Keywords

1 Introduction

Color is a complex visual and design element that can produce various emotional, psychological and physical outcomes that can be expressed through religious, cultural, political or social meanings. As such, color can play an important role in making informed decisions in which color meaning is associated with the cultural or real-world situations. Numerous studies confirmed this relationship showing that, for example, the impact of color on marketing drives product sales [1]. Interestingly, it was found that color has to “fit” or be “appropriate” to the product that it represents [2]. This suggests that people have some personal expectations about how the color environment should look, and, consequently, they try to find the best match between the expectations and the suggested color scheme. How to predict the color risk appropriateness (CRA) that would predict one’s reaction [3] is an important aspect that has received little attention in the context of IT security.

The majority of the past studies [e.g., 4,5,6,7] investigated the role of color on eCommerce shopping behaviors, providing clear evidence that color drives consumer attitudes and behaviors towards purchasing. More recently, several studies have confirmed that culture is an important and integral part of the decision-making process in which color appeal (the degree to which colors are defined as pleasing and appealing) [4] is a salient antecedent to behavioral intentions in culturally distinct countries [8], but also that color has different arousal effects [9,10,11,12]. However, in the context of computer warning messages, we are lacking clear evidence of how color risk appropriateness affects users’ decision-making processes. A computer warning message represents the communication designed to prevent users from hurting themselves or others [13] and, as such, are rather effective in assisting users throughout the decision-making process [14,15,16]. However, warning messages suffer from several shortcomings in which ignorance of the warning message seems to be the most important one [11, 17,18,19]. Although this ignorance can be explained by habituation, in reality, the number of studies that investigated the relationship between color risk appropriateness and users’ cognitive decision-making processes is still relatively low. In other words, understanding how color fits in with culture-risk dimension (color risk appropriateness) that drives behavioral intentions when it comes to deciding whether to be compliant or not with IT security policy, in the presence of the warning message, can be an important factor influencing a user’s security decisions.

In this research paper, we investigated the role of CRA, the Color Appeal and information fit-to-task on the behavioral intentions to be compliant with warning messages. More precisely, supported by the color-in-context theory, as suggested by Elliot and Maier [20], we intend to understand how CRA influences a user’s decision-making process among cultural groups in the U.S. and China.

In the following sections, we present the theoretical background and propose our research model. Next, we describe the methodology and present the results. We conclude by discussing the results, implications and limitations of our study.

2 Theoretical Framework

2.1 Color-in-Context Theory

In the human decision-making process, the color red has various meanings: (1) danger or caution (e.g., red ink used for grading students [21]), (2) anger cue (e.g., person becomes red [22]), or (3) sex and romance (e.g., facilitates approaching potential mates [23]). Overall, the color red in humans can be associated with different situations in different contexts.

Recently, color-in-context theory [20] has been suggested to explain the relationship between color and psychological functioning. This theory explains that the influence of color on affect, cognition and behavior is a function of the psychological context in which the color is situated [24]. In other words, it could be that the red color will have a different arousal effect depending on the context or culture in which it is used. In other words, it could be that the color red is not the most appropriate in certain cultures in which red does not have the same meaning. Table 1 shows the color-culture chart for India and the U.S. We can see that the color red has the same meaning associated with danger and caution in both cultures and that the color yellow has quite a different meaning among the U.S. and Indian cultures. Theory draws on social learning and biology in which we can expect to see responses to color stimuli based on the learning process in which we associate color with a particular message (0, in the driving context, humans, by default, associate red with danger and the word “STOP”). However, through the social learning process, we can often have different interpretations. For example, the color blue on a ribbon can be a positive sign that indicates a winning situation, while blue on a piece of meat has a negative connotation as it suggests that the meat is rotten [25].

Table 1. Color-Culture Chart for India and U.S.
Full size table

At its core, the color-in-context theory suggests that color can carry meaning that provides an explanation of psychological functioning that is context-specific and automatic. Overall, the theory argues that color does not contain the “feeling” component only, but is much more dynamic and can actively participate in the psychological reasoning and decision-making process.

Theory further explains that, in order to understand which meanings are associated with which colors, one has to go through the learning process in which associations have to be established. Human beings are constantly exposed to this learning process in which they are reminded about these associations (e.g., red warning stop sign).

However, one issue with this learning association process, in the warning message context, is that these associations are imposed on a global level and, as such, may not be the most effective in culturally distinct countries.

In this context, the question of the red color risk appropriateness can play an important role in the decision-making process when the user is confronted with the warning banner message. In the computer setting, it seems that most of the implementations of the user interfaces were simply copied from other areas where red is universally used as the color of danger [12]. Hence, what is expected is that the red color will motivate a protective behavior in which an individual confronted with a red warning message will trigger an avoidance motivation [26] leading to risk-averse behaviors [12].

2.2 Color, Decision-Making and Culture

The relationship among color, decision-making and culture is still in the early research stages in the IT security field. Although past research has already established a clear link between color and the decision-making processes [12] in the computer digital realm, we are still missing empirical validation regarding which colors are appropriate for the warning message context. Indeed, a study done by Silic, Cyr, Back and Holzer [8] found that color appeal is a significant predictor of the perceived risk and behavioral intentions to comply with the warning message content. The study revealed that color applications (red, yellow and green) are producing different effects in different cultures. For instance, red is the most appealing color in U.S. culture but not in the Indian culture. This is quite an interesting finding as it suggests that color plays a different role in a different cultural setup. However, one limitation of this study is that it does not identify which color is then the most appropriate to the risk situation that is represented by the warning message. Indeed, as highlighted in the study: “this indicates that another color application should be tested to understand if, for example, white is the most efficient color for the warning message context in Indian culture” [8, page 533].

As the warning message represents a risk-taking task in which the user is expected to make a binary decision (continue or exit), we can expect to see, similar to other contexts, behaviors that would trigger avoidance motivation or eventually contradictory effects in which color will cause risk-averse situations. Moreover, according to Wogalter, Conzola and Smith-Jackson [27], “warning components that are effective in one culture may not be effective in others, it is important to do cross-cultural testing of warnings whenever appropriate and possible.”

Overall, we aim to understand the following research question: which color applications are the most appropriate to the specific cultural setting in the specific warning message context?

3 Hypothesis Development

Relationships between Color Risk Appropriateness, Color Appeal, Information fit-to-task and Perceived Risk (PR)

Color risk appropriateness is the degree to which color reflects its fit to culture regarding the level of the risk perception. It is about how much the color application effectively transmits the risk associated with certain actions and if it adequately meets the cultural risk perceptions. For example, if red represents danger in a particular cultural environment, then we can expect that the red color will have a higher degree of CRA and will consequently be associated with danger or a risky situation. As PR is measuring the degree of putting one’s information, data or computer at risk (Johnston & Warkentin, 2010), then we can expect that CRA will positively influence the perceived risk. Hence, we hypothesize:

H1: Color risk appropriateness will have a positive impact on perceived risk.

Further, if the warning message itself, in which color represents an important design element, is visually pleasing, appealing and has a design that meets viewers’ expectations, then we can expect that the risk of being non-compliant with the action proposed by the warning message will be affected in such a way that higher color appeal will be positively related to PR. Also, as CRA reflects the fit-to-culture dimension, we argue that higher CRA will lead to higher color appeal. As PR brings the situation of uncertainty about negative consequences and usually leads to losses [28], in the warning message content, this loss would be represented by clicking on the continue button, which would suggest that the user may incur possible negative consequences (e.g., being affected by malicious software) as result of his/her action. This would suggest that, for example, if the yellow color in Indian culture is an appropriate color to signal the risk, then we would expect to see a positive impact on the perceived risk level in the Indian culture. Clearly, in different cultural contexts, we can expect to see different user reactions based on their color preferences when it comes to the right level of CRA [29,30,31]. Hence, we argue that color appeal will positively influence risk appropriateness. Therefore, we hypothesize:

H2: Color appeal will have a positive impact on color risk appropriateness.

One issue with warning message content is that it may contain words or phrases that can be difficult to understand by the typical user with limited IT knowledge. That is, many users may not know what “SSL” or “malware” keywords mean, which can cause some content interpretation issues. In that situation, users may not be able to decide which action to take (continue or exit), based on the content of the warning message, as they cannot fully understand it. This is why the understanding of the warning content can be of high importance. This would mean that the warning information is effective and provides enough information to make the right decision. Information-fit-to-task represents the level of understanding of the warning content and if the warning, as such, is effective in transmitting the right information [32]. Here, color is also part of the “information” system together with the message content. Hence, we hypothesize:

H3: Information-fit-to-task will have a positive impact on CRA.

The Relationship between Perceived Risk and Behavior Intention (BI)

Past research has already demonstrated that, in the warning message context, we can expect to see positive relationships between PR and BI [8]. Behavior intention refers to paying attention to the security risks by exercising caution and terminating actions that may lead to potentially dangerous and risky situations [33]. Overall, PR is influencing the user’s decisions [34], where the risk of putting one’s information and data is associated with the behavioral intentions in such a way that the user will either try to avoid the risky behavior (leading to abandonment of his/her actions) or will, on the contrary, continue his/her actions despite the possible negative consequences. We argue that, in the warning message content, similar to past studies [e.g. 35], PR will be positively associated with BI. Hence, we hypothesize:

H4: Perceived risk will have a positive impact on behavioral intention.

The Relationship between Culture and Color Risk Appropriateness

According to the cultural relativism, color perception is driven [36, 37] by different associations and the learning process in which user expectations have to be met. For example, Google translated its search engine website into most of the local languages as this was the expectation of its users and something that facilitates the learning and adoption processes. This cultural component seems to be an important criterion that is influencing the psychological reasoning, as suggested by the color-in-context theory. Consequently, in a different cultural context, we can expect to have a different influence on the relationship between CRA and PR. Moreover, taking into account the existing issue of habituation with warning messages, we can expect that some standard colors (e.g., red) will not be positively associated with PR. In addition, supported by the color-in-context theory, we argue that some colors (e.g., yellow) may have quite a different impact on the risk perception in the U.S. and Indian cultures. Hence, we hypothesize:

H5: The influence of CRA on PR will be influenced by cultural dimension with a different impact depending on the color application (black, red, yellow or red).

Our research model is depicted on Fig. 1.

Fig. 1.
figure 1

Research model

Full size image

4 Research Design

4.1 Participants, Measures and Procedures

To test our research model, we used participants recruited from Amazon Mechanical Turk. Each participant had to visit a web link in which, after a few seconds, a warning message was displayed, represented by one of four different color applications (black, red, white or yellow). A standard warning message from Google Chrome (Fig. 2) was used. After acknowledging the warning message, participants were taken to an online survey in which they had to provide answers to the questions related to the warning message they saw. The choice of the four color applications is based on the color-culture chart as proposed by [38], but also on the past studies that have found these colors to be the most appealing in the U.S. and Indian cultures [e.g., 8,9,10, 12].

Fig. 2.
figure 2

(adapted from Google Chrome version 46)

Warning message displayed

Full size image

All measures were adapted from past studies, wherever possible, and measured on a 7-point Likert scale. Information fit-to-task was adapted from [32], Behavior Intention from [33], Color Appeal from [4] and Perceived Risk from [39]. Color risk appropriateness is a new item developed for this study.

To analyze our model, we used Partial Least Squares (PLS), a components-based structural equation modeling (SEM) technique. We followed the two-step approach to SEM [40] by first assessing the overall model quality and then testing the hypotheses.

5 Results

In total, we received 382 answers. We removed 28 for various reasons (e.g., implausible response times, incomplete answers, etc.). Our final sample contained 354 answers consisting of 193 from India and 161 from the U.S. Females comprised 133 of the answers and males 221. The average age was 38.4.

We then examined the overall research model quality by testing the reliability of measurement items for each construct (Cronbach’s α), and checking convergent and discriminant validity using principal components analysis. Composite reliabilities (CR) ranged from 0.8027 to 0.9562. Average variance extracted (AVE) for each variable construct was higher than the recommended 0.5 [41]. To establish discriminant validity, we calculated the square root of the reflective construct’s AVE and checked that the AVE of each latent construct was higher than the construct’s highest-squared correlation. As the calculations did not reveal any lower AVE, we concluded that the discriminant validity test had been established. We also calculated variance inflation factors (VIFs) and found, as per [42, 43] recommendation, no value higher than 5. Hence, this provided evidence that we do not have multicollinearity issue. Finally, we checked for cross-loadings by making sure that the construct’s loading was higher than any other cross-loading of the indicator with other constructs. All constructs were higher than the suggested 0.7 value.

At the end, we wanted to be sure that we did not have any issue with the common method bias as we collected answers from single respondents. We used two procedures: Harman’s single-factor test [44, 45] and the statistical approach developed by [46]. Both tests showed that the common method bias is not an issue for this study.

5.1 Analysis of Models

In Table 2 below, we report the results from the full model and results per each country for all four color applications:

Table 2. Model analysis
Full size table

From the results, we observed that the full model is supported across all relationships with all path coefficients being positive. The corresponding t-values for each relationship were statistically significant. When it comes to country model testing, we saw different results. Comparing India’s black color application to the U.S., we could see that the black CA->CRA and CRA->PR relationships were positive and significant in the India sample, while, for the U.S., CRA->PR was not significant (t-value = 0.181), while color seemed to produce the same effects for both countries with all relationships being positive and significant except for IFT->CRA, which is not supported. Interestingly, the color red was not significant for CA->CRA and CRA->PR in the India sample and for CRA->PR in the U.S. sample. Finally, the color yellow was not significant for CA->CRA and CRA->PR in India’s case but fully supported and positive in the U.S. sample. Further, we can observe that, for the Indian culture, CRA->PR is supported for black and white colors, and, for the U.S. culture, CRA->PR is supported for white and yellow.

Overall, from the results presented in Table 2, we concluded that H1, H2, H3 and H4 are supported. Also, H5 is supported as we found different color applications to have a different effect on the relationship between CRA->PR.

6 Discussion, Limitations and Future Studies

Supported by the color-in-context theory, our research was aimed at analyzing the impact of CRA on PR and consequently on the behavioral intentions to comply with the warning banner message. In the next sections, we derive theoretical and practical implications of our study.

We found that all of our hypothesized relationships are supported. In particular, we found that CRA is positively associated with PR. This is an interesting finding as it suggests that the right choice of the color is an important factor in the user’s decision-making process. Indeed, if a higher degree of the color appeal is achieved, higher color appropriateness to the risk dimension will be obtained. Consequently, these relationships will positively influence the degree of the CRA on PR, which in turn, will influence the intention to be compliant with the warning message suggestion.

Past research has introduced the color appeal construct [4], which provided an initial understanding of the appeal of the warning message, but, in our research, we offer a more advanced view of the color-risk dimension through the new construct of CRA. This is an important insight for future theorizing as we uniquely positioned the color-in-context theory in the warning message context demonstrating that color plays an important role in the user’s decision-making process. Further, we found that culture plays a vital role in defining the right choice of the color design element being an integral part of the warning message.

In that context, some unexpected findings were revealed. To start, we did not find any support for our hypothesis for the CRA to PR relationship in the U.S. sample. This suggests that the red color is not efficient. This can be explained by the habituation effect, which is most likely causing this insignificant effect of the red color. This is even more pronounced in the Indian sample in which red is neither appealing nor appropriate to transmit the risk. Conversely, the white color is appealing and appropriate in Indian and U.S. cultures, suggesting that white is less influenced by the habituation effect. However, this finding has to be taken with precaution as it could be that users were simply surprised to see an unexpected color (e.g., white as opposed to red), and, consequently, they reacted with more precaution, stopping their behavior. The other two colors (black and yellow) received mixed attention from users. While yellow was found to be appealing and an efficient color to transmit risk in the U.S., yellow was fully ignored in the Indian culture. Finally, black was found to be a good risk color in Indian culture but not in U.S. culture (even having a negative relationship with the perceived risk).

Overall, these insights are important in order to better understand how risk-color dimension behaves in the unique warning message context. Indeed, by better understanding how different cultures react to different colors in a specific context, it would also be possible to better predict users’ behaviors when it comes to their decision-making processes.

These findings suggest that user interface designers should take into account the importance of the cultural dimension and adapt the look and feel of the warning message. One recent example of such an action is the introduction of the yellow warning message in Google Chrome. However, this would most likely work only in the U.S. culture and could be less efficient in other cultures. Clearly, software programmers need to be more cautious during the product design phase since there is currently only one way to approach the topic of the warning messages in different cultures, which does not seem to be efficient in preventing hazards from occurring.

Future research should include more cultures in order to fully validate our findings. Also, it would be interesting to see more color-based research in other security contexts, such as anti-virus or other warning base contexts, to understand users’ behaviors and expectations. Our research also has several limitations. We did not use the “deception” approach but relied on the answers from participants, which could reduce the accuracy of the study. Also, we did not test which colors are the most efficient to be used in a given culture but rather focused on the risk appropriateness of the color.

7 Conclusion

Supported by the color-in-context theory, our research investigates the color risk appropriateness impact on the perceived risk in two different cultures. We found that different colors behave differently in the specific warning banner context in which CRA is an important antecedent to users’ compliance. Overall, we advance current theoretical understanding on the color-risk dimension and its importance for the user’s decision-making processes.