Abstract
Privacy concerns may influence many choices consumers make. However, their expressed concerns are sometimes inconsistent with their information-sharing and privacy-protecting behaviors. Many theories have been proposed to explain the paradoxical gap between privacy attitudes and behaviors. Part of the privacy paradox may be explained with two measures that have received limited consideration: impulsiveness and social desirability bias (SDB). Surveys of US adults in 2015 and 2022 included questions to measure several types of privacy concerns along with impulsive tendencies and SDB (N = 2729). Age, education, gender, race, income, and impulsive tendencies were linked with some privacy concerns. If people with above-average concerns also disclose personal information on impulse, it might explain part of the paradox. Large coefficients on the SDB measure suggest that individuals who adjust their responses to be consistent with social norms may also overstate specific privacy concerns. For these individuals, their high expressed concerns may be inconsistent with their privacy behaviors. When researchers try to explain consumer attitudes or actions that involve privacy, multiple privacy concern dimensions should be considered and demographics, impulsive tendencies, and SDB should be included in the models.
Keywords
Many US adults are concerned about their privacy (Newall and Sawyer, 2022). Information collection and other privacy concerns may influence various attitudes and behaviors. Privacy concerns have been linked with interest in buying non-genetically-modified produce and cereal, interest in buying antibiotic-free and humanely-raised meat, support for adding radio frequency identification chips to car license plates, use of shopping lists, and even reactions to product stockouts in stores (Larson, 2018, 2019b, 2020a, 2022; Larson and Ferrin 2023). These relationships suggest that privacy concern measures may help explain many consumer choices.
Early research suggested privacy concerns are multidimensional. A 15-item scale, developed by Smith et al. (1996) and considered one of the most influential and reliable measures (Preibusch, 2013; Smith et al., 2011), divided privacy concerns into four factors: unauthorized secondary use, improper access, collection, and errors. The studies referenced above found that some privacy concern dimensions had different effects. Other research has used smaller scales or single composite measures of privacy concerns. This study argues that treating privacy concerns as one-dimensional may obscure important insights.
Because many people say privacy is important, some individuals may overstate their concerns. A social norm that suggests everyone should be concerned about privacy could cause some subjects to change their answers for impression management (i.e., to give positive impressions to others), self-deception (i.e., to feel better about themselves), or identity definition (Larson, 2019a). This overstatement can create social desirability bias (SDB) and change the relationships between privacy attitudes and various behaviors. However, only a handful of researchers have suggested that SDB could explain part of the gap between privacy attitudes and information-sharing or privacy-protecting behaviors (e.g., Milne, 1997; Norberg et al., 2007; Redmiles et al., 2017). Very few studies have examined this possible relationship.
More than 20 years ago, popular press writers (e.g., Furrow, 2004; Schwartz, 2000; Sweat, 2000), practitioners (e.g., Brown, 2001), and academic researchers (e.g., Dinev and Hart 2006; Radin, 2001) started using the phrase “privacy paradox” to describe the gap between privacy attitudes and privacy behaviors. This research will test whether social desirability bias (SDB), along with another measure, impulsiveness, are linked to privacy concerns. If these relationships are supported, researchers who test whether privacy concern measures influence other attitudes and behaviors may also want to consider these variables. SDB and impulsiveness may also explain part of the privacy paradox. The next section of this paper describes the prior research on the privacy paradox and the two measures of interest (SDB and impulsiveness). Then the methodologies and results from two regressions that used consumer survey data will be discussed. The final section summarizes the conclusions, highlights implications for researchers, businesses, and regulators, and reviews some limitations of this research.
Literature review
The existence of the privacy paradox depends on whether researchers assume it refers to having no relationship between privacy attitudes and privacy behaviors or a weaker-than-expected relationship. For example, Dienlin et al. (2023 [Germany]) used three surveys in a longitudinal design and found that those with higher privacy concerns were “slightly” less likely to share personal information. They interpreted this result as evidence against the paradox. This paper prefers the other interpretation, privacy attitudes have weaker-than-expected connections. If some people overstate their privacy concerns because of social norms, this could explain part of the gap. If individuals with high privacy concerns impulsively share personal information, this could explain more of the gap. In the next sections, the existence of the privacy paradox, the theories about the paradox, other variables that may influence privacy relationships, and methodological issues with privacy studies will be discussed.
Existence of a privacy paradox
Recent research has found a gap between privacy concerns and privacy behaviors including studies in the US (e.g., Martin and Shilton 2016; Hallam and Zanella 2017 [mostly students]; Larson, 2020b; Lutz & Tamó-Larrieux, 2020; Chapman et al., 2022; Madarasz & Pycia, 2022) and in other countries (e.g., Taddicken, 2014 [Germany]; Weinberger et al., 2017 [students, Israel]; Massara et al., 2021 [Italy]; Zhu et al., 2021 [China]; Ameen et al., 2022 [UK and UAE]; Schubert et al., 2022 [students, Switzerland]; Trestian et al., 2022 [Ireland]; Masur, 2023 [Europe]; Willems et al. In press [Austria]; Gruzd and Hernandez-Garcia In press [Canada]). Research that compared the US with other countries noted differences in some relationships (e.g., Dinev et al., 2006 [Italy]; Dinev et al., 2009 [South Korea]; Pope and Lowen, 2009 [Canada]; Markos et al., 2017 [Brazil]; Fox, 2020 [Ireland]), confirming that willingness to share information varies by culture (Bauer & Schiffinger, 2016; Bellman et al., 2004; Benamati et al., 2021; Grosso et al., 2020).
The extensive use of student samples in privacy research has raised concerns (e.g., Bélanger & Crossler, 2011). Privacy literature reviews noted that using students or people from countries with unique cultures as subjects could influence results (e.g., Maseeh et al., 2021; Okazaki et al., 2020). This paper highlights the data source of the referenced studies if student samples were used or if the study was conducted outside the US.
Reasons for the privacy paradox
At least two literature reviews, Baruh et al. (2017) and Gerber et al. (2018), suggested that much of the paradox can be explained. One of the most common explanations, privacy calculus, assumes that consumers are rational and weigh the benefits and risks involved when deciding whether to reveal personal information or adopt privacy protections (Olivero & Lunt, 2004; Li et al., 2010 [students]; Jiang et al., 2013; Martin, 2016; Bauer & Schiffinger, 2016; Duan & Deng, 2022 [Australia]; Shim & Yeon, 2022 [South Korea]; Morimoto, 2023 [Japan]). Subjects are assumed to receive significant social benefits from disclosing personal information (Fatima et al., 2019; Pomfret et al., 2020; Lin, 2023 [Taiwan]). The privacy calculus framework has not been supported by all users (e.g., Kim et al., 2019). Problems with the rationality assumption include a lack of knowledge, overconfidence, incomplete information, or misperceptions about the risks (Adjerid et al., 2018; Agi & Jullien, 2018; Brough & Martin, 2020; Hoofnagle & Urban, 2014; Jensen et al., 2005; Mantilla & Robles-Flores, 2021; Norberg & Horne, 2007; Nowak & Phelps, 1992; Solove, 2021; Turow et al., 2018; Waldman, 2020). Psychological factors (e.g., bounded rationality, optimistic bias, mental resource availability, framing, context, habits, psychological distance, etc.) may also influence the choices (Cho et al., 2010 [Singapore]; Acquisti et al., 2013; Dinev et al., 2015; Quinn, 2016; Acquisti et al., 2017; Hallam and Zanella 2017 [mostly students]; Veltri & Ivchenko, 2017 [UK]; Bandara et al., 2018; Becker et al., 2019; Bandara et al., 2020 [Australia]; Ackermann et al., 2022). Another problem with privacy calculus is that both mood and emotion influence information disclosures (Li et al., 2008; Braunstein et al., 2011; Kehr et al., 2015 [US and Switzerland]; Li et al., 2017 [students]; Alashoor et al. In press). Brain scans found that privacy decisions had both rational and emotional components (Mohammed & Tejay, 2021). Therefore, rational decision-making cannot explain the entire gap between privacy concerns and behaviors.
Barth and de Jong (2017) listed 34 other theories for explaining the paradox. One suggested that the paradox is caused by the lack of a market for personal information. Without this market, some people reveal their true privacy preferences when they share information (Holland, 2010; Godel et al., 2012 [Europe]; Fuller, 2019), making the paradox an expression of hypothetical bias. A recent test did not find evidence of this bias (Glasgow et al., 2021). Another theory suggested that giving consumers a choice to share data or use protective tools increases their perceived control and gives them a perception of power (Brandimarte et al., 2013 [students]; Mosteller and Poddar 2017; Bornschein et al., 2020 [US and Europe]; Mourey and Waldman, 2020). This sense of power could indirectly reduce perceived risks. Inattentiveness, laziness, and forgetting privacy concerns could also play a role in creating the paradox (Berendt et al., 2005 [Germany]; Marreiros et al., 2017 [UK]; Wirth et al., 2022 [Germany]) as could consumer fatalism, cynicism, and privacy fatigue (Hoffmann et al., 2016 [Germany]; Choi et al., 2018 [South Korea]; Xie et al., 2019; Tang et al., 2021 [China]; Tian et al., 2022 [China]; Van Ooijen et al. In press). The variety of theories makes comparing them difficult.
The two measures tested by this research (SDB and impulsiveness) were not among those discussed in major privacy literature reviews (e.g., Barth and De Jong 2017; Baruh et al., 2017; Gerber et al., 2018; Kokolakis, 2017; Okazaki et al., 2020) [Readers interested in more information about the privacy paradox should refer to these reviews]. Because SDB and impulsiveness differ by country (Kacen & Lee, 2002; Steenkamp et al., 2010; Tellis & Chandrasekaran, 2010; Zhang et al., 2010), their influence on privacy attitudes may vary by population. This research will test for relationships in the US.
Other variables that influence privacy concerns or behaviors
Some evidence suggests that privacy fears are linked to demographics. Scenarios that included privacy risks, developed by Wang and Petrison (1993), raised privacy concerns and these concerns were associated with some demographics (e.g., age, race, and income were each significant for at least one scenario). A study that asked consumers to react to five statements about privacy found that gender, income, and age were significantly related to their reactions (Graeff & Harmon, 2002). Blank et al. (2014) examined privacy actions in Britain, the US, and Australia and found that age was negatively related to taking actions to protect privacy. Privacy concerns or protective actions were associated with age, gender, education, and income (Savage & Waldman, 2015). Willingness to participate in health information exchanges was linked to age, education, and income, while gender was not significant (Esmaeilzadeh, 2019). Smit et al. (2014 [Netherlands and Belgium]) reported that age, gender, and education were associated with different privacy protection behaviors and income was not. Boerman et al. (2021 [Netherlands]) found that education was related to the use of different privacy protection behaviors while age and gender were not. Inconsistencies in the reported relationships suggest that more tests of demographic measures are warranted.
Other measures associated with privacy concerns include trust (e.g., Dinev and Hart 2006; Rodriguez-Priego et al., 2023), self-efficacy (Chen, 2018 [US and Hong Kong]), prior negative experiences (Mosteller and Poddar 2017; Trepte et al., 2014), knowledge (Hoofnagle & Urban, 2014; Fox, 2020 [US and Ireland]), belief that others have shared their data (Liao et al., 2021), and the uses of the requested information (Martin & Nissenbaum, 2016). Tests on these measures have also been mixed. For example, Lutz and Strathoff (2014 [Switzerland]) did not find a link between trust and privacy-protecting behaviors and Jahari et al. (2022 [students]) did not find any mediation from government trust in a relationship between privacy concerns and using digital contract tracing. Future research on privacy attitudes and behaviors could test more of these variables.
Methodological issues that affect privacy studies
Privacy concerns can be measured in a variety of ways and the scale choice can impact results (Okazaki et al., 2020). Phelps et al. (2000) and Staddon et al. (2012) used a single question to gauge privacy concerns. Single-question measures can miss important details. Van Slyke et al. (2006) and Hinz et al. (2007 [mostly students, Germany]) used longer scales, but did not split concerns into separate dimensions. Because privacy risks tend to have multiple aspects (e.g., physical, social, psychological, etc., Karwatzki et al., 2022), privacy concerns are likely to have multiple dimensions. Chapman et al. (2022) divided privacy concerns involving health status information into three categories and found significant differences in the effects from each concern. These results highlight the importance of scale selection and analysis.
Dienlin and Trepte (2015 [Germany]) tested whether general privacy concerns (10-item scale, one dimension) were associated with information sharing on Facebook and found little connection, supporting the paradox. However, they argued that intermediate relationships should be considered and used three criteria to split Facebook attitudes, intentions, and behaviors into three categories. Creating these nine measures using the same criteria increased the odds that relationships between them would be found. Both direct and indirect relationships were identified. The authors described the identified effects as “small” but concluded that Facebook privacy behaviors could be explained “sufficiently” by general concerns, Facebook attitudes, and Facebook intentions, eliminating the paradox. Other recent research in Germany has produced mixed results on the existence of the paradox (e.g., Halama et al., 2022; Wirth et al., 2022). There is also a question about whether results from Germany can be generalized to other countries. Krasnova et al. (2012) surveyed US and German Facebook users and found that privacy concerns significantly reduced self-disclosures in Germany, but not in the US.
Social desirability bias
The vast majority of privacy studies have not considered SDB. Only a few researchers acknowledged that SDB is a potential problem. Milne (2003) asked students and adults about the actions they take to protect their identities. Their responses were not correlated with an SDB index. Norberg et al. (2007 [students]) considered that SDB might explain at least part of the gap and cited a study about information disclosure where the results from indirect questions were not significantly different from direct questions. The cited study used a convenience sample of 103 adults in Rhode Island and it is unclear if these results can be generalized. Another experiment varied the emphasis placed on privacy and hypothesized that willingness-to-pay would change (Glasgow et al., 2021). Because the average willingness-to-pay was not significantly different, they concluded that SDB was not present. While both indirect questioning and changing emphasis may signal when significant SDB exists, neither approach can prove that SDB does not exist. If privacy concern is a strong social norm (and privacy surveys suggest it probably is), some subjects may over-report concerns with both direct and indirect questions and under different levels of emphasis. It is also possible that study samples did not include many people who are sensitive to social norms. This study will explore whether each type of privacy concern might be influenced differently by SDB using large national surveys. The following hypothesis will be tested:
Social desirability bias will be positively related to privacy concerns.
Impulsive behavior
Martin (2020) found that many consumers had strong privacy expectations after they revealed information, which would be consistent with people spontaneously sharing information. Only three privacy studies were found that included impulsiveness measures and concluded they were significant. In an experiment, subjects were asked if they would accept a data cookie on their computer that would create an information trail (Coventry et al., 2016). The authors used a common impulsiveness scale and found a positive link with cookie acceptance. A UK study of risky internet behaviors used a different scale that divided impulsiveness into three factors: attention (i.e., action without thought), motor (i.e., acting on the spur of the moment), and non-planning (i.e., lack of premeditation) (Hadlington, 2017). Attention and motor impulsivity were positively related to risky behaviors while non-planning impulsivity was negatively linked. The third study focused on information disclosure and found that motor impulsivity influenced the link between privacy concerns and disclosure and had a direct effect on the amount disclosed (Aivazpour & Rao, 2020). Impulsivity explained more information disclosure variance than the Big Five personality measures. These results suggest that impulsiveness should not be overlooked by privacy researchers.
Like privacy concerns, impulsiveness can be assessed in many ways. One impulsive behavior scale, developed by Hausman (2000), produces two factors, hedonic consumption and impulsive trait. “[The hedonic consumption measure] seemed to represent the fundamental elements of hedonic shopping … namely the novelty, entertainment, and emotional lift achieved by consumers through their shopping behavior” (Hausman, 2000, p. 412). Chih et al. (2012) linked the hedonic consumption measure to impulsiveness on travel websites. Gultekin and Ozer (2012) used a different scale to measure hedonic shopping motives and found that these motives had a positive impact on actual impulsive behaviors. This measure suggests that people who enjoy shopping may also make impulsive decisions.
Hedonic consumption and impulsive trait measures have been used to investigate a variety of marketing questions, including impulsive buying online (Kim & Eastin, 2011 [students]), shopper motivations in supermarkets (Yim et al., 2014), and preferences for non-genetically-modified foods (Larson, 2018), but have rarely been used in privacy studies. If disclosure decisions are similar to making purchases, this scale may provide new insights into privacy-related choices. This leads to two hypotheses:
The hedonic consumption factor will be positively associated with privacy concerns.
The impulsive trait factor will be positively associated with privacy concerns. If both H2 and H3 are rejected, then impulsive tendencies are probably not important contributors to the privacy paradox. If one of the hypotheses is at least partially supported, more impulsive individuals may share personal information on impulse and create a privacy gap. Other research would be needed to verify that impulsive behavior is a paradox contributor.
Study 1: Surveys in 2015
Methodology for study 1
Study 1 sample profile.
Both surveys used eight items from the Smith et al. (1996) scale, selected because of their high factor scores, to shorten the surveys. Many studies have used all of the Smith scale, parts of it, or modified some questions (e.g., Milberg et al., 1995; Malhotra et al., 2004; Korzaan & Boswell, 2008 [students]; Schwaig et al., 2013; Hong et al., 2013; Larson and Ferrin 2021). Stewart and Segars (2002) confirmed the reliability and validity of this scale. Not all of the users of the Smith scale identified four dimensions. For example, Lian and Lin (2008 [students, Taiwan]) found two factors and Campbell (1997 [Canada]) found three factors. Exploratory factor analysis of the privacy questions will create the dependent variables for the regressions. The independent variables will be the 12 demographics listed in Table 1, the impulsiveness factors, and the SDB measure.
SDB was quantified using the Stober (2001) SDS-17 scale. This 16-item scale was unrelated to demographics and had good validity (Blake et al., 2006). A psychometric analysis concluded that it could be used with a Likert scale in cross-cultural settings (Tran et al., 2012). The scale includes questions such as “I always eat a healthy diet” and “I sometimes litter” and measures how frequently respondents attempt to be consistent with social expectations. To measure SDB, responses of strongly agree or agree (i.e., top-two-box or bottom-two-box, if reverse-scaled) were totaled to create an index for each subject that ranged from 0 to 16. Larson (2019a) suggested a logistic transformation of the index so that small changes near the bottom or top of the measure’s range would have less impact than changes near the middle. Those with low scores probably provided unbiased responses and those with high measures probably provided biased responses. Small changes at the low or high end should indicate less bias change than small changes in the middle of the range.
Results for study 1
Varimax-rotated factor scores from study 1 for privacy concerns.
Bold indicates largest score for item.
Varimax-rotated factor scores from study 1 for impulsive behavior.
Bold indicates largest score for item.
Study 1 linear regressions for privacy concerns.
*and Bold indicate significant at p < .05.
The right-hand columns in Table 4 show the results for the collection factor regression.
Females expressed significantly higher concerns involving collection. Those who enjoyed shopping (i.e., hedonic consumption factor) expressed less concern. SDB was also positive and significant for this measure. The differences in the results across the table may explain the mixed findings in other studies.
Study 2: Survey in 2022
Methodology for study 2
Study 2 sample profile.
Results for study 2
Varimax-rotated factor scores from study 2 for privacy concerns.
Bold indicates largest score for item.
Varimax-rotated factor scores from study 2 for impulsive behavior.
Bold indicates largest score for item.
Study 2 linear regressions for privacy concerns.
*and Bold indicate significant at p < .05.
General discussion
The privacy paradox describes the weak connection between the privacy concerns expressed in surveys and actual information-sharing and privacy-protecting behaviors. Many theories have been proposed to explain this gap. This study tested two additional explanations, socially desirable responding (SDB) and impulsive information disclosures (impulsiveness). The SDB measure had significant, positive, and relatively large coefficients for the company actions and collections regressions in 2015 and the unauthorized use and errors regressions in 2022 (supporting H1). This suggests that social norms encourage some people to overstate some of their privacy concerns and create part of the paradox.
Respondent impulsiveness was assessed with two measures. Hedonic consumption had significant, negative signs in one 2015 regression and one 2022 regression. This unexpected result suggests that people who enjoy shopping may also report lower collection and unauthorized use concerns than the average consumer. The hedonic consumption factor was also significant and positive for errors in 2022 (partially supporting H2). Because hedonic consumption is associated with impulsiveness, some people with high privacy concerns involving data errors may also be more impulsive.
The impulsive trait factor was significant and positive for company actions in 2015 and errors in 2022 (partially supporting H3). Therefore, impulsive people may also express some higher privacy concerns. If they also revealed information on impulse, it could explain part of the paradox. More research is needed to confirm that many people impulsively share private information.
By dividing privacy concerns into components, significant effects were noted for several demographic variables, but none of the relationships were significant in all the concern regressions shown in Tables 4 and 8. Women expressed greater privacy concerns in both 2015 regressions and in one of the three 2022 regressions. Age was important in one of the 2015 regressions and two of the 2022 regressions. Income and education were each significant in one of the 2022 regressions. Race was important in two of the 2022 regressions. Because none of the demographic measures were consistently significant, studies that used single privacy concern measures might not identify the importance of demographics. This might also explain why prior privacy research produced mixed demographic results.
Conclusions and implications
If researchers examined just a segment of the privacy literature, they might conclude that privacy concerns have little value in explaining or predicting other attitudes or behaviors. Some studies used samples that may limit generalizations (e.g., respondents who are students or are from countries with different cultures) or used short scales or composite variables to create a single measure of privacy concerns. This research highlights the importance of splitting privacy concerns into components instead of a single measure. When these concerns were divided into factors, different variables were associated with each concern type (e.g., information collection, unauthorized use, etc.). Therefore, future studies that include privacy concerns should treat it as a multidimensional concept.
Privacy researchers should test more of the paradox theories. Besides considering variables previously linked with privacy concerns (e.g., trust, self-efficacy, prior negative experiences, knowledge, a belief that others have shared data, and the uses of requested information), they should include measures for SDB and impulsiveness. Omitting SDB and impulsive behavior variables could bias other factors being tested. Different privacy concern, SDB, and impulsive behavior scales could be employed, interactions between the measures could be considered, and nonlinear relationships could be explored. Demographics (e.g., gender, race, age, etc.) should also be included in the models. Research is needed to quantify the proportion of information disclosures that are done on impulse. Another potential research topic deals with the regret that impulsive consumers may feel after disclosing information.
The SDB results should give businesses more confidence about the acceptability of collecting information and using it to promote their products. Some customers appear to overstate their privacy fears because they believe being concerned is expected. For organizations gathering customer data, they may boost participation by reducing perceived risks (e.g., having a privacy policy, mentioning that thousands have already responded, etc.), making the disclosure process more enjoyable, or appealing to hedonic interests (e.g., offering participants luxurious rewards). However, many respondents still want their data to be protected and should not be disappointed with how their information is used. Businesses may also find the negative relationships between some privacy concerns and hedonic consumption useful. Customers who enjoy shopping may be more willing to share private information with companies. These individuals also could be over-represented in customer databases.
The privacy paradox may create a challenge for regulators. High concerns expressed in surveys typically suggest a need for more regulations. However, the significance of SDB implies that some individuals are overstating their true concerns. This may weaken the case for additional regulations on the use of personal information. The SDB results suggest that a strong social norm exists that favors privacy concerns, which leads many people to state that they are very concerned about privacy. This social norm also indicates that there may be widespread support for some additional regulations. The significant coefficients for impulsivity imply that people may share private information without careful deliberation. If future research finds that impulsive disclosures are common, regulators may consider giving consumers the option of retracting the information that they shared.
Like most studies, this research has several limitations. The 2015 surveys did not have good coverage of nonwhite respondents. Given the significance of this variable in two of the 2022 regressions, future surveys should strive for good representation of nonwhites and might explore dividing this group into ethnic segments. This research employed a limited number of questions to measure the dependent and independent variables. Longer scales for privacy concerns, impulsiveness, and SDB could produce more definitive measures. The surveys did not ask about other personality traits or privacy behaviors. These and other variables should also be tested along with demographics, SDB, and impulsiveness in future analyses. This study does not claim to explain the entire privacy paradox. Adding SDB and impulsiveness measures and utilizing multiple dimensions of privacy concerns could help researchers develop a better understanding of the effects of privacy concerns and gain a deeper understanding of paradoxical privacy behaviors.
Footnotes
Declaration of conflicting interests
The author declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.
Funding
The author received no financial support for the research, authorship, and/or publication of this article.
IRB Statement
Human Subjects Research: Human Subjects Institutional Review Boards examined the three surveys used in this research and judged them to be exempt from review because they were anonymous.
