Determinants of Online Privacy Concern and Its Influence on Privacy Protection Behaviors Among Young Adolescents
Seounmi Youn is an associate professor of marketing communication in Emerson College's School of Communication (firstname.lastname@example.org). This research was funded with a research allowance from Emerson College.
With Rogers' protection motivation theory as the theoretical framework, this study identified determinants of young adolescents' level of privacy concerns, which, in turn, affects their resultant coping behaviors to protect privacy. Survey data from 144 middle school students revealed that perceived risks of information disclosure increased privacy concerns, whereas perceived benefits offered by information exchange decreased privacy concerns. Subsequently, privacy concerns had an impact on risk-coping behaviors such as seeking out interpersonal advice or additional information (e.g., privacy statement) or refraining from using Web sites that ask for personal information. Counter to our expectation, privacy self-efficacy did not appear to be related to privacy concerns. Implications of privacy education to protect online privacy among young adolescents were discussed.
As the Internet has permeated the branded marketplace over the last decade, young adolescents, who were once known to use the Internet very little, now have a strong presence. eMarketer's report (2006) estimated that 85% of young adolescents aged 12–14 in the United States will be online by 2010, compared with 74% in 2006. With the rapid growth of the online market, e-marketers are targeting young adolescents through interactive venues such as viral marketing, social networking sites, and advergames (Chester and Montgomery 2007). Although these practices have allowed young adolescents to participate in the branded e-marketplace, consumer advocates express growing concerns about the invasion of privacy caused by e-marketers' information collection practices (Espejo and Glaubke 2005; Willard 2006; Subrahmanyam and Greenfield 2008). Young adolescents can be particularly vulnerable to e-marketers' information collection practices when promotional messages are skillfully blended with entertainment online (Moore 2004). More recently, young adolescents' information disclosure on social networking sites like MySpace has intensified parents' worries about loss of privacy (Romer 2006; Lenhart and Madden 2007; Livingstone 2008).
In response to these growing concerns, researchers have begun to empirically examine adolescents and their online privacy concerns (Grant 2005, 2006; Youn 2005, 2008; Moscardelli and Divine 2007). These studies have examined older adolescents' (ages 14–18) privacy concerns and their coping behaviors to protect their privacy rights. However, little is known about how younger adolescents (ages 11–13) perceive online privacy and how they respond to it. One exception is Lwin, Stanaland and Miyazaki's study (2008), which investigated how parental mediations and Web site safeguards affect preteens' (ages 10–12) disclosure of personal information. Thus, the primary objectives of this study are to examine which factors affect young adolescents' level of privacy concerns and how these concerns influence their behavioral responses to e-marketers' information collection practices. This topic is worth investigating because the findings can assist consumer educators and policy makers in developing policies that facilitate privacy education for young adolescents, which can help them protect their privacy rights online.
Drawing insights from Rogers' protection motivation theory (1975, 1983), this study investigates the determinants of young adolescents' level of privacy concerns, which, in turn, affect coping behaviors to deal with privacy-related risks. This theory postulates that individuals' assessment of the risks and benefits associated with risky behavior plays a pivotal role in accounting for their motivation to protect themselves from such behavior. This theory also posits that self-efficacy, that is, individuals' belief in their capability to successfully carry out an action, is crucial in explaining protective motivation. From this perspective, such protective motivation is postulated to activate and direct attitudinal and behavioral changes to deal with risks.
“Young adolescents” in this study refers to twelve- to thirteen-year-olds in seventh grade. The importance of studying this age group should be discussed first. The Children's Online Privacy Protection Act of 1998 (COPPA) requests that Web sites targeting children must seek verifiable parental consent for information collection from children under the age of 13 (Turow 2001). Seventh graders aged 12–13 are on the cusp between being protected by COPPA and not being protected. It would be worthwhile to examine their responses to privacy issues in terms of being teens making this transition. Furthermore, according to a report from the Pew Internet & American Life Project (Lenhart, Madden and Hitlin 2005), seventh grade appeared to be the tipping point at which many teens begin using the Internet, with the percentage of online teenagers jumping from 60% of sixth graders to 82% of seventh graders. As the great majority of seventh graders go online, they begin to form attitudes toward the information practices of e-marketers and understand possible risks stemming from privacy loss.
In support of this argument, Yan's studies (2005, 2006) uncovered that students in grades 7 and 8 showed an adult level of understanding regarding negative consequences of Internet use in general. Compared with students in grades 4, 5, and 6, seventh and eighth graders were found to understand social concerns such as online privacy invasion and to express a cautious attitude toward using email and navigating Web sites. These findings indicate that this age group has the ability to appreciate risks caused by privacy loss and link such perceived risks to their privacy protection behaviors, in general. In a study by Harris Interactive, Bagnaschi and Geraci (2003) reported that ten- to twelve-year-olds (55%) and thirteen- to fifteen-year-olds (62%) are more likely to worry about giving out personal information on a Web site than either eight- to nine-year-olds (37%) or sixteen- to seventeen-year-olds (52%). Altogether, these findings imply the importance of investigating how this age group responds to e-marketers' information collection and sharing practices.
Level of Privacy Concerns and Privacy Protection
“Consumer privacy” in this study refers to consumers' ability to control when, how, and to what extent their personal information is to be transmitted to others (Westin 1967; Goodwin 1991; Phelps, Nowak and Ferrell 2000; Milne and Culnan 2004; Lanier and Saini 2008). The key is not the information disclosure per se, but rather the degree of control that is exercised by consumers over the collection of information and its subsequent use by marketers (White 2004). Disclosing personal information online has been considered inherently risky in the online marketing context for several reasons. As one of the key drivers of online trust, Bart et al. (2005) identified the level of privacy to be associated with information risk. Information risk is related to the uncertainty associated with how personal information is handled by online establishments and who has access to it. Consumers are vulnerable in that they have little control over information collection and use by e-marketers beyond the original purpose for the information collection (Nowak and Phelps 1992, 1995; Dinev and Hart 2004; Milne and Culnan 2004). When there is a possibility of intrusion upon privacy, consumers may experience associated negative consequences, including a fear of being personally monitored, loss of anonymity, unasked-for commercial solicitations, identity theft, fraud, and so forth (Lee 2000, 2002; Miyazaki and Fernandez 2000, 2001; Milne 2003; Brown and Muchira 2004; Milne, Rohm and Bahl 2004).
Concerns for privacy are heightened when consumers feel uninformed about who is collecting their personal information, how companies obtain their information, or for what purposes the information is used (Nowak and Phelps 1995; Lanier and Saini 2008). Such negative feelings may motivate consumers to avert risks associated with divulging personal information to marketers (Phelps, Nowak and Ferrell 2000). The stronger an individual's concerns are about marketers' information collection practices, the more likely the individual is to adopt risk-reducing behaviors (Sheehan and Hoy 1999; Lwin and Williams 2003; Lwin, Wirtz and Williams 2007; Wirtz, Lwin and Williams 2007). This study thus contends that the level of privacy concerns motivates coping behaviors to handle privacy risks among young adolescents (Rifon, LaRose and Choi 2005). Next, how protection motivation theory is applied to explain determinants of the level of privacy concerns is discussed, which, in turn, influences coping behaviors for privacy protection.
As a theoretical framework, scholars have employed Rogers' protection motivation theory (1975, 1983) to explain risky behavior and to develop effective messages in an effort to prevent such behavior. Good examples in the realm of health communication are studies of binge drinking (Wolburg 2001), youth smoking (Sturges and Rogers 1996; Pechmann et al. 2003), and skin cancer (Mermelstein and Riesenberg 1992). In conjunction with online safety, researchers have just begun to utilize protection motivation theory and have identified factors predicting the intention of taking protective actions (Lee and LaRose 2004; Youn 2005; Siponen, Pahnila and Mahmood 2007; Lee, LaRose and Rifon 2008). In a similar vein, this study uses protection motivation theory to understand the tendency of young adolescents to employ safeguards to prevent privacy loss caused by e-marketers' information collection and sharing practices.
Originally, Rogers (1975) proposed that one's motivation to protect oneself from risks arises from three cognitive appraisal processes: (1) perceiving the risk to be likely to occur to oneself, (2) perceiving the risk to be severe, and (3) perceiving protective behavior to be effective in reducing risk, which is referred to as response efficacy. In an attempt to explain individuals' tendency to fail to engage in protective and desired behavior, Rogers (1983) and Maddux and Rogers (1983) revised the protection motivation theory by adding three more cognitive appraisals: (4) self-efficacy, which refers to an individual's belief that he or she has the ability to perform a desired behavior, (5) the response costs incurred by engaging in a desired behavior, and (6) the rewards associated with risky behavior.
Taken together, this theory asserts that an individual's motivation for engaging in risk-reducing behavior is increased by four cognitive assessments: the vulnerability to the risk, the severity of the risk, response efficacy, and self-efficacy. Furthermore, the risk-reducing motivation is diminished by two cognitive assessments regarding the perceived costs of desired behavior and the perceived benefits of risky behavior. This theory states that these six components are important determinants in eliciting an individual's protection motivation to control harm or danger resulting from risky behavior. Subsequently, such motivation affects an individual's intention to carry out a risk-reducing action. Protection motivation is regarded as a trigger that arouses and directs an attitudinal and/or behavioral change to cope with and to avert the risk. Coping behaviors encompass either taking direct action or inhibiting action (Rogers 1975, 1983).
Applying this theory to the online privacy context, young adolescents' level of privacy concerns may be considered protection motivation, which causes them to engage in risk-reducing behaviors. The greater an individual's concerns about marketers' information collection and sharing practices, the more likely an individual is to try to adopt privacy protection behaviors (Rifon, LaRose and Choi 2005; LaRose and Rifon 2007). Thus, this study views the level of privacy concerns as protective motivation that activates coping behaviors to deal with privacy risks. Within protection motivation theory, online privacy concern is considered to be a mediating variable that explains the relationship between cognitive appraisals and privacy-protecting behaviors (Lwin, Wirtz and Williams 2007; Wirtz, Lwin and Williams 2007). It is expected that cognitive appraisals of online privacy may influence young adolescents' concerns regarding privacy, which then affect resulting protective behaviors. This implies an indirect effect of cognitive appraisals on privacy protection behaviors through online privacy concerns.
When developing hypotheses based on protection motivation theory, this study focuses on three cognitive appraisal components: the perceived vulnerability to privacy risks, the perceived benefits from information disclosure, and self-efficacy, which refers to individuals' confidence in protecting their privacy. Prior studies on privacy imply that the risk and benefit assessments associated with information disclosure are related to consumers' motivations for privacy protection (White 2004; Youn 2005; Hui, Teo and Lee 2007; Norberg, Horne and Horne 2007). Researchers also indicate that the privacy self-efficacy construct is an important predictor of privacy coping behaviors (Dinev and Hart 2005–2006; Rifon, LaRose and Choi 2005; LaRose and Rifon 2007; Yao and Linz 2008).
It should be discussed why this study included only three rather than all constructs of protection motivation theory. From the developmental psychology perspective, scholars have expressed reservations about applying protection motivation theory to children or young adolescents, who have not yet developed abstract reasoning and logic (Jordan and O’Grady 1982; Maddux et al. 1986; Sturges and Rogers 1996). It is argued that protection motivation theory, along with other cognitive models of health behavior decision making, has been developed to explain adults' attitudes and behaviors under the assumption that adults are cognitively sophisticated in gathering information about health and making a rational decision about health behaviors (Maddux et al. 1986). In light of children's or young adolescents' limited cognitive abilities, it is recommended that the protection motivation theory should take into account this developmental aspect when applied to these groups (Maddux et al. 1986; Sturges and Rogers 1996).
Putting these arguments together, the present study focused on examining key constructs of threat appraisals and coping appraisals, which may be more relevant to young adolescents (Tanner, Hunt and Eppright 1991; Mermelstein and Riesenberg 1992; Sturges and Rogers 1996; Pechmann et al. 2003). The threat appraisal process was measured with perceived benefits associated with information disclosure and vulnerability to privacy risks, but not with severity of privacy risks. From the developmental perspective, as discussed before, Yan (2006) discovered that young adolescents in grades 7 and 8 developed a “sophisticated” understanding of social consequences of Internet use such as online privacy, relative to children in grades 4, 5, and 6. However, they were found to have not fully developed a “scientific” or “expert-like” understanding of social consequences of Internet use, which involve serious online threats such as teen-pornography, abuse of personal information, and intrusion into personal email accounts. This finding indicates that young adolescents may not be able to assess the severity of privacy risks due in part to their limited cognitive abilities. Alternatively, vulnerability to privacy risks and severity of privacy risks may not be separately distinguishable constructs in the minds of young adolescents. Thus, this study estimated perception of the threat with vulnerability to privacy risks.
The constructs of the coping appraisal process were also adapted to take this developmental perspective into account. The coping appraisal process was assessed with privacy self-efficacy, but not with response self-efficacy and response costs. It is assumed that young adolescents may evaluate their overall capability of protecting privacy online, but may not be capable of evaluating the belief that privacy protection responses are effective in protecting their privacy or any costs of employing privacy protection response options. Options for privacy protection require sophisticated technical skills and knowledge (e.g., filtering programs, deleting cookies, or downloading antivirus software), which can be highly challenging to young adolescents, and the responsibility in the application of such technologies primarily lies with adults in authority (e.g., parents or teachers) rather than with the child (Maddux et al. 1986; Rifon, LaRose and Lewis 2007). In Yan's study (2006), young adolescents in grades 7 and 8 were shown to not yet have fully developed knowledge of online protection strategies such as firewalls and password protection. These arguments imply that it would be difficult to assess response efficacy for young adolescents in the online privacy context. Furthermore, it is also assumed that if young adolescents are not knowledgeable with particular privacy protection response options, it would be ineffective to attempt to measure their perceived costs arising from the adoption of privacy protection responses. Thus, both constructs, response efficacy and response costs, were not included in this study. Next, this study will discuss the development of research hypotheses regarding the relationships between the three types of cognitive appraisal, the level of privacy concerns, and protection behaviors.
Perceived Vulnerability to Privacy Risks and Online Privacy Concerns
Drawing from protection motivation theory, this study predicts that young adolescents will be more concerned with e-marketers' information collection practices when they consider themselves vulnerable to privacy risks. “Vulnerability to privacy risks” in this study refers to the perceived negative consequences resulting from information disclosure (Dinev and Hart 2004). In studies of adult consumers, LaRose and Rifon (2007) discovered that consumers' expectations of negative outcomes, such as online scams or online identity theft, were positively related to their privacy concerns. Norberg, Horne and Horne (2007) found that overall risk perception of information disclosure had a negative impact on consumers' intentions to provide their information to a marketer. Dinev and Hart (2004) discovered that perceived vulnerability to privacy risks was positively related to privacy concerns.
In line with this, studies on the adolescent segment have illustrated consistent findings. In a study of qualitative in-depth interviews among teens aged 13–17, Grant (2006) explicated major causes for teens' privacy concerns online. Teens were concerned about their online privacy because they were worried about being barraged with unsolicited commercial messages and being tracked down by marketers, resulting in a loss of control over their private information. Youn (2005), in a survey study of teens aged 14–18, measured privacy risks teens are facing. These include emotional discomfort, conflict with parents, wasted time due to managing unsolicited emails, potential monetary loss, and the possible misuse of personal information by companies. Moreover, Youn (2005) found that as teens perceived privacy risks to be more severe, they were less likely to provide their personal information to a Web site. Thus, this study posits the following hypothesis:
H1: As young adolescents perceive that they are vulnerable to privacy risks resulting from information disclosure, they are more likely to be concerned about e-marketers' information collection practices.
Perceived Benefits of Information Disclosure and Online Privacy Concerns
In the youth market, e-marketers are using the Internet as a platform to create favorable relationships with adolescents. Young consumers play more games online, prefer instant messaging to email, spend more time downloading music, and frequent MySpace more than adult consumers (Market Wire 2006; Rainie 2006). Partly owing to adolescents' active use of the Internet, e-marketers are able to utilize viral marketing, advergaming, product placement, and social network marketing to engage teens in interacting with their brands (Willard 2006; Chester and Montgomery 2007). Indeed, adolescents exhibited more positive attitudes than adults toward companies gathering information for marketing purposes if given an incentive (Gervey and Lin 2000; Turow and Nir 2000). Similarly, Youn (2005) found that adolescents aged 14–18 were more willing to provide their personal information to a Web site when they perceived benefits such as entertainment, communication, information, and socializing in return for providing information. Therefore, the following hypothesis is developed:
H2: As young adolescents perceive more benefits associated with providing information to a Web site, they are less likely to be concerned about e-marketers' information collection practices.
Privacy Self-Efficacy and Online Privacy Concerns
Rogers (1983) and Maddux and Rogers (1983) emphasized the value of self-efficacy in enhancing protection motivation. It is proposed that individuals are motivated to engage in coping behavior when they believe they have the ability to apply a coping response. Self-efficacy beliefs are shown to be one of the strongest determinants of predicting protective behavior intentions among other constructs of protection motivation theory (Floyd, Prentice-Dunn and Rogers 2000). This proves to be true when protective behaviors require advanced knowledge (e.g., tracking software and spyware) or complex skills such as the Internet and computers do (Wirth et al. 2007). Following this postulate, this study predicts that individuals with high privacy self-efficacy, compared with those with low self-efficacy, will show stronger privacy concerns, thereby displaying increased privacy protection behaviors. “Privacy self-efficacy” in this study refers to individuals' confidence in their abilities to protect their privacy from e-marketers' information collection and sharing activities (Rifon, LaRose and Choi 2005).
LaRose et al. (2005) found that self-efficacy beliefs in implementing protective behaviors were positively related to intentions to employ online safety behaviors. Similarly, Rifon, LaRose and Choi (2005) found that individuals with higher privacy self-efficacy were less willing to provide their personal information to a Web site than those with lower self-efficacy. These findings indicate that consumers' confidence in their privacy protection abilities may make them alert to marketers' information collection and sharing practices, and increase awareness of their vulnerabilities to intrusive technologies used for information gathering. Consumers who are more confident in their privacy protection would be better able to understand the negative consequences associated with privacy invasion, thus leading to greater concerns for privacy. Therefore, the following hypothesis is developed:
H3: As young adolescents are confident they are able to protect their privacy, they are more likely to be concerned about e-marketers' information collection practices.
Online Privacy Concerns and Privacy Protective Behaviors
Rogers (1983) stated that individuals' protection motivation eventuates in coping behaviors to control danger. Namely, protection motivation arouses and directs the desired behavior to avert threats or risks (Rogers 1975, 1983). On the basis of the relationship between protection motivation and behavioral responses, this study predicts that young adolescents' level of privacy concerns will be positively related to their privacy protection behaviors.
The literature on adolescents' methods of coping with risks suggests two broad dimensions of coping strategies across diverse risky situations: approach and avoidance (Amirkhan 1990; Endler and Parker 1990; Piko 2001). Approach strategies encompass problem-solving and seeking social support or information, whereas avoidance strategies involve distancing, emotion-focused coping, and defensive reappraisal (Herman-Stahl, Stemmler, and Petersen 1995). The current study clearly sees the applicable role of these two dimensions in the context of online privacy. In fact, Raman and Pashupati (2004) in a study of adults found two different strategies for coping with privacy threats: confrontative (or approach) and avoidance strategies. Confrontative strategies result in accommodating or mastering the Internet, whereas avoidance strategies lead users to ignore threats or to refuse to use the Internet. In focus group interviews, they discovered that the participants with high levels of technological competence tended to adopt confrontative coping strategies, which include reading privacy policies, using third-party ratings of Web sites, and installing technological software such as firewalls or spam guards.
A positive relationship between the level of privacy concerns and protection behaviors has been consistently found in studies of adult consumers. Sheehan and Hoy (1999) identified that as consumers' concerns over privacy heightened, they adopted voicing behaviors, such as asking for name removal from lists or sending flames; withheld personal details from companies; or abstained from using certain Web sites. Likewise, in the Harris online panel and college student sample surveys, Milne, Rohm and Bahl (2004) found that the level of privacy concerns was a strong predictor of online privacy and identity protection behaviors such as falsifying information, refusing information disclosure or transactions, or removing personal information from lists. Recently, researchers also discovered that concerns for online privacy impacted consumers' responses to fabricate their personal information, to adopt privacy-enhancing technologies, and to refrain from interacting with a Web site (Lwin, Wirtz and Williams 2007; Wirtz, Lwin and Williams 2007). Researchers found similar patterns to those uncovered in the adult segment upon analysis of the teen segment. Moscardelli and Divine (2007) revealed that privacy-concerned teens were more prone to engage in privacy-protecting behaviors. For example, concerns about privacy were related to the following: providing inaccurate information, notifying Internet Service Providers (ISPs) about unwanted emails, requesting name removal from marketing lists, and flaming entities sending unwanted emails. Youn (2005) also found that teens were more likely to falsify or withhold their personal information, as they were increasingly concerned about information disclosure.
Following two dimensions of risk-coping strategies, this study examines approach and avoidance coping styles to deal with privacy risks. Approach strategies include fabricating personal information and seeking social support or information. “Fabricate” refers to young adolescents' efforts to falsify their information or provide incomplete information and “seek” refers to young adolescents' efforts to ask parents or teachers for advice or to read the privacy statement. Avoidance strategies include withholding personal information by refraining, where “refrain” represents young adolescents' refusal to use the Web site that asks them to provide personal information. “Fabricate” and “refrain” coping strategies are consistent with existing studies on privacy concerns in online marketing (Sheehan and Hoy 1999; Lwin, Wirtz and Williams 2007; Wirtz, Lwin and Williams 2007). It should be noted that coping strategies of using privacy-enhancing technologies (e.g., use of technology to reject cookies) were not included because young adolescents are not considered to be mature enough to install and manage privacy-related technologies. Instead, coping strategies of seeking social support or information were included because adolescents resort to these behaviors to reduce risks or dangers (Herman-Stahl, Stemmler and Petersen 1995). Altogether, this study predicts that as young adolescents have higher levels of privacy concerns, they will fabricate their personal information, seek out parents' guidance or information such as a privacy statement, or refuse to use Web sites which require registration.
H4: As young adolescents are more concerned about online privacy, they are more likely to engage in privacy protection behaviors such as fabricating, seeking, and refraining.
Differences in Intrapersonal Sources on Privacy Concerns and Behaviors
Although the focus of protection motivation theory is on two cognitive appraisals, threat and coping appraisals, Rogers (1983) also suggests environmental or intrapersonal sources that initiate these cognitive appraisal processes. It is of particular importance to investigate intrapersonal sources because privacy studies have shown that differences in intrapersonal sources (e.g., gender or Internet use) have an effect on the level of privacy concerns and resulting protective behaviors (Miyazaki and Fernandez 2001; Milne, Rohm and Bahl 2004; Moscardelli and Divine 2007). For example, prior studies demonstrated that concerns for online privacy were related to gender, with females showing more concern (Sheehan 1999; Graeff and Harmon 2002; Youn 2005; Moscardelli and Divine 2007). It has been shown that females were less likely to adopt privacy-protecting behaviors than males (Milne, Rohm and Bahl 2004). With regard to Internet use, Internet users with more experience expressed less privacy concerns (Miyazaki and Fernandez 2001) and tended to adopt more protection behaviors (Milne, Rohm and Bahl 2004). Prior studies also implied that consumers who are more knowledgeable about privacy practices may perceive greater control over their information, which results in less privacy concerns (Nowak and Phelps 1992, 1995; Dommeyer and Gross 2003). Furthermore, it has been argued that consumers with greater persuasion knowledge tend to be more skeptical of advertising and marketing practices and are able to cope with them more effectively (Mangleburg and Bristol 1998; Wright, Friestad and Boush 2005). Thus, this study included these intrapersonal sources in the data analysis in order to assess the independent influence of each source on the level of privacy concerns and resulting behaviors. All constructs and relationships discussed are presented graphically in Figure 1.
Data Collection and Samples
The survey was conducted in a public middle school located in the northeastern United States in 2006. The school was equipped with up-to-date computer facilities and integrated the Internet into the regular school curriculum. After receiving approval from the school's principal, the researcher delivered copies of the survey and consent forms to the school. The teachers facilitated the project by distributing parental consent forms to students and collecting these signed parental consent forms. Students also signed their own consent form and then filled out the surveys in class under the supervision of their teachers. The school received the general fund for research participation.
The sample consisted of seventh graders aged 12–13. Among a total of 148 surveys collected, 144 surveys were usable due to four missing data. The response rate was about 45%. Among them, 61% were girls. The majority of the sample (57%) had been using the Internet for more than four years, 39% for two to four years, and 10% for less than two years. With regard to the frequency of Internet use, 72% of the sample reported that they go online once or more a day and 26% said they go online once or more a week. About 3% used the Internet less often.
The survey instruments included a variety of measures to assess the following topics: (1) vulnerability to privacy risks; (2) benefits resulting from information disclosure; (3) privacy self-efficacy; (4) the level of concerns for online privacy; (5) privacy protective behaviors; and (6) intrapersonal sources.
To measure young adolescents' vulnerability to privacy risks, six items were developed from prior studies addressing risk perceptions caused by privacy invasion among teens (Turow and Nir 2000; Lenhart 2005; Liau, Khoo and Ang 2005; Youn 2005; Grant 2006). These items encompassed five components of perceived risks: psychological risk (“feeling anxious or regretful”), social risk (“having conflicts with parents”), financial risk (“experiencing financial loss,”“experiencing identity theft”), time risk (“getting junk email or unwanted mail”), and physical risk (“my personal information may be misused”). Respondents were asked to indicate the likelihood they felt each risk would occur to them. Items were all rated with a 5-point Likert scale from 1 = “not at all likely” to 5 = “very likely.” Six items were aggregated for further analysis (α = .80).
Perceived benefits associated with information disclosure were examined with ten items. Respondents were asked to indicate benefits they may receive in exchange for submitting their personal information to a Web site. Ten potential benefits were primarily derived from prior studies on teens' Internet use (Lenhart, Rainie and Lewis 2001; Youn 2005). They were “listen to or download music,”“play games,”“get information about product,” or “join clubs or groups,” to name a few. Responses were rated with a “yes” or “no” dichotomous format. For subsequent analysis, these items were indexed by adding the number of “yes” responses, with more benefits resulting in higher values (α = .58).
Privacy self-efficacy was measured using two items, which were developed by examining prior work on a related construct. Internet self-efficacy (Eastin and LaRose 2000; LaRose, Maestro and Eastin 2001) served as the basis for developing privacy self-efficacy among young adolescents. But, the Internet self-efficacy scale may not be directly applied to this study because it consists of the items that tap into individuals' beliefs in their abilities to use the Internet to accomplish specific Internet-related tasks. It is also designed for assessing adult consumers' Internet self-efficacy. Thus, this study developed items estimating young adolescents' general confidence in protecting their privacy from e-marketers' information practices. Young adolescents' confidence in mastering specific Internet skills for privacy protection was not assessed. The two items used in this study were: “I feel confident dealing with the ways that companies collect and use my personal information on the Internet” and “I feel confident learning skills to protect my privacy on the Internet” (r = .28). Responses were estimated using a 5-point Likert scale anchored by 1 = “strongly disagree” and 5 = “strongly agree.”
The level of privacy concerns was measured with one single item, which has been adopted from prior studies (Milne and Boza 1999; Phelps, Nowak and Ferrell 2000; Phelps, D’Souza and Nowak 2001). Respondents were asked, “How concerned are you about the ways that companies collect and use personal information about you on the Internet?” The level of consumer concern for privacy was assessed on a 5-point Likert scale ranging from 1 = “not at all concerned” to 5 = “very concerned.”
Young adolescents' protective behaviors in handling privacy risks were measured with items assessing three coping strategies: fabricate, seek, and refrain. These three coping strategies were each rated using two items. The items were derived from prior privacy studies investigating privacy protection behaviors (Sheehan and Hoy 1999; Milne and Culnan 2004; Milne, Rohm and Bahl 2004; Youn 2005; Moscardelli and Divine 2007). The wording was modified for young adolescents when necessary. The two items for “fabricate” responses were: “I use a false name or false ID” and “I provide incomplete information about me” (r = .44). The two items for “seek” responses were “I ask somebody (e.g., parents and teachers) what I should do” and “I read the privacy statement provided by the site” (r = .41). For “refrain” responses, “I go to other Web sites that don't ask for my personal information” and “I do nothing and leave the Web site” were used (r = .43). Respondents were asked how often they engaged in these activities when they respond to privacy risks. Responses were measured on a 5-point scale from 1 = “never” to 5 = “very often.” The two items for each coping strategy were aggregated for subsequent analysis.
As for intrapersonal sources, gender was dummy-coded as 0 = male and 1 = female. Internet use was assessed with two questions asking about the frequency of Internet use (“how often do you go online?”) and Internet use duration (“how long have you been using the Internet?”). Privacy knowledge was estimated by four items through a yes or no format. It should be noted that this study measured general knowledge of e-marketers' information collection and use practices, instead of specific, contextual knowledge of privacy policies adopted by certain Web sites. Some items assessed whether or not young adolescents were aware of how their information would be used or the extent to which their information would be accessible to other companies. Items had been generated from the privacy literature (Nowak and Phelps 1992, 1995). Raw scores were summed, with higher values indicating more knowledge about privacy (α = .64). Persuasion knowledge, that is, consumers' confidence in their ability to understand marketers' tactics, was assessed using five items developed by Bearden, Hardesty and Rose (2001). Responses were measured on a 5-point Likert scale from 1 = “strongly disagree” to 5 = “strongly agree” (e.g., “I can see through sales gimmicks used to get consumers to buy”). Raw scores were also added (α = .88). Complete questions are presented in Appendix 1, and a summary of correlations and descriptive statistics for each construct is given in Appendix 2.
To investigate hypothesized relationships among the constructs, a series of regression models were analyzed. In particular, this study expected that the level of online privacy concerns would mediate the effects of cognitive appraisals on young adolescents' privacy protection behaviors. To assess such a mediating role of online privacy concerns, this study performed three separate regression models recommended by Baron and Kenny (1986). Assuming that there is a predictor (A), a mediator (B), and a criterion variable (C), one would regress B on A in model 1, regress C on A in model 2, and regress C on A and B in model 3 (Table 1). This analytical approach allowed the researcher to examine a two-step process in which three cognitive appraisal variables (A) led to changes in the level of online privacy concerns (B), which in turn was expected to be associated with privacy-protecting behaviors (C).
Table 1. Hypotheses Testing and Test for Mediation
H1 through H3 were tested by using model 1, which accounted for 24.7% of the variance in the level of online privacy concerns. As predicted in H1, perceived vulnerability to privacy risks was positively related to the level of privacy concerns, with a regression coefficient of .366 (p < .001). With regard to H2, perceived benefits associated with information disclosure were negatively related to the level of concern for privacy, with a regression coefficient of −.209 (p < .05). H3 predicted a positive relationship between privacy self-efficacy and the level of online privacy concerns. Contrary to H3, privacy self-efficacy did not have a significant impact on the level of privacy concerns (β = .066, ns). Thus, the findings provided support for H1 and H2, but not for H3. Among intrapersonal variables, gender was a significant predictor, with girls showing stronger privacy concerns (β = .205, p < .05). However, Internet use, persuasion knowledge, and privacy knowledge did not appear to be related to the level of privacy concerns.
Model 3 was used to test H4, which predicted the relationships between the level of privacy concerns and coping behaviors to protect privacy. Because privacy protection behaviors were measured with the three coping strategies of fabricating, seeking, and refraining, three separate models were performed for each strategy. The models explained 5.1% of the variance for fabricating, 30.3% for seeking, and 23.1% for refraining. As predicted, when the respondents were more concerned about online privacy, they were more likely to engage in risk-coping behaviors, such as seeking out advice or information (β = .353, p < .001) and refusing to use certain Web sites (β = .237, p < .05). The level of privacy concerns was positively related to fabricating personal information, but the relationships did not reach significance (β = .189, p < .10). Thus, the findings provided partial support for H4.
It is noteworthy that gender and Internet use contributed significantly to the regression equations (model 2), explaining behaviors such as seeking and refraining. Gender appeared to be a significant predictor of “seeking out advice or information” (β = .176, p < .05) and refraining from using Web sites (β = .178, p < .05), with girls more likely to engage in these behaviors. Likewise, the respondents using the Internet less frequently tended to seek out more advice (β = −.225, p < .01) or refuse to use certain Web sites (β = −.223, p < .05).
Test for Mediation
To establish mediation, Baron and Kenny (1986) specified four conditions among the predictors (A), the mediator (B), and the criterion variables (C). First, the predictors (A) must be significantly related to the mediator (B) in model 1. The findings from model 1 indicated such relationships. Perceived vulnerability to privacy risks and perceived benefits of information disclosure were significantly related to the level of online privacy concerns. Second, the predictors (A) must be significantly associated with the criterion variables (C). The findings from model 2 showed that perceived vulnerability to privacy risks was significantly related to protective behaviors such as seeking and refraining and perceived benefits of information disclosure was also related to information-seeking behaviors. Third, the mediator (B) must significantly affect the criterion variables (C). The results from model 3 established this effect, showing that the level of privacy concerns had an effect on privacy protection behaviors such as seeking and refraining.
Fourth, the effects of the predictors (A) on the criterion variables (C) must be less when the mediator (B) is included in model 3. Namely, the regression coefficients of the predictors (A) should be reduced in model 3, when compared with those estimated in model 2. The comparison of regression coefficients of the predictors in models 2 and 3 indicated that the effects of cognitive appraisal variables were reduced considerably given the presence of the mediator in the model. None of the cognitive appraisal variables reached significance with p > .05. Hence, we can conclude that the level of online privacy concerns fully mediated the effects of risk and benefit cognitive appraisals on privacy-protecting behaviors such as seeking and refraining.
DISCUSSION AND CONCLUSIONS
With Rogers' (1975, 1983) protection motivation theory as the theoretical framework, this study identified determinants of young adolescents' level of online privacy concerns, which subsequently affect their resulting behaviors to protect their privacy. Using the test for mediation, the level of privacy concerns was found to mediate the effects of risk and benefit appraisals on privacy protection behaviors. Particularly, a greater level of risk perceptions caused by information disclosure led to more concerns over privacy, whereas greater perceptions of benefits offered in information exchange resulted in less concern over privacy. Contrary to the researchers' expectation, the privacy self-efficacy young adolescents felt did not strengthen their level of privacy concerns. As a mediating variable, the level of privacy concerns appeared to be an important motivation for privacy protection behaviors such as seeking advice or refraining from using certain Web sites.
An observation of regression coefficients of cognitive appraisals indicated that perceived vulnerability to privacy risks was the most important determinant in explaining the level of privacy concerns. This finding gives consumer educators insights regarding privacy literacy education for young adolescents who are in transition from being children protected by COPPA to teens who are not. Unlike the findings in health-related literature, which argue that self-efficacy is the strongest predictor of intention and behaviors (Floyd, Prentice-Dunn and Rogers 2000), this study showed that young adolescents' concerns over online privacy is affected by threat appraisals. In privacy education, an emphasis on privacy risks associated with information disclosure would be effective to trigger motivations to protect privacy for young adolescents. Specifically, a post hoc correlation analysis revealed that privacy risks such as psychological angst, unwanted harmful messages or junk emails, and misuse of personal information intensified the level of privacy concerns (Appendix 3). Therefore, privacy education needs to increase young adolescents' awareness and knowledge about technological solutions such as setting up a filter for junk emails or using tight privacy settings in social networking sites as coping strategies to deal with these risks.
It is notable that privacy self-efficacy did not appear to be positively related to the level of privacy concern. Several alternative explanations are possible. Among young adolescents, confidence in their ability to protect their personal information from e-marketers may be so strong and widespread that they have little concern about the negative consequences that can be associated with information disclosure. This is perhaps because young adolescents think they are in control over information privacy or online safety. As a result, their perception of privacy self-efficacy may not lead to a motivation to protect privacy. However, it may be questionable whether young adolescents are actually capable of coping with and averting privacy risks. Given that young adolescents have not fully developed the “scientific” understanding of technical and social aspects of Internet use (Yan 2006), their perception of privacy self-efficacy could be optimistically biased. Given that their beliefs and knowledge of privacy is still forming at the beginning stage of Internet use, it would be important to examine possible erroneous beliefs held by vulnerable, developing adolescents regarding their confidence in privacy protection.
Insignificant effects of the self-efficacy appraisal on protection motivation also echoed the argument that Floyd, Prentice-Dunn and Rogers (2000) tentatively made in their meta-analysis of research on protection motivation theory. They indicated that studies on children tended to show lower relationships between coping appraisal and protective motivation than studies on college students and adults. There may be a tendency that, when individuals are less cognitively sophisticated, their assessments of coping strategies are less predictive of their protective intentions and behaviors. Another reason for failure of the self-efficacy variable in explaining privacy protection motivation may be due in part to the way of measuring the self-efficacy construct in this study. The majority of prior studies using protection motivation theory have assessed self-efficacy with regard to the perceived ability of the individual to actually carry out the specific adaptive response provided by the intervention program (Maddux and Rogers 1983; Floyd, Prentice-Dunn and Rogers 2000). However, this study measured the general confidence young adolescents felt in protecting their privacy from e-marketers' information collection practices, instead of measuring specific adaptive coping strategies. Such general confidence in privacy protection abilities may have attenuated the relationship between privacy self-efficacy and the level of privacy concerns. The relationship between privacy self-efficacy and online privacy concerns is less established so far, but certainly worthy of further investigation.
This study revealed that the level of online privacy concerns led young adolescents to adopt several coping behaviors to protect their privacy from e-marketers. As for approach coping behaviors, privacy-concerned young adolescents seek out interpersonal support from parents or teachers, indicating that they rely on parental and school guidance to avoid potential risks associated with information disclosure. This result illustrates the central roles of parental mediation and school education in developing personal responsibility to promote online safety behaviors and decrease privacy risks for young adolescents who are not under legal protection of COPPA (Lwin, Stanaland and Miyazaki 2008; Youn 2008). Seeking interpersonal advice is in many ways an opportunity to spark conversations with adults, permitting the open exchange of information on negative consequences resulting from privacy loss.
However, parents are increasingly pressed to stay informed of ever-evolving media technologies and marketing tactics on the Internet and thus are faced with challenges in controlling or influencing their adolescents' online safety behaviors (Subrahmanyam and Greenfield 2008). Given that legal protection of COPPA is not available for adolescents over thirteen years of age, community- or school-sponsored interventions should be provided for parents to improve their parenting skills regarding supervising their adolescents' online experiences, so parents can have meaningful conversations about e-marketers' information collection practices with their adolescents (Youn 2008). A school-based intervention program aimed at increasing young adolescents' level of privacy concerns and coping behaviors should also be formally incorporated in the media education curriculum (Wirth et al. 2007). Privacy education in the young adolescent years will lead to a greater likelihood of engaging in self-protective behaviors in the late adolescent years. Thus, early adolescence should be considered as the optimal time to start privacy education, informing children about possible online risks regarding e-marketers' information collection practices and how to cope with them.
Privacy-concerned young adolescents were also found to seek more information by reading the privacy statement provided by the Web sites to handle privacy risks. This finding also challenges policy makers, industries, and consumer educators because there is much doubt regarding the efficacy of a privacy statement for teen-oriented Web sites (Steeves 2006). Policy makers and industries need to develop a privacy statement which is both simple and easy to understand, so as to not overwhelm young adolescents with highly detailed content (Youn 2005). Consumer educators should train young adolescents in reading such statements, teaching them to which information they need to pay attention and what the specific terms mean in the privacy statement.
As for avoidance coping strategies, this study found that young adolescents with privacy concerns tended to refrain from using certain Web sites that require registration. This coping behavior may be considered to be problematic by discouraging young adolescents from using Web sites which ask for personally identifying information but possibly provide benefits. Consumer educators should teach young adolescents how to evaluate benefits offered in information exchange with caution, while securing their privacy rights online. Consumer educators also need to coach young adolescents about the ways of differentiating safe sites from unsafe sites, by paying attention to specific indicators such as third-party endorsements or Web site safeguards (Rifon, LaRose and Choi 2005; LaRose and Rifon 2007; Lwin, Stanaland and Miyazaki 2008).
It is noteworthy that young adolescents' privacy concerns had marginal effects on the approach coping strategy of fabricating personal information. Studies on adult consumers and older adolescents exhibited that both groups withhold their identity by falsifying their personal information or by providing incomplete information on Web sites, as their concerns for online privacy heighten (Sheehan and Hoy 1999; Milne, Rohm and Bahl 2004; Youn 2005; Moscardelli and Divine 2007). It turned out that this is not true for young adolescents. It is speculated that privacy-concerned young adolescents are not accustomed to fabricating their personal information yet or do not recognize the importance of remaining anonymous in the branded e-marketplace. Consumer educators need to emphasize the value of anonymity and the ways of maintaining it among young adolescents.
Some findings of this study should be interpreted with caution. Although the regression models examined here were able to account for 23–30% of privacy protection behaviors except for fabricating responses, a substantial amount of the variance remained unanswered. Some possible reasons for this could be related to the measurement issue. This study used a single-item measure to assess the privacy concern level. Given that multiple items explain more variance of the focal variables of interest, future research needs to use multiple items for privacy concerns. Measures for privacy self-efficacy used in this study may also be problematic. The two items of privacy self-efficacy had a correlation of .28, which is somewhat low. In this study, these two items assessed young adolescents' general beliefs in confidence in their own privacy protection, without reflecting their specific skills or knowledge in this domain. As discussed earlier, prior studies using Rogers' protection motivation theory have examined self-efficacy as confidence in one's ability to initiate and implement specific adaptive responses recommended in the intervention program (Maddux and Rogers 1983; Floyd, Prentice-Dunn and Rogers 2000). Presumably, the general level of confidence in abilities to protect one's privacy from e-marketers may weaken the relationship with protection motivation, that is, online privacy concerns. Recently, LaRose and Rifon (2007) developed the 10-item scale for measuring adult consumers' privacy self-efficacy. Unfortunately, this scale was not available when the data were collected. However, some similarities can be found in that some items of their scale reflect overall confidence in protecting privacy online. Furthermore, the model needs to include other factors that may contribute to explaining young adolescents' privacy concerns and protection behaviors. One possible consideration would be consumer traits such as “trust propensity” (Hui, Teo and Lee 2007). It is expected that some adolescents may be concerned with e-marketers' information collection practices and thus be motivated to engage in protective behaviors if they have a low level of trust toward Web sites as exchange partners.
Some conclusions of our study should also be tempered by the limits of the study with regard to sampling. This study collected the survey data only from seventh graders in one public middle school. Owing in part to the limited sampling frame, the samples were relatively small. In addition, parents of young adolescents have started to express their concerns about children's online activities, especially regarding the use of social networking sites. Given that our research topic relates to online privacy, some parents might not have allowed their children to participate in this study. This could have led to a non-response bias in our sample in that this study could have included children whose parents were less concerned about their children sharing views and opinions. Hence, caution should be exercised when interpreting the results.
Young adolescents are at temporal borders in terms of making the transition from children legally protected by COPPA to teens without the same protection. Considering this critical stage in which young adolescents find themselves, it would be valuable to understand how they perceive and protect their privacy in the online marketplace. Overall, the results of this study provide support for the theorized linkage between risk–benefit assessments, privacy concerns, and protective behaviors; the findings extend the conclusions drawn from adult consumers to vulnerable adolescent consumers. It is hoped that this study helps consumer educators and policy makers develop effective privacy literacy programs, which encourage young adolescents to adopt safe and productive Internet usage practices, while optimizing their benefits.
Table 2. Measures of Constructs
Persuasion knowledge (5-point Likert scale)
• I know when an offer is “too good to be true”
• I can separate fact from fantasy in advertising
• I can tell when an offer has strings attached
• I can see through sales gimmicks used to get consumers to buy
• I have no trouble understanding the bargaining tactics used by salespersons
Privacy knowledge (yes or no format)
• How my information will be used
• The extent to which your information will be accessible to other companies
• Whether or not the Web site requires valid parental permission when collecting information from me
• Whether or not there is any information about age restrictions for online activities
Perceived vulnerability to privacy risks (5-point Likert scale)
• Feeling uncomfortable (e.g., feeling anxious, guilty, or regretful)
• Having conflicts with parents
• Getting junk email or unwanted mail
• Experiencing a feeling that my personal information may be misused
• Experiencing financial loss
• Experiencing identity theft
Perceived benefits of information disclosure (yes or no format)
• Listen to music or download music files onto your computer
• Play games online or download games
• Buy things online, such as books, clothing, or music
• Research information about products
• Get news about events
• Join clubs, groups, or teams
• Enter contests or sweepstakes
• Communicate with friends online like chat rooms or pen pals
• Send “instant messages” to someone who is also online
• Get a free email address
Privacy self-efficacy (5-point Likert scale)
• I feel confident dealing with the ways that companies collect and use my personal information on the Internet
• I feel confident learning skills to protect my privacy on the Internet
Privacy concern (5-point Likert scale)
• How concerned are you about the ways that companies collect and use personal information about you on the Internet?
Protection behaviors (5-point Likert scale)
• I use a false name or false ID
• I provide incomplete information about me
•I ask somebody (e.g., parents and teachers) what I should do
• I read the privacy statement provided by the site
• I go to other Web sites that do not ask my personal information
• Usually, I do nothing and leave the Web site
Table 3. Correlation Matrix and Descriptive Statistics