Getting the privacy calculus right: Analyzing the relations between privacy concerns, expected benefits, and self-disclosure using response surface analysis

Introduction

In 2001, in a report aimed to outline how internet users’ experience can be improved, Barry Brown from Hewlett Packard Laboratories observed “something of a ‘privacy paradox’” (2001, p. 1): Surprisingly, despite voicing concerns about privacy and security, users gave up their privacy in exchange for only little gain (e.g., supermarket loyalty points). Since then, the concept of privacy paradox, which generally refers to a gap between reported concerns/attitudes about privacy and intentions/behavior, has been a central dimension of debates about privacy self-management (e.g., adoption of protective behavior, use of online services, disclosure of information; Barnes, 2006; Barth & de Jong, 2017; Baruh et al., 2017; Dienlin & Trepte, 2015; Kokolakis, 2017).

Extant literature offers a number of explanations for the privacy paradox phenomenon. One commonly cited explanation is that many of the studies observing the privacy paradox (Fogel & Nehmad, 2009; Shin & Kang, 2016; Taddicken, 2014) focus only on concerns or risk perceptions as a predictor of privacy management behavior. A commonly cited alternative to this approach is the privacy calculus model (Culnan & Armstrong, 1999), which predicts that individuals’ decisions about privacy management behavior involve weighing the expected negative consequences of sharing personal information along with the expected benefits of such behavior. Accordingly, individuals would be more likely to engage in behaviors such as signing up for a new social media platform or disclosing information when the anticipated benefits of doing so exceed the expected costs.

While privacy calculus has become a key concept in privacy literature, researchers have mainly used traditional statistical techniques (e.g., multiple regression) that may not be as informative about privacy calculus mechanism as relatively novel statistical approaches. In this study, we hence reinvestigate privacy calculus using a novel technique called Response Surface Analysis (RSA). RSA can put privacy calculus to a statistical test that is more closely aligned with the premise of privacy calculus by directly analyzing how the difference between concerns about privacy and anticipated benefits (e.g., benefits being higher than concerns) is related to online self-disclosure. Therefore, we reanalyze three data sets to determine if the privacy calculus indeed helps explain these data.

Privacy Calculus

An increasing number of studies offer evidence against the privacy paradox and in favor of the privacy calculus model: The privacy calculus is observed in different cultures (Trepte et al., 2017), on social networking sites (SNSs; Krasnova et al., 2010), or in e-commerce, health, and news consumption contexts (Bol et al., 2018). In addition, an empirical meta-analysis of k = 37 studies found a statistically significant relationship between privacy concerns and online self-disclosure (Baruh et al., 2017). Although the reported relation is small (r = −.13), it is not trivial and represents further evidence against the privacy paradox. Contrary to the assertion of the privacy paradox, this finding implies that people who are more concerned about their privacy disclose less information online. For instance, we would expect someone with a high level of concern about their privacy to be more likely to have private social media pages. Moreover, recent reviews of privacy management behavior suggest that perceived benefits may be a stronger predictor of disclosure intention and behavior than concerns about the anticipated negative outcomes (Barth & de Jong, 2017; Gerber et al., 2018).

However, the privacy calculus model faces both conceptual and methodical challenges. Conceptually, with its emphasis on a rational comparison of benefits and costs, the privacy calculus model builds on the “calculus of behavior” (Laufer & Wolfe, 1977, p. 35) and, more broadly, on the rational choice paradigm (Simon, 1955). As such, like other rational choice theories, the privacy calculus model has been criticized for assuming (or overstating) that individuals rationally weigh the risks and benefits of sharing information (Acquisti, 2004; Knijnenburg et al., 2017).

There are several reasons why, in privacy-related decisional contexts, individuals may not be able to engage in a fully rational calculus. First, in many contexts, privacy-related decisions are often automatic and driven by emotions (Masur, 2019; Zhang & Fu, 2020). Second, individuals’ privacy-related decisions may often be based on “incomplete information” because both the risks and the benefits entail tangible as well as intangible dimensions (Acquisti, 2004). This impedes individuals’ ability to make informed decisions. Specifically, not only will it be difficult for individuals to accurately estimate the costs of disclosing information (Acquisti, 2004; Acquisti et al., 2018; Barth & de Jong, 2017), but also lack of information about means of protection may prevent individuals from acting on their intentions (Brough & Martin, 2020; Park, 2013). Third, the concept of bounded rationality underscores that insofar as the human ability to engage in cognitive information processing is limited, privacy-related decisions will often rely on cognitive shortcuts. Reliance on cognitive shortcuts may result in several biases, such as optimistic bias (underestimating the risk of a negative outcome), status quo bias (preference for sticking to the current situation), or immediate gratification bias (Acquisti, 2004; Acquisti et al., 2018; Bandara et al., 2020; Hallam & Zanella, 2017). Participation in social networks, as their use is associated with social validation, connectivity, and self-presentation (Lee et al., 2013), is a prime example of how expectations about immediate gratifications may override the consideration of longer-term risks to one’s privacy or security (Barth & de Jong, 2017; Debatin et al., 2009). Growing research on so-called dark patterns—interface designs that trick users into engaging in a behavior they did not mean to (Brignull, 2011)—underscores how such cognitive biases may be exploited by organizations to steer users into suboptimal privacy decisions (Nouwens et al., 2020; Waldman, 2020).

Related to these concerns about individuals’ capacity for making rational calculations, in a recent review, Barth and De Jong (2017) argue that one explanation for why users may perform actions online which run counter to their privacy concerns might be that there are contexts when users do not make a risk calculation when thinking about privacy, but instead focus on the expected benefits. This may happen due to routinized engagement with a platform, resulting in suppression of considerations about privacy risks. It may also happen in contexts where “value of desired goal outweighs risk assessment” (Barth & De Jong, 2017, p. 1048). Such contexts would include those within which the need for a service or product is so high that consideration of risks would be inconsequential and thereby unnecessary from the standpoint of the user. This would be the case when we consider simple conveniences in our lives, such as owning a smartphone or a credit card. Conversely, it is also possible that the expected benefits from a service or a product are insufficient to warrant a risk-benefit calculation, reducing the chances that risk considerations will factor into the decision to share information. Additionally, social compliance may be an important factor in reducing our ability to make autonomous decisions about disclosing information. This would be, for example, the case when disclosure is the norm for other members of a social network platform (Gerber et al., 2018; Lutz & Strathoff, 2014; Taddicken, 2014).

Reanalysing Privacy Calculus

Methodologically, one can question whether the studies supporting the privacy calculus have put it to a strict methodical test. For example, to test the hypotheses proposed by privacy calculus, most studies used multiple linear regression, path analysis, or structural equation modeling. A common approach is to model risks and benefits as predictors, with risks being negatively and benefits being positively associated with self-disclosure (e.g., Dinev & Hart, 2006; Trepte et al., 2017).

While useful for identifying the isolated linear impacts of risk and benefit perceptions of disclosure of personal information, the aforementioned conventional approaches cannot directly investigate the conjoint effects of both variables. Specifically, linear models cannot explicitly test whether the direction of the difference between risk and benefit perceptions influence disclosure (e.g., whether people disclose more if risks are larger than benefits or if benefits are larger than risks). This pattern would not be possible to test using multiple regression since it only provides the main effects of individual predictors (by controlling for the other predictors). In a similar vein, the effects of the respective levels of perceived benefits and risks are difficult to test via conventional methods. For instance, as discussed above, it may be the case that when expected benefits are at a high level, individuals are more likely to disclose personal information despite risk perceptions also being at a high level. Alternatively, as mentioned above, it is also possible that when individuals’ benefit perceptions are low, they may not feel the need to evaluate risks before deciding not to share information. Unlike conventional methods such as multiple regression, RSA can test whether both predictors being at high levels (vs. at low levels) are statistically associated with the outcome.

Because we cannot answer these theoretically important questions using conventional analyses, in this study, we use a novel analytical technique called polynomial regression with RSA (Edwards & Parry, 1993). While the aim of this paper is primarily to introduce the application of RSA, as a novel statistical approach, to investigating privacy calculus, it also expands our theoretical understanding of privacy calculus by providing additional conceptual insights. First, through applying RSA, we achieve a test of the privacy calculus that is closer to its theoretical assumptions that the decision to share information is the result of the difference between levels of risk and benefit perceptions rather than being the result of the isolated influence of risk and benefit perceptions. Second, by allowing us to investigate at what respective levels of benefit and risk perceptions the difference between them is most likely to influence the decision to share information, RSA can improve our understanding of the mechanisms that may result in risk considerations not being related to information sharing. Because RSA is a novel type of analysis and not routinely used in Communication research, we first provide a brief overview of the technique. Then, we proceed by discussing how it helps advance the conceptual debates about privacy calculus and introduce our main hypothesis and our research question.

Response Surface Analysis

RSA is a fine-grained technique suitable for testing conjoint effects, in other words, how differences in two predictor variables (e.g., the difference between perceived risk and anticipated benefit) relate to an outcome variable (e.g., intention to disclose personal information in social media). RSA has often been used to investigate how two predictor variables relate to an outcome variable such as similarity effects (Cemalcılar et al., 2018) and is suitable to investigate a variety of conjoint effects.

Originally, the conjoint effects of two variables were tested using difference scores, which often take the form of algebraic, squared, or absolute differences. However, these approaches suffer from a variety of statistical and conceptual shortcomings, including (a) lower reliability than its components, (b) difficulty in interpretation, and (c) confounding effects (for a detailed summary, see Edwards, 2002). RSA was developed to overcome these issues by simultaneously modeling the relationship between the outcome and the two predictors in a polynomial model, which encompasses both the differences and higher-order terms of these predictors (Edwards, 2002).

RSA starts with a polynomial regression (1). This polynomial regression contains the outcome variable (Z), linear and quadratic terms for the two predictors (X, X², Y, Y²), and the interaction of the predictors (XY):

Z = b₀ + b₁X + b₂Y + b₃X² + b₄XY + b₅Y² + e.                        (1)

As a result, the polynomial regression facilitates the testing of both linear and non-linear relations. However, rather than merely interpreting the coefficients of the polynomial regression, in RSA the polynomial regression coefficients are used to create a three-dimensional plot depicting how two predictors relate to the outcome, and to compute response surface values. In other words, these parameters are used to examine a three-dimensional representation of the relationship between the predictors and the outcome (Edwards & Parry, 1993; for an example, see Figure 1).

The response surfaces have several properties that can be used to make inferences. The line of congruence (LOC; blue line in Figure 1) is mathematically represented by the parameters a₁ (i.e., b₁ + b₂) and a₂ (b₃ + b₄ + b₅). It is the line where the two predictors have the same values (i.e., X = Y). When a₁ is significant but a₂ is not, LOC is linear. A positive a₁ indicates a linear additive effect, suggesting that the predicted outcome is higher when similar values of the predictors are on higher levels as compared to lower levels. When a₂ is significant, it means that LOC is curvilinear, producing the shape of a parabola. In other words, if both predictors increase, the outcome increases even stronger (i.e., exponentially).

Next, the line of incongruence (LOIC; red line in Figure 1) addresses situations when the two predictors have opposite values (i.e., X = −Y). LOIC is represented by the parameters a₃ (i.e., b₁ − b₂) and a₄ (i.e., b₃ − b₄ + b₅). A significant a₃ and a non-significant a₄ indicate that the line along the LOIC is linear and that the direction of the discrepancy (X > Y or Y > X) between the two predictor variables is important for the outcome. A positive a₃ suggests that the predicted outcome is at high levels when the first predictor is higher than the second predictor. A negative a₃ suggests that the outcome is at high levels when the second predictor is higher than the first predictor. A significant a₄ indicates that the LOIC is curvilinear, producing the shape of a parabola.

For an overview of the coefficients’ meaning, see Table 1. For a more comprehensive explanation and visual representations of the surface parameters, see Nestler et al. (2019, p. 294). For a tutorial, see Edwards and Parry (1993).

Table 1. Meaning of the Coefficients.

Combining Privacy Calculus and Response Surface Analysis

The use of RSA to investigate privacy calculus enables researchers to pose and answer important and interesting questions. For example, does the privacy calculus only take place once costs and/or benefits reach a certain magnitude? If so, at what levels of concerns and gratifications?

Furthermore, this methodology is informative for different explanations of the privacy paradox summarized above. Consider, for example, how “incomplete information” may both result in an underestimation of risks and/or a lack of knowledge regarding the implementation of effective protective measures. In RSA, these two potential consequences of “incomplete information” would, however, manifest themselves differently: When individuals underestimate risks, we would expect a positive relationship between the size of the difference between benefits (high) and risks (suppressed, low) and disclosure behavior. Within the RSA framework, we would observe that while benefits have a positive and linear main effect (significant b₁ and non-significant b₃–b₅), concerns do not have a main effect (non-significant b₂); furthermore, the line of incongruence would be linear and positive (significant a₃ and non-significant a₄), but this effect would be driven only by the benefits (significant b₁ and non-significant b₂). However, when individuals lack procedural knowledge about protecting themselves, we could expect to see disclosure behavior even when there is only a negligible difference between perceived benefits and risks. In RSA terms, we would expect that both benefits (b₁) and concerns (b₂) are positive and significant while the other predictors (b₃–b₅) are non-significant, but because concerns cannot translate into protective behavior, the difference between benefits (b₁) and concerns (b₂) would be less likely to predict behavior, leading to a non-significant line of incongruence (i.e., a₃ and a₄).

As a second example, let us revisit what Barth and De Jong describe as contexts where the expected value is so high that individuals do not consider the risks. What is important to note here, though, is the qualitative distinction between (a) “not considering” risks because the benefits are very high and (b) suppressing concerns about risks because there is no viable option for acting otherwise—a pattern related to what has been called privacy fatigue (Choi et al., 2018), privacy apathy (Hargittai & Marwick, 2016), or privacy cynicism (Hoffmann et al., 2016; van Ooijen et al., 2022). In the former, risk estimations might be low and potentially have no main effect on disclosure behavior, while benefits are high and may have a positive main effect. In RSA terminology, this model would translate to a linear and positive effect of benefits (significant b₁) while all of the other parameters (b₂–b₅ and a₁–a₄) are non-significant. In the latter case, it can be expected that disclosure behavior will be positively associated with a congruent increase in both benefit and risk perceptions, represented by a negative and non-linear line of incongruence with no main effects of the predictors (i.e., non-significant a₁–a₃, significant a₄; non-significant b₁–b₂ and significant b₃–b₅).

These examples suggest that RSA can contribute to the literature on privacy calculus in several ways. Notably, there is a growing body of literature that challenges the rationality assumption to investigate privacy management behavior. Such studies incorporate factors such as cognitive biases and affective states into the calculus, which would also be possible to test using RSA methodology (Kehr et al., 2015; Wilson & Valacich, 2012; Zhang & Fu, 2020). To untangle the intricate relationship of perceived benefits and concerns with online self-disclosure, in this study, we focus on the line of incongruence. Specifically, we formulate the following hypothesis:

H1: People are more likely to share information when perceived risks are lower than perceived benefits.

Accordingly, we expect a significant linear line of incongruency along with a non-significant line of congruence (i.e., significant a₃ and non-significant a₁, a₂, and a₄). Figure 1 visualizes this relationship. For instance, we expect that sharing behavior is at its highest (i.e., +2) for a participant that scored +2 on benefits and −2 on concerns, whereas the outcome is at its lowest (i.e., −2) for another participant that scored −2 on benefits and +2 on concerns. The same pattern can be observed for any pair of scores. A linear LOIC (as well as a nonsignificant LOC) informs us that this comparison is statistically significant.

The examples discussed above also raise the possibility that the relationship between these two predictors and sharing information will vary as a function of whether the perceived risks and benefits are low, moderate, or high. In this light, we additionally aim to investigate the following research question:

RQ1: At what levels of perceived benefits and risks does the difference influence disclosure the most?

Figure 1. Example Plot for Assumed Relationships.

Note. The x-axis represents Uses & Gratifications, the y-axis represents concerns about privacy, and the z-axis represents sharing personal information online. The values of variables come from a hypothetical distribution (i.e., z-scores). LOIC is the red line and represents cases where the predictors have opposite values. According to privacy calculus, we expect that it has a positive slope: If gratifications are larger than benefits, self-disclosure increases. LOC is the blue line, where both concern and Uses & Gratifications have the same values.

Methods

Data Analysis

We analyzed the data in R (R Core Team, 2020) using the package RSA (Schönbrodt, 2017). The factorial validity of all scales was tested by confirmatory factor analysis (CFA) using the raw data and lavaan package in R (Rosseel, 2012), and the model fits were evaluated based on the guidelines that can be found in Kline (2015). We estimated the RSA after centering the predictors around their mid-scale point, whose composite scores were computed by taking the average of the items indicated by the CFA models. Centering around mid-scale facilitates interpretation of the coefficients and deals with multicollinearity (Aiken et al., 1991; Edwards & Parry, 1993). The regressions were conducted using ordinary least squares, which require that residuals are normally distributed. Analyses showed that the residuals of study 2 were not normally distributed. Because RSA uses robust estimators, which help address non-normality (Pek et al., 2018), we are nonetheless optimistic that the violation of the normality assumptions is not problematic. The data, the items, the analysis scripts, and a detailed documentation of the results, and the descriptive summary of the variables can be found in the online supplementary materials: (https://osf.io/sy2az/?view_only=1394c169381845408f8d3134db535b3a).

Since we used secondary data, we were not able to conduct a priori power analysis. However, a sensitivity power analysis conducted using G*Power 3.1 (Faul et al., 2009) with five predictors for polynomial regression (i.e., R² going from two to five predictors) indicated that we could detect an effect size as small as f₂ = .028 (i.e., R₂ = .027), f₂ = .017 (i.e., R₂ = .017), f₂ = .008 (i.e., R₂ = .008) for Dataset 1, 2, and 3, respectively, with 80% power at α = 0.05. Furthermore, the observed effect sizes across the datasets were greater than the values indicated by the sensitivity power analyses (see Table 2 for the effect sizes).

Dataset 1

Procedure and Participants

The data come from an online survey, conducted online via Qualtrics survey platform, focusing on the relationship between personality traits and social media use tendencies.

A total of 344 students at a private university in Turkey during April in 2015 completed the survey. The average age was 21.20 years (SD = 2.25), 60% were female, and 30% reported having a college or graduate degree.

Measures

Anticipated benefits were captured with uses and gratifications of Twitter scale (Baruh, 2010; Chen, 2011). The current study measured four dimensions of Twitter uses and gratifications: Using Twitter to (a) network with others (e.g., to meet new people); (b) satisfy social curiosity (e.g., to learn about daily lives of other people); (c) self-express (e.g., to make people understand me better); and to (d) maintain relationships (e.g., to keep in contact with family and friends). All items described above were measured on a 5-point scale (1 = strongly disagree to 5 = strongly agree). A hierarchical measurement model including all 15 items (M = 2.75, SD = 0.72) and four dimensions showed good factorial validity, χ²(86) = 229.48, p < .001, CFI = .95, RMSEA = .07, 90% CI [.06, .08], SRMR = .07. The reliability for the second-order factor (i.e., general UG factor) was high (⍵ = .90).

Perceived risks of disclosing personal information are operationalized as concerns about privacy, which was assessed with 7 items adapted from existing privacy scales on a 5-point scale (e.g., I worry about sharing information with more people than I intend to; Baruh & Cemalcılar, 2014; Stieger et al., 2013). We ran a series of CFAs to investigate the factorial structure of the scale. Three items were removed due to insufficient factor loadings. The resulting scale with 4 items (M = 3.11, SD = 0.75) showed acceptable levels of factorial validity, χ²(2) = 19.57, p < .001, CFI = .93, RMSEA = .16, 90% CI [.10, .23], SRMR = .04. Reliability was also at an acceptable level (⍵ = .73).

The dependent variable, sharing information on Twitter, was assessed using eight items adapted from the self-disclosure index (Miller et al., 1983). Respondents were asked to rate, on a 4-point scale (1 = never to 4 = more than once a day), the frequency with which they would tweet about various topics about themselves (e.g., my personal habits). A measurement model with 6 items (M = 1.99, SD = 0.48) showed just acceptable factorial validity, χ²(9) = 58.18, p < .001, CFI = .93, RMSEA = .13, 90% CI [.10, .16], SRMR = .04 and reliability was high (⍵ = .84).

Dataset 2

Procedure and Participants

The data come from an online experiment conducted in Germany during the fall term of 2017, which analyzed the privacy calculus using actual behavioral data (for more details on the study, see Dienlin et al., 2020). The field phase of the experiment lasted for one week. On an authentic website, participants were invited to discuss a current political topic (i.e., how to prevent terrorist attacks). Afterwards, participants answered a follow-up questionnaire about privacy concerns and obtained gratifications.

The final data set consists of 561 participants, of which 51% were female. The average age was 46.20 years (SD = 15.60), and 29% reported having a college degree.

Measures

Anticipated benefits of using the social networking site were captured with a 15-item scale of specific uses and gratifications. The scale consisted of five dimensions (informativeness, relevance, participation, meaningfulness, help). One example item is Using the participation platform it has been possible for me to learn things I would not otherwise have noticed. The scale had a 7-point answer format, with options ranging from 1 = completely disagree to 7 = completely agree (M = 4.71, SD = 1.00). Factorial validity was okay, χ2(85) = 448.03, p < .001, CFI = .93, RMSEA = .09, 90% CI [.08, .10], SRMR = .06 and reliability was good (⍵ = .95).

The perceived risks of disclosing personal information were operationalized with a 7-item scale of online privacy concerns. One example item is Using the participation platform I had concerns about my privacy. The scale had a 7-point answer format, with options ranging from 1 = completely disagree to 7 = completely agree (M = 3.45, SD = 1.25). The scale showed good factorial validity, χ2(14) = 44.22, p < .001, CFI = .99, RMSEA = .06, 90% CI [.04, .09], SRMR = .01 and reliability was high (⍵ = .92).

The dependent variable measured the number of words, likes, and dislikes shared on the website, which was then log-scaled (M = 1.92, SD = 2.28).

Dataset 3

Procedure and Participants

The data come from an online experiment conducted in the Netherlands during the fall term of 2017 that aimed to examine privacy calculus using hypothetical scenarios (Bol et al., 2018). Participants were instructed to read different scenarios in randomly assigned conditions and to look for information using a search engine, followed by visiting a website. After the experiment, participants filled out an online survey about perceived concerns and benefits and willingness for future self-disclosure (for more details about the experiment, see Bol et al., 2018).

The final sample consisted of 1131 participants (M_age = 56.00, SD_age = 16.30; 50% female, 37% higher education), and was representative of Dutch population.

Measures

Anticipated benefits were assessed by eight items, answered on a 7-point scale ranging from 1 = strongly disagree to 7 = strongly agree, either generated by the authors or based on the previous literature (M = 3.01, SD = 1.35). One sample item was I find sharing my personal information with [health/shopping/news] websites useful in my daily life. The factorial validity of the scale was okay, χ²(20) = 480.53, p < .001, CFI = .94, RMSEA = .13, 90% CI [.14, .15], SRMR = .04. Reliability was high (⍵ = .95).

Privacy concerns were assessed by 5 items adopted from Baek and Morimoto (2012). Items were on a 7-point scale ranging from 1 = strongly disagree to 7 = strongly agree (M = 5.25, SD = 1.35). One sample item was When I visit [health/shopping/news] websites, I have the feeling that others keep track of where I click. The scale showed good factorial validity, χ²(5) = 23.81, p < .001, CFI = .99, RMSEA = .06, 90% CI [.04, .08], SRMR = .01. Reliability was high (⍵ = .95).

To assess willingness for future online self-disclosure, participants were asked to report how likely it is for them to share personal information (e.g., their name) if they visited a similar website in the future on a 7-point scale (M = 2.24, SD = 1.28). The scale showed good factorial validity, χ²(21) = 117.33, p < .001, CFI = .99, RMSEA = .05, 90% CI [.06, .08], SRMR = .03. Reliability was high (⍵ = .92).

Results

The data were analyzed using RSA.¹ RSA requires that there be sufficient numbers of cases representing all possible combinations of two predictors (i.e., risks > benefits; benefits > risks; risks ≈ benefits; Shanock et al., 2010). Across all datasets, we fulfill that condition. For example, for Dataset 1, in 47.7% of the cases, perceived benefits were lower than privacy concerns, in 21.8% of the cases perceived benefits exceeded privacy concerns while in 30.5% of the cases perceived benefits and privacy concerns were equal (see online supplementary materials for all distributions of congruent and incongruent cases). In addition, because RSA is based on polynomial regression, another requirement is that residuals are normally distributed. Analyses revealed that the residuals of Dataset 2 were not normally distributed. To investigate whether the results are affected by the non-normally distributed residuals, we also conducted a bootstrapped RSA with 1000 samples. This technique is a valid strategy to effectively handle non-normally distributed residuals (Pek et al., 2018). The bootstrapped results were closely aligned with the regular ones (e.g., the same effects were significant). Because RSA is conducted with robust estimators and hence robust to violations of the normality assumption of residuals, and because results were virtually identical, in what follows we report the results of the regular RSAs. The results of the bootstrapped RSA can be found in the online supplementary materials. Table 2 presents the coefficients for polynomial regression and surface parameters.

Our focus is on the incongruence between risk and benefit perceptions (i.e., risks > benefits vs. benefits > risks). In RSA, this is represented by a₃ and a₄. As explained above, a significant a₃ with a non-significant a₄ shows that the incongruence effect is significant and linear (i.e., not curvilinear). As expected, in Dataset 2, this is exactly the pattern we observe. That is, a₃ was positive (i.e., .50) while other surface parameters were non-significant. This finding suggests that the number of words shared by participants was greater when perceived benefits exceeded perceived risks. For example, the predicted value of the number of words shared is around 2.15 (M = 1.92) for someone who scores 6 (on a 7-point scale) on benefits and who scores 4 (on a 7-point scale) on concerns about privacy; whereas the predicted value of the outcome is around 1.12 for someone with the opposite pattern (also, see Figure 2).

Table 2. Polynomial Regression Coefficients and Surface Parameters.

In Dataset 1 and 3, findings were similar to one another but slightly different from the findings in Dataset 2. Both LOC and LOIC were positive and linear (i.e., positive a₁ and non-significant a_2; positive a₃ and non-significant a₄). As in Dataset 2, the positive a₃ indicates that participants reported (the willingness for) sharing more information online when their anticipated benefits were higher than their concern for their privacy (compared to the other way around). At the same time, unlike in Dataset 2, the positive a₁ indicates that the outcome variables (i.e., self-reported self-disclosure on Twitter in Dataset 1 and the willingness for future online self-disclosure in Dataset 3) were greatest when both benefits and concerns about privacy were high (see Table 2 and Figure 1 for the parameters and plots).

Figure 2. Response Surfaces for Dataset 1–3.

Note. X-axis shows perceived benefits of online disclosure, y-axis shows concerns about privacy, z-axis shows specific outcome variables. The bag plots, as displayed on the surfaces, indicate the location, spread, correlation, skewness, and tails of the data (Rousseeuw et al., 1999), analogous to boxplots. The area inside the larger bag contains half of the observations, and the rest are located in the region between the inner and outer bag.

The findings suggest that, overall, the willingness for sharing information was highest when both the benefits and risks were highest, and the benefits were greater than the concerns compared to the opposite pattern. For example, in Dataset 1, the predicted value of information sharing on Twitter is around 2.26 (M = 1.99) for someone who scores 4 (on a 5-point scale) on benefits and who scores 3 (on a 5-point scale) on concerns about privacy; whereas the predicted value of the outcome is around 2.04 for someone with the opposite pattern (see Figure 2). In a similar fashion, in Dataset 3, the predicted value of the willingness for the future online self-disclosure is around 3.76 (M = 2.24) for someone who scores 6 (on a 7-point scale) on benefits and who scores 4 (on a 7-point scale) on concerns about privacy; whereas the predicted value of the outcome is around 2.43 for someone with the opposite pattern, which is still above the mean level, indicating the additivity effect of benefits and concerns.

Discussion

The present study reanalyzed three datasets by applying a novel analytical technique called RSA to understand better the relationship of anticipated benefits and risks of information sharing with online self-disclosure. While techniques like linear regression test how the benefits and concerns separately predict online self-disclosure, they do not offer a direct test of the main premise of the privacy calculus model, which predicts that self-disclosure depends on the difference between these variables, or more precisely, whether perceived benefits exceed perceived risks. The use of RSA allowed us to explicitly test how the difference between the benefits and concerns was associated with online self-disclosure.

Consistent with our expectations, the findings demonstrate that individuals are more likely to engage in online self-disclosure when their anticipated benefits exceed their concerns about privacy. In addition, the findings from Datasets 1 and 3 indicate that online self-disclosure is greatest when both benefits and concerns are high. This finding underscores the importance of perceived benefits as a factor that qualifies the nature of the risk-benefit calculation in privacy calculus because it implies that, unless they expect a benefit, users will not engage in disclosure just because it is not risky to do so. In other words, benefit considerations may act as a steppingstone for the privacy calculus in the sense that users will potentially first consider whether there is sufficient benefit from the act of disclosure and then will evaluate potential risks only if they expect benefits. Conversely, as we will further discuss below, there may also be contexts within which expected benefits are so important that risk considerations are suppressed. These possibilities have several important implications for research on privacy calculus. First, it supports the need to apply a more situational perspective (Masur, 2019) in assessing the relative role that risk-benefit considerations play in predicting disclosure. Second, it points to the need to collect more finely grained data that can help investigate in further detail the risk-benefit evaluation processes of individuals (e.g., the sequence with which they are considered in varying contexts). Third, it underlines the importance of decisions regarding the selection of disclosure behavior that will be treated as the dependent variable. Specifically, especially in studies that investigate the linear relationship between risk perceptions/concerns and disclosure behavior, researchers should be cognizant of the possibility that for disclosure behaviors that are not perceived to be highly beneficial, risk perceptions will be less likely to be a factor that predicts the behavior.

More generally, these findings suggest that a privacy calculus that emphasizes the relationship between the concerns and benefits is a more suitable model to explain self-disclosure than the privacy paradox, which overlooks the anticipated benefits of self-disclosure. This is also consistent with the findings of a recent study that used an elaboration likelihood model to investigate privacy calculus and privacy fatigue within the context of a health application (Zhu et al., 2021). The authors found that while perceived benefits of sharing personal information was positively associated with disclosure intentions, this relationship was reversed for privacy concerns. More importantly, perceived benefits were a stronger predictor of disclosure intentions than privacy concerns (Zhu et al., 2021).

One potential explanation of this pattern of results is that having “incomplete information” regarding benefits and privacy concerns promotes high levels of self-disclosure either because estimation of risk is inaccurate, or because individuals have inadequate information regarding how to protect their privacy in online settings. For instance, research shows that although older individuals (i.e., 65+) are concerned about their privacy, they lack the knowledge and skills to protect it (Kezer et al., 2016). Moreover, in a context where individuals perceive disproportionately more benefits of sharing personal information, individuals may fail to conduct a risk assessment. Alternatively, in contexts where individuals habitually spend a considerable amount of time online, they may not be cognizant of the risks of self-disclosure. Similarly, in such contexts, it is possible to observe norms that compel self-disclosure, which may be leading them to suppress or disregard their concerns about privacy. We recommend that future research models these factors explicitly, so that our theoretical explanations can be tested empirically.

In line with the immediate gratification bias (Acquisti, 2004), another possible explanation for why individuals are influenced by the benefits of self-disclosure more than by concerns for privacy is that self-disclosure is intrinsically rewarding (Tamir & Mitchell, 2012). That is, humans feel rewarded when sharing information about themselves, in the same way when satisfying primal needs such as hunger. Similarly, research shows that we like people who disclose to us and vice versa (Collins & Miller, 1994). Indeed, from an evolutionary standpoint, self-disclosure brings about many adaptive advantages such as strengthening social relationships and receiving feedback from others about one’s self (Dunbar, 1997).

In conclusion, our findings in all three datasets indicate that the anticipated benefits of self-disclosure outweigh concerns about privacy for individuals to engage in online self-disclosure. Therefore, we posit that people engage in a privacy calculus where online self-disclosure takes place only when benefits exceed concerns. In other words, there is a privacy calculus, and the benefits are more important.

Limitations

Although in this paper we hypothesize that privacy concerns and expected benefits influence self-disclosure and not vice versa, this assumption is based purely on theoretical grounds, because all three studies do not allow for causal statements. In particular, the correlational nature of the current research does not eliminate the effect of unobserved factors on both predictors and outcomes. For instance, participants’ mood at the time of data collection may have impacted the results. Someone who is in a highly positive mood may have perceived higher benefits and may have disclosed more as a result of their mood.

RSA allows us to statistically compare the role of both benefits and costs. As a result, we can now state that people are more likely to disclose if the benefits actually exceed the costs. At the same time, we still do not know whether participants explicitly compare benefits to costs. It might be that this process takes place implicitly, for example via heuristics (Sundar et al., 2013). Similarly, RSA may not be a suitable technique to test all models related to privacy calculus. Nevertheless, RSA can be a useful analytical tool when including additional predictors and covariates, such as declarative and procedural privacy literacy.

As discussed above, across two datasets, in addition to our main finding, we observed that levels of self-disclosure increased if both benefits and concerns were on higher levels. However, this relationship was not replicated in the second dataset. Therefore, this finding might not be generalizable and robust. Future research with the same research design as in the second dataset is required to provide stronger evidence to support or to reject this association.

We have explained self-disclosure using two variables. However, other variables likely also explain self-disclosure (e.g., mood, context, or culture), which could attenuate the effects reported here. Hence, the coefficients might be overestimated. On the other hand, because response surface analysis is based on polynomial regression analysis using manifest variables, it is not possible to partial out error variance by using latent factors, which is why the effects might also be underestimated.

Our measures for concerns and benefits in Dataset 1 somewhat differed in their degree of specificity. While we measured gratifications obtained from using Twitter to operationalize positive aspects of self-disclosure, the scale used to measure negative attitudes toward self-disclosure touched upon more general concerns about one’s privacy. Even though such general concerns may encompass specific concerns, the results would be more precise with predictors measured at similar levels of specificity. Acknowledging the shortcomings of the secondary datasets used in the present research, we believe that future research should pay more attention to the measurement of risks and benefits of self-disclosure such that both predictors should be measured on the same level.

In a similar vein, the measures employed to assess risks and benefits of self-disclosure in Dataset 3 evaluate risks and benefits of self-disclosure at a general level for the websites that the participants visited. A measurement of the risks and benefits for the specific task that they were asked to complete would also be informative so as to understand how self-disclosure in a specific situation may deviate from a general privacy calculus. Thus, researchers should also investigate specific situations across different contexts (e.g., Twitter vs Instagram) to reveal whether (or how) assessments of general and specific risks and benefits of self-disclosure are related to self-disclosure.

Another potential issue with our use of secondary datasets for this paper concerns the content validity of the disclosure items we used as the dependent variable. In Dataset 1, we used a self-reported frequency with which respondents tweeted about different topics about themselves. In Dataset 2, disclosure was operationalized using the number of words, likes and dislikes shared on the website. In Dataset 3, disclosure was assessed with items asking intentions to share various information about themselves. In general, the extant literature on self-disclosure distinguishes between two dimensions of disclosure: breadth and depth. The former refers to the quantity of information, the number of utterances, or the number of topics, whereas the latter refers to the level of sensitivity (i.e., how private the information is; Collins & Miller, 1994; Greene et al., 2006). Research indicates that these two dimensions not only differ from each other in terms of their potential predictors but also in terms of how they may influence relational outcomes (Baruh & Cemalcılar, 2018; Bazarova & Choi, 2014; Orben & Dunbar, 2017). Unfortunately, due to lack of access to a dataset that measured depth, all the datasets we used were primarily about the breadth of disclosure; nevertheless, the RSA technique can readily be applied to studies that investigate predictors of the depth of disclosure.

Our study was not preregistered. Two of the datasets we used come from studies that have already supported the privacy calculus. We recommend utilizing RSA while conducting novel, preregistered studies using new data. We emphasize the need to run a priori power analysis. Response surface analyses are based on polynomial regression; consequently, they need two to three times the usual sample size (Aiken et al., 1991).

Implications and Conclusion

Despite the study’s limitations, the findings suggest that the anticipated benefits contribute more to the decision to share personal information in online settings, using a relatively more precise statistical method (i.e., RSA). Importantly, online self-disclosure seems to be at its highest when the perceived benefits exceed the concerns about privacy.

Finally, one of the most important implications of the study lies in its methodology. The study underscores the potential utility of the RSA technique in further exploring how and why people engage in self-disclosure, even when they are highly concerned about the consequences of such exposure. We recommend that future research now takes into consideration additional key predictors such as literacy, trust, and affect, to further contextualize the nuances of online self-disclosure.

Footnotes

¹ We also conducted condition-based regression analysis (CRA; Humberg et al., 2018) for each dataset. CRA is similar to RSA in that, like RSA can, it also tests whether one predictor being greater than the other predictor affects the outcome or only one predictor accounts for the results. Applying CRA in our datasets, we found the same results as with the RSA, suggesting that online self-disclosure is higher when anticipated benefits of self-disclosure exceed perceived concerns about privacy. It should be noted that although the finding for Dataset 1 was in the same direction as the findings in the other datasets, it was not statistically significant. See online supplementary material for the analyses and results.

Conflict of Interest

The authors do not have any conflicts of interest to report.