Abstract
The privacy calculus assumes that people weigh perceived privacy risks and benefits before disclosing personal information. So far, empirical studies investigated the privacy calculus on a between-person level and, therefore, were not able to make statements about the intrapersonal psychological processes. In the present preregistered online within-person experiment, participants (N = 485) were asked to imagine three different disclosure situations in which privacy risks were indicated by a privacy score. As personality variables, rational and intuitive privacy decision-making styles and privacy resignation were assessed. Results of a within-between random effects model showed that benefit perceptions were positively associated with self-disclosure intentions on between- and within-person levels. The privacy score was found to be effective in supporting users to make more privacy aware choices (within-person level). Finally, the rational decision-making style was positively related to privacy risk perception, while especially intuitive decision-makers can benefit from decision-making aids like the privacy score.
The assets of some of the most valuable and powerful companies in the world (e.g., Alphabet and Facebook) are primarily based on the business model of collecting and processing personal information. Thus, using these (and other) websites requires giving up huge parts of one’s personal privacy allowing the companies to gain sensitive insights and inferences into one’s personality or preferences. This new form of capitalism based on surveillance and data collection poses a threat not only to individuals (e.g., by creating new power asymmetries) but to democratic structures in general (West, 2019; Zuboff, 2019). Therefore, data protection is not only indispensable for individuals but for governments of democratic societies in general to preserve their liberal structures and to protect basic human rights (Zuboff, 2019). Policy makers and regulators, however, continue to shift the responsibility for privacy protection primarily onto the users, but at the same time, the individual possibilities of escaping privacy threats are very limited (Baruh & Popescu, 2017). Hence, to find ways to empower and protect users, it is important that researchers comprehend the psychological mechanisms of online privacy decision-making. The present study takes a closer look at a prominent approach explaining people’s online privacy behaviors—the privacy calculus (Culnan & Armstrong, 1999). This approach assumes Internet users’ self-disclosure decisions to be the result of a cost-benefit analysis. Former studies tested privacy calculus assumptions on the between-person level (i.e., relations and differences between users). However, the privacy calculus primarily makes assumptions about a within-person process (i.e., relations and differences within one user in different situations). Hence, the present study aims to further investigate the privacy calculus by separating between- from within-person variance to obtain a more detailed insight into individual privacy decision-making. To create within-person variance, each participant will imagine three different self-disclosure situations represented by three different websites. Because people seem to unevenly weigh risks and benefits with anticipated benefits being more strongly related to self-disclosure (e.g., Dienlin & Metzger, 2016), a privacy risk cue called privacy score will be tested in addition. This privacy score is an adaption of a nutrition label that has been found to be an easily understandable decision-making aid (Egnell et al., 2019). Finally, to also address critical points that have been raised about the approach and further elaborate on inter-individual differences, the influence of two different privacy decision-making styles (rational and intuitive) and privacy resignation on perceived risks and benefits will be examined.
Literature Review
Privacy Calculus
A prominent perspective when investigating online privacy behaviors and behavioral intentions is that self-disclosure is the result of a cost-benefit analysis. According to this privacy calculus, Internet users rationally weigh privacy costs and disclosure benefits (e.g., Culnan & Armstrong, 1999; Dinev & Hart, 2006). The underlying idea of the privacy calculus is that if a person perceives high benefits in a particular situation, self-disclosure will be more likely in that situation because benefits outweigh risks. Contrarily, if this person anticipates higher risks with disclosure compared to other situations, information revelation will be less likely in this particular situation due to an overweight of the privacy risk perception. However, it has been criticized that many former studies rather assessed an accumulated picture and did not capture the situational diversity of multiple privacy decisions (Masur, 2018) that would reveal within-subject variations. Consequently, whereas the privacy calculus describes within-person processes, studies mostly used cross-sectional designs to investigate the approach, therefore, focusing on between-subject relations (e.g., Bol et al., 2018; Krasnova et al., 2010). This means that former studies observed differences between persons, for instance, that persons who perceive higher benefits than others have an increased willingness to self-disclose compared to others (see Bol et al., 2018; Dienlin & Metzger, 2016; Meier et al., 2020). Although it is not unusual to infer intra-individual differences from observed differences between persons, this assumption is not always valid (see Hamaker, 2012). In some cases, equating within- and between-person changes can lead to some serious misinterpretations or shortcomings in the implications of empirical results (Molenaar, 2004). For example, confounding between- and within-subject variation can lead to an error known as Simpson’s Paradox (Simpson, 1951) stating that a relationship at the population level can have a different direction than in the population’s subgroups. This means that, for example, a relation can be positive at the between-person level but negative at the within-person level. Therefore, it is important to investigate the question whether the psychological processes postulated by the privacy calculus occur equally at the between- and within-person level. In the following, the between- and within-person levels will be described.
Between-person perspective
As briefly addressed above, the empirical evidence concerning the privacy calculus is exclusively based on cross-sectional studies. Most of these studies found positive relations between benefit perceptions and self-disclosure intentions and negative relations between privacy cost perceptions (e.g., perceived privacy risks) and self-disclosure intentions (Bol et al., 2018; Krasnova et al., 2010), whereby benefits seem to be more strongly related to self-disclosure than perceived privacy costs (Dienlin & Metzger, 2016; Meier et al., 2021). These findings imply that persons who generally or situationally perceive higher benefits than others have a higher intention to self-disclose as compared to these other persons. In contrast, those who perceive higher privacy risks than other individuals have a decreased self-disclosure intention. Although these relationships have been examined in several studies, we retest these relations to compare the between- with the within-level associations and to draw a more comprehensive picture. Thus, the following hypotheses are derived:
Hypothesis 1 (H1): Participants who perceive higher benefits than other participants will have an increased intention to self-disclose.
Hypothesis 2 (H2): Participants who perceive higher privacy risks than other participants will have a decreased intention to self-disclose.
Within-person perspective
It becomes evident that based on between-person findings, researchers are only able to make predictions about comparisons of different individuals but not about one individual experiencing a sequence of different situations (see Masur, 2018). Research regarding privacy on the within-person level is relatively scarce. Recently, Dienlin et al. (2021) found that people who had higher privacy concerns than they normally have also had a lower self-disclosure intention than normal. Those who had a temporal increase in their attitudes toward self-disclosure had higher self-disclosure intentions. These findings are a first indication that within-person processes of the privacy calculus may work similarly. The privacy calculus assumptions on the within-subject level would state that a temporal increase in perceiving benefits is associated with a temporal increase in the tendency to reveal personal information. When someone experiences a current increase in their privacy risk perception, their self-disclosure intention should be decreased in that situation. However, as stated above, there is no empirical evidence so far. Based on the literature review of the privacy calculus on the within-person level, the following hypotheses are put forward:
Hypothesis 3 (H3): Participants who perceive higher benefits in one situation compared to the other situations will have an increased intention to self-disclose.
Hypothesis 4 (H4): Participants who perceive higher privacy risks in one situation compared to the other situations will have a decreased intention to self-disclose.
Privacy Decision-Making Styles
The general idea of rational privacy decisions as postulated by the privacy calculus has been subject to criticism, and researchers argue that online communication is affected by biases, heuristics, or impulsivity (Knijnenburg et al., 2017; Ostendorf et al., 2020). Therefore, online self-disclosure is unlikely to be solely determined by perceived benefits and risks but is also affected by more or less “rational” factors. For instance, people differ in the ways they think and make decisions (Hamilton et al., 2016; Scott & Bruce, 1995) which is not considered by the approach. Research in this realm is also scarce: Dienlin et al. (2020) found people who make more deliberate privacy choices have higher privacy concerns and disclose slightly less information. Hence, it seems that stable traits can impact the inner psychological process of the privacy calculus. According to dual process theories of choice and judgement, there are two cognitive systems. One system works fast, unconsciously, and intuitively whereas the other one operates slowly, controlled, and deliberately (e.g., Bechara, 2005; Kahneman, 2003; Strack & Deutsch, 2004). Consequently, some people’s cognitions are primarily based on complex thinking, reasoning, and deliberation whereas others tend to think and act rather impulsively and intuitively (Evans, 2008), although both systems work simultaneously among all persons (Bechara, 2005; Strack & Deutsch, 2004). With respect to privacy decisions, this would mean that some persons may more carefully weigh risks and benefits whereas others rather trust their gut feelings, possibly immediately reacting to anticipated gratifications. Stated differently: some persons make more rational privacy choices than others. In the present study, we do not assume direct relations between decision-making styles and self-disclosure (intentions) but argue that these reflection styles impact the perception of privacy risk and self-disclosure benefits. Findings of Dienlin et al. (2020) already indicated that a more careful consideration of the pros and cons of self-disclosure seems to result in an increased risk awareness. Contrarily, primarily relying on one’s intuition and gut feelings may be related to a higher awareness of the short-term consequences (i.e., rewards) of self-disclosure in the first place (see Ostendorf et al., 2020). Ostendorf et al. (2020) argue that because privacy risks are often abstract and intangible, intuitive decision-makers tend to primarily perceive the gratifications which increases the chance to make intuitive choices. Hence, we assume that persons who would rather rely on their intuition will have an increased benefit perception whereas rational privacy decision-makers will have an increased privacy risk awareness when they are about to disclose information. Because there is only very little research in this realm, research questions are formulated:
Research Question 1 (RQ1): Will the rational privacy decision-making style be related to participants’ privacy risk perception?
Research Question 2 (RQ2): Will the intuitive privacy decision-making style be related to the self-disclosure benefit perception?
Privacy Decision Aid
Online, there appears to be an imbalance between people’s privacy risk and benefit perceptions. Studies repeatedly show that anticipated benefits are more strongly related to self-disclosure (intentions) as compared to the associated privacy risks (Bol et al., 2018; Dienlin et al., 2020; Meier et al., 2021). One attempt to explain this observation is that the benefits of disclosure are certain and immediate whereas privacy risks are abstract, elusive, and uncertain (e.g., Masur, 2018). Therefore, besides legal support (West, 2019), people can profit from decision-making aids that, for example, reduce information complexity and make privacy threats more visible (e.g., Cranor et al., 2002; Efroni et al., 2019; Meier et al., 2020). One way to support individual privacy decision-making is the application of privacy tools that show relevant information to the user. An example of such a tool is the Privacy Bird displaying websites’ privacy levels by different colors (Cranor et al., 2002). In the present study, a Nutri-Score alike privacy score will be presented to participants as an indicator of privacy risks. Calculated from the composition of its nutrients, the Nutri-Score is an optional label for food packages to communicate the level of healthiness of different food products ranging from A (highest quality) to E (lowest quality; Julia & Hercberg, 2017). It has been found to be more comprehensible than other food labels that convey more complex information (Egnell et al., 2019) and to affect people’s nutrition choices in the way that healthier food is purchased (Julia & Hercberg, 2017). Previous studies have shown that users can benefit from nutrition labels in the field of online privacy as well by finding relevant information more easily which increases the quality of their choices (e.g., Kelley et al., 2010). Kelley et al. (2010), however, used rather detailed labels that contained quite a lot of information and may again lead to effort in extracting the information. Hence, we adopt an approach that should ideally not require extra costs but can still provide necessary information. Displaying the situational level of privacy, the privacy score should positively affect people’s perception of privacy risks. Moreover, there is empirical evidence that in an environment of little privacy, the perception of self-disclosure benefits is reduced (see Meier et al., 2020). This leads to the assumption that the privacy score can decrease participants’ perception of benefits. Finally, the privacy score may also directly affect people’s self-disclosure intention. The following hypothesis is derived:
Hypothesis 5 (H5): An increasing (i.e., worsening) privacy score will (a) positively affect privacy risk perception, (b) negatively affect benefit perception, and (c) negatively affect self-disclosure intention.
A question that arises from investigating the privacy score is whether people perceive such a decision-making aid to be helpful or unnecessary. Being more precise, it will be examined for which types of decision-makers such decision-making aids might be more useful. We argued that privacy risks are less salient for intuitive privacy decision-makers (see Ostendorf et al., 2020). Hence, providing them with information about the level of privacy risks might be particularly helpful for this user group. However, because we are not aware of research following similar questions, we derive this research question:
Research Question 3 (RQ3): Will the intuitive or the rational privacy decision-making style be related to the perceived effectiveness of the privacy score?
Resignation
Besides trait-like variables such as dispositional decision-making forms, attitudes are likely to affect privacy decision mechanisms as well. Some researchers have proposed that individuals who are especially aware of increasingly eroding online privacy for commercial purposes (West, 2019; Zuboff, 2019) fall into a state of uncertainty, mistrust, and powerlessness and finally resign to manage their online privacy (Hoffmann et al., 2016; Lutz et al., 2020). The researchers assume that these negative feelings which they call privacy cynicism work like a coping mechanism to handle concerns or perceptions of privacy threats while continuing sharing personal data to receive various benefits. Recently, Lutz et al. (2020) showed that privacy concerns were negatively related to privacy resignation (a sub-facet of privacy cynicism) and those who had resigned engaged in less privacy protection. Besides reduced active privacy protection, it may also be that persons who have resigned to manage their privacy are less affected by risk-based cues like the privacy score. Resigned persons may therefore not follow behavioral suggestions or risk cues because they perceive more cautious privacy behaviors to be pointless. It is assumed that privacy cynicism negatively moderates the positive effect on privacy protective attempts (Hoffmann et al., 2016). Likewise, cynicism or its sub-facet resignation may negatively moderate the effects of the privacy score on perceived privacy risks, perceived benefits, and self-disclosure intentions. Because there is no empirical research following these arguments, research questions are formulated:
Research Question 4 (RQ4): Will privacy resignation moderate the positive relationship between the privacy score and privacy risk perception?
Research Question 5 (RQ5): Will privacy resignation moderate the negative relationship between the privacy score and (a) benefit perception as well as (b) self-disclosure intention?
Method
Preregistration
The study idea, design plan, a-priori power analysis, hypotheses, and research questions were preregistered on the OSF-platform (osf.io). Because we had not settled on a specific analysis method when we preregistered the study, the differentiation of between- and within-person relationships is lacking in the preregistered hypotheses as this came up later. Also, we loosely stated to analyze the results using structural equation modeling, but we decided for the multilevel approach instead which constitutes a deviation from the preregistration. Finally, we changed the formulations of some hypotheses and research questions to be more precise. The originally preregistered hypotheses and research questions can be viewed here: https://osf.io/v3zxt.
Power Analysis and Sample Size
A power analysis was conducted considering a smallest effect size of interest (SESOI; Lakens, 2014). Because we used a multilevel approach, there are two different power levels. We used the between-person relations to define the smallest sample size setting the SESOI to β = |.15| based on previous findings (Bol et al., 2018; Krasnova et al., 2010). This results in a chance of 91% to detect this effect size given the 485 participants. On the within-person level, effect sizes are often smaller than at the between-level. Hence, we used a SESOI of β = |.1| for the within relations resulting in a power of 97% due to the 1,455 observations (485 participants rated three situations). It is important to note that these power estimates are approximations rather than exact power levels.
Procedure
In this within-person experiment, participants were instructed to test a new browser tool called privacy score. They were told that this tool would automatically read a website’s privacy policy, match it with their personal settings, and display the personalized score of the website. By claiming that the score was customized, we aimed to make the meaning of the score more valuable and less abstract for respondents. Participants were then asked to indicate some privacy preferences to make the scenario more realistic. These preferences were oriented toward frequently applied user tracking mechanisms (most of which can be found when accepting or rejecting cookies on websites), and practices like information processing and dissemination (e.g., “A Website may . . . set cookies” or “. . . allow search engines to observe and analyze my behavior”). A full list of the items can be seen in the Supplemental Material. Participants had the options to choose never (1) or always (4) on a four-point scale. Most participants had very strict preferences (M = 1.7, SD = 0.5). The privacy score was a reduced version of the Nutri-Score, consisting of three instead of five letters and colors. The current study’s score comprised letters A to C, using a traffic light’s colors. A (green) was the best category, indicating that the website respects nearly all preferences of the user. The middle category B (yellow) was explained to coincide with some of participants’ settings but not with others. C (red) was described to hardly match any of one’s preferences. The privacy score is included in the main analysis and treated as a quasi-metric variable (A = 1, B = 2, and C = 3). After explaining the privacy score to participants, they were asked to put themselves in the position of three different situations. In each situation, a different kind of website and a random privacy score was displayed. Participants were asked to indicate the perceived benefits, privacy risks, and self-disclosure intention after each of the three situations. At first, a news website that allows for personalized content was presented while participants were asked to envision being motivated to enhance their knowledge in an area of their interest. Then, an e-health website was shown, and participants should think of having a mild cold. Finally, participants should imagine to be looking for a new smartphone on an e-commerce website. These three contexts and the respective scenarios were oriented toward those used in a study of Bol et al. (2018). To enhance the perceived realism, we decided to include self-made pictures of the respective websites. The stimulus material and scenarios can be seen in the Supplemental Material (https://osf.io/9cx2a/).
Sample
The study was conducted in Germany. We collected data of 506 German-speaking respondents via different social media channels, surveycircle.com (i.e., a website on which surveys can be distributed in exchange for participation in other surveys), and a panel provider (prolific.co). Participants recruited via the panel provider (n = 202) received a fix incentive while those recruited via the other channels had the chance to participate in a cash lottery (total amount of €150). A total of 21 persons were deleted from the dataset because they finished the study in less than 4 minutes which was considered to be unrealistically fast. Hence, the final sample consisted of 485 participants (281 women, 199 men, and 5 diverse) aged 18 to 67 (M = 27.9, SD = 8.3). Most participants stated to be highly educated (34.2% university entrance qualification, 52.6% university degree) and to be students (59%) or employees (28.7%). The department’s ethics committee expressed no concerns regarding the conduct of the study.
Measures
For all scales, confirmatory factor analyses (CFAs) were performed to test its factorial validity. For the context dependent measures (self-disclosure intention, perceived benefits, and perceived risks), three separated CFAs were calculated. Besides self-disclosure, all scales showed good values of internal consistency (Cronbach’s alpha, McDonald’s omega, and average variance extracted). The CFAs of self-disclosure intention revealed a second order structure with three and four first-order factors, respectively. All items and results of the CFAs can be seen in the Supplemental Material.
Self-disclosure intention
Participants’ intention to disclose personal information was assessed by 10 items partly adapted from Bol et al. (2018) asking for different information types (e.g., full name, sex, financial information, political views, and health issues). Items had to be rated concerning the likelihood of sharing (“How likely is it that you will provide the following information on the website?”) on a 7-point Likert scale (from 1 = very unlikely to 7 = very likely).
Perceived benefits
The perception of disclosure benefits had to be rated using six items (e.g., “By sharing my personal data with the website, I have advantages that I would not have otherwise”) on a 7-point Likert scale from 1 = I do not agree at all to 7 = I totally agree. The items were self-developed to best fit the three different websites.
Perceived privacy risks
Respondents’ perception of privacy risks was assessed with six items (e.g., “I think that this website tracks my Internet activities”) on a 7-point Likert scale from 1 = I do not agree at all to 7 = I totally agree. Again, the items were designed by us to fit the three contexts.
Privacy decision-making style
Five items for a rational (e.g., “I thoroughly evaluate decision alternatives before making a final choice, whether to disclose information about me on the Internet”) and five items for an intuitive (e.g., “When making the decision whether to disclose personal information about me on the Internet, I rely mainly on my gut feelings”) privacy decision-making style were adapted from the scale of Hamilton et al. (2016). Items had to be rated on a 7-point Likert scale ranging from 1 = I do not agree at all to 7 = I totally agree.
Privacy resignation
Five items from the resignation subscale of the privacy-cynicism scale by Lutz et al. (2020) were taken as a measure in the current study. Items (e.g., “It doesn’t make a difference whether I try to protect my personal data online or not”) were rated on a 7-point Likert scale (1 = I do not agree at all to 7 = I totally agree).
Perceived efficacy of the privacy score
To assess participants’ perception of the efficacy of the privacy score, five items partly taken from a study of Meier et al. (2020) were used. Items (e.g., “The privacy score supports me in protecting my privacy”) had to be rated on a 7-point Likert scale from 1 = I do not agree at all to 7 = I totally agree.
Data Analysis
All statistical analyses were run using R (version 3.6.3). The main analyses were performed applying a within-between random effects model (WB-REM; Bell et al., 2019) which constitutes a multilevel approach. A multilevel approach was chosen because in longitudinal data, measurement occasions (level 1) are nested within individuals (level 2). The slopes of the within-person relationships were set to be random because deciding for fixed slopes can lead to misspecified standard errors on the within-person level (Bell et al., 2019). We transformed the dataset to person-period structure (see Finch et al., 2014) and separated between- from within-person variance by calculating each participant’s mean of the repeatedly measured variables over the three situations. These scores were then grand mean centered to receive the between-person variance. Finally, the within-person variance was extracted by computing the deviations of each individual’s personal score in each of the three situations.
For each of the three dependent variables (i.e., self-disclosure intention, benefit perception, and privacy risk perception), one WB-REM was computed. We build the models stepwise to observe changes in coefficients, however, we test hypotheses and research questions with the models excluding exploratory variables. Please note that we also included additional variables in the models that will be reported in the exploratory results. Each of the models was controlled for participants’ age, sex, and education.
Results
Descriptive statistics and zero-order correlations of the between-person level variable’s mean scores can be seen in Table 1. Collapsed scores were used for self-disclosure intention, perceived benefits, and perceived privacy risks. In Table 2, additional within-person zero-order correlations are displayed to show the size of the direct relations.
Between-Person Zero-Order Correlations of the Variables.
Scores are collapsed over all three situations.
No descriptive statistics are reported for the privacy score because it was randomly displayed to participants.
p < .05. **p < .01. ***p < .001.
Within-Person Zero-Order Correlations of the Variables.
Note. For this correlation analysis, the deviations from the individual mean scores were used.
p < .001.
Model 1: Self-Disclosure
In model 1 (see Table 3), self-disclosure intention was used as dependent variable. We used Model 1.3 to evaluate all research questions and hypotheses which includes all preregistered assumptions. Hypothesis 1 predicted that persons who expect greater benefits from self-disclosure than others throughout the three situations would have a higher self-disclosure intention than others. The results revealed a positive relationship on the between-person level (b = 0.45, β = .50, p < .001) supporting H1. H2 assumed that persons who perceive more privacy risks than others in all three situations would have a reduced self-disclosure intention. However, results did not reveal such a relationship (b = −0.06, β = −.05, p = .095). Thus, H2 had to be rejected. This means that, in contrast to the zero-order correlations, the privacy risk perception was not significantly related to self-disclosure when controlled for the other variables in the model. Turning toward the within-person relationships, the third hypothesis argued that when someone perceived higher benefits in one situation compared to the other situations, their self-disclosure intention should be increased. Results supported H3 (b = 0.29, β = .25, p < .001). Contrarily, for privacy risks it was assumed that when a person perceived higher privacy risks in one of the situations than in the others, they would have a reduced self-disclosure intention. Although results revealed a significant negative relationship (b = −0.07, β = −.06, p = .008), this link was too small to be meaningfully interpreted. Hence, H4 had to be rejected. Thus, privacy risks were not related to self-disclosure intentions on the within-subject level when the effects were controlled for the other variables in the model, although a direct relationship was seen in the correlation table. In the fifth hypothesis, a negative effect of the privacy score on participants’ self-disclosure intention was predicted. Indeed, a negative relationship was uncovered (b = −0.17, β = −.12, p = .005). This relationship is above the within-level SESOI, which is why H5c is considered as supported. Hence, the higher the situational privacy score was, the lower participants’ intention to disclose information was. Finally, research question 5 aimed at investigating a moderating effect of privacy resignation on the negative effect of the privacy score on participants’ self-disclosure intention. However, no such moderating effect was found (b = 0.01, β < .01, p = .877) which is why RQ5b was rejected. Hence, the privacy score had a similar effect on self-disclosure among resigned and non-resigned participants.
Within-Between Random Effects Model Predicting Self-Disclosure Intention.
Note. Model 1.3 was used to evaluate the hypotheses and RQs in order not to bias the results by the exploratory variables. In Model 1.4, exploratory variables are integrated.
Model 2: Perceived Benefits
Model 2 used participants’ perception of self-disclosure benefits as the dependent variable and can be seen in Table 4. To evaluate the hypotheses, we used Model 2.2 that includes only the preregistered hypotheses and research questions. Research question 2 followed up on the matter of whether people who identify themselves as intuitive privacy decision-makers would perceive higher or lower benefits. The results revealed a positive relationship (b = 0.15, β = .12, p < .001) that, however, fell below the between-person SESOI. Hence, there was no support for RQ2 indicating that intuitive decision-makers did not perceive meaningfully higher benefits than non-intuitive decision-makers. In hypothesis 5, a negative effect of the privacy score on participants’ benefit perception was hypothesized which was also revealed by the findings (b = −0.50, β = −.26, p < .001). Consequently, H5b was confirmed showing that participants’ perception of a situation’s benefits was affected by the displayed level of privacy. Finally, the question of a moderating effect of privacy resignation on the effect of the privacy score on benefit perception was pursued in RQ5. Results revealed a significant positive moderating effect (b = 0.06, β = .04, p = .001) that, however, was too small to be meaningfully interpretable. Hence, RQ5a was rejected implying that the privacy score had a similar effect among both resigned and non-resigned participants.
Within-Between Random Effects Model Predicting Benefit Perception.
Note. Model 2.2 was used to evaluate the hypotheses and RQs in order not to bias the results by the exploratory variables. In Model 2.3, exploratory variables are integrated.
Model 3: Perceived Privacy Risks
In model 3 (see Table 5), perceived privacy risks were the dependent variable. Again, we used the model that included all preregistered RQs and hypotheses (i.e., Model 3.2). First, in research question 1 we were interested in a relationship of a rational privacy decision-making style and the perception of privacy risks. Indeed, a positive relationship was found (b = 0.20, β = .20, p < .001) supporting the assumption of RQ1. Consequently, those who said to make more rational choices compared to others also perceived higher privacy risks. Next, H5a argued that the privacy score would positively affect participants’ perception of privacy risks in each situation. This assumption was confirmed by the results (b = 0.71, β = .43, p < .001) showing that when someone saw a higher privacy score their perception of risks to their privacy was increased. Finally, it was asked whether privacy resignation was moderating the positive effect of the privacy score on privacy risk perception (RQ4). The results did not reveal such a moderating effect (b = 0.03, β = .02, p = .064). Thus, RQ4 was not supported. Again, this means that the privacy score worked equally irrespective of resignation.
Within-Between Random Effects Model Predicting Privacy Risk Perception.
Note. Model 3.2 was used to evaluate the hypotheses and RQs in order not to bias the results by the exploratory variables. In Model 3.3, exploratory variables are integrated.
Privacy Score Effectiveness
Research question 3 asked whether rational or intuitive privacy decision-makers would rate the privacy score as more effective. Results of the zero-order correlations (see Table 1) showed that there was no relation for rational decision style (r = −.06, p = .209) while there was a small positive correlation (r = .22, p < .001) for the intuitive style. It follows that persons who tend to make intuitive self-disclosure decisions rated the score to be especially helpful.
Exploratory Data Analyses
While analyzing the data, we observed that benefit and risk-perceptions were significantly related to each other and to self-disclosure in correlational analyses, but in the model, only benefits were significantly related to self-disclosure. Moreover, rational and intuitive decision-making styles as well as resignation were significantly related to disclosure intentions on a bivariate level. Thus, in addition to the preregistered hypotheses and research questions, we analyzed further relationships by integrating additional variables in the models. We integrated these explorative variables in the last step of the models while using the second last step to evaluate the results to observe changes in the parameters and to avoid affecting the preregistered assumptions. In model 1.4, the rational and intuitive privacy decision-making style and privacy resignation were integrated. However, we found no significant relations (see Table 3). Hence, neither the decision-making styles nor privacy resignation were significantly related to participants’ self-disclosure intention. In model 2.3, privacy risks were integrated on both the between- and the within-person level. As can be seen in Table 4, the between-person results showed that participants who perceived higher privacy risks than others had a reduced perception of benefits (b = −0.26, β = −.17, p < .001). Persons who perceived higher privacy risks in one of the situations compared to the other situations had a reduced benefit perception, too (b = −0.38, β = −.22, p < .001). Hence, there were negative associations between risk and benefit perceptions on both between- and within-levels. In model 3.3, benefit perception was integrated as a further variable. On the between-person level, results revealed a negative relationship (b = −0.13, β = −.12, p < .001) that, however, fell below the between-level SESOI. Hence, persons who perceived higher benefits than others in all situations did not necessarily perceive less privacy risks. Contrarily, on the within-subject level, a negative relationship was found: someone who perceived higher benefits in one of the situations in comparison to the other situations had a lower privacy risk perception (b = −0.25, β = −.23, p < .001).
Discussion
The present article pursued the objectives of investigating the inner-psychological process of the privacy calculus, to associate the approach with potentially influencing factors, and to test a possible privacy decision-making aid in the form of a privacy score. Therefore, participants were asked to imagine three different self-disclosure situations and indicate their self-disclosure intention as well as risk and benefit perceptions. The findings of this study contribute to the debate about the privacy calculus and add to the understanding of online privacy decision-making especially on the within-person level.
Privacy Calculus
One of the major aims of the present article was to investigate the privacy calculus approach by separating between- from within-subject relations. Although several studies showed that the perception of benefits is associated with an increase in self-disclosure (intention) and the perception of privacy risks is linked to a decreased self-disclosure (intention; Bol et al., 2018; Dienlin & Metzger, 2016; Krasnova et al., 2010; Meier et al., 2020, 2021), these studies did not separate between- from within-person relations. However, it is important to understand whether people’s online privacy decisions are the result of fixed rules or whether self-disclosure is determined by a situationally varying privacy calculus.
The results of the current study showed that both participants’ benefit and risk perceptions were significantly related to their intention to self-disclose on both the between- and the within-person level in the zero-order correlations. However, analyzing the variables together in one model, revealed that the relationship between participants’ perceived privacy risks and their self-disclosure intention was no longer significant as they were controlled for perceived benefits, the privacy score, and the interaction of the privacy score and resignation. This means that generally perceiving higher self-disclosure benefits than others (between-level) and temporarily perceiving higher self-disclosure benefits than in other situations (within-level) was positively associated with the intention to reveal personal information to one of the websites in order to (hypothetically) receive these benefits. However, neither the general perception of privacy risks in comparison to other participants nor the temporal risk perception in comparison to other situations was significantly related to self-disclosure intention (when controlling for perceived benefits, the privacy score, and the interaction of the privacy score and resignation). Consequently, the findings of the multilevel model seem to contradict the logic of the privacy calculus (Culnan & Armstrong, 1999). However, there are a few observations that must be considered when interpreting these results. First, the zero-order correlations show direct negative relationships between perceived risks and self-disclosure on both the between and within-person level. Second, the exploratory analyses revealed that risk and benefit perceptions are not independent of each other but are negatively related. Hence, the influence of privacy risks might also be visible in the reduced size of the relationship between participants’ benefit perception and self-disclosure intention in the model as compared to the correlations. Third, it must be stated that the current study found externally induced privacy risks (by means of the privacy score) to work similarly compared to privacy risk perceptions. Together, these points imply that both perceiving more privacy risks than others and perceiving more risks in one of the situations was negatively related to self-disclosure intentions, but these relations may have been concealed by the other variables in the model (e.g., the privacy score and perceived benefits). Hence, we must acknowledge that the analysis method may have considerably shaped the results.
Another observation is that the effect size of the relation between perceiving benefits and self-disclosure is larger than the effect size between the induced privacy risks and self-disclosure, although privacy risks have been indicated by a privacy score. This score may have the advantage of being more accurate than normal privacy perceptions that are often biased (Meier et al., 2020) due to the fact that most privacy threats are abstract and invisible (Masur, 2018). Therefore, although privacy risks were made salient to users, the expectation of benefits from self-disclosure still seems to be more important to predict self-disclosure than the perception of privacy risks. This can be explained by the assumption that users favor immediate gratifications over avoiding uncertain future risks or that even when privacy risks are made salient, they are still too obscure and intangible for people to be reasonably integrated into a decision (Masur, 2018; Ostendorf et al., 2020). However, combining the non-significant relation between privacy risks and disclosure and the significant effect of the privacy score on self-disclosure moves the effect size closer to the effect size of the benefit perception and disclosure. This may be seen as an indicator that the influence of both risk and benefit perceptions might be much more balanced when risks are indicated by some kind of cue than when no cue is present.
In the exploratory analyses, negative relations between benefit and privacy risk perceptions were found both on the between- and the within-level. This finding may be an implication that perceptions of risks and benefits are not independent of each other but negatively related. This argument was already put forth by Dinev and Hart (2006) who assumed that certain beliefs could outweigh privacy risk perceptions. Previous studies also found negative associations of risk and benefit perceptions (Bol et al., 2018; Krasnova et al., 2010) and privacy-friendly websites were perceived to be more beneficial compared to privacy-intrusive ones (Meier et al., 2020). The findings of the present study indicate that the risk and benefit perceptions of the same person seem to affect each other in one situation such as that a high perception of benefits is unlikely to be accompanied by a high perception of privacy risks and vice versa. Consequently, the findings of the current study provide evidence that benefit perceptions and risk perceptions can reduce or outweigh each other both on the between- and the within-subject level.
Unlike in other studies that addressed contextual effects (e.g., Bol et al., 2018; Meier et al., 2021), the present study used different contexts (i.e., websites) to create variations in participants’ perception of self-disclosure benefits. To induce situationally different levels of privacy risks, the privacy score was used. With this approach, we aimed to create within-person variance in perceptions and behavioral intentions. The choice for the three contexts of news, health, and commerce was based on the study of Bol et al. (2018) who did not find the general privacy calculus mechanisms to differ in these three contexts. Hence, although those contexts are associated with different positive and negative consequences, the weighing of risks and benefits seems to work similarly in each context. The present study now expands the findings by Bol et al. (2018) by showing that persons who perceive higher benefits in one of these contexts as compared to the other contexts are willing to disclose more data, and that persons who perceived higher privacy risks based on the privacy score were less inclined to disclose information in this specific context. This means that each time people find themselves in a new situation or context, they make a new calculation by weighing the benefits and (induced) privacy risks and coming to different conclusions about how much information they should disclose.
In summary, the key findings of the present study mainly concern the situational within-person perspective in contrast to previous studies that focused on the (accumulated) between-level. It was shown that people’s situational self-disclosure decisions seem to be primarily driven by their momentary perception of potential positive effects that are associated with disclosure. However, people also take into account currently perceived potential negative consequences for their privacy when they consider sharing data online. Here, they seem to benefit from external risk indicators like the investigated privacy score that seems to work similarly to someone’s normal privacy risk perception with the advantage of being able to unbiasedly show privacy risks. This means that when someone’s perception of disclosure benefits or (induced) privacy risks changes from one situation to another, their intention to disclose personal data changes as well. The study is one of the first showing that people have different behavioral intentions in distinct situations in relation to differences in their perceptions of privacy risks and disclosure benefits.
Privacy Decision-Making Styles
Besides the internal psychological mechanisms of the privacy calculus, the present study investigated whether decision-making styles would affect risk and benefit perceptions. The results revealed that the rational decision-making tendency was positively related to the perception of privacy risks. Contrarily, the intuitive privacy decision-making style was not related to the perception of self-disclosure benefits (the significant positive relationship was too small to be of interest). These findings imply that primarily cognitively driven privacy decisions are characterized by a high awareness for potential privacy threats. Moreover, the results contradict the argumentation of Ostendorf et al. (2020) who stated that especially intuitive decision-makers may tend to primarily perceive gratifications which increases the chance to make intuitive choices. It may, however, be that especially intuitive privacy decision-makers were affected by the privacy score because they may normally have a rather low privacy risk awareness. A second explanation includes a notion of Hamilton et al. (2016) stating that persons with a higher intuitive decision-making tendency can be both rational and irrational decision-makers. Hence, it could be that the group of intuitive privacy decision-makers is heterogenous in itself so that, for instance, some intuitive privacy decision-makers spontaneously react to anticipated advantages of self-disclosure whereas others rather rapidly respond to perceived privacy risks. These assumptions, however, should be addressed by future studies in more detail as there is empirical evidence that impulsivity can lead to benefit-sensitivity and increased disclosure (Ostendorf et al., 2020). Rational decision-makers, in contrast, seem to think longer about the advantages and disadvantages of information sharing which can lead to a pronounced awareness of privacy risks. Thus, the results are in line with findings of Dienlin et al. (2020) who showed that persons who make deliberate privacy choices have more privacy concerns. The explorative analyses showed that neither the rational nor the intuitive decision style were directly related to self-disclosure intentions.
Resignation
Moreover, it was suggested that people who have resigned to manage their online privacy would be less affected by the induced privacy level. However, this was not the case. Privacy resignation did not moderate the effects of the privacy score on disclosure intention, perceived risks, or perceived benefits. Hence, it may be that people who believe that privacy protective attempts are pointless (Draper & Turow, 2019; Lutz et al., 2020) can still positively benefit from external privacy risk cues that may subsequently affect their online privacy decisions. In the explorative analyses, no relationship between resignation and participants’ intention to disclose personal information was found.
Privacy Score
Several studies found that people’s benefit and privacy risk perceptions are imbalanced (e.g., Bol et al., 2018; Dienlin et al., 2020; Meier et al., 2021). Hence, it is an important task to find ways how to reduce this mismatch in people’s perceptions so that they become more aware of the potential negative consequences of their privacy choices online. In the current work, an approach called privacy score was used which—like a nutrition score—shows different letters and colors that imply different privacy levels. Generally, the privacy score directly affected people’s self-disclosure intention as well as their perception of self-disclosure benefits and privacy risks on the within-person level. Thus, risk-based approaches like a privacy score or privacy icons seem to be effective in transporting potential threats to Internet users (see also Efroni et al., 2019). By means of such decision-making aids, users may make more informed choices and consider privacy threats to a higher extent when they decide about disclosing personal information (see also Kelley et al., 2010). Participants who reported to normally make intuitive privacy decisions found the score to be more effective than others as can be seen in the correlational analyses. Hence, this user group may benefit most from decision-making aids as they might not be as capable as rational privacy decision-makers to realistically judge existing privacy risks. In our opinion, actual privacy scores should be more graduated (e.g., like the Nutri-Score) than in the present study to have more variability. However, the present study’s results indicate that such decision aids are a good supplement supporting users in their privacy decisions as they raise awareness of privacy risks and could lead to more thoughtful privacy behaviors. Because we made the privacy score pretty salient to participants in the current study, future studies should also examine whether people even notice such scores at all when they are not explicitly told about them.
Limitations
It is important to consider the study’s limitations when interpreting its findings. Some results may be biased by the experimental design. First, a scenario-based approach was chosen which is known for having high internal but low external validity. Second, there may be spillover effects by the order the websites were presented in. This was done because we had not settled on a specific analysis approach when the study was conducted and did not want to compromise the chance to choose particular statistical options. Also, the list of privacy preferences presented to participants in the beginning of the study may have disadvantaged persons who have low privacy literacy. Future studies should pretest such items for comprehensibility among a larger audience. Further issues comprise that the decision-making styles are based on self-reports. Future studies should think about using implicit methods (e.g., experimental paradigms) to examine privacy choices more realistically. Another issue concerns the interpretation of the effect sizes that may not be comparable to studies that use long time intervals between the measurement points. Future investigations should study these within-person relations also among longer periods of time (e.g., 6 months). Moreover, the between-person SESOI (Lakens, 2014) that was chosen for the association between privacy risks and self-disclosure may have been too high (i.e., β = |.15|). Future studies may consider using smaller SESOIs (β = |.1|) which would, however, require researchers to collect very large samples (N > 1,000) in order to achieve sufficient power. Another limitation is that the results of the present study are based on a convenience sample, which means that sex, age, and education are skewed and may have affected the results. Finally, self-disclosure intention but not actual self-disclosure behavior was assessed. Hence, observing real behavior in non-hypothetical situations might be targeted by future studies.
Conclusion
The present study extended previous research on the privacy calculus by separating between- from within-person relations. The results showed that privacy risk perceptions were negatively, and benefit perceptions positively associated with self-disclosure intentions both generally between different individuals and situationally within one person. When all variables were investigated together in one model, participants’ privacy risk perceptions were found to be no longer related to participants’ disclosure intentions. This implies that the relationship has been concealed by other variables such as perceived benefits and the privacy score. This supporting tool seems to have somehow replaced participants’ risk perceptions while decreasing both their disclosure intentions as well as benefit perceptions and increasing their awareness for privacy risks. Hence, decision-making aids can support users in their privacy calculus decisions by emphasizing potential privacy threats in a realistic way. Exploratory analyses showed that risk and benefit perceptions were negatively related to each other on the within-subject level which may be comparable to a weighing process in which risk and benefit perceptions potentially override each other. This can also explain the insignificant relation between privacy risks and self-disclosure when multiple relations are investigated at once. Still, although perceiving privacy risks may reduce the effect of benefits on disclosure, the size of the relation between benefit perception and disclosure is larger than the relation between induced risks and disclosure although the privacy score brings these relations closer together. Consequently, the weighing process is unlikely to be completely rational and is probably affected by biases and heuristics which underlines the immense importance of supportive privacy tools. Results also pointed to interindividual differences in the weighing process: participants’ tendency of making rational privacy choices was positively related to their risk perception. Persons who self-disclose based on intuition found the privacy score to be more effective. This indicates that miscellaneous user groups may differ from one another in how they make online privacy choices and would differently benefit from supportive measures. Nevertheless, although the results of the present study indicate that privacy tools can be helpful and that privacy risk perceptions can override benefit perceptions, Internet users’ possibilities for self-protection are very limited, which is why better legal and technical measures are urgently needed to stop the further erosion of personal privacy.
Footnotes
Declaration of Conflicting Interests
The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.
Funding
The author(s) disclosed receipt of the following financial support for the research, authorship, and/or publication of this article: This work has been funded by the German Federal Ministry of Education and Research (Funding number: 16KIS0743).
