Usable Privacy and Security in Mobile Applications: Perception of Mobile End Users in Saudi Arabia

Abstract

Privacy and security is very critical for mobile users and in-depth research into the area highlights a need for more scientific literature on the perception and challenges of end users to better align the design of privacy and security controls with user expectations. In this paper, we have explored the perceptions of the usability of privacy and security settings in mobile applications from mobile users in Saudi Arabia. The findings highlight that gender, age, and education level of users do not have any positive correlation with the privacy and security usability perceptions of mobile users. On the other hand, user concerns about privacy and security and the trustworthiness levels of end users regarding mobile phone privacy and security have a positive impact on end users’ perception of privacy and security usability. Furthermore, privacy usability perception has a positive impact on users’ feelings about their control over the privacy and security of their mobile phones. Based on the results of this empirical study, we propose that user-centric design of privacy and security controls, transparent data handling policies, periodic data management status preview and validation by end users, user education guidelines, strict governmental policies, and automated security settings recommendations can enhance the usability of the privacy and security of mobile phone applications. Our study did not take the geographical location of respondents into account, nor were the respondents balanced based on age and gender. In future work, these weaknesses need to be taken into account, and more qualitative studies can help to extract design guidelines for usable and secure mobile applications.

1. Introduction

Mobile applications provide convenience and efficiency for various daily tasks ranging from work to leisure and entertainment. These applications handle the personal, financial, and health data of users and protection of such sensitive data from unauthorized access is important. However, concerns over privacy and security issues of user data managed by these mobile applications are also increasing. Once the end users are confident that a certain mobile application is secure this will enhance end users trust and adoption rate. Furthermore, privacy laws and regulations such as the general data protection regulation (GDPR) require mobile applications to adopt transparent data privacy practices. Furthermore, the design of privacy and security controls in these mobile applications should be easy to use so that end users’ tasks are facilitated with minimal effort. Such well-designed privacy and security controls allow users to manage their data in an effective manner and ensure that such well-designed applications provide a competitive advantage to mobile applications providers. Therefore, it is important to understand the end user’s perception about the usability of privacy and security controls of mobile applications.

In this paper, we explore the perception of the usability of privacy and security settings of mobile phones of users from Saudi Arabia to better understand their concerns. The selection of Saudi Arabia as a case setting is due to the higher density of mobile internet usage. According to a survey, the number of internet users is estimated reach 39.18 million by 2029, the internet penetration rate is going to reach 98%, and the number of mobile phone internet users is estimated to reach 38.01 million by 2029 in Saudi Arabia [1]. In order to maintain this high number of mobile phone internet users, the need for usable privacy and security of mobile phones becomes very critical. Therefore, in this paper, we have focused on mobile phone users in Saudi Arabia regarding the perception of the usability of the privacy and security settings of mobile phones.

In order to minimize the security vulnerabilities, extensive technologies focusing on improving privacy and security have emerged. One of the key technologies to ensure security in mobile applications is the development of authentication mechanisms where biometric and behavioral characteristics of users are taken into account [2]. Similarly, multi-factor authentication mechanisms provide stronger security without sacrificing user convenience [3]. Techniques such as differential privacy [4] and homomorphic encryption [5] enable data analysis while preserving the confidentiality of sensitive information.

Moreover, decentralized and blockchain-based systems offer new avenues for enhancing privacy and data control in mobile applications [6]. Despite these extensive technological advancements, security concerns of end users have increased and human factors have become major contributors to cybersecurity threats. As a result, usable privacy and security controls in mobile applications has gained significant attention, which advocates for integrating user privacy and security and a positive user experience.

It is imperative to integrate privacy and security considerations into the design of mobile applications and services during the development stage rather than as an afterthought. Issues such as limiting the collection of unnecessary user data, anonymizing data wherever possible, and providing clear privacy policies outlining how user data is handled need to be dealt with optimally in the software design process.

In addition, during the application development stage the system designers should integrate privacy-enhancing features in mobile applications such as private browsing modes, ad tracker blockers, and encrypted messaging. These features empower users to take control of their digital privacy while using their mobile devices by setting secure and strong passwords, patterns, or other biometric authentication mechanisms. However, such features should be easy to set up and use, while still providing adequate protection against unauthorized access. Achieving such a balance typically means weighing privacy against usefulness; therefore, the requirement engineering stage of the application development lifecycle should focus on security features to be developed in mobile applications.

Moreover, mobile operating systems should provide easily accessible and understandable privacy settings so that end users can control permissions for each application conveniently to control access to their location, camera, microphone, contacts, etc. Clear explanations should accompany each permission request to help users make informed decisions to control the privacy and security of their personal data [7,8]. Therefore, user perceptions of privacy and security issues have a significant impact on their adoption and usage behavior [9,10]. In order to design usable privacy and security controls it is important to understand user perceptions to continuously improve the usability of privacy and security controls. This paper contributes to the literature by providing detailed insights of the perceptions of mobile users in Saudi Arabia of the usability of privacy and security controls.

This paper is organized as follows: related work is discussed in Section 2, followed by the research methodology in Section 3. Section 4 discusses empirical data; Section 5 focuses on discussion and is followed by a conclusion in Section 6.

2. Related Work

Due to the recent importance of cybersecurity, there has been a significant amount of research on the security of mobile applications. In the literature, trust, control, and perceived risks are termed as key determinants of users’ privacy-related decisions [11,12]. There are many studies to understand the security implications of mobile applications in different domains. For instance, Chatterjee et al. [13] explored user behavior in conducting financial transactions using smartphones and highlighted that privacy concerns have a significant impact on the usage by end users. Similarly, Choi et al. [14] explored the usage of traveler applications by end users to understand the relationship between application security and usage intention. They found user security, trust, and end user satisfaction, alongside fulfillment of expectations, play a significant role in the continued use of travel applications.

Almaiah et al. [15] found that the perceived trust, security, and service quality of applications results in an increased adoption of mobile banking applications by end users. Kanaan et al. [16] carried out an empirical study in Jordon and concluded that privacy, security, and service quality have a positive impact on the trust of end users. In a similar research project carried out in Spain and Portugal, Martínez-Navalón et al. [17] found that privacy and perceived ease of use of applications positively impacts the usage of banking applications by end users, and there was no significant evidence that the nationality of end users has an impact on the trust, privacy, and ease of use perception of end users. The use of social networking applications is on the rise by end users, which further enhances the threat to users’ privacy and data security. In the literature, there is a detailed discussion on security threats posed by social network applications, and Bhattacharya et al. [18] have developed a taxonomy of machine learning solutions to secure online social networks.

Kulyk et al. [19] noted that a higher density of smartphone use has resulted in extensive personal data being stored in smartphones, which may be misused by different mobile applications installed on those smartphones. They further discussed that although app stores provide some indication of the potential security implications of mobile applications, the effectiveness of such information is limited as it is confusing to end users, especially those with limited technical expertise. In order to educate the end users, the authors prepared a brochure which can help end users’ awareness.

Lin et al. [20] found that the evolution of mobile applications in the health sector has resulted in privacy, security, and usability challenges, and they proposed a set of principles for mobile application designers to enhance the privacy and security of healthcare applications, making them more secure and resilient. Pattnaik et al. [21] carried out an analysis of twitter datasets to understand the discussion of twitter users about cybersecurity and the privacy of computing devices. The study found interesting insights, e.g., the number of tweets about cybersecurity from non-technical users increased after the COVID-19 pandemic showing more awareness of end users. The study highlighted that end users have overall negative sentiments, showing a concern about cybersecurity by end users. The study advocates a more rigorous research effort by keeping in view the users’ perceptions. In another study, Alsyouf et al. [22] analyzed the use of health record systems by patients using a technology acceptance model and concluded that security, privacy, and usability are the key enablers for successful use of electronic health records by end users.

In another study, Du et al. [23] looked into mismatches in mobile applications in security settings and data collection by third party data collection libraries in mobile applications. They identified 157 such inconsistencies and reported them to relevant application developers to rectify them. Valero et al. [24] highlighted that end users experience serious privacy and security concerns while using smart personal assistants, and the handling of user data by these agents is not transparent. Groen et al. [25] have advocated that adoption of a human centered design approach in the development of security technologies can facilitate end users by taking into account diverse needs, contexts, and user behaviors in the design process. Aljedaani et al. [26] carried out an empirical study in Saudi Arabia and highlighted that end users have limited knowledge about security features of such mobile applications. The study reported that users were not aware of data protection mechanisms adopted by these mobile applications to protect user data and this can result in their failure to use these applications. Therefore, the study advocates for better communication support from application providers regarding user data management to foster successful usage.

Cerf et al. [27] have highlighted that there is a need for more effective security controls for end users to manage their privacy and security settings. The authors highlighted that despite the provision of security controls, the management of such controls may be difficult by end users; therefore, there is a need to integrate usability aspects in the design of privacy and security controls to enable end users to better manage their personal data. Chennamaneni and Gupta [28] have highlighted that personality traits significantly contribute in predicting users’ privacy behavior while using mobile applications. The findings highlighted that in line with protection motivation theory, end users who have higher levels of neuroticism in their personality tend to adopt higher levels of security protection behavior in their usage of mobile applications.

In another study, Akter et al. [29] highlighted the advantages of involving community members to increase awareness and promoting secure behavior among end users. They further highlighted that such an involvement can help in identifying security risks, which may not be identified by deploying only technical measures. Brunotte et al. [30] have highlighted that provision of privacy explanation helps in increasing the end users’ trust of software. Therefore, it is critical that data management processes of technological systems should be transparent and users are consistently informed about their data privacy. Similarly, Assal et al. [31] highlighted that the actual usability of mobile applications is below the end users’ expectations; therefore, end users find it difficult to manage their security controls optimally. As a result, the usage rate of privacy features in mobile applications is limited; therefore, designers of these applications need to take into account the user experience while designing security features of mobile applications.

Feth et al. [32] have proposed a user centric model to improve privacy and security. The model takes into account users’ needs, behaviors, and contexts during the design of privacy and security controls, which can result in more usable security solutions having more resilience. Liu et al. [33] have highlighted that customizable user security profiles can help in improving the privacy and security of mobile phones. Creating such profiles can help in customizing the privacy and security preferences of end users, and security settings can be automated based on user preferences, thus reducing the user’s cognitive load and making the user security settings adjustment process more usable. Wu et al. [34] in their study also highlighted the importance of usability in designing privacy and security controls. They highlighted that well designed, clear notifications help in improving users’ security perceptions and trust of the mobile applications, whereas poorly designed notifications negatively impact users’ perceptions and lead to lower user retention. Acar et al. [35] argued that usable privacy and security should not only include the perception of end users, but rather it should also take into account developers and all other stakeholders as well. Such a 360-degree approach will help in designing more comprehensive security solutions and ultimately help in enhancing overall privacy and security.

Di Nocera et al. [36] concluded that there is a strong need to embed usability aspects in designing privacy and security controls to facilitate end users. The authors further highlighted the need for more rigorous research in this domain to support end users in managing the security controls effectively. In another study, Pattan and Madamanchi [37] investigated context aware mobile applications and concluded that usability aspects in such applications’ security controls is compromised due to the enormous dynamicity of the applications’ functions. As a result, end users have difficulties in managing their security preferences, which can lead to insecure behavior of end users. The authors highlighted that intuitive and flexible privacy and security control mechanisms should be designed to optimize the security settings of mobile applications based on users’ expectations. Christin et al. [38] have highlighted the need for striking a balance in automated controls and user controls to foster usable privacy in mobile sensing applications. Due to diverse data collection sensors, users struggle to continually control the data privacy settings. Therefore, the integration of automated controls and user controls can help users in fostering effective controls to protect their data privacy.

Gutfleisch et al. [39] looked into the key reasons for integrating usable security into software end products. They highlighted the lack of communication among security researchers and product developers, limited resources for usability testing, and competing priorities undermining usability concerns. The authors also highlighted that user experience is not taken into account in the design of security controls, resulting in difficulties for end users in using the software. They, therefore, emphasized the need to integrate usability issues into the security design process. Mathis et al. [40] pushed for the involvement of experts in the design of security systems to have their input early in the development lifecycle to make security systems more robust and usable as well.

Chin et al. [41] noted the mismatch between end users’ privacy and security perceptions and actual security mechanisms implemented in smartphones. As a result of this gap, potential security breaches may happen; therefore, users must be educated about potential security risks of smartphones to make informed decisions. Zhang [42] looked into the usability of in-app browsing interfaces and highlighted that such interfaces may mislead end users about the origin of the content. Furthermore, the study highlighted that usability issues can hinder the effectiveness of security features.

Similarly, Balapour et al. [6] have highlighted that user perception is very critical in fostering the successful use of mobile applications by end users. The authors highlighted that if end users perceive an application as secure their adoption rate increases and a negative security perception will lower the trust of users. Therefore, it is important to address end users’ privacy and security concerns to enhance end users’ trust. Reuters et al. [43] looked into the progress made in the usable privacy and security research field and highlighted that despite the progress in the field, transparency of privacy and security practices and the ability to tailor security settings are still critical challenges to foster usable security solutions and there is a need for sustained research on these themes.

Musa et al. [44] have proposed a blockchain based storage approach for Android mobile applications to secure the data. Khan et al. [45] have highlighted that there is limited empirical evidence on the usability effectiveness of implicit authentication as compared to explicit authentication. The authors carried out an empirical study that highlighted that 91% of participants rated implicit authentication as more convenient and 81% perceived that it provides them with the required level of security. Liu et al. [46] have developed a recommender system which adopts crowdsourcing to enhance the privacy and usability of mobile applications. This system reflects on crowdsourced data to recommend privacy permissions to end users, thus minimizing the cognitive load on end users and facilitating them to foster personalized security settings.

Moreover, Frik et al. [47] discussed the usability of smartphone privacy and security settings, and the implications have not been investigated in depth, especially with the less technically skilled end users. They conducted a study to gain insight into the perceptions of users and found that the majority of end users are not aware of their ability to control their privacy and security settings on smartphones. They noted that some socio demographic groups of end users are more prone to privacy and security issues.

Alt and von Zezschwitz [48] highlighted that the design of privacy and security mechanisms should take into account diverse user needs and contexts. Furthermore, they highlighted the need for better user education and adoption of communication strategies to better inform end users about the privacy and security mechanisms.

In another empirical study, Ferreira et al. [49] investigated security issues in Android applications and found that the majority of applications collect personal data unnecessarily and transfer them to the network without the end user’s consent. Therefore, it is critical to bring transparency in data communication and improve overall application security. Chen et al. [50] highlighted that privacy settings in mobile applications are often difficult to find; therefore, most end users are unable to control their information in the default mode of an application. They conducted an experiment and explored 100,000 mobile applications and found that 36.29% applications had difficult to control security settings, and among them, 82.16% were sharing user data in their default mode.

Lin et al. [51] noted that automated tools for observing mobile app behavior do not accurately reflect user behavior, making it unclear whether data usage is based on user consent. The authors used crowdsourcing techniques to understand smartphone users’ security expectations and identified potential security breach points in mobile applications.

Nema et al. [52] discussed how end users of mobile applications have diverse perspectives which are based on the nature and type of data collected by mobile applications as well as their contexts. Therefore, it is critical to involve a large base of end users to understand their privacy and security priorities to foster usable mobile application security mechanisms.

Jacobs and McDaniel [53] carried out a review to outline critical factors to foster usable security and highlight that there is a need for better integration of usability factors in the design process of privacy and security controls. Ismail et al. [54] have highlighted that mobile application developers can use crowdsourcing as a means to understand end user behavior regarding privacy management, and as a result, the usability issue can be resolved to better design the security management features of mobile applications. Martin and Shilton [55] carried out an empirical study to understand users’ privacy expectations of mobile devices and found that context influences the users’ expectations; therefore, it is important to understand user expectations to better design privacy controls and establish effective communication with end users regarding the use of data.

From the related work, we can deduce that there is a need for better usability for privacy and security controlling mechanisms, users’ perceptions are key for better design, and the diversity of users’ background and context impact end users’ adoption of security and control mechanisms. Therefore, there is a need to strengthen the body of knowledge to provide more insights of user perceptions and awareness regarding privacy and security implications to further improve the privacy and security of mobile applications. Based on the review of literature, following six hypotheses have been developed for our study.

Hypothesis 1:

Gender of users has a positive impact on perception of usable privacy of mobile phone users.

Hypothesis 2:

Age of users has a positive impact on perception of usable privacy of mobile phone users.

Hypothesis 3:

Study level of users has a positive impact on perception of usable privacy of mobile phone users.

Hypothesis 4:

Users concerns of privacy and security have a positive impact on perception of usable privacy of mobile phone users.

Hypothesis 5:

Trustworthiness level of users of mobile phone privacy and security has a positive impact on perception of usable privacy of mobile phone users.

Hypothesis 6:

Usable privacy perception has a positive impact on users’ feelings about controlling privacy and security of mobile phones.

3. Materials and Methods

As shown in Figure 1, we followed a standard scientific approach for our study. We started with research problem identification regarding the usability of privacy and security and then carried out a rigorous literature review to identify knowledge gaps. After this, we developed research questions and formulated the hypotheses. The hypotheses were tested through a designed research approach, followed by data collection, analysis, and interpretation. Based on the findings, recommendations were formulated.

Figure 1. Research design.

In order to evaluate our hypotheses, we conducted a quantitative study. Quantitative studies are widely used across different disciplines to analyze data and generalize the findings [56]. This study used a questionnaire for data collection. Designing a questionnaire requires considerable efforts to decide the required length, type of options for questions, sample size, sampling methods, etc. [57]. The questionnaire for this study was designed by reviewing earlier studies [11,58]. While designing the questionnaire, theoretical constructs came mainly from the usable privacy and information systems domain. The individual questions were mainly based on a five-point Likert scale (strongly disagree, disagree, neutral, agree, and strongly agree). Once the first draft of the questionnaire prepared, it was reviewed by a colleague for content validity.

After, the feedback questionnaire was revised and Google forms were used to collect the empirical data. The questionnaire was rolled out in May 2024, and 889 responses were collected, among which 3 responses were rejected, resulting in 886 valid responses. For data collection, we relied on a non-probability sampling technique and used a snowball sampling approach. Initially, we approached some connections by rolling out the questionnaire link using WhatsApp messages and emails. We requested the help of these initial contacts to further roll out the questionnaire link to their peers. Joining the survey was voluntary and data was collected anonymously and kept confidential. Participants were invited through email to join our survey, and there was a qualification criterion that the respondent was a mobile phone user.

Keeping in view the 886 valid responses and a confidence level of 95%, we achieved a margin of error of 3.23%. Once the data had been collected, it was processed in Microsoft Excel to get the percentages of the responses, and after this, the complete data sheet was coded into numeric data to process it using SmartPLS 4[59] to identify the relevance of the constructs in the model outcome. During our analysis, we applied the bootstrapping procedure using the partial least squares method with 5000 iterations. After the formulation of the model, the p-value was used to approve or reject our hypotheses. The discriminant validity was measured using the Fornell–Larcker criterion and heterotrait–monotrait ratio of correlations. Discriminant validity helps in providing the confidence that the constructs used for data collection are aligned with the research questions.

4. Results

As shown in Table 1, our survey included 308 male and 578 female respondents and a large number of respondents belonged to the age group of 19–25 years, and their study level was undergraduate.

Table 1. Demographic attributes of respondents.

Variable	Category	Number	Percentage
Gender	Male/Female	308/578	34.76%/65.24%
Age	Less than 18 Years	81	9.14%
	19–25 Years	612	69.07%
	26–35 Years	104	11.74%
	36–50 Years	57	6.43%
	Greater than 50 Years	32	3.61%
Study Level	Elementary or Less	32	3.61%
	Intermediate	44	4.97%
	Secondary	103	11.63%
	Undergraduate	500	56.43%
	Graduate and Above	207	23.36%

In our questionnaire, there were four questions relevant to user concerns. As shown in Table 2, in the first question, 59.37% respondents strongly agreed that they used a password or a biometric control to secure their mobile phone. In the second question, we intended to understand the users’ concerns about the privacy of their personal information on their mobile phones, and the majority of respondents chose the middle ground. In the third question, we enquired from users about how often they review the privacy policy of mobile applications before using them, and the majority of respondents indicated that they review such policies sometimes. In the last question, we enquired about how concerned the user is about personal information privacy while using mobile applications, and only 7% strongly agreed, 16.14% agreed that they were not concerned, and 39.39% of respondents remained in the middle, whereas 24.83% disagreed, and 12.64% strongly disagreed with it.

Table 2. Responses to questions focusing on end user concerns.

Variable	Category	Number	Percentage
I use a password/biometric to access my mobile phone.	Strongly Agreed	526	59.37%
	Agreed	194	21.90%
	Neutral	115	12.98%
	Disagreed	23	2.60%
	Strongly Disagreed	28	3.16%
On a scale of 1 to 5, how concerned are you about the privacy of your personal information when using mobile applications?	1	62	7.00%
	2	143	16.14%
	3	349	39.39%
	4	220	24.83%
	5	112	12.64%
How often do you review the privacy policy of mobile applications before using them?	Always	81	9.14%
	Often	146	16.48%
	Sometimes	272	30.70%
	Rarely	243	27.43%
	Never	144	16.25%
On a scale of 1 to 5, how concerned are you about the privacy of your personal information when using mobile applications?	1	81	9.14%
	2	163	18.40%
	3	349	39.39%
	4	174	19.64%
	5	119	13.43%

There were eight questions related to trustworthiness of mobile applications in our questionnaire, which are shown in Table 3. The first question was about the presence of concerns that intruders will know the user’s location, and 18.74% strongly agreed, and 32.28% respondents agreed that they have this concern. The second question asked about the possibility of an intruder accessing a user’s photos and personal data, and 21.22% strongly agreed, and another 34.65% respondents agreed that they were concerned about it. In the next question, respondents were asked whether they have the concern that someone would take over control of their mobile phone, and in response to this question, 19.07% strongly agreed, and another 25.85% respondents remained neutral; however, 45% respondents agreed or strongly agreed. Furthermore, 17.04% respondents strongly agreed and 34.54% agreed that there is uncertainty associated with the intended use of their personal information regarding mobile applications providers, whereas 34.31% remained neutral, 10.50% disagreed, and 3.61% strongly disagreed. In response to the next question, 22.91% respondents strongly agreed and another 37.70% agreed that they are concerned that installed mobile applications will use their personal information without their authorization. In response to the next question in our survey, 13.21% respondents strongly agreed and 22.22% agreed that installed mobile applications would tell the truth regarding data management practices to end users. In addition, 11.74% respondents strongly agreed and 28.33% agreed that they believe that all mobile application providers are in general predictable and consistent regarding the use of personal data of end users. Overall, only 12.08% of respondents strongly agreed and 27.43% agreed that they consider mobile phone communication safe.

Table 3. Responses to questions focusing on trustworthiness of mobile applications.

Question	Strongly Agreed	Agreed	Neutral	Disagreed	Strongly Disagreed
I am concerned that someone else (other than the intended user) will know my location during my mobile application usage.	18.74%	32.28%	30.93%	12.87%	5.19%
I am concerned that someone will access my photos and other personal data (contact list, call history) on my phone.	21.22%	34.65%	25.85%	13.32%	4.97%
I am concerned that someone will take control of my phone.	19.07%	25.85%	27.20%	18.74%	9.14%
There is too much uncertainty associated with the intended usage of my personal information by mobile application providers.	17.04%	34.54%	34.31%	10.50%	3.61%
I am concerned that the installed mobile applications will use my personal information for other purposes without my authorization.	22.91%	37.70%	25.73%	9.82%	3.84%
I am confident that installed mobile applications would tell the truth and providers would keep my best interests in mind when dealing with my personal data that I provide to applications.	13.21%	21.22%	36.68%	20.88%	8.01%
I believe that all mobile application providers are in general predictable and consistent regarding the usage of my personal data.	11.74%	28.33%	37.92%	17.27%	4.74%
I consider mobile phone communication safe.	12.08%	27.43%	36.79%	18.40%	5.30%

In the context of the usability privacy perception of mobile applications, there were nine questions in our questionnaire which area shown in Table 4. In the first question, we asked the respondents whether the mobile operating systems provide easily accessible and understandable privacy settings, and 25.28% respondents strongly agreed, 36.12% agreed, 27.54% remained neutral, 7.11% disagreed, and 3.95% strongly disagreed with it. In response to the next question that locating and reviewing privacy and security policies and guidelines of mobile applications are usable and easily accessible in the mobile applications, only 18.62% respondents strongly agreed, another 35.33% agreed, 31.94% remined neutral, whereas 10.95% respondents disagreed, and 3.16% strongly disagreed. In response to the question that users can easily find out who has what level of access in mobile applications, 12.98% respondents strongly agreed, 25.73% agreed, 34.09% remained neutral, 20.32% disagreed, and 6.88% strongly disagreed. Regarding the question, I know how my data will be processed and by whom, 12.98% strongly agreed, 25.73% agreed, 32.17% remained neutral, 20.77% disagreed, and 8.35% strongly disagreed. In addition, 13.43% respondents strongly agreed, 35.21% agreed, and 32.39% remained neutral to the fact that it is normally clearly mentioned on mobile applications that data will not be accessed without my explicit consent. Another 14.45% respondents disagreed, and 4.51% strongly disagreed with it.

Table 4. Responses of question focusing on usability privacy perception of mobile applications.

Question	Strongly Agreed	Agreed	Neutral	Disagreed	Strongly Disagreed
My mobile operating system provides easily accessible and understandable privacy settings. (Users should be able to control permissions for each app, including access to location, camera, microphone, contacts, etc.)	25.28%	36.12%	27.54%	7.11%	3.95%
Locating and reviewing security and privacy policies and guidelines for mobile applications is usable and easily accessible for mobile applications.	18.62%	35.33%	31.94%	10.95%	3.16%
I can find out who has which level of access in the mobile applications.	12.98%	25.73%	34.09%	20.32%	6.88%
I know how and who will process my data; it is clearly mentioned in mobile applications.	12.98%	25.73%	32.17%	20.77%	8.35%
It is normally clearly mentioned on mobile applications that data will not be accessed without my explicit consent.	13.43%	35.21%	32.39%	14.45%	4.51%
It is clearly mentioned on mobile applications what security measures are used in these applications.	13.09%	35.10%	34.76%	13.21%	3.84%
Users are notified about changes in privacy policy.	17.61%	34.09%	30.70%	12.53%	5.08%
Mobile applications educate users about mobile security and privacy best (in-app tips, tutorials, and informational resources such as avoiding insecure Wi-Fi networks, recognizing phishing).	16.70%	30.70%	31.60%	16.25%	4.74%
Mobile applications integrate privacy-enhancing tools and features (such as private browsing modes, ad tracker blockers, and encrypted messaging options).	15.46%	35.89%	34.09%	10.95%	3.61%

In response to the next question about whether it is clearly mentioned on mobile applications which security measures are used in the applications, 13.09% respondents strongly agreed, 35.10% agreed, 34.76% remained neutral, 13.21% disagreed, and 3.84% strongly disagreed. Furthermore, 17.61% respondents strongly agreed and another 34.09% agreed that they will be made aware of any changes in the privacy policy of mobile applications. In response to the next question about whether mobile applications educate users about setting up privacy and security controls, 16.70% strongly agreed, 30.70% agreed, 31.60% remained neutral, 16.25% disagreed, and 4.74% strongly disagreed that mobile applications provide such features. Regarding the integration of privacy-enhancing tools and features in mobile applications, 15.46% respondents strongly agreed, 35.89% agreed, 34.09% remained neutral, 10.95% disagreed, and 3.61% respondents strongly disagreed.

In the section on user feelings regarding the privacy and security of mobile applications, we had 8 questions in the questionnaire which are shown in Table 5. In the first question, we enquired about whether users are aware of how to control the privacy and security of mobile applications, and 15.80% of respondents strongly agreed, 35.33% agreed, 30.81% remained neutral, 13.32% disagreed, and 4.74% strongly disagreed. In the second question, we asked respondents whether they feel that they can protect their mobile phone from hackers/phishers if they take good care of computer security. In response to this question, 23.59% respondents strongly agreed, 31.72% agreed, 28.10% remained neutral, 12.87% disagreed, and 3.72% strongly disagreed with it. In response to the next question, 13.77% strongly agreed, 24.04% agreed, 30.47% remained neutral, 21.78% disagreed, and 9.93% strongly disagreed with the fact they regularly review policies and the security/privacy certificate of mobile applications before installing them on their mobile phones.

Table 5. Responses to questions focusing on users’ feelings on privacy and security of mobile applications.

Question	Strongly Agreed	Agreed	Neutral	Disagreed	Strongly Disagreed
I am aware of how I can control the security and privacy of my mobile applications.	15.80%	35.33%	30.81%	13.32%	4.74%
I think I can protect my mobile phone from hackers/phishers, if I take good care of computer security.	23.59%	31.72%	28.10%	12.87%	3.72%
I regularly review policies and the security/privacy certificate of mobile applications before installing them on my mobile phone.	13.77%	24.04%	30.47%	21.78%	9.93%
I think it is important to pay attention to computer security.	41.65%	26.41%	22.12%	5.53%	4.29%
Computer security worries me.	20.32%	31.15%	30.14%	12.42%	5.98%
I think it makes a difference if I pay special attention to computer security, such as installing a browser that is less vulnerable.	29.80%	35.55%	25.17%	6.32%	3.16%
I think the information that I keep on my mobile phone is not interesting enough for people to try and hack into my mobile phone.	18.28%	26.41%	28.67%	18.28%	8.35%
I think it does not matter what I do; if people have bad intentions, they will be able to hack into my mobile phone.	18.85%	28.33%	30.59%	13.77%	8.47%

In response to the next question, 41.65% strongly agreed, 26.41% agreed, 22.12% remained neutral, 5.53% disagreed, and 4.29% strongly disagreed with the fact that it is important to pay attention to cybersecurity. In response to the next question, around 52% respondents strongly agreed or agreed with the fact that cybersecurity issues worry them. In response to the next question, 29.80% respondents strongly agreed, 35.55% agreed, 25.17% remained neutral, 6.32% disagreed, and 3.16% strongly disagreed that they think that if they pay special attention to cybersecurity, it will make a difference. In response to the next question regarding the belief that their personal information is not interesting for others and no one will hack their phone, 18.28% respondents strongly agreed, 26.41% agreed, 28.67% remained neutral, 18.28% disagreed, and 8.35% strongly disagreed. In the last question, we asked the respondents whether they felt that, regardless of the security mechanisms they might adopt, individuals with bad intentions could still break into their mobile phones, and 18.85% strongly agreed, 28.33% agreed, 30.59% remained neutral, 13.77% disagreed, and 8.47% strongly disagreed.

In order to validate our hypotheses, we used p-values as a measure, and as shown in Table 6, the p-values of hypotheses 1, 2, and 3 are above 0.05 [60], which is considered a threshold value for approving hypotheses; therefore, the first 3 hypotheses are rejected. This implies that our study finds that the gender, age, and study level of users are not deemed to positive influence the mobile end user’s perception of the usability of privacy. As shown in Table 6, hypotheses 4 and 5 achieved a p-value of 0, which approves hypotheses, which highlights that regarding user concerns of privacy and security, the trustworthiness of mobile phone privacy and security of end users has a positive impact on the usability of privacy perception. Furthermore, hypothesis 6 highlights that the usability privacy perception of end users having a positive impact on users feeling in control of their mobile phone security is also approved in our study.

Table 6. Results of hypotheses.

Hypotheses	Original Sample	Standard Deviation	T Statistics	p-Values	Results
Hypothesis 1	0.090	0.059	1.538	0.124	Rejected
Hypothesis 2	−0.044	0.036	1.231	0.218	Rejected
Hypothesis 3	−0.027	0.034	0.805	0.421	Rejected
Hypothesis 4	0.211	0.032	6.598	0.000	Approved
Hypothesis 5	0.478	0.029	16.373	0.000	Approved
Hypothesis 6	0.532	0.029	18.064	0.000	Approved

In order to measure the discriminant validity, we used the Fornell–Larcker criterion, and as shown in Table 7, the topmost values are the maximum in each of the columns, except trustworthiness and user feeling, where the difference is 0.034 and 0.08, respectively, which is very minor and can be ignored [61]; therefore, the validity is confirmed.

Table 7. Fornell–Lacker criterion for discriminant validity.

	Age	User Concerns	Study Level	Trustworthiness	User Feelings	Usable Security	Gender
Age	1.000
User Concerns	0.021	0.548
Study Level	0.343	0.056	1.000
Trustworthiness	−0.012	0.234	−0.044	0.495
User Feelings	−0.038	0.239	0.018	0.390	0.524
Usable Security	−0.060	0.319	−0.053	0.529	0.532	0.571
Gender	−0.112	−0.037	−0.033	−0.005	0.025	0.038	1.000

Furthermore, the heterotrait–monotrait ratio of correlations was counted, and as per Henseler et al. [62] and Hair et al. [63], the value should be below 0.9. As is shown in the HTMT matrix in Table 8, all values are below 0.9, which also proves the construct validity.

Table 8. HTMT matrix discriminant validity.

	Age	User Concerns	Study Level	Trustworthiness	User Feelings	Usable Security	Gender
Age
User Concerns	0.132
Study Level	0.343	0.332
Trustworthiness	0.050	0.633	0.079
User Feelings	0.075	0.603	0.121	0.639
Usable Security	0.071	0.660	0.094	0.584	0.737
Gender	0.112	0.157	0.033	0.062	0.043	0.096

5. Discussion

The empirical findings highlight that the number of mobile users with strongly agree and agree responses is limited and there is a need to improve the privacy and security perception of end users. Gender, age, and education level did not positively contribute to perception, but the trustworthiness level of mobile users and users’ concerns of privacy and security positively contributed to enhanced awareness of end users, which in turn positively impacts end users’ feelings about controlling the privacy and security of mobile phones.

This work has significant practical implications for policy makers and mobile application designers. In order to improve the usability of privacy and security awareness of end users, we propose a model which is based on six key elements, as shown in Figure 2. We highlight that the design of privacy and security controls should focus on usability aspects to ensure that end users can easily locate and use these controls. This is in line with the findings in many earlier studies [37,39,42,46,54]. The adoption of a user-centric approach is necessary in the development process by fostering participatory design practices [64,65]. This approach will help in simplified user interfaces, use of end user language rather than technical terms, reduced information overload, interactive controls, and accessible privacy features.

Figure 2. Model to improve usability of privacy and security awareness among mobile users.

Another design recommendation is to provide automated security recommendations to end users where artificial intelligence capabilities can be integrated, as most users may not be aware what the optimal privacy and security settings are [33,38,51]. Advanced approaches such as federating learning and differential privacy can be adopted for optimally training security models and setting up customized security settings. Another design feature to improve the usability of privacy and security in our model is to provide regular data management status previews for end users so that they are aware of what kind of security permissions are available in applications and they can validate these settings [23,27].

The fourth element of our model highlights that mobile applications should have transparent data handling policies which should be visible to end users, which will improve the confidence level of end users [66]. Mobile applications may adopt a minimal data collection approach and allow easy data deletion features. Furthermore, mobile applications need to educate users about security implications, and a game-based approach may be adopted. The minimal cognitive load principle from usability engineering can be applied on privacy and security controls to provide users with easy-to-use tips and guidelines to enhance their information security awareness.

The last element of the model highlights the governmental role in designing regulations to reassure end users that data management by mobile application providers is safe and regulated by governmental policies [10]. Designing appropriate regulations for organizations and individuals increases end users’ confidence in adopting mobile applications as well as helping in the digital literacy of the general public.

One of the limitations of our study is that the number of male respondents was less as compared to the female respondents, and a majority of respondents were in the age group of 19–25 years, which may have had an impact on the findings. Furthermore, the geographical location of respondents in Saudi Arabia was not considered in our survey. Future studies can work on these limitations, and qualitative studies need to be conducted to further understand the design implications of the identified issues. Additionally, participatory design approaches can be used in application design stages to design usable mobile applications.

6. Conclusions

The usability of the privacy and security of mobile phone applications is an emerging area. As the literature highlights, there is a need for more detailed studies to understand users’ perceptions; therefore, in this paper, we have focused on the mobile users in Saudi Arabia to understand their perceptions. The study highlights that the gender, age, and education levels of end users do not have any impact on the privacy and security usability perception of mobile users. It also found that end users’ concerns regarding privacy and security positively impact the perception of mobile users. Similarly, the trustworthiness level of users regarding mobile phone privacy and security positively impacts the usability privacy perception of end users. Furthermore, the usability privacy perception has a positive impact on users’ feelings about controlling the privacy and security of mobile phones. Based on our study, we presented a model to improve the usability privacy and security perception of mobile applications. This model advocates for six enablers, which are the adoption of user-centric approaches to design privacy and security controls, transparent data handling policies, periodic data management status preview and validation by end users, user education guidelines, strict governmental policies, and automated security settings recommendations.