Publications

Abstract

Decentralized metaverse economies leverage blockchain cryptocurrency and asset tokens to enhance the concepts of digital ownership and scarcity, uniquely combining aspects of real, virtual, and blockchain economies. This study applies and extends token adoption and valuation theory to conceptualize and empirically analyze the dynamics in decentralized metaverse economies. We analyze over 4.5 million blockchain transactions from two blockchains across two years in the “The Sandbox” metaverse using vector autoregressive models. Our findings reveal complex dynamics among exchange rates, economic actors, and their activity, highlighting the exchange rate’s central role in fostering growth, particularly regarding creating scarce digital assets. The results provide insights for designing and regulating decentralized metaverse economies and offer a novel conceptual framework for understanding these emerging information systems. Our research contributes to the literature by bridging economic theories with the technological realities of blockchain-based metaverses, providing a foundation for future studies on the convergence of real and virtual economies in the metaverse.

Abstract

Blockchains are often associated with anonymity and illicit activities. However, public blockchains offer an unparalleled level of transparency because they record all transactions openly. This transparency allows firms to observe in real-time and at a low cost the transactions of both their customers and competitors. This article outlines how to use the transparency of blockchain data to gain valuable insights into real-world behaviors, such as customers’ share of wallet. The empirical study uses blockchain data from the entire NFT trading market, which covers 22.7 million sales transactions from 1.3 million customers across eight competing firms, and totals to over US$500 million in fees. The study reveals that a customer’s current spending (size of wallet) is not a valid indicator of future growth potential because it has little correlation with the share of wallet or potential wallet size.

Abstract

The rapid expansion of Decentralized Finance (DeFi) has created substantial cybersecurity risk. Existing decentralized insurance platforms cover less than 1% of DeFi’s total value locked, indicating structural inefficiencies in current risk-transfer models. We propose a market-based insurance mechanism that prices protocol-level cybersecurity risk through binary prediction markets and aligns stakeholder incentives via collateral-based coverage. Protocols post forfeitable collateral to access protection from liquidity providers, while continuous risk pricing emerges from trading HACK tokens across quarterly expiries. Liquidity provider yields adjust dynamically to market-priced risk and pool utilization, supporting capital-efficient risk transfer. The mechanism decouples price discovery from insurance provision while maintaining solvency through dynamic utilization constraints. Analytical results establish equilibrium existence, incentive compatibility, and bounded utilization. The design provides a framework for cybersecurity risk insurance built on established prediction-market mechanisms.

Abstract

Online gambling platforms exhibit increasing revenues, exacerbating societal issues while evading regulatory oversight. The emergence of blockchain gambling platforms aggravates these issues, luring users with the promise of transparent and verifiable gambling rules. To provide insights for regulators and user protection measures, we strive to understand how users interact with these emerging platforms. We analyze over 22,800 rounds of YOLO, a gambling platform implemented as a smart contract. In our sample, 3,306 unique users lost a total volume of USD 5.1 million. Generalized linear mixed model estimation results reveal the effects of users’ cognitive biases while engaging in on-chain gambling, demonstrating the substantial risks of gambling smart contracts in exploiting users with gambling inclinations, especially given the lack of user protection measures. Enforcing user protection remains challenging for decentralized gambling smart contracts, which might exacerbate the lack of oversight, user protection, and law enforcement on traditional online gambling platforms.

Abstract

Users face increased risks in Web3's public and decentralized systems as adversaries can directly steal digital assets and tokens. Additionally, Web3 systems' transparent transaction information and smart contract source codes offer adversaries ideal conditions for planning and executing attacks. As of 2024, over US$ 30 billion has been lost across more than 1,000 documented hacks and scams in Web3, demonstrating the urgent need for understanding adversary behaviors. We address this need by developing the Web3 Attack Matrix, a comprehensive knowledge base that systematically categorizes attack vectors and adversary tactics specific to Web3, based on the MITRE ATT&CK cyber security framework. The Web3 Attack Matrix’s empirical evaluation by Web3 security experts enables the development of professional standards, processes, and countermeasures, bridging the gap between Web3 academic researchers, practitioners, and users. The Web3 Attack Matrix is extendable to accommodate future Web3 security developments and potential new threats.

Abstract

This research explores the emerging phenomenon of "Phygitals" - bundled products combining physical goods with their unique digital counterparts (tokenized digital products) in the context of bundling theory. We examine how superadditive utility created by the integration of physical and digital components affects optimal bundling strategies, considering the associated technical integration costs. Through analytical modeling, we demonstrate that producers can increase profits by introducing superadditivity in pure and mixed bundling strategies, despite integration costs. Our findings suggest that mixed bundling consistently outperforms other strategies, while the effectiveness of pure bundling versus pure components depends on the degree of superadditivity. We conceptualize different levels of Phygital functionality, ranging from basic authentication to advanced digital twin applications, and discuss real-world implementation examples. This study contributes to understanding the implications of the ontological reversal in Information Systems, specifically how producers can strategically bundle superadditive Phygitals for profit maximization.

Abstract

Platform businesses leverage consumer data for value creation, yet offering high privacy levels could yield competitive advantages. Thus, platforms try to compete on privacy without jeopardizing their value creation potential. However, our understanding of consumer perception of privacy-friendliness and its importance for business models is limited, hindering platforms to develop privacy-friendly business models. Drawing on Design Science, we demonstrate a novel research-and-design approach, leading to a recommender system for analyzing and enhancing the privacy-friendliness of platform business models. We present a framework assessing the privacy-friendliness of platform business models, calibrated with an adaptive choice-based conjoint experiment eliciting consumers’ preferences in a representative U.S. sample. Users configure their (planned) platform business model through the recommender, which then computes a privacy-friendliness score based on our framework and offers improvement suggestions. This research aims to facilitate the design of privacy-friendly platform business models, addressing the growing importance of privacy in the digital landscape.

Abstract

This work presents insights into consumer preferences regarding Privacy Management Systems in the context of the General Data Protection Regulation (GDPR). The authors perform a Choice-Based Conjoint experiment with consumers (n = 589) to elicit preferences over four attributes and compute usage likelihoods for all product configurations. Results show that data sharing for marketing purposes and discounts are the most important attributes for consumers. Furthermore, consumers prefer digital access to privacy-related information, detailed rights management for data sharing and no data sharing for marketing purposes. Moreover, a cluster analysis reveals differing importance weights across clusters. The study concludes that incorporating consumer preferences into the design and development process of Privacy Management Systems could increase their use and effectiveness, ultimately strengthening consumers’ privacy rights and companies’ legal compliance. The authors suggest researching legal, business, and consumer requirements more holistically to converge these perspectives to improve Privacy Management Systems adoptions.

Abstract

The GDPR introduced restrictive privacy-preserving measures, affecting the daily life of (online) consumers. Moreover, literature shows that privacy preferences are constantly evolving. This is the first study introducing a GDPR exercising-oriented approach to identify consumer privacy types. Based on a representative sample of the German online population, we cluster consumers according to their privacy importance (“intention to act”) and GDPR knowledge (“ability to act”) and derive four consumer privacy type clusters: fundamentalists, amateurs, pragmatists, and unconcerned. We investigate motivational factors for changing privacy settings and find significant differences between consumers’ intentions and actions for selected factors. This provides evidence for the privacy paradox. Contrarily, intentions and actions align for other factors, which supports the hypothesis that action-based consent might lower the privacy paradox. Finally, we suggest the development of standardized scales and corresponding clustering methodologies for consumer privacy type clustering to increase comparability over time and across populations.

Zusammenfassung

Transparenz und Intervenierbarkeit sind zentrale Prinzipien der DSGVO, doch ihre praktische Umsetzung bleibt herausfordernd. In diesem Beitrag wird untersucht, wie Datenschutz durch gezielte Gestaltung von technischen Hilfssystemen in Plattformökonomien effektiver gestaltet werden kann, um Nutzerrechte verständlich und anwendbar zu machen. Dieses Ziel wird fortlaufend als Datenschutzinitiative bezeichnet. Im Rahmen des PERISCOPE-Projekts wurden interdisziplinäre Methoden aus User Experience, Recht und Ökonomie kombiniert, um Datenschutzmaßnahmen aus verschiedenen Perspektiven zu bewerten. Empirische Studien mit Endnutzern und Plattformbetreibern zeigen, dass bestehende Datenschutzlösungen oft schwer verständlich sind und Nutzerrechte durch komplexe Prozesse eingeschränkt werden. Die Forschung hebt hervor, dass eine transparente Kommunikation, nutzerfreundliche Gestaltung und gezielte Interaktivität entscheidend für die Akzeptanz und Wirksamkeit von Datenschutzinitiativen sind. Zudem werden wirtschaftliche Faktoren analysiert, die Unternehmen zur Implementierung datenschutzfreundlicher Modelle motivieren können. Dieser Beitrag leitet konkrete Handlungsempfehlungen für die Weiterentwicklung nutzerzentrierter Datenschutzstrategien ab und betont die Notwendigkeit einer ganzheitlichen Integration von Regulierung, Technologie und Nutzererwartungen.

Zusammenfassung

Plattformunternehmen sind zur Wertschöpfung auf Nutzerdaten angewiesen, aber der Schutz von Daten und Privatsphäre ist zu einer wichtigen Quelle für Wettbewerbsvorteile geworden. Plattformunternehmen versuchen daher zunehmend, über den Schutz von Daten und Privatsphäre zu konkurrieren, ohne ihr datenbasiertes Wertschöpfungspotenzial zu gefährden. Das allgemeine Verständnis über die von Nutzenden wahrgenommene Privatsphärenfreundlichkeit von Geschäftsmodellen ist jedoch begrenzt, was es Plattformunternehmen erschwert, ihre Geschäftsmodelle zielgerichtet zu optimieren. Daher wird zurzeit ein „Geschäftsmodell-Navigator“ entwickelt und implementiert, der Plattformunternehmen dabei unterstützt, ihre Geschäftsmodelle im Hinblick auf die wahrgenommene Privatsphärenfreundlichkeit der Nutzenden zu analysieren und zu verbessern.

Zusammenfassung

In der Digitalwirtschaft besteht ein erhebliches Bedürfnis nach sowohl effektiven als auch effizienten Lösungen, um datenbasierte Geschäftsmodelle mit den hohen europäischen Datenschutz-Standards in Einklang zu bringen. Hierbei stellen einerseits die Förderung von Transparenz und Intervenierbarkeit für die betroffenen Personen sowie andererseits der Ressourcenaufwand zur Einhaltung der rechtlichen Vorgaben für – insbesondere kleine und mittlere – Unternehmen wesentliche Herausforderungen dar. Personal Rights Management (PRM)-Systeme können bei der Adressierung dieser Herausforderungen unterstützen, indem sie auf einen vermittelnden Ansatz abzielen, der den Interessen aller Stakeholder gerecht wird. Dieser Beitrag beschreibt aus einer datenschutzrechtlichen, sozioökonomischen und technischen Perspektive die Motivation für und die Multi-Stakeholder-Anforderungen an die Komponente des Transaktionsjournals zur automatisierten Protokollierung von Datenverarbeitungstätigkeiten im Rahmen eines PRM-Systems. Betroffene erhalten durch das Transaktionsjournal eine nachvollziehbare Darstellung dessen, was mit ihren Daten geschieht, was die jeweilige Verarbeitungstätigkeit legitimiert und welche Interventionsmöglichkeiten ihnen zur Verfügung stehen. Unternehmen profitieren von einem besseren Überblick ihrer Datenverarbeitungstätigkeiten und der Förderung ihrer Fähigkeit zum Nachweis der Einhaltung ausgewählter datenschutzrechtlicher Anforderungen.