A longitudinal examination of Internet users’ privacy protection behaviors in relation to their perceived collective value of privacy and individual privacy concerns

Abstract

People’s perception of privacy can primarily be directed to themselves or to the value of privacy for society. Likewise, privacy protection can repel both individual and collective privacy threats. Focusing on this distinction, the present article examines Internet users’ privacy protection behaviors in relation to individual privacy concerns and their perceived collective value of privacy over time. We conducted a longitudinal panel study with three measurement points (N = 1790) to investigate relations between and within persons. The results of a random-intercept cross-lagged panel model revealed positive relations between the perceived value of privacy, privacy concerns, and privacy protection between persons. At the within-person level, only a temporal increase in the perceived value of privacy was related to increased protection behaviors. This suggests that individual privacy concerns are not as important for temporal protection as assumed, but that a recognition of collective privacy may temporarily change people’s privacy behavior.

Keywords

Collective value of privacy individual privacy concerns privacy protection random-intercept cross-lagged panel model within-person relations

The Internet has not only brought great facilitations for people’s daily lives, but also heavily impacted every person’s privacy. Constantly, massive amounts of personal data are collected and generated by websites, companies, or governments which are then processed by big data techniques. This handling of sensitive personal information can lead to delicate privacy violations because it provides third parties with the power to draw highly intimate inferences about individuals (e.g. Reece and Danforth, 2017). In addition, there is a growing understanding that privacy threats are not solely the result of individual decisions. Research indicates that privacy threats have become a collective rather than an individual concern (Baruh and Popescu, 2017; Bazarova and Masur, 2020; Ochs, 2018) because big data techniques enable predictions about individuals who have not even actively disclosed data (Bagrow et al., 2019; Matzner, 2014). Bagrow et al. (2019) showed that they can predict Twitter users’ future posts with a higher accuracy the more social ties they integrated into their analyses. This means that the actions of one person affect others—not only for the worse, but also for the better. Due to this networked nature of online privacy both the sharing of data and the protection of privacy relate to the individual as well as the collective. The current study will focus on people’s perception of these two dimensions of individual and collective privacy from a longitudinal perspective. A previous work found that social media users who either focused on their personal privacy in the first place or who thought that privacy is a general right of everybody engaged in higher privacy protective efforts (Baruh and Cemalcılar, 2014). The present study will expand this view from social media onto Internet users in general by considering people’s privacy orientation to their own person (i.e. individual privacy concerns) and to privacy as a societal necessity (i.e. the perceived collective value of privacy) in relation to their privacy protection behaviors.

In general, privacy behaviors have been described as dynamic regulations meaning that people adjust their behaviors as their motivations or perceptions change (Altman, 1976). Recent studies point to such temporary adjustments when self-disclosing personal information (Dienlin et al., 2021) and adopting mobile applications (Meier et al., 2022). However, most previous studies that investigated privacy protection used cross-sectional designs and thus cannot make statements about these temporary adjustments (e.g. Boerman et al., 2021; Büchi et al., 2017; Meier et al., 2020). Hence, this study will examine both the between-person relations (e.g. do people who have higher privacy concerns than others protect their privacy better?) and the within-person relations and effects (e.g. does someone who currently has higher privacy concerns protect their privacy better than usual?) to make statements about such temporal changes. In sum, the present study will contribute to the general understanding of online privacy protection and related perceptions by analyzing data of a large representative sample across three waves of measurement and separating between- from within-person relations.

Theoretical background

Online privacy protection

Whereas the revelation of certain personal information (e.g. to use a website or app) is often indispensable, users still do not have to passively tolerate all privacy interferences but can apply protective measures to shield at least some of these threats (Büchi et al., 2017; Matzner et al., 2016). Users can adopt strategies such as not using certain services, withdrawal of information, or using additional software (Matzner et al., 2016; Son and Kim, 2008). Studying why Internet users engage in different self-protective behaviors is essential, for instance, to detect obstacles for individuals or to further promote and support protective efforts (see Krämer and Schäwel, 2020). Especially investigating why users change their protection behaviors at certain time points is crucial for this understanding. Empirical studies investigating this issue, however, seem to be lacking. Previous cross-sectional investigations indicate that online privacy protective behaviors are complex and affected by numerous factors. For instance, it has been shown that people are more likely than others to protect their online privacy when they have high privacy literacy (i.e. protection knowledge and skills; Baruh et al., 2017; Büchi et al., 2017); that they take more protective actions than others when they perceive or are concerned about threats to their privacy (Baruh et al., 2017; Boerman et al., 2021; Dienlin and Metzger, 2016; Meier et al., 2020); that people with a higher desire for privacy protection than others are more motivated to engage in self-protection (Meier et al., 2021); and that people will shield privacy risks more than others when they think that a protective behavior is effective (Boerman et al., 2021; Meier et al., 2020). Contrarily, people who have a high privacy cynicism, or resignation have a lower motivation than others to apply protective attempts as they perceive privacy protection to be pointless (Lutz et al., 2020). Together, these studies provide a comprehensive picture of factors why some people protect their privacy more than others. However, all of those studies focused on factors that are directed toward the own person and they lack evidence about temporal fluctuations in privacy protection and related determinants within individuals. Hence, there is a need to investigate privacy perceptions that are not only focusing on the self and to scrutinize the within-person level.

Adjusting privacy protection over time

Altman (1976) described privacy as a dynamic process of boundary regulation. People are assumed to adjust their privacy when one’s personal motivations or perceptions change. Whereas this notion originally focused on interpersonal communication, recent within-person studies indicate that people’s online privacy behaviors seem to follow similar dynamics (Dienlin et al., 2021; Masur and Trepte, 2021; Meier and Krämer, 2022; Meier et al., 2022). For instance, Dienlin et al. (2021) found that people’s momentary self-disclosure behaviors shift along with changes in attitudes and privacy concerns. Meier et al. (2022) showed that individuals’ decision to use a Covid-19 contact tracing app at a certain time was a dynamic choice related to people’s perception of benefits, privacy concerns, and privacy knowledge. The authors concluded that people continually reevaluate their personal perceptions and attitudes and adjust privacy behaviors accordingly. Hence, it seems that people’s attitudes, motivations, and perceptions change over time which leads to dynamic adjustments in their privacy behaviors. So far, however, there appears to be a lack of studies that focused on temporary adjustments regarding people’s privacy protection behaviors, that is, decisions to take more protective measures than before or to forgo protective measures. Therefore, the present work makes an attempt to study both the between-person relations (i.e. relations based on variance between persons) and the within-person relations (i.e. relations based on variance between time points) of people’s privacy protection behaviors by adopting a bipartite perspective in people’s privacy perception as both an individual concern but also a collective value. This perspective is derived in the following.

Individual and collective privacy

Privacy has both crucial individual and collective values (Baruh and Popescu, 2017; Regan, 2002). On the individual side, for instance, privacy is important for a proper psychological development and functioning (Kupfer, 1987; Margulis, 2003). On the collective side, privacy is the foundation of democratic processes like developing autonomous opinions or realizing fundamental rights such as freedom of speech (Margulis, 2003; Regan, 2002). Likewise, there are both individual (e.g. intrusions into one’s decisional autonomy) (Susser et al., 2019) and collective privacy threats (manipulation of societal clusters sharing a specific characteristic) (Mantelero, 2017). Algorithms work on the basis of huge amounts of collected and aggregated information while being able to make predictions about someone about whom no or only very little data may be available (see Matzner, 2014). These predictions become more accurate the more information about one’s social connections is available (Bagrow et al., 2019). This means that privacy protection is not only an individual matter, but also a collective concern (see Baruh and Popescu, 2017). People are not solely responsible to protect their personal privacy, but they also contribute to the protection of others. Hence, it is worthwhile to examine whether people are aware of both individual and collective privacy aspects and whether this is also evident in their efforts to engage in privacy protection. We want to emphasize that people are not exclusively focused on either individual or collective privacy dimensions, but they can have a high sense of both at the same time.

So far, only few theoretical and empirical works indicate that people do not solely focus on their own privacy (e.g. Baruh and Cemalcılar, 2014; Bazarova and Masur, 2020; Masur, 2020; Moll and Pieschl, 2016). Moll and Pieschl (2016), for instance, introduced a concept they called “trust in collective privacy.” According to this approach, people rely on the huge amounts of data available on the Internet which they believe conceals their own information. This naïve form of trust in the collective can apparently increase self-disclosure and may hinder people from privacy protection (Moll and Pieschl, 2016). Baruh and Cemalcılar (2014) investigated a distinct form of collective privacy perception. They found that Facebook users who believed in privacy as a right of everyone protected their privacy as high as persons who were primarily concerned for their own privacy. Hence, it seems that different perceptions of collective privacy can be related to either reduced protective efforts (Moll and Pieschl, 2016) or increased privacy protection (Baruh and Cemalcılar, 2014). The present work takes up this topic again by investigating Internet user’s attributed value of privacy (i.e. thinking that privacy is important for and a right of everyone) as a measure of the collective dimension and their privacy concerns (i.e. worrying about personal privacy invasions) at the individual level in association with their privacy protection behaviors. Moreover, these relations will be investigated at both the between- and the within-person level to observe potential temporal dynamics. The two constructs and the between-within separation will be described below in more detail.

Individual privacy concerns between persons

Relations between privacy concerns and protective behaviors are largely investigated based on between-person differences. Privacy concerns have been described as a negatively connoted affective attitude (Dienlin and Trepte, 2015). Typically, privacy concerns are understood as people’s worries about the access of companies, governments, and other persons to one’s personal data, which may lead to intrusions into individual privacy. Hence, privacy concerns are focused on potential negative future consequences for oneself. Generally, people’s individual privacy cost perceptions and individual concerns for their own privacy appear to be a reliable predictor of protective and cautious privacy intentions and behaviors (e.g. Baruh et al., 2017; Boerman et al., 2021; Dienlin and Metzger, 2016; Meier et al., 2020). Taken together, these studies (including a meta-analysis) show that individuals who are generally more concerned about their personal privacy when using the Internet are also more likely to take protective measures than those who are less concerned (Baruh et al., 2017; Dienlin and Metzger, 2016; Lutz et al., 2020). Hence, the following hypothesis is derived.

Hypothesis 1 (H1). Persons who have higher individual privacy concerns than others will engage in more privacy protection.

Individual privacy concerns within persons

Concerning within-person associations of privacy concerns and protective behaviors there appears to be no empirical evidence so far. Recent studies indicate that deviations from people’s “normal” level of privacy concernedness occur which are related to privacy behaviors (Dienlin et al., 2021; Masur and Trepte, 2021; Meier et al., 2022). One incident that has been found to temporarily raise privacy concerns are prior personal experiences of privacy violations (Masur and Trepte, 2021). A situational increase in privacy concerns can, in turn, lead to reduced information sharing behavior at one point of time (Dienlin et al., 2021) or to a temporally reduced likelihood to use a tracing app (Meier et al., 2022). However, it remains an open question whether people who temporarily experience an increase (or decrease) in privacy concerns also engage in more (or less) safeguarding behaviors at this point in time. When someone, for instance, experiences a privacy breach or watches a media report about little online privacy, their concernedness for privacy risks may temporarily increase. The critical question is whether this person then starts to protect their privacy to a greater extent. We posit the following hypothesis:

Hypothesis 2 (H2). Persons who have higher individual privacy concerns than expected¹ will engage in more privacy protection than expected.

Perceived collective value of privacy between persons

As outlined earlier, people’s perception of and attitudes toward privacy do not necessarily relate exclusively to personal matters, but people can also focus on aspects of collective privacy (Baruh and Cemalcılar, 2014; Bazarova and Masur, 2020; Masur, 2020; Moll and Pieschl, 2016). Whereas most studies in this field focused on self-oriented privacy concerns and attitudes, few studies investigated collective privacy orientations on social media (e.g. Baruh and Cemalcılar, 2014; Jia and Xu, 2016). One study found that Facebook users whose privacy attitudes were primarily directed toward the general importance of and right to privacy of everyone engaged in high privacy protection efforts (Baruh and Cemalcılar, 2014). This indicates that a prerequisite for a high engagement in protective efforts may not only be an awareness of possible negative future consequences for oneself, but also an acknowledgment of privacy as a fundamental collective value. Generally, people attribute a certain value to privacy (Rössler, 2018) which could apply to both individual and collective privacy dimensions. In the current study, we define the personally perceived collective or societal value that people place on privacy, as a subjective belief that privacy is important and a right to everyone. Such a belief may form as a result of socialization, personal experiences, social norms, or as Masur (2020) assumes, basic knowledge about individual and collective online privacy threats.

It is conceivable that people who think that privacy is indispensable to everyone, also believe that privacy is important for themselves, and they may feel concerned for their own privacy as well as the privacy of others (Jia and Xu, 2016). The study of Baruh and Cemalcılar (2014) supports the idea by revealing a positive correlation between individual privacy concerns and thinking that privacy is a right to everyone. Hence, it can be assumed that persons who generally attribute a higher collective value to privacy than others will also have a higher awareness for individual privacy threats which would be expressed by increased privacy concerns.

Hypothesis 3 (H3). Persons who perceive a higher collective value of privacy than others will have higher individual privacy concerns.

Protecting one’s data is in the first place viewed as a means to protect against individual privacy threats. However, as data and persons are networked online, and individual privacy invasions can occur due to the aggregated data of (unknown) others (Bagrow et al., 2019; Matzner, 2014), individual protection should also protect others and others’ protection should protect the individual (see also Regan, 2002). People who perceive a high collective value of privacy and who are aware of this networked nature of privacy may then engage in even higher privacy protective efforts than persons who are basically concerned for themselves because the former ones might also feel responsible for others. For Facebook users, this assumption was supported by the study of Baruh and Cemalcılar (2014) showing that persons who believed that privacy is a right to everyone engaged in higher privacy protective efforts on the social networking site. However, as the networked nature of privacy is probably less visible outside of social networking sites, this assumption must be tested among Internet users in general. Therefore, the following hypothesis is derived:

Hypothesis 4 (H4). Persons who perceive a higher collective value of privacy than others will engage in more privacy protection.

Perceived collective value of privacy within persons

As a personally held belief, the perceived collective value of privacy should be rather stable over time. However, although attitude-like variables unlike, for instance, emotions have a rather high stability across different situations, they can still be formed temporarily (Albarracín et al., 2005). Hence, attitudes and beliefs may be subject to changes over time, too, but probably not as strong as emotions or situational perceptions. People’s perceived value of privacy may change, for instance, when one learns about collective privacy threats (Mantelero, 2017) or potentials (Masur, 2020). This raises the question how a temporary change in people’s perceived value of privacy is related to their individual privacy concerns and their privacy protection behaviors at this point in time. For instance, it may be possible that a person who attributes a higher value to everyone’s privacy than normally is also increasingly willing to protect their personal privacy. Because we are not aware of any former studies that investigated similar notions at the within-person level, we hypothesize the same directions as at the between-person level:

Hypothesis 5 (H5). Persons who perceive a higher collective value of privacy than expected will have higher individual privacy concerns than expected.

Hypothesis 6 (H6). Persons who perceive a higher collective value of privacy than expected will engage in more privacy protection than expected.

Longitudinal effects

As the current study includes data of three measurement points, we are able to investigate whether the constructs predict themselves (i.e. autoregressive effects) and each other (i.e. cross-lagged effects) across the measurement points. The three time points are each 6 months apart which is a common interval in privacy research (Dienlin et al., 2021; Masur and Trepte, 2021). However, there is very little empirical evidence on within-person longitudinal effects. Dienlin et al. (2021) did not find any long-term effects of privacy concerns, privacy attitudes, or self-disclosure across 6 months at the within-person level. In the studies of Masur and Trepte (2021) and Meier et al. (2022), no longitudinal effects were tested. Hence, we can only speculate about potential longitudinal effects. It is, for example, conceivable that a person who perceives higher privacy concerns than expected, does not immediately engage in more privacy protection but only slowly starts to build more awareness and increasingly protects their privacy after 6 months². Contrarily, it is also possible that someone who engages in greater privacy protection efforts will have decreasing privacy concerns because of a higher sense of safety. Because there appear to be no prior empirical findings for the within-person relations of the measures used in this study, research questions are formulated:

Research question 1 (RQ1). Will persons who have higher or lower individual privacy concerns than expected (a) perceive a higher or lower value of privacy, (b) engage in more or less privacy protection, and (c) have higher or lower individual privacy concerns than expected after 6 months?

Research question 2 (RQ2). Will persons who engage in more or less privacy protection than expected (a) perceive a higher or lower value of privacy, (b) engage in more or less privacy protection, and (c) have higher or lower individual privacy concerns than expected after 6 months?

Research question 3 (RQ3). Will persons who perceive a higher or lower collective value of privacy than expected (a) perceive a higher or lower collective value of privacy, (b) engage in more or less privacy protection, and (c) have higher or lower individual privacy concerns than expected after 6 months?

Method

Sample

The present study uses a dataset that is part of a large three-wave panel study and was conducted through a professional panel provider. Respondents either participated in an online survey or were interviewed by telephone. The three waves were surveyed at 6-month intervals from October 2018 to November 2019. The sample is representative for the German population aged 16 years and above and includes data of 1887 persons who participated in all three waves. Ninety-seven persons had to be excluded from the current analyses being non-Internet users³. Hence, the final sample consisted of 1790 participants (922 females, 867 males, 1 other) aged 16–86 years (M = 49.38, SD = 15.65). Most participants were employees having a full time (n = 691) or part-time job (n = 248). The second largest group were pensioners (n = 387) followed by homemakers and unemployed persons (n = 153). The conduct of the study was approved by the department’s ethics committee.

Measures

Below, the measures that were used in the analyses are listed. Prior to the main analyses, confirmatory factor analyses (CFAs) of the value of privacy and privacy concerns were conducted to control for one-dimensionality. Both scales, however, revealed multi-dimensionality in subsequent exploratory factor analyses (EFAs). EFA results and items can be seen online: https://osf.io/t8j4u/. CFA results are depicted in Table 1. In Figure 1, the distributions of the variables are depicted (diagonal).

Table 1.

Results of the confirmatory factor analyses and reliability values (Cronbach’s α, McDonald’s ω, and average variance extracted).

	χ² (df)	p	CFI	TLI	RMSEA	SRMR	α	Ω	AVE
Privacy concerns W1	225.00 (19)	<.001	.97	.96	.08	.04	.85	.90	.63
Privacy concerns W2	178.35 (19)	<.001	.98	.97	.07	.04	.85	.90	.62
Privacy concerns W3	216.25 (19)	<.001	.97	.96	.08	.04	.86	.91	.64
Value of privacy W1	128.72 (24)	<.001	.97	.95	.05	.03	.76	.85	.52
Value of privacy W2	173.32 (24)	<.001	.95	.93	.06	.03	.76	.84	.52
Value of privacy W3	188.98 (24)	<.001	.96	.93	.06	.04	.77	.86	.54

CFI: comparative fit index; TLI: Tucker–Lewis index; RMSEA: root mean square error of approximation; SRMR: standardized root mean square residual; AVE: average variance extracted.

Figure 1.

Zero-order correlations of the measured constructs for all three measurement points.

Value of privacy

The perceived collective value of privacy was measured with 11 items that were developed by Trepte and Masur (2015). A 5-point Likert-type scale was used (ranging from 1 = do not agree at all to 5 = fully agree). An example is “privacy is an important property that deserves to be defended.” Factor analyses revealed a four-dimensional solution excluding two items. For the analyses, the factor score of the whole construct was used which showed good reliability (see Table 1).

Online privacy protection

Twelve items asked whether respondents have made use of certain online privacy protection measures in the last 6 months. Items contained various protection strategies like using additional tools, restricting one’s behavior, deleting cookies, and increasing anonymity using fake information. The possible answers were no (= 0) and yes (= 1). A sum score was calculated that ranged from 0 (indicating no privacy protection) to 12 (indicating high privacy protection).

Privacy concerns

Participants’ privacy concerns were assessed by eight items covering concerns for privacy threats that stem from organizations (e.g. “Organizations analyze my data in order to influence me specifically regarding my opinions”) and other Internet users (e.g. “Other people on the Internet use my private information (e.g., photos) to harm me”). Participants were asked how worried they are about each privacy threat on a 5-point Likert-type scale ranging from 1 = not at all worried to 5 = very worried. The factor analyses showed that the scale is two-dimensional, divided into an organizational and a social axis. Again, the overall factor score was used in the analyses that revealed good reliability (see Table 1).

Power analysis, smallest effect size of interest, and alpha level

We conducted a power analysis using R to determine the likelihood to detect effects of a certain size. We strove for balanced alpha and beta levels to have equally likely chances to accept an effect that is not existent in the population and to miss an existing one. To identify the beta level, we decided to determine a smallest effect size of interest (SESOI; Lakens, 2014) simultaneously aiming a power of at least 95%. Baruh and Cemalcılar (2014) found significant relationships between privacy concerns and privacy as a right and protective efforts on Facebook to be as small as r = .084. Hence, we set our SESOI to r = .|08| which results in a chance of 95.5% to detect an effect of that size given the 1790 participants. The alpha level was accordingly adjusted to 4.5% (i.e. p ⩽ .045). Note that this analysis reflects approximate rather than exact power.

Analysis

All statistical analyses were performed with R (version 4.1.0). We uploaded the dataset and the script to the OSF. A random intercepts cross-lagged panel model (RI-CLPM; Hamaker et al., 2015) was chosen as the central method of analysis. In contrast to traditional cross-lagged panel models, RI-CLPMs have the advantage of separating between- from within-person variance by including random intercepts. Hence, it unveils stable between-person relations across all times of measurement and within-person relations at the measurement points based on participant’s within-person deviations from their own means. Moreover, the autoregressive and cross-lagged effects represent within-person processes. The model was analyzed using factor scores, controlled for participants’ age, sex, and education, and follows code provided by Mund and Nestler (2019).

Since the sample contained missing data, the respective cases were inspected in the first place: 1629 cases contained complete data, among 138 cases around 1% of the data were missing, and 23 cases had more than 2% missing data (the highest value of missing data was around 9%). Because data seemed to be missing at random, missing data were imputed using the predictive mean matching method.

Results

As already reported above, we tested the hypotheses using a RI-CLPM (Hamaker et al., 2015) with factor scores while controlling for participants’ age, sex, and education. Participants’ age was positively related to their perceived value of privacy (β = .15 to .16, p < .001) but negatively to their amount of privacy protection (β = −.23 to −.27, p < .001). Male participants were found to adopt more privacy protective measures than females (β = .20 to .23, p < .001). The model produced an excellent fit: χ²(21) = 37.75, p = .014, χ²/df = 1.80, comparative fit index (CFI) = 1.00, Tucker–Lewis index (TLI) = 1.00, root mean square error of approximation (RMSEA) = .02 (90% confidence interval [CI] = [0.01, 0.03]), standardized root mean square residual [SRMR] = .01. Zero-order correlations can be seen in Figure 1 and the results of the RI-CLPM are shown in Table 2.

Table 2.

Results of the RI-CLPM with factor scores and control variables.

Label	Assumption	RI-CLPM with control variables
		B	SE_B	p	CI_B	β
	Between-person relations
H1	Privacy Concerns ↔ Privacy Protection	0.23	0.03	< .001	0.17 to 0.28	.26
H3	Value of Privacy ↔ Privacy Concerns	0.12	0.01	< .001	0.10 to 0.14	.44
H4	Value of Privacy ↔ Privacy Protection	0.26	0.02	< .001	0.22 to 0.31	.33
	Within-person relations (W1)
H2	Privacy Concerns ↔ Privacy Protection	0.04	0.02	.048	0.00 to 0.07	.07
H5	Value of Privacy ↔ Privacy Concerns	0.02	0.00	< .001	0.02 to 0.03	.28
H6	Value of Privacy ↔ Privacy Protection	0.03	0.01	.005	0.01 to 0.04	.12
	Within-person effects over 6 months
RQ1a	Privacy Concerns → Value of Privacy	−0.05	0.02	.001	−0.09 to −0.02	−.12
RQ1b	Privacy Concerns → Privacy Protection	0.10	0.10	.323	−0.09 to 0.28	.03 to .04
RQ1c	Privacy Concerns → Privacy Concerns	0.16	0.06	.005	0.05 to 0.27	.16 to .17
RQ2a	Privacy Protection → Value of Privacy	0.00	0.01	.618	−0.01 to 0.01	.01 to .02
RQ2b	Privacy Protection → Privacy Protection	0.01	0.05	.849	−0.10 to 0.12	.01
RQ2c	Privacy Protection → Privacy Concerns	0.01	0.01	.621	−0.02 to 0.03	.02
RQ3a	Value of Privacy → Value of Privacy	0.38	0.07	< .001	0.24 to 0.52	.36 to .42
RQ3b	Value of Privacy → Privacy Protection	0.12	0.25	.638	−0.37 to 0.61	.02
RQ3c	Value of Privacy → Privacy Concerns	−0.11	0.10	.264	−0.30 to 0.08	−.05

RI-CLPM: random intercepts cross-lagged panel model; SE: standard error; CI: 95% confidence interval.

The within-person relations (H2, H5, and H6) are based on the results of the first measurement wave. We have uploaded a figure that shows the results of all three waves (https://osf.io/t8j4u/). Please note that there were no considerable differences between the three waves, and only the sizes of the relations vary slightly.

Between-person relations

First, the results of hypotheses H1, H3, and H4 will be reported focusing on the relations at the between-person level. H1 predicted that persons who are more concerned for their privacy than others would engage in more privacy protective efforts. The results confirmed this assumption (β = .26, p < .001). The third hypothesis (H3) assumed that persons who perceive a higher societal value of privacy than others would be more concerned for their own privacy. This assumption was also supported by the data (β = .44, p < .001). Finally, H4 suggested that those who value collective privacy more than others engage in more individual online privacy protection. Again, the hypothesis was supported (β = .33, p < .001).

Within-person relations

Next, hypotheses H2, H5, and H6 were scrutinized by considering the relations of the within-person deviations from one’s personal mean in the first wave. The second hypothesis (H2) assumed that someone who has temporally increased individual privacy concerns would have a temporally heightened privacy protection behavior. The results revealed a small positive effect that was, however, both non-significant and fell below the SESOI (β = .07, p = .048). Hence, H2 must be rejected. H5 hypothesized a positive relation between privacy concerns and participants’ perceived collective value of privacy. Indeed, the results showed that when someone perceived a higher societal value of privacy than at the other measurement points their individual privacy concerns were heightened, too (β = .28, p < .001), supporting H5. Finally, hypothesis H6 asked whether a person who temporally perceives a higher value of privacy than at other times engages in more privacy protection at this measurement point. Results confirmed H6 (β = .12, p = .005).

Longitudinal within-person effects

Research questions RQ1–RQ3 focused on the auto-regressive and cross-lagged within-person effects in the model. Due to conciseness, we only report significant results in the text. Please see Table 2 for the complete overview of the longitudinal effects. RQ1a that asked whether someone who has a temporal change in their privacy concerns would have a temporal change in their perceived value of privacy 6 months later yielded a significant result. A person who perceived higher privacy concerns at one point of time perceived a decreased collective value of privacy after half a year (β = −.12, p = .001). The next significant result was found among RQ1c that asked whether there would be a significant auto-regressive effect among participants’ privacy concerns. Someone who had higher privacy concerns than expected, was more likely to have increased privacy concerns after 6 months (β = .16 to.17, p = .005). Finally, results yielded a significant auto-regressive effect for participants’ value of privacy (RQ3a). A person who had an increased perception of the societal value of privacy still had an increase in this perception after half a year (β = .36 to .42, p < .001).

Exploratory analysis

Besides testing the hypotheses and research questions, we exploratively analyzed the assessed protective measures for commonalities by means of an EFA (see OSF for all details). The 12 protective measures build five categories: deletion of traces (e.g. deletion of cookies), self-restriction (e.g. non-use of certain services), usage of additional tools (e.g. use of anti-tracking software), concealment of identity (e.g. registered with a pseudo-name), and deletion requests (asked service provider to delete information). These categories fit to previously identified actions such as active, passive, and legal strategies (Matzner et al., 2016) and refusal to provide information, misrepresentation, and removal of information (Son and Kim, 2008).

Discussion

While researchers point to the crucial distinction between individual and collective privacy (Baruh and Popescu, 2017; Bazarova and Masur, 2020; Ochs, 2018), there appears to be a deficiency in the number of empirical studies examining people’s perception of such a distinction. The present longitudinal study had the objective of examining Internet users’ orientation toward individual privacy concerns and their personal beliefs about the collective value of privacy in relation to their privacy protection behaviors at both between- and within-person levels to make statements about temporal adjustments of people’s privacy behaviors (Altman, 1976). This work makes an important contribution, first, by providing more empirical data about people’s perception of collective and individual privacy and, second, by examining temporal changes in their protective efforts.

Individual privacy orientation: privacy concerns

A vast number of studies have investigated people’s concernedness for their personal information due to using Internet technologies. People who are concerned for their own privacy have been found to engage in more privacy protection strategies compared with those who are less concerned (Baruh et al., 2017; Dienlin and Metzger, 2016; Lutz et al., 2020). This means that discomfort in the face of data collection practices applied by many websites and companies is accompanied by an increased care to keep personal data protected. The between-person results of this study point to the same connection: participants who were more concerned for their individual privacy than others over all three measurement points engaged in more protection strategies than others. This relation, however, was not found at the within-person level. Those who perceived higher privacy concerns at one of the occasions in comparison to their personal average did not automatically engage in higher protection at this measurement point. This observation indicates that enhanced privacy concerns are not associated with an immediate increase in protection behaviors. Hence, privacy concerns may not be as reliable an explanation for temporal within-person changes in people’s protection behavior as the between-person results indicate. As future studies may further scrutinize the exact role of individual privacy concerns for protection behaviors, we can speculate about possible reasons. Being a form of affective attitude (Dienlin and Trepte, 2015), privacy concerns could fluctuate rather often and fast, but protection behaviors may only slowly adapt. However, Dienlin et al. (2021) found that current changes in one’s privacy concerns were negatively associated with temporal self-disclosure. Thus, it seems that some forms of protective behaviors are related to situational privacy concerns, whereas others might not. Another explanation is that the relation between privacy concerns and protection is not causal, but that privacy concerns and protective efforts increase together with other variables like privacy literacy (Baruh et al., 2017; Büchi et al., 2017), perceived effectiveness of protection efforts (Boerman et al., 2021; Meier et al., 2020), a desire for more privacy protection (Meier et al., 2021), or protection self-efficacy⁴ (Dienlin and Metzger, 2016). Hence, it may be that a temporal fluctuation of privacy concerns does not instantly lead to changes in one’s protection behavior but that other factors need to change, too. Future studies could pick up on this issue.

At this point we must make an important remark. The decision to reject the relation between privacy concerns and protection was based on our choice of a SESOI of β = .|08| (see Lakens, 2014) and a power level of at least 95%. A lower statistical power (e.g. 90%) combined with a smaller SESOI could have led to the acceptance of this relation. Hence, it is very important to develop better benchmarks of when an effect size is too small to theoretically and practically matter. Therefore, we must reject this relation based on the decisions we have made, however, some uncertainty regarding this relation remains and it may be that there are very small relations between individual privacy concerns and privacy protection within persons.

Collective privacy orientation: value of privacy

Privacy and its protection are not only an individual but also a collective concern (Bazarova and Masur, 2020; Ochs, 2018; Regan, 2002). Information collected about others can be used to make predictions even about someone about whom no data are available (Bagrow et al., 2019; Matzner, 2014). Thus, protecting one’s own privacy should not only repel individual but also collective privacy threats, and the more people pursue individual protection the more collective privacy should be safeguarded (Regan, 2002). Hence, we examined whether people’s personal belief that privacy is a fundamental good and basic right to every person would be related to their protective behaviors. The results revealed that Internet users who generally perceive a high collective value of privacy are also more concerned for individual privacy threats and protect their privacy to a higher extent than others. This shows that a general focus on the collective dimension of privacy can also relate to protective behaviors, as opposed to, for instance, a naïve reliance in collective privacy (Moll and Pieschl, 2016). Furthermore, the findings are in line with those of Baruh and Cemalcılar (2014) and imply that many people do not seem to focus on either individual or collective privacy, but that one is likely accompanied by the other. One explanation for this finding is that a higher perception of the collective value of privacy could be the result of an intense consideration with the topic of privacy that leads to an awareness of both individual and collective privacy threats and is accompanied by an increase in skills to protect oneself (i.e. critical privacy literacy; Masur, 2020). Thus, the present study shows that self-protection positively relates to both a focus on individual and collective privacy. Future studies should target further differences between both individual and collective dimensions and could more carefully carve out the unique features of both.

At the within-person level a somewhat different pattern emerged. A person who perceived a higher collective value of privacy at one of the measurement occasions simultaneously had higher privacy concerns and engaged in more privacy protection. These findings are insofar interesting as not the individual privacy orientation—privacy concerns (which are a reliable predictor of protection at the between-person level)—but only the collective privacy orientation was related to self-protection on the within-subject dimension. Hence, it seems that people can develop a holistic view of privacy that encompasses both individual and collective aspects and together with this broadened perspective on privacy, people start to engage in more privacy protective behaviors. Hence, when people think that everyone has a right to privacy, they might also think that they have the right or even the obligation to protect their privacy from online companies that aim to access huge amounts of personal data. In parts, this view on privacy is similar to what Masur (2020) describes as critical privacy literacy. Critical privacy literacy is described as a reflection competence to challenge current data collection traditions and being motivated to take responsibility for social transformation (Masur, 2020). Transferred to the results of this study, this means that a holistic privacy perspective could be associated with specific knowledge, skills, and motivations to protect personal privacy as this also contributes to collective privacy protection. Future studies could especially focus on the reasons why an awareness of the collective value of privacy is related to increased protective behaviors and whether there are relations to critical privacy literacy.

At this point we must note that we are aware of the fact that individual privacy protection is a very limited behavioral approach, and many researchers criticize it as insufficient while demanding more technical and governmental protection at the same time (e.g. Baruh and Popescu, 2017; Ochs, 2018). Hence, it is unrealistic that collective privacy can be achieved by individual privacy protection of many people alone. Rather, desired privacy levels can only be attained when all involved actors recognize and respect its collective dimension (see Baruh and Popescu, 2017).

Implications

The current study found further evidence for the claim that privacy behaviors are dynamic and adjusted when people’s perceptions and motivations change (Altman, 1976) and adds to a growing body of research that found people’s self-disclosure and app-adoption behaviors being the result of temporal and situational changes of perceptions and attitudes (Dienlin et al., 2021; Masur and Trepte, 2021; Meier and Krämer, 2022; Meier et al., 2022). The results showed that people increase their online privacy protection efforts when they adopt a holistic view on privacy (i.e. when they acknowledge that privacy is not only important to themselves but to everyone).

Furthermore, the study found further evidence for people’s orientation to both the individual and collective dimension of privacy (see also Baruh and Cemalcılar, 2014). The results of this work point out that people’s orientation to the two dimensions is not independent of each other since participants who were more concerned for their own privacy were also more likely to perceive a higher collective value of privacy. Similar results were also found by Baruh and Cemalcılar (2014) among Facebook users. This indicates that an awareness of individual and collective privacy may either develop simultaneously or that one is the result of the other. Future studies should build on these findings to examine how such differences in people’s focus on privacy occur.

Generally, the results of the current study can be seen as a basis for both further empirical but also theoretical works. Especially the distinction between collective and individual privacy perceptions is largely absent in the theoretical literature. Hence, there are many open questions, for instance, under which circumstances people either focus on individual or collective privacy or how one’s perspective expands to a holistic view on privacy. Future empirical studies might also elaborate on other determinants of privacy protection at the within-person level. The present study has made a first step in revealing that online privacy protective behaviors can increase temporarily together with people’s perceived collective value of privacy.

From a practical point of view, it appears to be important to raise awareness for the networked nature of privacy and for the fact that online behaviors do not solely affect oneself but have consequences for other individuals too. In this way, people might be additionally motivated to engage in protective efforts. Hence, it might be more useful to teach people about the importance of collective privacy (i.e. focusing on positive privacy; Masur, 2020) rather than focusing on negative individual consequences that might lead to higher privacy concerns but would not necessarily result in increased protective efforts.

Long-term effects

The longitudinal within-person level examines whether the measured constructs predict each other over a period of 6 months (i.e. from Wave 1 to Wave 2 and from Wave 2 to Wave 3). The results revealed three significant long-term effects. First, individuals who were more concerned about their privacy (compared with their personal mean) had lower perceptions of the value of collective privacy after 6 months (compared with their personal mean). Because a temporal increase in privacy concerns may be due to experiences of privacy violations (Masur and Trepte, 2021), it could be that people who feel their individual privacy is compromised begin to think that privacy is not important to others either. This is partly similar to the concept of privacy cynicism, which describes how people who are aware of constant surveillance of personal data eventually feel powerless and no longer care about their privacy (see Lutz et al., 2020). Another way of explaining the finding is that some people become increasingly worried about their own privacy and, as a result, their focus shifts from collective to individual privacy.

Two further observations affect privacy concerns and the value of privacy. Participants who were more concerned about their privacy than expected, were still more concerned after 6 months and persons who perceived a higher value of privacy than expected still did so after half a year. This means that people’s privacy concerns can be increased or decreased (i.e. above or below the individual average level) over long periods of time. Likewise, and even stronger, people’s perceived collective value of privacy can be in- or decreased over periods of 6 months or longer. In future studies, more measurement waves should be assessed to even better estimate people’s individual average level of the variables.

Limitations

Some limitations of the current work must be addressed. The between- and within-person relations of the variables (not the longitudinal effects) are mere correlations. Hence, they reflect bivariate connections, each of which is not controlled for the respective third variable in the model. Moreover, the results of the present study are based on self-reports which is especially critical concerning privacy protection behavior. Assessing actual behavior would solve this problem. Similarly, the degree to which participants protected their online privacy was measured using the sum of all applied measures. However, these measures were not equally protective. For instance, one could adopt more protective methods and drop less protective methods but the resulting score would remain the same. Hence, it was actually only assessed whether people used more or less protective strategies and not whether they were better or worse protected. Moreover, the measures for collective and individual privacy orientation were assessing positive (i.e. a right to privacy) and negative (i.e. privacy concerns) aspects of privacy. Future studies could assess more balanced privacy constructs. Finally, using a sample that is representative of the German population, we cannot rule out cultural effects. The results may be transferrable to other European countries but may be hard to transfer to other nations outside the EU or even cultural areas.

Conclusion

The current article adopted a twofold perspective on people’s privacy orientation either to individual privacy concerns or to their belief that privacy is an important good of everyone. We examined whether differences in this orientation between and within persons would be associated with differences in people’s online privacy protection and whether people dynamically adjust their behaviors over time. Between persons, the results indicate that Internet users who perceive a higher collective value of privacy than others are more concerned for their own privacy and engage in more privacy protection. At the within-person level, only a temporal increase in the perceived collective value of privacy, but not individual privacy concerns, was related to increased privacy protection. These findings indicate that temporal fluctuations in privacy concerns do not motivate or enable people to quickly adapt their protective efforts. Contrarily, developing the belief that privacy is a right and necessary to everyone is associated with an immediate increase in privacy protection. Moreover, the positive relations between privacy concerns and the perceived value of privacy indicate that individual and collective privacy orientations accompany each other, and that people develop a holistic view on privacy that involves personal as well as collective matters. In sum, the findings of the current study contribute to a general understanding why persons temporarily engage in higher protective efforts. In times of increasingly eroding privacy, individual privacy protection remains a very limited remedy to actually shield privacy threats, and while companies as well as governments are urged to find solutions to adequately safeguard user privacy, we find that people still value and care for (collective) privacy.

Footnotes

Declaration of conflicting interests

The author(s) declared no potential conflicts of interest with respect to the research, authorship and/or publication of this article.

Funding

The author(s) disclosed receipt of the following financial support for the research, authorship and/or publication of this article: This work has been funded by the Federal Ministry of Education and Research of Germany (No. 16KIS0743).

Data availability

The dataset, R-script, and items are available under:

ORCID iD

Yannic Meier

Notes

Author biographies

Yannic Meier (PhD, University of Duisburg-Essen) is a postdoctoral researcher in the team Social Psychology: Media and Communication at the University of Duisburg-Essen. His research focuses on psychological aspects of online communication and online privacy management as well as the effects of transparency enhancing cues on privacy perceptions and protection behaviors.

Nicole C. Krämer (PhD, University of Cologne) is a full professor of Social Psychology: Media and Communication at the University of Duisburg-Essen. Her research focuses on social psychological aspects of human-machine-interaction and computer-mediated-communication and processes of information selection, opinion building, and relationship maintenance of online communication.

References

Albarracín

Johnson

Zanna

, et al. (2005) Attitudes: introduction and scope. In: Albarracín

Johnson

Zanna

(eds) The Handbook of Attitudes. Hillsdale, NJ: Lawrence Erlbaum Associates, pp. 3–19.

Altman

(1976) Privacy: a conceptual analysis. Environment and Behavior 8(1): 7–29.

Bagrow

Liu

Mitchell

(2019) Information flow reveals prediction limits in online social activity. Nature Human Behaviour 3(2): 122–128.

Baruh

Cemalcılar

(2014) It is more than personal: development and validation of a multidimensional privacy orientation scale. Personality and Individual Differences 70: 165–170.

Baruh

Popescu

(2017) Big data analytics and the limits of privacy self-management. New Media & Society 19(4): 579–596.

Baruh

Secinti

Cemalcilar

(2017) Online privacy concerns and privacy management: a meta-analytical review. Journal of Communication 67(1): 26–53.

Bazarova

Masur

(2020) Towards an integration of individualistic, networked, and institutional approaches to online disclosure and privacy in a networked ecology. Current Opinion in Psychology 36: 118–123.

Boerman

Kruikemeier

Zuiderveen Borgesius

(2021) Exploring motivations for online privacy protection behavior: insights from panel data. Communication Research 48(7): 1–25.

Büchi

Just

Latzer

(2017) Caring is not enough: the importance of internet skills for online privacy protection. Information, Communication & Society 20(8): 1261–1278.

10.

Dienlin

Metzger

(2016) An extended privacy calculus model for SNSs: analyzing self-disclosure and self-withdrawal in a representative US sample. Journal of Computer-Mediated Communication 21(5): 368–383.

11.

Dienlin

Trepte

(2015) Is the privacy paradox a relic of the past? An in-depth analysis of privacy attitudes and privacy behaviors. European Journal of Social Psychology 45(3): 285–297.

12.

Dienlin

Masur

Trepte

(2021) A longitudinal analysis of the privacy paradox. New Media & Society. Epub ahead of print 4 June. DOI: 10.1177/14614448211016316.

13.

Hamaker

Kuiper

Grasman

RPPP

(2015) A critique of the cross-lagged panel model. Psychological Methods 20(1): 102–116.

14.

Jia

(2016) Measuring individuals’ concerns over collective privacy on social networking sites. Cyberpsychology: Journal of Psychosocial Research on Cyberspace 10(1): 4.

15.

Krämer

Schäwel

(2020) Mastering the challenge of balancing self-disclosure and privacy in social media. Current Opinion in Psychology 31: 67–71.

16.

Kupfer

(1987) Privacy, autonomy, and self-concept. American Philosophical Quarterly 24(1): 81–89.

17.

Lakens

(2014) Performing high-powered studies efficiently with sequential analyses. European Journal of Social Psychology 44(7): 701–710.

18.

Lutz

Hoffmann

Ranzini

(2020) Data capitalism and the user: an exploration of privacy cynicism in Germany. New Media & Society 22(7): 1168–1187.

19.

Mantelero

(2017) From group privacy to collective privacy: towards a new dimension of privacy and data protection in the big data era. In: Taylor

Floridi

Van der Sloot

(eds) Group Privacy: Philosophical Studies Series Vol.126. Cham: Springer, pp. 139–158.

20.

Margulis

(2003) Privacy as a social issue and behavioral concept. Journal of Social Isues 59(2): 243–261.

21.

Masur

(2020) How online privacy literacy supports self-data protection and self-determination in the age of information. Media and Communication 8(2): 258–269.

22.

Masur

Trepte

(2021) Transformative or not? How privacy violation experiences influence online privacy concerns and online information disclosure. Human Communication Research 47(1): 49–74.

23.

Matzner

(2014) Why privacy is not enough privacy in the context of “ubiquitous computing” and “big data.” Journal of Information, Communication and Ethics in Society 12(2): 93–106.

24.

Matzner

Masur

Ochs

, et al. (2016) Do-it-yourself data protection empowerment or burden? In: Gutwirth

Leenes

De Hert

(eds) Data Protection on the Move: Law, Governance and Technology Series Vol.24. Dordrecht: Springer, pp. 277–305.

25.

Meier

Krämer

(2022) The privacy calculus revisited: an empirical investigation of online privacy decisions on between-and within-person levels. Communication Research. Epub ahead of print 16 July. DOI: 10.1177/00936502221102101.

26.

Meier

Meinert

Krämer

(2022) One-time decision or continual adjustment? A longitudinal study of the within-person privacy calculus among users and non-users of a COVID-19 contact tracing app. Media Psychology. Epub ahead of print 26 June. DOI: 10.1080/15213269.2022.2092750.

27.

Meier

Schäwel

Krämer

(2021) Between protection and disclosure: applying the privacy calculus to investigate the intended use of privacy-protecting tools and self-disclosure on different websites. Studies in Communication and Media 10(3): 283–306.

28.

Meier

Schäwel

Kyewski

, et al. (2020) Applying protection motivation theory to predict facebook users’ withdrawal and disclosure intentions. In: Proceedings of the11th international conference on social media and society, Toronto, ON, Canada, 22–24 July, pp. 21–29. New York: ACM.

29.

Moll

Pieschl

(2016) Expecting collective privacy: a new perspective on trust in online communication. In: Blöbaum

(ed.) Trust and Communication in a Digitized World. Cham: Springer, pp. 239–251.

30.

Mund

Nestler

(2019) Beyond the cross-lagged panel model: next-generation statistical tools for analyzing interdependencies across the life course. Advances in Life Course Research 41: 100249.

31.

Ochs

(2018) Self-protection beyond the self: collective privacy practices in (Big) datascapes. In: Sætnan

Schneider

Green

(eds) The Politics of Big Data. London and New York: Routledge, pp. 265–291.

32.

Reece

Danforth

(2017) Instagram photos reveal predictive markers of depression. EPJ Data Science 6(1): 1–12.

33.

Regan

(2002) Privacy as a common good in the digital world. Information, Communication & Society 5(3): 382–405.

34.

Rössler

(2018) The Value of Privacy. Hoboken, NJ: John Wiley & Sons.

35.

Son

Kim

(2008) Internet users’ information privacy-protective responses: a taxonomy and a nomological model. MIS Quarterly 32(3): 503–529.

36.

Susser

Roessler

Nissenbaum

(2019) Technology, autonomy, and manipulation. Internet Policy Review 8(2): 1–22.

37.

Trepte

Masur

(2015) Privatheit im Wandel. Eine repräsentative Umfrage zur Wahrnehmung und Beurteilung von Privatheit (Bericht vom 18. Juni 2015). [Privacy in Transition. A representative survey on the perception and assessment of privacy (report of June 18, 2015)]. University of Hohenheim. Available at: https://medienpsychologie.uni-hohenheim.de/fileadmin/einrichtungen/psych/Dateien/Publikationen/Trepte_Masur_2015_Privatheit_im_Wandel.pdf