 1960s, when Kevin Ashton introduced the idea of using interconnected systems to improve supply chain operations [15]. The 1980s brought further advances, as research began focusing on integrating IoT into everyday life [4]. Consumer adoption increased notably around 2011 with the emergence of home automation systems, smart appliances, and wearable technologies [15].

The widespread adoption of IoT has profoundly impacted modern lifestyles by offering enhanced efficiency, cost-effectiveness, convenience, and task optimization. These devices reduce the need for human input by automating routine activities, for example, simplifying tasks in a smart home environment through voice commands, pre-set schedules, or remote access.

IoT technologies are now deeply embedded across various domains, including smart homes, healthcare, and industrial automation. With billions of devices currently in use globally, the number is projected to grow rapidly in the coming years [7]. Smart home technologies, in particular, are becoming increasingly prevalent. To date, global smart home penetration is expected to reach about 19%, with forecasts predicting an increase to over one-third of households by 2028 [28]. The smart home appliance market is projected to exceed $154 billion in value in 2024 alone [28]. In the United States, 33% of households report using IoT devices for building safety and security, while 29% own smart appliances such as robotic vacuum cleaners and smart kitchen devices [29].

Despite these benefits, the expansion of IoT usage is accompanied by growing concerns regarding security and privacy. Many IoT devices remain vulnerable because of weak encryption protocols, inadequate access controls, and delayed or missing software updates. These vulnerabilities expose users to risks such as cyber-attacks, unauthorized data access, and personal information breaches [17]. Current data reveals a disturbing trend in the frequency and scale of IoT-related security incidents, with millions of users affected each year [50].

Within smart home environments, IoT devices commonly perform various autonomous functions, including lighting control, energy management, security monitoring, and appliance operation. Devices such as smart locks, security cameras, and motion sensors work in concert to enhance safety, while others optimize daily routines. These devices continuously communicate and interact via integrated systems, thereby streamlining operations, improving performance, and reducing the likelihood of human error.

Figure 1 illustrates a conceptual model of an integrated smart home network, showcasing the connectivity and interaction between multiple IoT devices.

In such smart home IoT networks, Alansari et al. [27] emphasize that vulnerabilities such as weak encryption and insufficient access controls are prevalent across IoT systems, necessitating privacy-preserving frameworks like advanced cryptography and decentralized architectures to address these challenges effectively. IoT data breaches have become an increasing concern as IoT devices are adopted in homes and industries. Figure 2. present available records from 2005-2023 on user data compromises, data exposed, and individuals impacted. For example, in 2022, the number of IoT cyber-attacks worldwide reached over 112 million, a significant increase from 32 million in 2018 [21]. The United States accounted for 48.3% of IoT attacks between August 2021 and December 2022 [22]. In the third quarter of 2024, over 422 million data records were exposed worldwide [23].

According to Identity Theft Resource Center [24], the number of data compromises in the United States stood at 3,205 cases in 2023. Meanwhile, over 353 million individuals were affected by data compromises that year, including data breaches, leakage, and exposure. As the number of IoT devices continues to grow, with an estimated 17 billion devices expected by 2024, the potential for data breaches is likely to increase [24], creating a challenge and a new set of dilemmas for security and privacy.

As devices communicate seamlessly and autonomously to predict human wants and needs, the risk data collected increases, due to the processing and storing sensitive user information. Collecting and storing this data makes these devices enticing targets for attackers, given the value of the data they process or store. In essence, IoT device manufacturers urgently need to integrate security controls and defense strategies against the current threat landscape and predict future attacks. The continuous evolution of cyber threats and corresponding defense mechanisms presents an ongoing challenge. When IoT devices are involved, the risk to users increases significantly, as these devices often introduce additional vulnerabilities that can lead to data breaches and unauthorized information exposure.[36].

Attackers can exploit IoT device vulnerabilities in many ways. Previous work [36] has shown universal, simple yet effective ways to prevent lower-level attacks from succeeding. These include user education, actively scanning devices for malware, changing weak or default device passwords, and regularly checking for software updates. In a broader defense strategy, IoT vendors can frequently remind users to update their software or download and install new software patches [36]. This preventive strategy is important for protecting IoT user privacy and security. Unfortunately, we have witnessed growth in data breaches within the IoT space that require investigation.

In the coming years, IoT devices will likely be in almost every home. The Consumer IoT market revenue reached $209.91 billion worldwide in 2024, with an anticipated annual growth rate of 11.26%, leading to a market volume of approximately $357.80 billion by 2029 [31]. IoT devices in households are meant to create a world where appliances will know what we need and want and perform tasks accordingly. Kumar and Patel [9] found that “The privacy of users and their data protection have been identified as one of the important challenges which need to be addressed. The authors [9] raise pressing concerns about the privacy of IoT users and critical information regarding security threats that require immediate attention. Unpatched vulnerabilities, weak authentication, and insecure APIs are targets that threat actors may exploit, leveraging the IoT device as a major security risk factor for other connected devices on the network. [7]. In general, security risks are dangerous because they allow an attacker to access a device or system, they normally shouldn’t be able to access. For example, an attacker can typically gain access to devices and steal personally identifiable information, financial information, or other sensitive data such as context data, interaction data, etc.

This situation raises critical research questions about the interplay between the perceived privacy and security risks of IoT devices and their actual vulnerabilities. Moreover, research remains limited on how users perceive and respond to these risks, and whether those perceptions influence adoption and usage patterns. The lack of robust security frameworks and user awareness exacerbates the risks, creating a pressing need for comprehensive strategies that bridge the gap between user behavior, device vulnerabilities, and vendor accountability.

First, this research seeks to address the critical challenge of understanding the relationship between IoT device usage and associated privacy and security risks, with a particular focus on consumer IoT devices. By examining user perceptions, behavior, and mitigation strategies, and evaluating existing security measures, this study aims to provide actionable insights to strengthen IoT security and privacy practices.

Second, this work assesses the prevalence of small-scale consumer IoT devices within our communities and compares perceived privacy risk with the actual risk associated with using these devices, using a triangulation research approach that includes quantitative, qualitative, and descriptive methods to explore the extent to which respondents perceived the risk of using IoT devices. Data collection instruments include a survey, a literature review, qualitative analysis to identify research gaps, and questionnaire assessments.

Third, this work assesses participants’ perceived risk of using IoT devices and describes each user’s perceptions and the ways or methods they use to mitigate IoT device risks. To explore how privacy concerns affect IoT device usage, we can examine potential correlations between privacy concern levels and frequency of IoT device usage. By comparing these factors, we can assess whether higher privacy concerns lead to reduced usage or whether usage remains steady despite privacy worries. Based on this, we hypothesize that:

H1: Greater privacy and security concern is associated with lower frequency of consumer IoT device usage.

H2: Users’ perceived IoT security risk is positively associated with their awareness of IoT data collection and security vulnerabilities.

H3: Greater awareness of IoT security risks is associated with stronger self-reported protective security behaviors.

H4: Greater trust in vendors’ privacy and security protections is associated with higher consumer IoT usage.

These hypotheses (H1 –H4) serve as a foundation for exploring the relationship between privacy concerns, usage behaviors, and potential solutions for mitigating security risks in IoT devices. The contribution of this work is threefold. First, this work contributes to the literature by improving understanding of consumer-based IoT security and privacy and by developing the IoT privacy and security awareness, training, and policies needed to minimize user errors that lead to IoT device breaches. Second, this work contributes to current research by identifying many gaps in consumer-based IoT device use and user perceptions versus reality. Finally, this work provides recommendations to inform users and vendors about strategies to develop and integrate protections for IoT devices and user PII, context, and interaction data. This work is divided into section 2, Related work, which reviews and addresses previous work, findings, solutions, and gaps; section 3, methodology; section 4, Results and discussion of findings; and section 5, Conclusion.

2. Related Work

Recent studies highlight advancements in IoT architecture attempting to mitigate privacy risks while improving device functionality.

2.1. Overview of Related Work—IoT Devices Security and Future Trends

Alaba et al. [1] discussed the future direction of IoT and the challenges development and implementation of IoT devices face. According to Alaba et al. [1], the main obstacles facing the future of IoT involve system security and user privacy concerns. The authors’ analysis shows that “The IoT development faces many security, trust, and infrastructure challenges” [1]. Despite these challenges, the paper proposes intuitive applications and uses. The work discussed a method of large-scale resource management via IoT, which could serve as a viable tool and future application of IoT. Although functionalities and applications such as optimizing traffic flow control and network resources are beneficial, they also highlight challenges that must be addressed before implementation and use. Their work shows that research on IoT devices and their future direction is becoming increasingly prevalent.

A survey by García et al. [37] investigated concerns about IoT devices in the healthcare industry and highlighted both the benefits and challenges of their implementation. While IoT devices can improve healthcare outcomes, they also pose significant security and privacy risks that must be addressed for safe use in medical environments. For example, IoT in healthcare can assist patients with Alzheimer’s by automatically reminding them to practice breathing exercises [1]. Yet, if the same device is not properly secured, it can expose patient information, making future applications difficult to adopt widely because of serious system security and privacy concerns.

In the survey by Lee, Bae, and Kim [10], the authors analyze the technical details of how an IoT device system functions within a network and provide valuable insight into the future uses and capabilities of IoT devices. Lee, Bae, and Kim [10] provided an overview of IoT and its current state and offered insight into future development and implementation. In this work [10], the first layer, the service layer, consists of “autonomous driving, health care, smart industry, personal devices, and door security”. This is the most common and well-known IoT layer, as it involves the methods users use to communicate and interact with IoT devices. The authors [10] discuss the necessary specifications of IoT devices within an IoT network. Their findings demonstrate that “the IoT network should be able to provide a connectivity mechanism for connecting trillions of devices and managing networking addresses regardless of the type of network connection” [10]. Lee et al. [10] argue that while IoT has limitations and issues, it also offers strong potential for future applications. They also discuss specifications for future IoT device use and the requirements for a safe, secure network to support its functionality. The work concluded that, for IoT to have a future, necessary precautions and objectives must be met for an ideal IoT system to be operable and attainable.

2.2. Overview of Related Work—Major Security Attacks and Risks

One of the most significant challenges facing the future of IoT is the major security concerns and risks associated with it [26]. Much research on IoT has focused on the security aspects of current and future applications. IoT devices and systems can have an immense impact on the efficiency and quality of tasks, making them a high-value target for attackers. An attack on an IoT device can lead to privacy issues, as a malicious user can easily connect to the user’s IoT device and infiltrate the network without restrictions. Furthermore, an attacker can easily repurpose the user’s device as an attack vehicle by using a cheap, disposable IoT device to launch a DDoS attack [10]. When an attacker breaches an IoT device, it can spiral into multiple attacks that affect other devices and further impact the user.

Alaba et al. [1] investigated and discussed IoT security threats and vulnerabilities. The authors [1] examine the threats and vulnerabilities that affect IoT devices, and we must consider how an attacker may attempt to gain access. In the survey by Alaba et. al. [1], hardware threats, network threats, and smart application threats are discussed. The findings on hardware threats in IoT devices include RFID tags, ZigBee, Bluetooth, and sensor nodes, all of which are part of IoT hardware [1]. These components make IoT devices vulnerable to tracking, DoS, repudiation, spoofing, eavesdropping, counterfeiting, packet manipulation, hacking, key exchange, KillerBee, Scapy, Bluesnarfing, Bluejacking, car whispering, and Bluebugging [1]. This list of threats and vulnerabilities shows the many ways an attacker could breach IoT devices, highlighting the prevalence of privacy and security concerns for IoT devices.

Alaba et al. [1] proposed possible solutions for securing IoT device usage at scale based on the corresponding device vulnerabilities. Proposed solutions to address IoT security concerns include key management systems, an SDN architecture, a novel lightweight key management protocol, a lightweight validation and authorization security framework, and SecKit, a security tool for integrating management frameworks [1]. Although the authors [1] proposed unique solutions, each has drawbacks that affect privacy or usability. These drawbacks range from privacy concerns within the framework to significant packet delay and loss, unwanted traffic, and a lack of specification for third parties.

In addition to hardware IoT device threats and vulnerabilities, the authors investigated and discussed network and smart application threats [25]. Some network and smart application threats IoT devices face include data manipulation, extortion hacking, equipment hijacking, and misconfiguration. Others include hacking, signal loss, DoS, information manipulation, fake seismic detection, fake flood detection, theft and loss, insider misuse, internal attacks, and cyber-attacks [1]. This long list of vulnerabilities underscores the security risks and concerns associated with IoT devices, which we aim to address in our findings.

Extensive research has examined IoT security across current and future applications. IoT devices and systems play a critical role in enhancing efficiency and task quality, making them highly valuable targets for cyber attackers [33]. A compromised IoT device can lead to significant privacy violations; for instance, an attacker may repurpose a user’s inexpensive and disposable IoT device as an attack vector to launch a Distributed Denial-of-Service (DDoS) attack [10]. Furthermore, once an IoT device is breached, it can trigger a cascade of attacks, compromise additional devices and exacerbating the impact on the user.

2.3. Overview of Related Work—User Behavior and Privacy

Many IoT users prioritize ease of use over security, which increases vulnerability to breaches. Research shows that users often prioritize convenience over security, leaving default settings unchanged and neglecting necessary updates, which creates vulnerabilities in the system.[41,42]. This behavior is also linked to a general lack of awareness about the risks that default settings pose and how they may expose users to cyber threats. Barbosa et al. further emphasize that while users recognize the importance of cybersecurity, they often underestimate the extent of data collection by IoT devices, leading to an overreliance on the perceived security of these devices. [43]. A psychological element also plays a role: cognitive biases such as optimism bias and status quo bias can significantly shape users’ decision-making. This overconfidence, coupled with the complexity of managing IoT security, often results in inadequate precautions.

For instance, users may believe cyberattacks are unlikely to affect them because they use recognized brands or high-spec gadgets. Gordon et al. also highlight that many users feel overwhelmed by the complexity of securing their devices, which ultimately leads to suboptimal security practices [46]. Even when risks are apparent, configuring security settings often feels overwhelming. This avoidance may stem from the perception that securing IoT devices is difficult and requires time and technical expertise that many users feel they lack. This reluctance is further amplified when users believe devices will handle security automatically, overlooking the fact that a personalized approach is often necessary to mitigate potential risks effectively.

To address this limitation, the study acknowledges that the findings may not fully generalize to broader populations. Additionally, the study used statistical techniques such as Pearson’s correlation and cross-tabulation to identify relationships between variables like privacy concerns and IoT usage. Steps taken to maintain data integrity, including randomization of survey responses and masking participant identities, are now elaborated to enhance credibility.

2.4. Theoretical Framework

TAM [48] explains continued IoT adoption by emphasizing perceived usefulness and perceived ease of use. In consumer IoT settings, convenience, automation, safety, and efficiency can sustain usage even when users recognize privacy or security concerns. TAM therefore provides the adoption-side explanation for the central paradox examined in this study: perceived benefits may offset, rather than eliminate, perceived risk.

RPT [49] complements PMT and TAM by explaining why risk judgments may be subjective and shaped by cognitive, social, and affective factors. In this study, RPT is used to interpret variation in perceived IoT security risk and awareness of data collection. Because the survey does not independently test the technical security of respondents’ devices, RPT is applied to perceived risk rather than to a direct perceived versus objective vulnerability comparison.

Taken together, the three theories address distinct but complementary mechanisms. PMT focuses on threat and coping appraisals that can motivate protective behavior; TAM explains adoption through perceived usefulness and ease of use; and RPT explains subjective judgments about uncertain threats. Their integration provides a framework for interpreting why consumers may report concern yet continue using IoT devices and why awareness may not consistently translate into protective action.

Lastly, we use RPT [49] to analyze the gap between users’ perceived and actual cybersecurity and privacy risks. RPT stipulates that individuals’ risk perceptions are shaped by cognitive, social, and emotional factors, often leading to subjective biases in risk assessment [49]. In the context of this study on consumer-based IoT, we suspect that users may lack awareness of the types of data their devices collect, yet still express strong concerns about privacy risks. By applying RPT, this work may explore user risk perceptions, whether their concerns align with actual privacy or cyber threats, and how misinformation or lack of awareness influences their IoT security behaviors.

Using PMT, TAM, and RPT in this work allows us to bridge cybersecurity, behavioral decision-making, and technology adoption, offering a deeper understanding of consumer IoT security behavior. The findings from this study will contribute to developing more effective consumer education strategies, cybersecurity awareness programs, and privacy protection materials for consumer-based IoT devices.

3. Methodology

3.1. Research Design

This study uses an exploratory cross-sectional mixed-methods design centered on a survey of members of the University at Albany–State University of New York Community. The quantitative component consists of descriptive statistics and inferential tests examining associations among IoT usage, privacy/security concern, awareness, trust, and self-reported security behavior. Open-ended survey responses provide qualitative context regarding participants’ protective practices and perceptions. The literature review is used to frame the research problem and interpret findings; it is not treated as an independent empirical data stream. Participant identities were not reported in the analysis. The study received approval from the University at Albany Institutional Review Board.

3.2. Aim and Objectives

This study investigates the relationship between consumer IoT usage and privacy/security perceptions using Protection Motivation Theory (PMT), the Technology Acceptance Model (TAM), and Risk Perception Theory (RPT). The study focuses on whether privacy and security concerns are associated with usage, whether perceived risk is related to awareness, whether awareness corresponds with self-reported protective behavior, and whether trust in vendor protections is associated with IoT usage. Because the design is observational and cross-sectional, the study evaluates associations rather than causal effects.

The detailed objectives of the study are as follows:

• To characterize the prevalence and frequency of consumer IoT use within the study sample and examine whether privacy/security concerns are associated with usage frequency. This objective evaluates the behavioral relationship between concern and IoT usage among study participants without assuming that concern necessarily causes reduced adoption.
• To examine relationships among perceived IoT security risk, awareness of device data practices, and self-reported protective security behaviors. This objective evaluates whether awareness and risk perception correspond with behaviors such as password management, software updating, and other reported protective measures.
• To examine whether trust in vendor privacy and security protections is associated with consumer IoT usage and to identify gaps among concern, awareness, and reported behavior. This objective also identifies where future research should incorporate objective technical assessments of devices to compare perceived risk with measured vulnerability.

These objectives map directly to the four hypotheses and the integrated theoretical framework. H1 tests the association between privacy/security concern and IoT usage. H2 examines the association between perceived risk and awareness. H3 evaluates whether greater awareness corresponds with stronger self-reported security behavior. H4 examines whether trust in vendor protections is associated with IoT usage. PMT is most relevant to H1 and H3, TAM helps interpret continued usage in H1 and H4, and RPT informs H2 by explaining variation in subjective risk judgments. This alignment improves construct clarity while recognizing that the available survey data cannot establish causality or independently measure technical device vulnerabilities.

3.3. Data Collection

The survey was distributed to approximately 423 potential participants associated with the University at Albany, State University of New York. Recruitment used university email contacts and supplemental outreach through social and messaging channels. Thirty complete responses were retained for analysis, producing a 7.1% completion rate relative to the number initially contacted. The achieved sample, rather than the number invited, determines the precision and statistical power of the analyses; accordingly, the inferential results are interpreted as exploratory. The sample is a nonprobability university community sample and is not assumed to represent the broader population of consumer IoT users.

Following IRB approval, potential participants received a survey link and information describing the study purpose, voluntary nature of participation, estimated completion time, and researcher contact information. Eligibility included individuals associated with the University at Albany community, including students, faculty, and staff. Survey settings limited participants to one response. No personally identifying information is reported in the analysis.

Data collection remained open for approximately one month. Quantitative items used ordinal response scales to measure constructs including IoT familiarity, usage frequency, privacy/security concern, perceived risk, awareness of data collection, and trust in vendor protections. Descriptive statistics were used to summarize response distributions. Pearson correlations were used for the reported bivariate association tests, and a t-test was used for the reported awareness group comparison. Statistical significance was evaluated at α = .05. Given the small sample (n = 30), p-values are reported alongside effect direction and magnitude, and nonsignificant results are not interpreted as evidence that no relationship exists. Open-ended responses concerning security practices were summarized descriptively; because a formal multi-coder qualitative protocol was not implemented, these qualitative findings are treated as contextual rather than as independently validated themes.

4. Data Analysis and Discussion

The survey was distributed to approximately 423 potential participants and produced 30 complete responses (7.1%). As depicted in Figure 3, the respondent group included 2 undergraduate students (6.7%), 11 graduate students (36.7%), 5 professors (16.7%), and 12 other faculty/staff or respondents selecting other/not applicable (40.0%). Because the achieved sample is small and was recruited from a single university community using nonprobability methods, the results should be interpreted as exploratory and descriptive rather than population estimates. We suspect that this low response rate also raises the possibility of nonresponse bias, particularly if individuals interested in technology, privacy, or cybersecurity were more likely to participate.

The demographic composition provides useful context for interpreting the results but does not support reliable subgroup comparisons because several categories contain very small numbers of respondents. Accordingly, subsequent analyses focus primarily on overall patterns and bivariate relationships in the full sample.

Figure 4 shows the results of a survey question about familiarity with IoT (Internet of Things) devices, including smart home devices, smart wearables, connected appliances, and other “smart” devices. For this question, the response scale ranges from 1 (least familiar) to 5 (most familiar). The total response is thirty. The response distribution is as follows: two respondents (6.7%) indicated they were least familiar with IoT devices. One respondent (3.3%) indicated some familiarity with IoT devices. Two respondents (6.7%) selected a familiarity level of 3. The majority of respondents, 15 (50%), chose a familiarity level of 4, indicating a high level of comfort or knowledge with IoT devices. Finally, ten respondents (33.3%) reported the highest level of familiarity with IoT devices, which is most familiar. Some of the key observation base on the analysis are as follows: (1) A significant portion of the respondents (83.3% in total) rated their familiarity at levels 4 and 5, suggesting that the majority have a high level of familiarity with IoT devices; (2) Only a small number (16.7%) rated their familiarity at levels 1, 2, or 3, indicating minimal to moderate familiarity; (3) This distribution suggests a well-informed audience with a strong understanding or use of IoT technology.

Figure 4 shows that 83.3% of respondents rated their IoT familiarity at levels 4 or 5. This indicates high self-reported familiarity within the sample, but familiarity should not be equated with adoption, objective technical knowledge, or security competence. The result is best interpreted as descriptive context for the subsequent analyses. The familiarity distribution does not independently test H1–H4 because the hypotheses concern relationships among concern, usage, awareness, behavior, and trust. It does, however, suggest that many respondents had sufficient exposure to IoT technologies to provide experience-based perceptions. Whether that familiarity corresponds with accurate risk knowledge or safer practices requires direct analysis of the relevant variables.

Thus, Figure 4 establishes the sample’s self-reported familiarity with IoT devices without demonstrating that participants are objectively well informed about IoT security or privacy. This distinction is important because later results show limited knowledge of device data collection among many respondents.

Figure 5 illustrates survey results on the frequency of current IoT (Internet of Things) device usage, such as smart home devices, wearables, connected appliances, and other “smart” devices. The response scale for this question allows participants to rate their frequency of IoT device use on a scale from 1 (least frequent) to 5 (most frequent). Similarly, thirty participants responded to this question. Based on the analysis, 5 respondents (16.7%) selected level 1, indicating they rarely use IoT devices. For level 2, 4 respondents (13.3%) chose this level, suggesting infrequent usage of IoT devices. Further, 2 respondents (6.7%) rated their usage at this level, indicating moderate usage. More respondents selected level 4: 8 respondents (26.7%) selected this level, indicating they frequently use IoT devices. Lastly, 11 respondents (36.7%) rated their usage at the highest level, showing they use IoT devices very frequently. This question on IoT device usage frequency shows a high level of use, as the majority (63.4%) of respondents rated their usage at levels 4 and 5, indicating that many participants use IoT devices frequently. Nonetheless, a smaller portion (36.6%) rated their usage at levels 1, 2, or 3, suggesting lower usage frequency among this group.

Figure 5 shows that 63.4% of respondents reported frequent or very frequent IoT use (levels 4 and 5), whereas 36.6% reported lower usage (levels 1–3). This pattern demonstrates substantial IoT engagement in the sample but, by itself, does not establish whether privacy or security concern influences usage. H1 is tested directly using the correlation between privacy concern and usage reported in Section 4.1.

The descriptive distribution is nevertheless consistent with the study’s central observation that substantial IoT use can coexist with privacy and security concern. TAM provides one possible interpretation: perceived usefulness and convenience may sustain use even when users recognize risk. This theoretical interpretation should not be treated as a causal conclusion from the present cross-sectional data.

Figure 5 does not directly test H2, H3, or H4 because it presents usage frequency only. Associations involving perceived risk, awareness, protective behavior, and trust are evaluated separately. Avoiding hypothesis conclusions from single-variable figures reduces the risk of overinterpreting descriptive results.

Overall, Figure 5 establishes that IoT use was common among respondents and provides the behavioral outcome used in the H1 and H4 association tests.

Figure 6 assesses the correlation between participants’ familiarity with IoT devices and how often they use them. The diagram above compares familiarity and usage frequency on the same 1 to 5 scale, providing a clearer perspective on the relationship between familiarity and usage frequency. Figure 6 visually compares familiarity and usage frequency and suggests that higher self-reported familiarity often co-occurs with more frequent use. However, the figure alone does not provide a reported correlation coefficient or significance test for familiarity versus usage; it should therefore be interpreted descriptively rather than as evidence of a statistically established relationship.

Participants reporting low familiarity nevertheless included some IoT users, while the midscale categories contained relatively few responses. With only 30 respondents, these distributional differences may be unstable and should not be interpreted as distinct user segments without a larger sample. This comparison is theoretically relevant to TAM because experience and perceived ease of use may accompany continued technology use. It does not directly test H1, which concerns privacy/security concern and usage, and it does not establish that familiarity is a stronger determinant of usage than privacy concern.

Likewise, the figure does not determine whether privacy concerns explain any difference between familiarity and usage. Such explanations remain plausible interpretations that require multivariable analysis in a larger sample. The descriptive pattern therefore motivates, rather than confirms, the study’s theoretical argument that adoption may reflect multiple simultaneous influences, including perceived benefits, risk appraisal, familiarity, and trust.

Figure 6 also does not test H2 because no objective vulnerability measure is included, nor does it test the revised perceived risk/awareness association directly. We assert that similarly, familiarity can treated as equivalent to security awareness. A user may be highly familiar with IoT functionality while having limited knowledge of data collection or protective practices, as the later survey results illustrate.

Overall, Figure 6 provides descriptive evidence that familiarity and use often move together in this sample, while reinforcing the need to distinguish functional familiarity from security awareness and to test hypothesized relationships with the appropriate variables.

Figure 7, survey results show the level of concern participants have regarding the security of their IoT (Internet of Things) devices, including smart home devices, wearables, connected appliances, and other “smart” devices. Based on participant responses, 30 respondents rated their security concern on a scale from 1 (least concerned) to 5 (most concerned). Analysis of the responses shows that 1 respondent (3.3%) selected this level, indicating very low or no concern about IoT security. 4 respondents (13.3%) chose this level 2, showing relatively low concern about security risks. About 11 respondents (36.7%) selected this level 3, indicating moderate concern regarding IoT device security. This is the largest group, suggesting that many participants have some security concerns but are not overly worried. 6 respondents (20%) rated their concern at level 4, suggesting a high level of concern about IoT security. For level 5 (most concerned), 8 respondents (26.7%) selected the highest level of concern, indicating very strong apprehension about the security of their IoT devices.

Figure 7 reveals critical insights into participants’ concerns about IoT security risks. Among the 30 respondents, 83.4% expressed moderate to very great concern about IoT security risks (levels 3 to 5), with 36.7% indicating moderate concern (level 3), 20% expressing high concern (level 4), and 26.7% reporting the highest level of concern (level 5). Conversely, only 16.6% expressed minimal concern (levels 1 and 2), suggesting that most users are at least somewhat apprehensive about the security vulnerabilities of IoT devices.

The high prevalence of security concern is relevant to H1, but the figure alone does not show whether concern changes usage. H1 is evaluated by the reported correlation between concern and usage in Section 4.1. Figure 7 does not establish a gap between perceived and actual technical risk because no technical assessment of respondents’ devices was conducted. Instead, it documents perceived concern, which can be compared with respondents’ awareness and reported behaviors to identify perceptual and behavioral mismatches.

The results are also relevant to H3 as contextual evidence that concern is common, but concern is not equivalent to awareness and does not demonstrate stronger protective behavior. The direct H3 test is reported in Section 4.1. For H4, the prevalence of concern underscores the practical importance of vendor security and privacy protections, but this figure does not test whether such protections cause greater adoption. The study instead examines the association between trust in vendor protection and IoT usage.

In summary, Figure 7 establishes that security concern is widespread in this sample while leaving the hypothesized behavioral relationships to the inferential analyses.

The survey results presented in Figure 8 show participants’ perceptions of security risks in their IoT devices. Respondents rated the scale from 1 (lowest risk) to 5 (highest risk), with 5 respondents (16.7%) selecting level 1, indicating minimal perceived risk of security breaches, and 7 respondents (23.3%) choosing level 2, reflecting a low perception of risk. The largest group, 12 respondents (40%), rated their risk at level 3, representing moderate concern about potential security breaches. A smaller portion, 3 respondents (10%), rated their risk at level 4, indicating greater concern, while 3 respondents (10%) rated the risk at level 5, suggesting they perceive a very high risk of security breaches.

The key observation is that most participants (80%) rated their perceived security risk at levels 1 to 3, suggesting they recognize potential vulnerabilities but do not consider the likelihood of security breaches to be high. Most participants (40%) rated the risk as moderate, indicating awareness of possible threats but a belief that these threats are not immediate or severe. A minority of respondents (20%) expressed great concern by selecting levels 4 or 5, reflecting a heightened sense of vulnerability.

In conclusion, these results indicate that although participants are generally aware of security risks, most perceive them as moderate or low rather than high. This finding contrasts somewhat with the previous survey results on security concerns, where a larger portion of participants expressed strong concern about security issues. The discrepancy could suggest that while participants are aware of security risks and express concern, they do not perceive a high likelihood of experiencing a breach themselves.

The perceived-risk distribution is relevant to H2, but it should not be interpreted as evidence of a perception-versus-technical-reality gap because the study did not independently assess device vulnerabilities. H2 is evaluated using the association between perceived risk and awareness of IoT data collection/security issues.

The findings also touch on H2. The fact that most respondents perceive moderate or low risks while still expressing concern may suggest that perceived risk does not align with actual technical vulnerabilities, which may be higher than users anticipate. This could point to a discrepancy: users’ perceived risks may not reflect the actual vulnerabilities in IoT devices, supporting H2 to some extent. Overall, H1 is supported: users’ perceptions of security risks influence their behavior, though they may not deter usage. H2 is partially supported, as the gap between perceived and actual risks could indicate that users are not fully aware of the technical risks involved.

Figure 9 reveals insights into the relationship between users’ concerns about IoT security and their perceptions of risk. The data show that level 3 received the most responses for both security concern and perceived risk, indicating that many participants feel moderately concerned about IoT security while perceiving a moderate level of risk. This suggests that most participants acknowledge some level of concern and risk associated with IoT security, but neither is perceived as extreme. Additionally, at levels 4 and 5 (higher levels of concern), security concern tends to be higher than the perceived risk, indicating that for some participants, the worry about IoT security outweighs their belief in the likelihood of a security breach. Conversely, at the lower levels (levels 1 and 2), perceived risk of IoT devices is higher than concern, suggesting that some participants recognize risks but feel less worried or concerned about them.

These findings reveal a gap between concern and perceived risk: participants express moderate concern about IoT security but do not perceive the risks as high. This discrepancy could indicate limited awareness of IoT devices’ actual security vulnerabilities, suggesting that while participants are concerned, they may not fully understand the extent of the risks involved. The results imply that increased user awareness or education could bridge this gap by helping participants better understand the specific threats IoT devices face, which may lead to more informed behaviors and a stronger sense of urgency about security risks.

Figure 9 highlights a descriptive mismatch between the intensity of security concern and perceived likelihood/severity of risk for some respondents. This is evidence of differing subjective judgments, not proof that respondents underestimate objectively measured technical vulnerabilities.

With respect to the hypotheses, the figure provides descriptive context for H1 and H2 but does not itself establish statistical support. H3 and H4 likewise require the corresponding awareness/behavior and trust/usage analyses. The pattern is consistent with RPT’s proposition that concern and perceived risk can differ across individuals, but causal explanations require additional evidence.

Overall, Figure 9 suggests that concern and perceived risk are related but conceptually distinct. Future work should pair these self-reports with standardized risk-knowledge measures and technical assessments of participants’ devices to determine whether perceived risk is calibrated to objective vulnerability.

Figure 10 provides valuable insights into participants’ privacy concerns when using IoT (Internet of Things) devices. The data show that none of the participants (0%) were completely unconcerned about privacy, as no responses were recorded at the lowest level (1). A small portion of participants (20%) expressed relatively low concern about privacy risks by selecting level 2. However, the largest group of respondents (40%) indicated moderate concern (level 3), suggesting that while they acknowledge privacy as an issue, they do not perceive it as highly alarming. A notable proportion of participants (16.7%) rated their concern at level 4, indicating high privacy concern. Moreover, 23.3% of respondents selected the highest level (5), showing that many participants are very concerned about the privacy implications of using IoT devices.

The key findings show that privacy is a meaningful concern for most participants. A combined 80% of respondents expressed moderate to great concern (levels 3 to 5), suggesting that while IoT devices are useful, they raise substantial privacy concerns for users. This finding underscores the importance of privacy considerations in designing, implementing, and communicating IoT device features. In contrast, only 20% of respondents expressed lower concern (level 2), and no participants were entirely unconcerned about privacy risks, as reflected in the absence of responses at level 1.

These findings have implications for the hypotheses. Specifically, H1 is supported. Although many participants use IoT devices, widespread privacy concerns suggest these concerns may influence adoption and usage patterns. H4 is indirectly supported. The significant privacy concerns among participants emphasize the importance of robust vendor privacy measures to alleviate these concerns and potentially encourage greater adoption of IoT devices. H2 and H3 are not directly addressed in this analysis, as it focuses specifically on privacy concerns rather than security risks or the gap between perceived and actual risks.

These privacy-concern results provide descriptive context for H1. They show that concern is common even in a sample with frequent IoT use, but they do not establish that concern significantly affects usage. H1 is tested with the correlation reported in Section 4.1. The results also motivate H4 conceptually, although the causal effect of vendor privacy measures was not experimentally tested.

Overall, Figure 10 demonstrates the coexistence of privacy concern and IoT use in the sample. This pattern is central to the adoption-despite-concern phenomenon and is consistent with a multi-theoretical interpretation in which perceived benefits and trust may offset risk concerns.

The analysis of Figure 11 sheds light on participants’ knowledge of the data their IoT (Internet of Things) devices track, store, and collect. The survey results show that a significant portion of participants (56.6%) reported limited or low knowledge, with 23.3% rating their knowledge as level 1 (least knowledgeable) and 33.3% selecting level 2. This suggests that more than half of participants do not fully understand what data their IoT devices collect. Only 16.7% of respondents selected a moderate level of knowledge (level 3), and just 23.3% rated their knowledge as relatively high (level 4). Only one respondent (3.3%) reported being very knowledgeable (level 5), indicating that very few participants feel confident in their understanding of IoT data collection practices.

These findings reveal a key issue regarding awareness of IoT data practices: a large portion of users (56.6%) have limited understanding of what data their devices are gathering. This suggests that many participants may lack sufficient information to make informed privacy decisions. In contrast, only 43.4% of participants feel moderately to very knowledgeable about their IoT devices’ data collection, with a very small group (3.3%) possessing an in-depth understanding. This knowledge gap likely contributes to users’ privacy concerns, as they may feel they have little control over or understanding of how their data is used.

The results of this analysis are particularly relevant to the hypotheses provided. H1 is indirectly supported. The lack of knowledge regarding data collection practices could increase users’ perceptions of privacy risks, leading to cautious or limited adoption of IoT devices. H3 is also supported. The data suggests that increased education on IoT data practices could mitigate participants’ lack of awareness, which may improve privacy- and security-related user behaviors. H4 could also be supported, as greater transparency of data collection and stronger privacy measures could alleviate users’ concerns and increase trust in IoT devices, leading to higher adoption rates.The knowledge results are directly relevant to the study’s awareness construct. They show that self-reported familiarity with IoT devices does not necessarily imply detailed knowledge of data collection practices. This distinction strengthens the rationale for separately measuring familiarity and security/privacy awareness.

Figure 11 provides descriptive context for H2 and H3 but does not, by itself, establish either hypothesis. The relevant inferential tests are reported in Section 4.1. The pattern nevertheless identifies an actionable transparency issue: many users report limited knowledge of what their devices collect, store, or track.

Figure 12 shows participants’ level of concern about their privacy in the event of a security breach of their IoT (Internet of Things) devices. The survey results indicate that privacy is a major concern for most respondents. Of the 30 participants, 80% rated their worry at levels 4 and 5, indicating a high to extremely high level of concern if their IoT device’s security were breached. Specifically, 50% of participants selected the highest level (5), expressing extreme worry about potential privacy violations, while 30% rated their concern as high (level 4). These findings suggest that privacy is a major concern for most IoT users, especially when they face the possibility of a security breach.

In contrast, only 20% of respondents rated their worry at levels 1, 2, or 3, indicating minimal to moderate concern. Only one participant (3.3%) chose level 2, and no one selected level 1, suggesting that virtually no participants are entirely unworried or only slightly concerned about privacy risks related to IoT security breaches. This highlights the importance of privacy for most IoT users, who are clearly worried about the potential consequences of a security breach.

These findings provide strong support for Hypothesis H1: “Users’ perceptions of privacy and security risks associated with IoT devices significantly influence their adoption and usage behaviors.” The results indicate that most participants view privacy as a significant issue, especially in the event of a breach, suggesting that privacy concerns may influence how users engage with IoT devices. Participants’ great concern about privacy risks, particularly breaches, likely affects their overall adoption and usage behaviors, making them more cautious when using IoT devices.

The high level of breach-related privacy worry provides descriptive evidence that potential privacy consequences matter to respondents. It does not, on its own, establish that such concern changes adoption or usage; that relationship is evaluated under H1. Similarly, these results motivate the importance of vendor privacy protections but do not demonstrate the causal claim that stronger vendor measures increase adoption. H4 is tested as an association between trust in vendor protection and usage. In summary, Figure 12 shows substantial concern about privacy consequences if an IoT breach occurs. The finding supports the practical relevance of the study but should be interpreted separately from the nonsignificant inferential hypothesis tests.

The qualitative data analysis in Figure 13 from the survey revealed two distinct patterns in the security measures participants take to protect their IoT devices. According to the responses, 10 participants reported using strong passwords or changing them regularly to safeguard the integrity of their IoT devices. This suggests that some users proactively enhance device security by following basic cybersecurity best practices, such as creating strong passwords and updating them regularly to prevent unauthorized access.

However, another significant finding is that 10 participants admitted to taking no security measures or stated they had no specific actions in place to protect their IoT devices. This finding is particularly concerning, as it suggests that some IoT device users may be vulnerable to security risks because they lack awareness or concern about safeguarding their devices.This finding matters because it highlights the contrasting security behaviors observed among participants. While some take basic security precautions, a substantial portion of users neglect protective measures, potentially leaving their devices vulnerable to security breaches.

The open-ended responses show heterogeneity in self-reported protective behavior: some participants described password-related precautions, while others reported taking no specific security measures. This contrast is consistent with a concern–action gap but does not establish that awareness or education caused the observed behaviors. Accordingly, these qualitative responses provide contextual evidence for H1 and H3 rather than direct hypothesis tests. Because the responses were not analyzed using a formal multi-coder qualitative protocol, the categories should be treated as descriptive summaries and not as generalizable qualitative themes.

Overall, the open-ended responses reinforce the need for usable, low-friction security guidance and secure-by-default configurations, while future research should employ systematic qualitative coding and objective behavioral measures to validate the observed patterns.

4.1. Testing Hypothesis

Table 1 reports the inferential tests used to evaluate the four hypotheses. Because n = 30, these analyses have limited statistical power; therefore, interpretation emphasizes effect direction and magnitude together with p-values. Statistical significance was evaluated at α = .05, and no hypothesis test reached that threshold.

H1 predicted that greater privacy/security concern would be associated with lower IoT usage. The observed correlation was weak and negative (r = -0.167), but it was not statistically significant (p = .377). H1 was therefore not supported by the inferential test. The direction of the estimate is consistent with the hypothesis, but the data are insufficient to conclude that concern is reliably associated with reduced usage in the target population.

H2 predicted a positive association between perceived IoT security risk and awareness of IoT data collection/security vulnerabilities. The observed relationship was weakly positive (r = .121) and not statistically significant (p = .525). H2 was not supported. This result should not be described as a test of perceived versus actual technical risk because no independent technical vulnerability assessment was conducted.

H3 predicted that greater awareness would be associated with stronger self-reported protective behavior. The reported group comparison produced t = .717, p = .479, indicating no statistically significant difference. H3 was not supported by this test. The result suggests that awareness alone may be insufficient to explain protective behavior, but the small sample and measurement approach limit stronger conclusions.

H4 predicted that greater trust in vendor privacy/security protection would be associated with higher IoT usage. The observed correlation was moderate and positive (r = .334) but did not reach the .05 significance threshold (p = .071). H4 was therefore not supported at the prespecified significance level. The effect direction and magnitude may warrant examination in a larger, adequately powered sample, but it should not be presented as a confirmed effect.

Across the four tests, the study found no statistically significant evidence for the proposed associations at α = .05. The descriptive findings nevertheless reveal a noteworthy pattern: frequent IoT use coexists with substantial privacy/security concern, limited knowledge of device data practices, and inconsistent protective behavior. These results are best treated as exploratory evidence that motivates larger confirmatory studies rather than as proof of the hypothesized relationships.

5. Conclusion and Recommendations

This exploration study examined consumer IoT adoption, privacy/security concern, awareness, trust, and self-reported protective behavior through the complementary lenses of PMT, TAM, and RPT. The descriptive results reveal an adoption-despite-concern pattern: many respondents reported frequent IoT use while also expressing substantial privacy and security concern. At the same time, many participants reported limited knowledge of device data collection and uneven protective practices.

The inferential results were more cautious. None of the four hypothesis tests reached statistical significance at α = .05. Privacy/security concern showed a weak negative association with usage. Perceived risk showed a weak positive association with awareness; while the awareness-group comparison did not show a significant difference in the reported outcome. The trust in vendor protection showed a moderate positive association with usage that approached but did not reach conventional significance. Our result from this work is an exploratory estimate rather than confirmed effects.

The theoretical contribution lies primarily in the integrated interpretation of the observed concern use behavior pattern. PMT helps explain why recognizing a threat may not lead to action when coping efficacy or self-efficacy is limited. TAM helps explain why convenience and perceived usefulness may sustain adoption despite concern. RPT helps explain why subjective concern, perceived likelihood, and awareness may not align. The present data are consistent with these mechanisms but do not constitute a full latent-variable test of the three theories. Our study clarifies an important boundary on its findings: it did not conduct technical vulnerability assessments of participants’ IoT devices. Consequently, the results identify mismatches among self-reported concern, perceived risk, awareness, and behavior, rather than demonstrating a measured gap between perceived and objectively verified device vulnerabilities.

For practice, the findings support continued attention to secure-by-default design, transparent disclosure of data collection and retention, accessible update mechanisms, multi-factor authentication where technically appropriate, and user guidance that reduces the effort required to take protective action. These recommendations are grounded in the observed awareness and behavior gaps and in established IoT security principles, but their effects on adoption should be evaluated empirically in future work.

Overall, the study provides a focused exploratory account of why consumer IoT use may persist despite privacy and security concern. Its strongest evidence is descriptive: concern, usage, limited awareness, and inconsistent protective practices coexist in the sample. The results establish a defensible foundation for a larger confirmatory study rather than definitive evidence of causal or population-level relationships.

By distinguishing descriptive patterns from statistically supported relationships and by aligning the hypotheses with the variables actually measured, the revised interpretation strengthens the study’s methodological transparency and its contribution to research on consumer IoT adoption, privacy, and security behavior.

While most participants expressed concern about IoT-related privacy risks, many continued to use these devices regularly, reinforcing the complex interplay between risk perception, convenience, and behavior. This reveals a critical contradiction: concern alone does not necessarily drive cautious behavior, especially without clear guidance and systemic support.

To address these challenges, several recommendations emerge. IoT vendors should increase transparency regarding data collection, storage, and usage. Stronger default security settings, such as mandatory password creation and encryption, should be standard. Vendors must also provide regular updates and user-centric security guidance. Policymakers should implement standardized security requirements, strengthen enforcement of privacy laws, and hold vendors accountable for breaches. Users must also take an active role by adopting best practices, including changing default passwords, enabling two-factor authentication, and limiting unnecessary data sharing.

In conclusion, while IoT technology offers substantial benefits, its expanding prevalence necessitates a coordinated effort to strengthen privacy and security protections. This study shows that many users still adopt IoT devices despite concerns—often because of limited knowledge or a perception that threats are distant. These findings underscore the urgent need for targeted educational initiatives, stronger vendor accountability, and more robust regulatory frameworks. Future research should explore the impact of security awareness campaigns and assess the effectiveness of various technical and policy interventions. By fostering collaboration among vendors, policymakers, and consumers, it is possible to develop a safer, more transparent, and user-centered IoT ecosystem.