"I'm trying not to get hacked:" How Adults with Intellectual and Developmental Disabilities Navigate Security and Privacy Notifications

1 Introduction

• Although digital participation is increasingly normative, user-facing protections may not accommodate diverse cognitive profiles, and notification accessibility for these users remains underexplored.Notifications can require background knowledge, timely decisions, technical interpretation, or reading lengthy informational text.Source: §1 · p. 2
• The study examines how adults with IDD understand and respond to everyday security and privacy notifications, extending prior IDD research beyond authentication and training.It asks what challenges participants face and what shapes their understanding and decisions.Source: §1 · p. 2
• Seven adults with IDD completed a formative study evaluating notifications across browser and smartphone contexts, with qualitative analysis identifying three themes and informing design suggestions.The study aimed to understand participants’ experiences and assess notification usability.Source: §1 · p. 2
• Notification interpretation depended on task and interface context, everyday concepts anchored understanding, and uncertainty about outcomes shaped hesitation, avoidance, or support-seeking.The resulting design suggestions address context-dependent misunderstandings, clarify action-outcome connections, and enable interdependent decision-making.Source: §1 · p. 2

2.1 Characteristics and Diversity Within Intellectual and Developmental Disabilities

• IDD encompasses varied cognitive, adaptive, literacy, and support profiles; adults participate across daily contexts, often with differing levels of independence and interdependence.Technology use can offer opportunities, while accessibility gaps and rapid system changes remain barriers.Source: §2.1 · p. 3

2.2 Usable Security and Privacy Notifications

• Notification research has studied login alerts, browser warnings, spam warnings, and consent prompts, while accessibility for people with IDD remains understudied.Prior work explores interface design and notification effectiveness; Table 1 illustrates distinctions between task relevance and whether a notification requires action.Source: §2.2 · p. 3, Table 1 · p. 4

2.3 Security and Online Safety for People with Intellectual and Developmental Disabilities

• Prior IDD security research covers collaborative safety practices, authentication, and education, while this study turns to everyday notifications encountered in the moment.Prior studies report password-management demands and describe caregiver guidance and accessible learning strategies.Source: §2.3 · pp. 3–4

3 Method

• Seven adults with IDD participated in a formative study using realistic notifications embedded in primary activities such as email, browsing, and mobile-app use.The design aimed to capture reactions without making security the explicit focus of the activity.Source: §3 · p. 4

3.1 Selecting Notifications

• The researchers selected notifications across intervention and intrusion categories, distinguishing relevance to the primary task from whether a response was actionable.An actionable notification requires a security- or privacy-related action to proceed.Source: §3.1 · p. 4

3.2 Participant Recruitment and Demographics

• Recruitment yielded seven adults aged 19–42; five had Down syndrome, one autism spectrum disorder, and one an IDD diagnosis, with four inviting support people.The authors note that this sample does not capture the full heterogeneity of the IDD population.Source: §3.2 · pp. 4–5

3.3 Study Protocol

• The protocol combined screening and accessible consent, interviews about technology experience, usability testing, and a post-study interview.Participants were encouraged to make decisions and complete tasks as independently as possible; breaks were available during sessions.Source: §3.3 · p. 5

3.3.1 Task Design.

• Three tasks embedded notifications in Gmail email and two-factor authentication, a Pinterest-like website with cookie and browser prompts, and a weather app with permissions.Researchers reviewed notifications after tasks; the email task included a simulated phishing message and the website task triggered sign-in alerts with correct or fraudulent details.Source: §3.3.1 · p. 5

3.4.1 Inclusive Methods.

• Researchers personalized materials and devices, offered visual aids and breaks, and used prompts that encouraged exploration while letting participants act first.Participants could include a support person for comfort, but questions were directed to the participant with IDD.Source: §3.4.1 · p. 5

3.4.2 Ethical Study Design Choices.

• Researchers used simulated risks and blocked external links to avoid exposing participants to malicious content; after one unsafe click, they reviewed the choice with the participant and support person.The phishing email contained no malicious content, and the browser warnings came from benign testing sites.Source: §3.4.2 · p. 6

3.5.1 Data Collection.

• Data collection combined interviews, observations, recordings, eye-tracking, and click logs, but calibration challenges left eye-tracking data incomplete for three participants.Researchers also recorded assistance needs and visible signs of confidence, frustration, or confusion.Source: §3.5.1 · p. 6

3.5.2 Data Analysis.

• Two researchers used iterative Reflexive Thematic Analysis, integrating transcripts, field notes, observations, and available click and gaze data as qualitative evidence.The analysis involved three collaborative theme-development sessions and roughly 50 hours of work.Source: §3.5.2 · p. 6

3.5.3 Positionality.

• The researchers brought complementary experience with the IDD community and cybersecurity support for at-risk community members.The first author had over a decade of community-group experience; the second had formal security training.Source: §3.5.3 · p. 7

3.6 Limitations

• Seven participants with five primary Down syndrome diagnoses, one IDD diagnosis, and one ASD diagnosis only partially represent the broader community, limiting generalizability.The authors call for future work with a more diagnostically diverse population.Source: §3.6 · p. 7
• Eye-tracking calibration succeeded for only five participants, and researcher-provided devices and accounts plus priming may have altered natural interactions and help-seeking.Retrospective familiarity reports may also be unreliable.Source: §3.6 · p. 7
• The study examined only visual notifications, while gentle prompts may have encouraged persistence and reduced ecological validity.The authors suggest exploring auditory or haptic cues in future work.Source: §3.6 · p. 8
• Because evidence within participant–support-person dyads was not consistently source-attributed, findings on interdependence and help-seeking may mix participant, researcher, and caregiver perspectives.The study was not designed to assess support-person influence or dyadic power dynamics.Source: §3.6 · p. 8

4.1.1 Technology Experience.

• All seven participants used multiple devices; smartphones and tablets were common, while family support often accompanied email and online shopping.Participants also independently used email and calendars, and weather-checking was popular.Source: §4.1.1 · p. 8, Table 4 · p. 9

4.1.2 Security Experience.

• Participants used varied password strategies and often relied on family for password management or account recovery, while some described recognizing scams and taking protective steps.Device PINs were common, and four participants paired them with biometrics.Source: §4.1.2 · p. 8

4.2 Experiences, Challenges, and Interaction Decisions with S&P Notifications

• Across notifications, challenges arose from the combination of notification content, task context, and user goals; three themes captured interpretation, familiar anchors, and uncertainty-driven responses.Table 5 summarizes participant patterns across notifications and themes.Source: §4.2 · p. 8, Table 5 · p. 10

4.2.1 Theme 1: Notification Interpretation Was Shaped by the Ongo-

• Participants interpreted indicators and choices through nearby interface elements and the task flow, such as reading recording indicators as clock or battery cues and warnings through preceding tasks.Cookie consent was sometimes treated as a login gate, and the authors report that flow-based interpretation extended beyond dark-pattern cases.Source: §4.2.1 · p. 9

4.2.2 Theme 2: Everyday Concepts Provided Anchors for Under-

• Participants grounded unfamiliar notification terms and cues in everyday concepts, including food, social sharing, learned rules, and color, sometimes producing misleading interpretations.These experience-based anchors could support reasoning even when the analogy was inaccurate.Source: §4.2.2 · p. 9
• When participants were unsure what a notification meant or what an action would do, they hesitated, avoided actions, or tested controls; outcome uncertainty appeared across three participants.Two participants used diagnostic exploration, including clicking non-functional elements before resolving the notification.Source: §4.2.3 · pp. 9–10
• Some participants quickly dismissed or missed notifications, while others understood them from their text or visual cues.No participant reported noticing the screen-recording or microphone-in-use indicators.Source: §4.2.3 · p. 10
• Participants also sought guidance from trusted people in and outside the study, drawing on established routines; this support was consistent but did not guarantee assistance.Avoidance and uncertainty are documented security behaviors, but notifications often offered limited help in resolving uncertainty.Source: §4.2.3 · pp. 10–11

5 Discussion

• Cautious inaction or exploratory clicking did not always produce the intended secure action, and avoiding a sign-in alert could itself leave participants exposed.The authors distinguish uncertainty about meaning or outcomes from fatigue, suggesting decision support rather than only novelty or interruption for the former.Source: §5 · p. 11
• Brief, secondary, time-sensitive notifications may need tailored accessibility principles: subtle cues, overlooked links, and abstract terms created perceivability, operability, and understandability breakdowns.The discussion notes that linguistic simplicity alone does not guarantee comprehension and suggests situated meaning across changing visual and task contexts.Source: §5 · p. 11
• Privacy notifications may serve business interests through permissive settings, and accessibility cannot resolve dark-pattern incentives, though transparency may limit harmful forms.The authors note that clearer designs may also support consumer trust and retention.Source: §5 · p. 11

5.1 Design Implications

• Designers should calibrate language to task and interface context, explicitly identify what is being acted on, and use visual or multimodal cues to distinguish notifications from surrounding content.Progressive disclosure is suggested when additional clarification is needed.Source: §5.1 · p. 11
• Notifications should connect actions to their consequences before users commit, for example by previewing the next screen or offering an optional guided walkthrough.The authors recommend communicating the resulting system state without revealing sensitive information or requiring lengthy explanations.Source: §5.1 · pp. 11–12, Table 6 · p. 12
• S&P mechanisms should support users’ decisions with trusted others without removing user control, including safe ways to exit time-sensitive flows and seek help later.Flexible stewardship could include user-designated collaborators, user-initiated controls, or time-based access, but multi-user designs must avoid new avenues for technology abuse.Source: §5.1 · pp. 12–13

6 Conclusion

• Participants interpreted notifications through task and interface context.Source: §6 · p. 13
• Participants mapped both technical and non-technical terms to everyday concepts.Source: §6 · p. 13
• Uncertainty about meaning and consequences was associated with hesitation, avoidance, and support-seeking.Source: §6 · p. 13
• The authors recommend addressing context-dependent language misunderstandings beyond jargon simplification.Source: §6 · p. 13
• They recommend making connections between actions and outcomes transparent.Source: §6 · p. 13
• They recommend enabling interdependent decision-making in security and privacy notifications.Source: §6 · p. 13

A Notifications Shown During Study Session

• Figure 2 depicts two-factor authentication notifications.Source: Figure 2 · p. 17
• Figure 3 depicts Chrome browser warnings.Source: Figure 3 · p. 17

(a) MW — Malicious website blocked

• The browser-warning labels identify an invalid HTTPS certificate and a dangerous download blocked.Source: (a) MW — Malicious website blocked · p. 17
• The cookie-consent materials include a banner and a view reached after selecting “customize.”Source: Figure 4 · p. 18, (a) MW — Malicious website blocked · p. 18
• Other supplied visuals show iOS permission requests, screen and microphone recording indicators, and Gmail spam notifications.Source: Figure 5 · p. 18, Figure 6 · p. 18, Figure 7 · p. 19

(b) SP-R — Red "malicious content" warning

• The new sign-in email appears in two versions with different login details.Source: Figure 8 · p. 19

HTTPS Warning (HT)

• For HTTPS warnings, participants generally chose Back to Safety, while nobody used Advanced.Several read the warning or its icon as a reason not to proceed, and some relied on a support person to read the button labels.Source: B Notification-Based Participant… · p. 21

Cookie Consent (CC)

• Cookie-consent choices often reflected access, food, color, or support cues rather than a clear grasp of data-sharing alternatives; nobody opened Customize independently.Participants variously treated cookies as food, chose Allow to access the site, or needed help interpreting the banner.Source: B Notification-Based Participant… · p. 21

Permissions

• Tracking, notification, and location prompts elicited habits and mismatched meanings; some allowed by default, while others hesitated, explored screens, or could not explain options.One participant tied tracking to Find My iPhone, while others tried to dismiss prompts or clicked through settings to reach app content.Source: B Notification-Based Participant… · pp. 21–22

Spam Banners (SP)

• Spam-banner cues were unevenly noticed and interpreted: participants used color and text differently, and some relied on established delete-or-ask-family routines.Some missed banners or the term “phishing,” while others combined color, wording, and icons to judge risk.Source: B Notification-Based Participant… · pp. 22–23

Dangerous Download (DD)

• Dangerous-download warnings were often ignored or allowed to disappear, and nobody proceeded to an unsafe site; a slight delay prompted repeated trigger clicks.Participants sometimes believed interacting with the warning itself could be dangerous, or did not know what its options meant.Source: B Notification-Based Participant… · pp. 21, 23

New Sign-In Alert (NSI)

• New sign-in comparisons hinged on city or state mismatches, but recognition was inconsistent; prompts helped some participants focus on location rather than surface cues.Some participants accepted both locations as familiar or reversed their judgments before settling on an answer.Source: B Notification-Based Participant… · pp. 23–24

Indicators

• Screen-recording and microphone indicators often went unnoticed or were interpreted through nearby icons, colors, and familiar device concepts.Participants variously guessed that the indicators concerned time, location, Wi-Fi, or charging; one participant turned off screen recording in settings.Source: B Notification-Based Participant… · p. 24

• Animations and small or delayed prompts could confuse participants when they conflicted with the active device or went unnoticed.Source: C Notification-Based Participant… · pp. 25, 27
• Some concrete warning titles and icons conveyed danger, while abstract status icons were commonly mapped to unrelated concepts.Source: C Notification-Based Participant… · pp. 25, 27
• Red warning pages and salient icons helped some participants recognize danger, but others avoided proceeding or said they would click a link without knowing its effect.Source: C Notification-Based Participant… · p. 25
• Technical terms and fluent reading did not guarantee comprehension: participants misunderstood privacy, phishing, download blocking, and notification language.Source: C Notification-Based Participant… · pp. 25–26
• On cookie consent, participants mapped cookies and tracking onto everyday meanings, yet none chose controls through understanding their effects.Source: C Notification-Based Participant… · pp. 25–26
• Cookie customization and action controls were often opaque: participants overlooked toggles, misread buttons, or could not distinguish clickable text from static content.Source: C Notification-Based Participant… · pp. 25–26
• Participants interpreted permission-tier colors inconsistently and could not reliably explain option scopes, even when they read labels correctly.Source: C Notification-Based Participant… · p. 26
• For sign-in alerts, location helped all seven identify the real login, while device details and protective hyperlinks often failed to guide action.Source: C Notification-Based Participant… · p. 27