Privacy Risks in the Adoption of IoT: A Quantitative Study on Data Exposure in Costa Rica

Abstract

This research employs a mixed-methods approach, combining quantitative surveys (n = 84) and device-level vulnerability assessments, to investigate the interaction between Internet of Things (IoT) adoption, user awareness, and security practices. It addresses the growing privacy concerns associated with IoT devices in Costa Rican homes.  The objective of the study was to identify the main problems in the area of privacy, along with evaluating user behavior and suggesting specific mitigation measures in the context of the Gran Área Metropolitana. While multivariate analysis (Adj. R² = 0.48) underlined education as a major predictor of security procedures, Spearman's correlation (ρ = 0.53, p < 0.001) methodologically showed a modest positive link between IoT device count and perceived privacy issues. Among the main results are a 24% awareness-practice gap, with 85% of respondents having IoT knowledge but 31% keeping default passwords, and device audits revealing 68% of tested devices with unpatched Common Vulnerabilities and Exposures. The research finds regional socioeconomic elements, like urbanicity (β = 0.09, p = 0.21) and old device prevalence (41% with deprecated software), aggravate risks beyond global standards. Among the suggestions are blockchain-based patching, Internet Service Provider-mediated inspections, and IoT security labeling. Among the drawbacks are the cross-sectional design and self-reporting bias, which call for longitudinal follow-ups. Future studies should investigate cross-national comparisons and behavioral interventions to confirm the framework in comparable developing countries. By including technical and socio-behavioral insights, this research enhances the IoT privacy discussion and provides practical policy and technology answers.

Received: 9 March 2025 | Revised: 17 July 2025 | Accepted: 19 August 2025

Conflicts of Interest

The author declares that he has no conflicts of interest in this work.

Data Availability Statement

Data sharing is not applicable to this article as no new data were created or analyzed in this study.

Author Contribution Statement

Gabriel Silva-Atencio: Conceptualization, Methodology, Software, Validation, Formal analysis, Investigation, Resources, Data curation, Writing - original draft, Writing - review & editing, Visualization, Supervision, Project administration.