Abstract
Internet and Communication Technologies (ICTs) can foster efficient communication and knowledge acquisition, but there are also tradeoffs in terms of risks to one’s privacy. Previous research, including work with the privacy calculus framework, indicates that factors such as perceived risks and benefits of using ICTs, ICT trust, and general privacy concerns can influence individuals’ digital privacy-related decisions. One pervasive psychological factor that may potentially alter such privacy-related behaviors is acute stress. Acute stress can promote risk-seeking behaviors and a tendency to prefer immediate rewards over delayed, greater value rewards. However, the effect of acute stress in the applied context of privacy decision making is relatively unknown. Participants (N = 143) in this study were randomly assigned to either an acute stress task (socially evaluated cold pressor task) or an active control task (lukewarm water alone). Results revealed that acute stress condition increased information disclosure, as indexed by accepting more online cookies, sharing one’s location more frequently, and revealing greater willingness to self-disclose personal information. In addition, the impact of individuals’ levels of perceived risk and benefits, trust, and privacy concern on privacy decision making was examined. However, none of these constructs consistently influenced privacy decisions over and above the effect of stress. Overall, our findings suggest that acute stress has robust, independent influence on privacy decision making.
Introduction
The pandemic ignited numerous societal changes, including a parallel rise in social media use and stress. Indeed, in 2023, the average American spent 2.5 hours daily on social networking sites (SNSs), 1 with over 50% reporting frequent stress. 2 Acute stress can distort risk perception, 3 potentially diminishing the perceived risks of information sharing. Despite its pervasiveness, the impact of stress on privacy decisions in SNS contexts remains largely unexplored. This study aims to empirically bridge this gap and examine how acute stress interacts with factors like privacy concern and trust in SNS providers on privacy decision making.
Theories of privacy decision making
According to privacy calculus theory, individual’s information disclosure is based on a privacy risk-disclosure benefit trade-off. 4 When users perceive the benefits of SNS information disclosure as higher than the perceived risks to one’s privacy, they tend to disclose more information and vice versa.4,5 Trust in SNS providers reduces the impact of perceived risk on disclosure willingness,5,6 whereas privacy concern decreases information disclosure.7–9
The Elaboration Likelihood Model (ELM) also provides insight into how users make digital privacy decisions. The ELM proposes two distinct decision-making routes: the central route, characterized by thorough cognitive processing and logical evaluation of available rational risk–benefit calculations, and peripheral, relying on heuristic cues, past experiences, and emotions (Wang et al., 2020).10–12 The central route aligns with privacy calculus theory. However, in instances where cognitive resources are limited, the peripheral route assumes prominence (Gu et al., 2017).12–14 Although such heuristic-based decisions can save time and effort, they can also lead to unfavorable outcomes from unintended privacy data disclosure. 10
Acute stress and decision making
Acute stress is a rapid, short-lived physiological response to demanding situations, triggered by hypothalamic-pituitary-adrenal (HPA) axis activation.15–18 Studies indicate that acute stress increases risk-taking behaviors for potential gains while reducing sensitivity to losses.3,19 Consequently, it may negatively affect risk–benefit trade-offs in decision making, potentially leading to increased risky privacy decisions.
Current study and hypotheses
Based on previous research,3,7,20,21 we propose the following hypotheses:
Acute stress will lead to riskier privacy decisions, increasing location sharing (H1a), cookie acceptance (H1b), default privacy setting acceptance (H1c), and intention to disclose information (H1d) compared with the control. Lower perceived risk will correlate with more frequent location sharing (H2a), accepting all cookies (H2b), accepting default privacy settings (H2c), and willingness to disclose information (H2d). Lower perceived benefits will result in decreased frequency of location sharing (H3a), online cookie acceptance (H3b), acceptance of default privacy settings (H3c), and willingness to disclose information (H3d). Greater trust will be associated with increased location sharing (H4a), online cookie acceptance (H4b), acceptance of default privacy settings (H4c), and willingness to disclose information in SNS (H4d). Higher privacy concern will lead to decreased location sharing (H5a), online cookie acceptance (H5b), acceptance of default privacy settings (H5c), and willingness to disclose information in SNS (H5d).
Ancillary hypotheses for two-way interaction effects are presented in the supplementary materials.
Method
Participants
An a priori power analysis showed that 98 participants would be needed to have 80% power. We sought to collect 25% more participants to account for outliers or exclusions. The final sample included 143 participants (Table 1).
Demographics Information
SD, standard deviation.
Experimental manipulation
Acute stress induction
The Socially Evaluated Cold-Pressor Task (SECPT), which is widely used to activate the HPA axis, 18 was utilized to induce a moderate acute stress response. 22 Peak stress-induced HPA axis activation is achieved 15–40 minutes after initial activation. 23
In the SECPT, participants submerged their right hand in 0–4°C ice water for up to 3 minutes, recorded on camera. Those lasting less than a minute were excluded. Participants were informed that their expressions would be analyzed from the video, though no footage was saved.
Control condition
Individuals submerged their hand in lukewarm water (36–40°C) for 3 minutes and were not subjected to the video recording manipulation.
Salivary cortisol assessment
Salivary cortisol was collected, following the procedure in Schwabe et al., 2008 18 ; see supplementary materials.
Questionnaire measures for individual differences variables
We included scales for perceived risk (Internet Users’ Information Privacy Concern [IUIPC]), 24 perceived benefits,20,25 trust,26,27 and privacy concern (Internet Privacy Scale). 28 Questionnaire details are in the supplementary materials.
Privacy decision-making outcome measures
Privacy decisions were administered through a simulated SNS called Clemgram (https://clemgram.web.app/), designed specifically for this study. Participants were informed that the study aimed to improve a new social media platform for students at this specific university. They created a Clemgram account, set-up their profile (Figure 1A), and made a sensitive post about their opinion on a political controversy (Figure 1B). They then navigated the site, viewing ads, customizing cookie settings, and indicating their location-sharing preferences (Figure 1C).

Default privacy setting management
Participants on Clemgram were presented a default post visibility setting of “Anyone can see,” with the option to change it to “Close friends only.” 29
Acceptance of online cookies
Participants navigated three simulated webpages in Clemgram and made decisions on whether to “Customize” or “Accept All Cookies.”30–32
Location sharing
Individuals were asked to enable or disable location sharing for three simulated webpages. 33
Information disclosure
Participants indicated their willingness to disclose personal information across three dimensions (money, personality, and body) on Clemgram, using a three-point scale, drawing from the Jourard 60-Item Self-Disclosure Inventory. 34
Procedure
Participants refrained from eating or drinking for 1 hour before arriving to the lab. After providing written consent, they acclimated for 3 minutes to the lab environment to reduce heart rate, 21 completed demographics and questionnaires via Qualtrics, and provided their first salivary cortisol sample. Participants were then randomly assigned to an experimental condition and performed the SECPT. An anagram task was administered to allow cortisol levels to rise before providing a second sample. Participants then created a “Clemgram” account, completed privacy decision-making measures, and were debriefed. Figure 2 shows the procedure overview.

Procedure flow, task order, and time duration. The acclimation period serves to allow participants time to adjust to the lab environment and decrease their heart rate and autonomic activity from their previous activities (e.g., walking to the lab) before their lab session (Wemm & Wulfert, 2017). Participants completed questionnaires, provided cortisol samples, and were then randomized to either an acute stress (socially evaluated cold pressor task) or control (warm water) induction. Participants then completed a simulated SNS called “Clemgram” in which they needed to make a series of privacy decisions, including managing default settings (“Anyone can see” vs. “Close friends only”) for posting, location sharing, acceptance of online cookies, and information disclosure preferences. As part of the SNS navigation, they viewed three ads and decided whether or not to share their location and accept cookies for that company’s webpage. The simulation ended with participants answering questions about the type of information they wished to disclose on Clemgram. The study ended by debriefing participants.
Results
Table 2 shows descriptive statistics. Full regression results for each structural equation model (SEM) are in Table 3, with detailed path coefficients in Figure 3. An exploratory analysis assessed if individual differences factors influence privacy behaviors differently in control and acute stress groups 1 . Four multigroup SEMs were constructed, presented in supplemental materials for conciseness and clarity (see Supplementary Tables S2–S5).

Detailed path coefficient for SEM. Note: For each privacy outcome measure, we ran a separate model; ns, nonsignificant; *p < 0.05; **p < 0.01; ***p < 0.001. SEM, structural equation model
Descriptive Statistics
Note: Perceived risk was assessed by the risk beliefs subscale of Internet Users’ Information Privacy Concern (IUIPC; Malhotra et al., 2004); privacy concern was measured by the sub-questionnaire of the internet privacy scale (Buchanan et al., 2006). Self-disclosure was measured using three subscales of The Jourard 60-Item Self-Disclosure Inventory (Jourard & Lasakow, 1958).
Model Fit Statistics and Regression Results for Each Structural Equation Model
CFI, comparative fit index; RMSEA, root-mean-squared error of approximation; SEM, structural equation model; TLI, Tucker-Lewis index.
Cortisol results
Cortisol increased from baseline to postexperimental manipulation, p = 0.047, suggesting effective acute stress induction (details in supplementary materials).
Confirmatory factor analysis (CFA)
A CFA was conducted to assess construct validity and reliability. The model has a good fit: χ2 (689) = 1265.55, p < 0.001; root-mean-squared error of approximation (RMSEA) = 0.077; comparative fit index (CFI) = 0.972; Tucker-Lewis index (TLI) = 0.970. Supplementary Table S1 displays factor correlations, Table 4 presents the details of CFA, and Table 5 shows second-order factor measurement.
Confirmatory Factor Analysis
Note: Items that are labeled (*r) mean reverse coded.
AVE, average variance extracted; SNS, social networking site.
Second-Order Factor Measurement
The impact of acute stress and individual differences on privacy decision making
The SEM results for location sharing indicated that higher perceived benefits, lower perceived risk, and acute stress were associated with greater frequency of location sharing on Clemgram, which support hypotheses H1a–H3a, but not H4a and H5a.
Next, the model for online cookie acceptance showed that frequency of accepting online cookies was significantly higher in the acute stress compared with control condition. No other pathways were significant. Thus, H1b was supported, whereas H2b through H5b were not.
Default setting management was dummy coded as “0” (stay with default) and “1” (change default). Higher perceived risk and lower trust predicted an increased likelihood of changing the default setting from “everyone can see the post” to “only close friends can see the post,” which supports H2c and H4c, but not H1c, H3c, or H5c.
Finally, the self-disclosure model revealed that only acute stress significantly impacted intention to disclose private information. Therefore, H1d was supported, but H2d–H5d were not.
Discussion
This study found that acute stress increases location sharing, acceptance of online cookies, and personal information disclosure (H1a, b, and d), but not privacy default setting management (H1c) in simulated SNS contexts relative to controls. Acute stress may promote reliance on the ELM’s peripheral route processing.10,11 People often accept digital privacy defaults owing to heuristic effects. 35 Similarly, our study observed that acute stress prompts more decisions favoring data tracking and information sharing on simulated SNSs.
On the simulated SNS, higher perceived benefits and lower risks increased location sharing. Lower perceived risks and higher trust were linked to changing default privacy settings for sensitive content. However, there was no direct impact of risks, benefits, privacy concerns, or trust on other privacy outcomes, partially supporting H2–H5. This could be owing to users’ unfamiliarity with the simulated SNS “Clemgram.” Past studies primarily examined well-known platforms like WeChat and Facebook.8,9 Users may weigh privacy calculus factors, trust, and privacy concern differently on highly familiar, real-world SNSs than a novel simulated SNS.
As a potential mechanism, stress can impair working memory, leading to greater reliance on heuristics and increasing cognitive load.36,37 Alternatively, stress may induce decision fatigue, hindering risk–benefit assessment and resulting in less privacy-conscious decisions and avoidance of effortful privacy decisions.38–40 Future research could explore mediators elucidating how stress impacts privacy-related decisions.
Limitations and future directions
We note that methodological limitations in using a simulated SNS, SECPT stress manipulation, and cross-sectional design may impact external validity and generalizability. Results might not fully apply to real-world SNSs, which involve real social connections, 41 or technology-specific stressors, such as simulating a computer virus or spam messages. Moreover, future longitudinal work is needed to elucidate whether the impact of stress on privacy behaviors fluctuates over time. Future research may investigate whether the study findings apply to other online contexts, including more advanced digital environments like virtual reality, which offer unique social interactions and information-sharing opportunities.
Moreover, examining individual differences in privacy knowledge, awareness of online privacy issues, past experience with privacy violations, and personality traits42,43 were outside the study scope but may impact privacy behavior. These factors may mitigate susceptibility to the effects of stress when disclosing information. Collectively, future studies could explore how these additional individual differences interact with stress in influencing privacy decision making. Furthermore, the participants, primarily college students, were homogenous in age and level of education, and future work should aim to replicate the study with a more diverse demographic.
Conclusions and practical implications
To the best of our knowledge, this is the first study to investigate the impact of acute stress on privacy decisions, yet such decisions frequently occur in real-life situations. Acute stress increased willingness to disclose privacy information on a simulated SNS platform and led users to ignore their privacy attitudes. Consequently, acute stress increases risky decisions in digital privacy contexts and puts individuals at greater risk for cybersecurity issues.
The current findings may elicit beneficial guidelines for intervention that incorporate stress-adaptive digital privacy support. Digital platforms could utilize real-time monitoring to detect stress-related behaviors, such as time spent reading privacy consents. If users quickly choose “Accept all cookies” without reading the policy, the system could dynamically adjust the setting to ensure privacy, such as opting out unnecessary cookies by defaults. Policymakers could also integrate stress considerations into privacy regulations to ensure they are effective, such as mandatory stress-aware privacy checks, periodic self-reported stress assessments, and provision of stress management resources. By implementing design strategies that reduce stress-related impacts on privacy decisions, organizations can promote a safer and more privacy-conscious online environment.
Footnotes
References
Supplementary Material
Please find the following supplemental material available below.
For Open Access articles published under a Creative Commons License, all supplemental material carries the same license as the article it is associated with.
For non-Open Access articles published, all supplemental material carries a non-exclusive license, and permission requests for re-use of supplemental material or any part of supplemental material shall be sent directly to the copyright owner as specified in the copyright notice associated with the article.
