Abstract
The Internet of Things (IoT) has become embedded in everyday consumer environments through smart home devices, wearables, connected appliances, and related technologies. These devices offer substantial convenience and functionality while creating persistent privacy and security concerns. This exploratory study examines how consumer IoT familiarity, usage, privacy and security concerns, awareness of data practices, and self-reported protective behaviors relate to one another. The study is interpreted through Protection Motivation Theory (PMT), the Technology Acceptance Model (TAM), and Risk Perception Theory (RPT). A cross-sectional survey was distributed to 423 members of the University at Albany community and yielded 30 complete responses (7.1%). Quantitative analyses used descriptive statistics, correlations, and a t-test, while open-ended responses were summarized to provide qualitative context. Respondents reported high familiarity and frequent IoT use alongside substantial privacy and security concern, but many demonstrated limited knowledge of the data collected by their devices and inconsistent protective practices. The hypothesis tests were not statistically significant at the .05 level: privacy concern and IoT usage were weakly negatively correlated (r = -0.167, p = .377); perceived risk and awareness were weakly positively correlated (r = .121, p = .525); the awareness-group comparison was nonsignificant (t = .717, p = .479); and trust in vendor privacy protection showed a moderate positive association with IoT usage that did not reach conventional significance (r = .334, p = .071). The results therefore provide exploratory rather than confirmatory evidence of an adoption concern paradox: participants often continued to use IoT technologies despite privacy and security concerns. The findings are consistent with the possibility that perceived usefulness, convenience, risk appraisal, self-efficacy, and trust jointly shape consumer behavior, but the small nonprobability sample and cross-sectional design preclude causal inference and broad generalization. Importantly, this study measures perceived risk and awareness; it does not independently conduct technical vulnerability assessments of participants' devices. This study contributes by integrating PMT, TAM, and RPT to interpret the coexistence of IoT adoption and privacy/security concern; documenting mismatches among concern, awareness, and self-reported protective behavior in an exploratory university sample; and identifying implications for user education, secure-by-default product design, vendor transparency, and future research that combines behavioral measures with objective device-security assessments.