Exploring Consumer Behavior in the Digital Age: Insights from Theory-driven, Large-scale Randomized Field Experiments on Mobile Data Alerts and Data Breach Announcements

Project Information

DALE

Grant agreement ID: 101152906

DOI

10.3030/101152906

Project closed

EC signature date 7 March 2024

Start date 1 April 2024

End date 31 March 2026

Funded under

• Marie Skłodowska-Curie Actions (MSCA)

Total cost

No data

EU contribution

€ 181 152,96

Coordinated by

UNIVERSIDAD DE NAVARRA
Spain

Periodic Reporting for period 1 - DALE (Exploring Consumer Behavior in the Digital Age: Insights from Theory-driven, Large-scale Randomized Field Experiments on Mobile Data Alerts and Data Breach Announcements)

Reporting period: 2024-04-01 to 2026-03-31

Summary of the context and overall objectives of the project

We live more and more of our lives through digital channels. Two everyday consequences of this shift have been largely under-studied. First, mobile internet has become a near-universal but capped resource: when our monthly data allowance is about to run out, our operator sends us a "near-end" reminder, yet we know surprisingly little about whether — and for whom — these reminders actually work, or at what point in the month they are best sent. Second, the same digital convenience that makes online shopping the default also exposes us to cyberattacks: when a retailer's online store goes down because of a data breach, customers must decide whether to wait, switch channels, or switch providers. Although such incidents are increasingly common and costly, what individual consumers actually do in response remains poorly documented.
DALE — Exploring Consumer Behavior in the Digital Age — addresses both gaps. The project combines theory-driven modelling with large-scale, real-world data from two industry partners to deliver evidence-based answers to two questions that matter for consumers, firms, and regulators alike:
• MODALE: How effective are reminder-based "nudges" when a digital resource is scarce, and does the timing of the reminder change the answer?
• CYDALE: How do consumers actually behave after a corporate cyberattack disrupts the online channel of an omnichannel retailer?
The project is hosted at IESE Business School (University of Navarra, Spain) under the supervision of Prof. Víctor Martínez-de-Albéniz, and is funded by the European Commission's Marie Skłodowska-Curie Postdoctoral Fellowship programme (Horizon Europe, 2024–2026).
The expected pathway to impact is threefold. Scientifically, the project advances the interdisciplinary understanding of consumer behavior at the intersection of operations management, marketing, behavioral economics, and information systems. For firms, it provides directly actionable evidence on how to design alerts and how to manage customer recovery after a cyber-disruption. For policy, it informs European frameworks on digital consumer protection (bill-shock alerts) and cybersecurity (notably the NIS2 Directive and the Cyber Resilience Act framework) by quantifying the consumer-side consequences of these regulations and the events they aim to address.

Work performed from the beginning of the project to the end of the period covered by the report and main results achieved so far

DALE delivered two complementary empirical studies, each combining theory and a large-scale real-world dataset.

MODALE — Reminder timing for heterogeneous mobile users. In partnership with a leading European telecommunications operator, we ran a large-scale randomized field experiment involving 21,481 mobile clients on 2 / 4 / 6 GB plans, drawn from a stratified sample of more than 215,000 candidate clients. The experiment manipulated when the near-end reminder was sent — at 80% versus 90% of the data allowance — over a three-month window, followed by a within-subject consistency period. We complemented the experiment with an analytical model of intertemporal data consumption that incorporates limited attention and overconfidence, and we used a Bayesian mixture model to classify each user into a behavioral type. We find that the "average user" implied by aggregate analysis matches only about 9.3% of real users, that several distinct behavioral types coexist with different optimal reminder policies, and that — crucially — while the overall mix of types is stable across both policy changes and time, individuals do not reliably stay in the same type. This last finding fundamentally challenges the practical viability of personalised reminder policies.

CYDALE — Customer responses to a cyberattack in omnichannel retail. With a large omnichannel grocery retailer that suffered a major cyberattack triggering a one-week shutdown of its online store and a corporate data breach, we obtained four years of high-frequency loyalty-card transaction data covering more than 20,000 customers. Using a within-customer difference-in-differences design — comparing 2022 (the attack year) with 2019 (a clean pre-pandemic counterfactual) — we estimated the causal impact of the attack on customer behavior over a 13-week post-attack window, with extensive robustness checks (PPML / quasi-Poisson estimation, customer-clustered bootstrap, Kaplan–Meier survival analyses, exposure-likelihood triple-difference).

Outputs. Two manuscripts have been written, deposited as Open Access pre-prints on SSRN, and submitted to top-tier journals — Marketing Science (MODALE) and Management Science (CYDALE). MODALE was presented at the EURO Working Group on Retail Operations (EWG-ORD) Conference in Vienna; CYDALE is scheduled for presentation at the Conference on Operations Engagement and Research (COER) at Harvard Business School. The researcher's Career Development Plan and the five planned IESE training streams were completed, alongside bi-weekly mentoring with the supervisor and four-monthly departmental reviews. Project ethics were reviewed and approved by the IESE Institutional Review Board.

Progress beyond the state of the art and expected potential impact (including the socio-economic impact and the wider societal implications of the project so far)

DALE moves the literature forward in four concrete ways:
• The "average user" is a poor guide to reminder policy. MODALE shows that aggregate consumption patterns hide profound individual heterogeneity: only about 9.3% of users actually behave like the representative agent. Reminder policies designed against the aggregate may therefore work for very few people in practice.
• Personalised reminder policies are harder than they look. Even when behavioral types can be identified, individuals do not stay in the same type over time. This calls into question the practical viability of one of the most popular ideas in nudge design — personalisation — and reframes how scholars and policy makers should think about "targeting".
• Cyberattacks have *long-run*, not just short-run, consumer-level effects. Firm-level event studies have generally reported only short-lived stock-market reactions to cyberattacks.

CYDALE shows that, at the consumer level, online transactions and revenue declined by approximately 10% with no recovery over at least 13 weeks. The true cost of a cyberattack to a firm is therefore materially larger than firm-level studies suggest.
• Omnichannel architecture is not a reliable safety net for commodity retail. Prior work (Janakiraman et al. 2018) documented within-firm channel substitution after a breach in a department store. CYDALE shows that, in a commodity-driven grocery context, the offline channel does not absorb the displaced online demand: customers substitute toward competitors instead, generating a net revenue loss for the focal firm.
These results combine novel theoretical micro-foundations with novel empirical evidence from real consumer behavior at scale. The associated methodological tools (Bayesian mixture-model behavioral-type classification; within-customer DiD with bootstrap-propagated exposure-likelihood inference) are reusable in adjacent settings.