JMIR Publications

ABSTRACT

Background:

Digital behaviors such as sleep, social interaction, and productivity reflect how individuals’ structure daily life. Among university students, online activity patterns mirror academic schedules, social rhythms, and lifestyle habits, with disruptions linked to sleep, stress, and well-being. Existing approaches—including wearables, apps, and surveys—yield useful insights but depend on self-report or active participation, limiting long-term adherence. Passive sensing of network traffic offers a scalable alternative for unobtrusive capture of smartphone usage patterns that preserves privacy.

Objective:

This study evaluated whether encrypted smartphone network traffic, collected via a virtual private network (VPN), can capture patterns of digital behavior. We assessed feasibility (sustained data capture) and acceptability (usability, burden, and privacy perceptions) and examined whether traffic-derived features reveal aspects of digital behavior—including timing, intensity, and regularity—relevant to health and daily functioning.

Methods:

We conducted a two-week prospective observational study at New York University. Participants installed the WireGuard VPN client on personal smartphones, enabling passive capture of encrypted network traffic. Feasibility was assessed using a mixed-methods approach combining quantitative measures of user retention and data coverage with qualitative analysis of semi-structured exit interviews. Acceptability was evaluated using the System Usability Scale (SUS), NASA Task Load Index (NASA-TLX), and qualitative interview analysis. Exploratory analyses visualized traffic-derived features in relation to digital activity patterns.

Results:

Thirty-eight students consented to participate, of whom 29 contributed valid network traffic data and formed the analytic cohort. Within this cohort, 93% of participants (27/29; Wilson 95% CI: 78–98%) contributed at least five days of monitoring, corresponding to 71% retention relative to all consented participants (27/38; Wilson 95% CI: 55–83%). Mean data coverage within the analytic cohort (N=27) was 74.1% (median 77.1%; bootstrap 95% CI: 66.3–81.4%). These participants contributed an average of 311.6 hours of monitored traffic (approximately 13 days, SD 3.5), ranging from 121 to 496 hours. Acceptability outcomes were evaluated among participants completing the exit survey and interview. Usability ratings were high (mean SUS score = 78) and perceived workload low (NASA-TLX scores minimal). Participants described the system as easy to install, unobtrusive, and generally trustworthy, though some reported temporarily disabling the VPN during activities they considered private. No inferential statistical tests were conducted; analyses were descriptive. Exploratory analyses indicated that traffic-derived features reflected daily digital activity rhythms and revealed distinctive lifestyle patterns, including gaming and irregular late-night food delivery use.

Conclusions:

VPN-based monitoring of encrypted smartphone traffic was feasible and acceptable, enabling sustained passive data collection with minimal burden. This approach shows promise as a scalable, device-agnostic method for digital phenotyping that captures fine-grained behavioral rhythms while preserving privacy. With broader validation, this technique could expand the toolkit for studying health and well-being in everyday life. Clinical Trial: This study was not registered as a clinical trial because it did not involve randomization.