Introduction

With the advances in Internet technologies, such as data mining tools, personalized marketing services, and ubiquitous electronic commerce applications, the collection and analysis of personal information are becoming rampant. Online consumers are increasingly concerned about their privacy, as their personal information and online activities are often automatically tracked and analyzed without their consent or knowledge (CIGI 2018; IDC 2017). Data breaches of large commercial databases, such as Facebook and Sony Pictures (Chaykowski 2018; Lewis 2014), also exacerbate consumers’ privacy concerns. Such privacy concerns are further evident in the multimillion dollars lawsuits against Twitter (Roberts 2017), Facebook (Meyer 2017), and Google (Ruddick 2017). According to recent surveys, 91% of consumers agreed that they have lost control of their personal information and data (Rainie 2016), and 70% of consumers are more concerned about their privacy today than they were a few years ago (IDC 2017). The growing privacy concern has caused consumers to make serious changes in their behavior, such as closing social media accounts and making fewer online purchases (CIGI 2018). Hence, it is imperative for online companies to understand the drivers and inhibitors of individuals’ privacy concerns so as to formulate strategies to alleviate such concerns.

Privacy concern has traditionally been a topic in business ethics research (e.g., Ashworth and Free 2006; Hajli and Lin 2016; Shaw 2003; Zhou and Piramuthu 2015). Specific to the online context, Internet privacy concern (IPC) is defined as an individual’s concern about possible loss of privacy due to voluntary or surreptitious information disclosure to websites (Dinev and Hart 2005). This definition of IPC is an extension of the traditional concept of information privacy concern, which refers to an individual’s perception of fairness within the context of information privacy (Campbell 1997), to the online environment. In particular, IPC is viewed as a dyadic relationship between an individual and an online entity, which can either be a particular website or websites in general. Similar definitions have been adopted in prior research on IPC (e.g., Malhotra et al. 2004; Son and Kim 2008).

Although much research has been done on information privacy concerns in general and IPC in particular, most of the research has focused on the linkage between privacy concerns and outcomes, with little attention paid to the linkage between the antecedentsFootnote 1 and privacy concerns (Smith et al. 2011). While some studies have examined factors that influence an individual’s information privacy concern or IPC (e.g., Culnan and Bies 2003; Dinev and Hart 2004; Hann et al. 2007; Phelps et al. 2001; Ward et al. 2005), the goal of identifying the critical antecedents of IPC remains elusive due to the many external, internal, and situation-specific factors that can potentially influence IPC. For example, the legal and cultural environments can influence what an individual perceives as fair or not fair (Bellman et al. 2004; Caudill and Murphy 2000; Milberg et al. 2000). Meanwhile, an individual’s perception of such external conditions can vary with personal characteristics (Chen et al. 2001; Phelps et al. 2000; Sheehan 2002) and past experience (Awad and Krishnan 2006). In summary, although previous studies have investigated the relationships between a number of antecedents and privacy concerns, these studies have usually been conducted in a disjointed manner (Smith et al. 2011). Therefore, there is a need for a comprehensive theoretical framework to guide a systematic identification and examination of the antecedents of IPC, which is a major stream of privacy research (Popovic et al. 2017).

Accordingly, our objective is to provide a comprehensive investigation of the drivers and inhibitors of IPC. First, we use the Multidimensional Development Theory (MDT; Laufer and Wolfe 1977) to guide our investigation. The MDT suggests that an individual’s privacy concern is jointly determined by factors pertaining to four dimensions—i.e., environmental, individual, information management, and interaction management. The MDT was previously used to examine the conceptualization and measurement of IPC, particularly addressing the question of what IPC is (Hong and Thong 2013). We extend this line of research by using the MDT to study the antecedents of IPC, addressing the broader question of how IPC is formed or influenced by a variety of sources. We use the multidimensional conceptualization to guide our literature review and organize prior research findings on the antecedents of privacy concerns. Second, we formulate and empirically test a research model that incorporates key factors under each dimension of MDT. The results, based on a sample of 2417 respondents to an online survey conducted in Hong Kong, provide support for the significance of all four dimensions of MDT in affecting IPC. Finally, we validate our model by examining the unobserved heterogeneity in our sample (Becker et al. 2013; Esposito Vinzi et al. 2008). The analysis of unobserved heterogeneity confirms our findings and leads us to propose a refinement of the MDT by considering the interactions between the individual dimension and other dimensions. A follow-up moderation analysis confirms such interactions, thus providing a more nuanced and contextual understanding of the different drivers and inhibitors of IPC (Hong et al. 2014).

This study makes several contributions. Theoretically, this study demonstrates the utility of the MDT in understanding specific drivers and inhibitors of IPC, and it also refines the MDT by identifying its boundary conditions. Empirically, this study utilizes a large sample to validate the significance of the key antecedents of IPC, and it also illustrates the importance of incorporating unobserved heterogeneity into the analysis and validation. Practically, the findings will provide actionable and prescriptive advice to online companies regarding the management of users’ IPC.

Theoretical Background

Literature Review

In a review of information privacy research, Smith et al. (2011) presented a macro level (APCO) model (Antecedents → Privacy Concerns → Outcomes) that considers a number of antecedents and outcomes associated with privacy concerns. They classified previously studied antecedents of privacy concerns into five dimensions: privacy experience, privacy awareness, personality differences, demographic differences, and culture/climate. They noted that past studies have investigated only the relationships between some selected antecedents and privacy concerns. Further, these relationships have not been confirmed through repeated studies and are thus tenuous.

To supplement Smith et al.’s (2011) APCO model, we conducted a more focused literature review of the antecedents of IPC and its closely related constructs—i.e., information privacy concern, consumer privacy concern, and employee privacy concern. As personal information of consumers and employees can be collected through the Internet, both consumers’ and employees’ perspectives are relevant to IPC and were included in our review. The reference disciplines covered in our literature review include information systems, marketing, public policy, management, and social science.

Our literature review reveals four major observations. Firstly, a variety of theories have been used in prior studies, such as utility maximization theory (Awad and Krishnan 2006; Hui et al. 2007), social contract theory (Martin 2016; Phelps et al. 2000; Singh and Hill 2003; Xu et al. 2005), justice theory (Ashworth and Free 2006), and protection motivation theory (Youn 2005). The majority of the theories are built upon the concept of “privacy calculus”, which refers to the cost-benefit analysis that individuals perform when balancing the trade-offs between the cost of providing personal information and the benefit of information disclosure (Culnan and Armstrong 1999; Culnan and Bies 2003; Klopfer and Rubenstein 1977; Stone and Stone 1990). For example, the principle of the utility maximization theory (Awad and Krishnan 2006; Hui et al. 2007) is to maximize the total utility or satisfaction by an individual. The theory depicts the utility function of information disclosure as the difference between expected benefits (such as monetary incentive and personalized service) and expected costs (such as consumer privacy concerns and risks), and suggests an optimal point between the two, which determines the amount of information the individual is willing to disclose (Li 2012). Moreover, the privacy calculus (or cost-benefit analysis) is subject to further adjustment. The social contract theory suggests that the provision of personal information to an online merchant involves not only an economic exchange (i.e., purchasing goods and service) but also a social exchange (i.e., establishing relationships) (Li 2012). A social contract governs the information exchange and involves an implicit assessment of exchange fairness, i.e., the degree of fairness of information exchange involving whether the personal information is collected fairly and, will subsequently be used fairly (Li et al. 2011). An individual’s understanding or implicit assessment of the fairness of information exchange will adjust the cost-benefit analysis (Culnan and Bies 2003). The justice theory suggests that fairness perceptions can have a positive effect on an individual’s privacy decision making, which leads to a positive outcome of their privacy calculus and a greater willingness to disclose personal information (Xu et al. 2009). Despite its popularity in information privacy research, the privacy calculus framework does not account for the fact that privacy concern is developed over a long period of time as a result of interaction between the environment, the individual, and the social exchange situation (Laufer and Wolfe 1977; Marshall 1974; Weigel-Garrey et al. 1998). Some alternative theoretical perspectives, such as the protection motivation theory (Junglas et al. 2008),Footnote 2 have been adopted to study IPC from a set of factors that focus on users’ perceived severity of privacy threats and their perceived ability to protect themselves from such threats. Given the multiple theories that focus on different aspects of IPC drivers and inhibitors, we suggest that a more comprehensive and complementary framework is necessary to gain a more complete understanding of the antecedents of IPC.

The second observation is much prior research has focused on conceptualizing and measuring information privacy concerns and IPC (e.g., Hong and Thong 2013; Liu et al. 2005; Malhotra et al. 2004; Smith et al. 1996; Son and Kim 2008; Stewart and Segars 2002), while there is a lack of general understanding of the antecedents of IPC. IPC has been conceptualized as a multi-facet construct that consists of multiple underlying dimensions (e.g., collection, secondary usage, errors, improper access, etc.) modeled using a variety of factor structures (i.e., first-, second-, or third-order; see Hong and Thong 2013 for a review). While previous studies have confirmed the predictive validity of IPC and reached a consensus on its effect on important dependent variables, such as trusting beliefs, risk beliefs, and complaining actions (e.g., Hong and Thong 2013; Malhotra et al. 2004; Son and Kim 2008), there is a lack of general understanding of the antecedents of IPC. Existing studies on the antecedents of IPC were done on a case-by-case basis (Smith et al. 2011), with some studies focusing on general factors, such as benefit of information disclosure, perceived vulnerability and perceived control (e.g., Ashworth and Free 2006; Dinev and Hart 2004; Hajli and Lin 2016), and some focusing on the context- or technology-specific factors, such as use of privacy protection tools, inclusion of privacy policy statement, provision of privacy enhancing features (e.g., Culnan and Bies 2003; Singh and Hill 2003; Son and Kim 2008; Xu et al. 2011a). While these disjointed findings provide useful insights, it is necessary to consolidate the findings and present an integrated framework to provide a general understanding of the key factors for managing privacy concerns.

The third observation is prior empirical studies on the determinants of IPC may over-represent experienced Internet users, by soliciting subjects through emails (e.g., Bellman et al. 2004; Chen et al. 2001; Sheehan 2002), or targeting at students and IS professionals (e.g., Chen et al. 2001; Hui et al. 2007; Milberg et al. 1995). As a result, the privacy concerns of some population groups, such as less-experienced Internet users or non-students and non-IS professionals, have not been adequately studied. Some researchers have called for more balanced samples collected from the general population when studying IPC (Phelps et al. 2000; Ward et al. 2005). Further, the sample sizes in previous studies are typically around a few hundred, which limits the number of independent variables that can be simultaneously examined in a single study. There is a need for large-scale surveys which allow simultaneous investigation of a larger set of independent variables to determine and compare their impacts on IPC.

The fourth observation is most of the existing surveys were conducted on samples from western cultures, such as the US, Europe, and Australia (Rose 2006; Sheehan and Hoy 2000; Singh and Hill 2003). There are very few large-scale surveys published in peer-refereed journals using Asian samples (see Hong and Thong 2013). Prior literature suggests that cultural differences affect what people perceive as private and lead to different levels of privacy concern (Bellman et al. 2004; Harris et al. 2003; Milberg et al. 2000; Pavlou 2011). It is widely accepted among social scientists that the Asian culture differs from the western culture on many dimensions, including power distance, individualism, masculinity, and uncertainty avoidance (Hofstede et al. 2010). For example, as Asian cities are typically more crowded, people are used to others intruding into their personal space and being observed by others,Footnote 3 which may lead to lower levels of privacy concern perceptions (Westin 2003). The results of our study will help to validate prior findings from a western culture to an Asian culture with very different values.

Multidimensional Development Theory

The multidimensional development theory (MDT) proposed by Laufer and Wolfe (1977) provides a comprehensive description of multidimensional factors that influence an individual’s perception of privacy and privacy invasion. According to the MDT, any privacy situation can be described in terms of four dimensions—i.e., environmental, individual, information management, and interaction managementFootnote 4—building on the recognition that an individual’s privacy concern is a result of environmental influences, the individual’s experience, and the interaction between the individual and other parties involved in the privacy situation. Thus, the MDT can provide a more comprehensive understanding of the antecedents of privacy concerns than other theories that are primarily based on the concept of privacy calculus (e.g., utility maximization theory). Next, we will elucidate the details of MDT and describe how it can be applied to the online setting together with a summary of relevant antecedents of IPC that have received theoretical or empirical support in the literature.

The environmental dimension refers to elements that act as boundaries of privacy meaning and experience. The environmental elements critically influence an individual’s ability to perceive, have, and use available privacy options. For example, different government legislations provide different levels of privacy protection, and online privacy protection in particular (Caudill and Murphy 2000; Sarathy and Robertson 2003; Singh and Hill 2003; Westin 2003). These regulatory settings define, evoke, and sustain behaviors that are private. We summarized the environmental factors identified in prior studies as antecedents of IPC or its closely related constructs (see Table 4 of Appendix A). Government legislations, industry self-regulations, and culture values have been identified as three major environmental factors that affect an individual’s perception of IPC. First, government legislations aimed at providing individuals with better control of their personal data can help to reduce privacy concern. For example, the Federal Trade Commission has implemented the Children’s Online Privacy Protection Act to protect online privacy of children (Sarathy and Robertson 2003). Second, industries may develop rules and enforce procedures that protect consumers’ privacy (Culnan and Bies 2003; Sarathy and Robertson 2003). Such industry self-regulations are typically provided by a particular company or an alliance of companies. Third, culture values such as individualism, uncertainty avoidance, and communication patterns have been found to be related to differences in privacy perceptions (e.g., Milberg et al. 2000; Miltgen and Peyrat-Guillard 2014).

The individual dimension refers to the influence of an individual’s developmental process on his or her concept of privacy. The developmental experience of being capable of functioning independently adds a critical aspect to the relationship between the self and privacy. This dimension also reflects the fact that claims of privacy are shaped and asserted by each individual in daily life, as a function of one’s education, past experience, and psychological makeup (Westin 2003). We summarized the individual factors identified in prior studies as antecedents of IPC or its closely related constructs (see Table 5 of Appendix A). Following Westin (2003), we classified the individual factors identified in prior literature into three categories. The first category represents past experience, such as previous privacy invasion experience (e.g., Awad and Krishnan 2006; Xu et al. 2012). The second category includes psychological and personality traits, such as risk avoidance, trust propensity, personality, etc. (e.g., Smith et al. 1996; Xu et al. 2005). The third category represents demographic variables, including age, gender, education, income, and Internet literacy (e.g., Chen et al. 2001; Sheehan 2002).

In addition, the MDT suggests that an individual’s concept of privacy rights and rules is incrementally formed through interactions with other parties involved in privacy situations. All forms of privacy assume the existence of others and the possibility of a relationship with them. The acting out of this relationship has two elements: information management and interaction management (Laufer and Wolfe 1977). Information management refers to the management of information disclosure by balancing benefits and risks, whereas interaction management refers to the management of social interaction among individuals or between individuals and their socio-physical environment. We adapt these two concepts to the online environment. The information management dimension largely reflects the “privacy calculus” concept discussed earlier (Culnan and Armstrong 1999; Dinev and Hart 2006a). It refers to the recognition of the intrinsic tradeoff between the benefits derived from disclosing personal information to websites and the risks of privacy loss from the disclosure. We summarized the information management factors identified in prior studies as antecedents of IPC or its closely related constructs (see Table 6 of Appendix A). As expected, the benefit of information disclosure and the risk of information sensitivity have been extensively studied in prior literature (e.g., Andrade et al. 2002; Ashworth and Free 2006; Jiang et al. 2013; Miller and Weckert 2000; Phelps et al. 2000; Xu et al. 2011b); they represent the benefit and risk sides of an online information exchange respectively.

The interaction management dimension reflects the efforts of optimizing the exchange mechanism, so that individuals have more control of the information exchange situation and better ability to make the benefits-risks trade-offs (Milne 2000). In the online environment, interaction management can be done through either the direct approach or the indirect approach. We summarized the interaction management factors and classified them into these two categories (see Table 7 of Appendix A). The direct approach refers to the technical implementations on websites with the observable purpose of reducing privacy concern, such as the use of privacy seals, authorization form for information release, inclusion of privacy statement, and provision of privacy enhancing features. (Culnan and Bies 2003; Singh and Hill 2003; Turner and Dasgupta 2003; Xu et al. 2011a). On the other hand, the indirect approach refers to the subtle measures that websites can adopt to reduce privacy concern, such as increasing the reputation of the website or the degree of human element (i.e., social presence) through the Web interface design (Eastlick et al. 2006; Pavlou et al. 2007; Xie et al. 2006).

Research Model

By applying the MDT in our literature review, we identified four dimensions that can impact individuals’ IPC. As our primary objective is to test the utility of MDT in identifying the important antecedents of IPC, rather than to investigate all possible antecedents in a single study, we select the more prominent factor(s)Footnote 5 from each dimension of MDT to develop our research model (see Fig. 1).

Fig. 1
figure 1

Research model

Full size image

Environmental Dimension

Under the environmental dimension of MDT, we identify familiarity with government legislation which has received the strongest theoretical and empirical support in prior research involving environmental factors. We exclude industry self-regulation and culture values as it is not the objective of this study to compare IPC across industries and countries.

Familiarity with Government Legislation refers to an individual’s familiarity with government regulations and laws addressing privacy protection (Culnan and Bies 2003). Most governments have introduced privacy legislations and laws in order to protect privacy.Footnote 6 Prior research suggested that the implementation of privacy legislations provides individuals with control over their personal data, which can help to reduce privacy concern (Caudill and Murphy 2000; Culnan and Bies 2003; Sarathy and Robertson 2003; Xu and Teo 2004). When strict regulations are in place regarding personal information handling practices, individuals’ level of privacy concern may relax due to the reduced number of privacy violations (Bennett 1992). Thus, we hypothesize that individuals who are familiar with government legislations are likely to have lower levels of IPC (H1).

Individual Dimension

Under the individual dimension of MDT, we identify one key antecedent from each of the three sub-dimensions. Specifically, previous privacy invasion experience is selected as a past experience factor as it best describes an individual’s past experience that may raise privacy concern. Among the many personality factors, risk avoidance is selected as it has consistent empirical support from prior research. Similarly, Internet knowledge is selected as a prominent demographic factor as it has received more research attention and empirical support than the other demographic variables.

Previous Privacy Invasion Experience refers to previous personal experience of privacy invasion (Smith et al. 1996). Prior research showed that individuals vary in their concern for privacy based on life experiences (Culnan and Armstrong 1999; Singer et al. 1993). In particular, an individual’s previous privacy invasion experience plays an important role in shaping the person’s privacy concern (Culnan 1993; Smith et al. 1996; Stone and Stone 1990). If an individual had been a victim of privacy invasion before, the person is more likely to develop privacy concern due to the fear that the bad experience will recur. Prior research has found a positive relationship between past privacy invasion experience and IPC or reluctance to disclose personal information in the online environment (Bansal et al. 2010; Smith et al. 1996; Xu et al. 2012). Hence, we hypothesize that previous privacy invasion experience will increase IPC (H2).

Risk Avoidance is a personality characteristic that describes an individual’s current tendency to take or avoid risks (Sitkin and Weingart 1995). The release of personal information is typically regarded as risky by individuals as they become vulnerable to a company’s potential opportunistic behaviors (Laufer and Wolfe 1977; Milne and Gordon 1993). The provision of personal information for services and goods can be viewed as an exchange between individuals and websites. Individuals have little control over how their information will be processed by websites after the exchange. Thus, individuals with higher risk avoidance are more likely to develop stronger IPC as compared to individuals with lower risk avoidance due to the uncertainty and lack of control in online environment. Empirical evidence from prior research also supports the positive relationship between risk avoidance and IPC (Dinev and Hart 2005; Xu et al. 2005). Hence, we propose that risk avoidance has a positive effect on IPC (H3).

Internet Knowledge refers to an individual’s perception of their knowledge about the Internet and its related privacy issues (Harris et al. 2003). Individuals having more Internet knowledge are expected to have accurate privacy perceptions (Harris et al. 2003). Internet knowledge is often believed to have a significant impact on privacy concern. However, findings about this variable in the literature are mixed. On the one hand, Internet knowledgeable individuals may have less privacy concern because they are more skillful at protecting their online privacy. On the other hand, they may be more concerned because they are more aware of the potential threats posed by the Internet. The majority of prior studies have shown that Internet knowledge helps to reduce IPC (Dinev and Hart 2005; Harris et al. 2003; Miyazaki and Fernandez 2001; Rose 2006), but some studies found no significant correlation between Internet knowledge and privacy concern (e.g., Sheehan 2002; Ward et al. 2005), or even a positive relationship between Internet knowledge and privacy concern (e.g., Hoffman et al. 1999). In line with the majority of prior research, we propose that greater Internet knowledge helps to reduce IPC (H4).

Information Management Dimension

Under the information management dimension of MDT, information sensitivity and benefit of information disclosure are the two antecedents that have extensive theoretical and empirical support. They represent the risk and benefit sides of the “privacy calculus” concept respectively.

Information Sensitivity is defined as the level of privacy concern an individual feels for a type of data in a specific situation (Sheehan and Hoy 2000); it represents the “risk” side of the “privacy calculus” concept. Personal information can be classified into different categories, from less sensitive information, such as demographic data, lifestyle interests, and media habits, to more sensitive information, such as personal identification data (i.e., name, address, phone number, and social security number) and financial data (Phelps et al. 2000). The more sensitive the data collected by companies, the higher the risk that individuals are exposed to in case the data are misused. Prior research has found that privacy concern increases as the sensitivity of personal information submitted to websites increases (Andrade et al. 2002; Ashworth and Free 2006; Dinev and Hart 2006b; Dinev et al. 2013; Rohm and Milne 2004; Ward et al. 2005). Hence, we hypothesize that information sensitivity has a positive effect on IPC (H5).

Benefit of Information Disclosure is defined as the benefits that individuals retain from information disclosure, such as monetary savings, time saving, self-enhancement, social adjustment, pleasure, novelty, and altruism (Hui et al. 2006). It represents the “benefit” side of the “privacy calculus” concept. Nowak and Phelps (1997) found that in traditional direct marketing situations, individuals often willingly supply personal information in expectation of future benefits, such as reduced prices, premiums, or other incentives. Similarly, Phelps et al. (2000) suggested that privacy concerns can be alleviated if marketers offer benefits in exchange for personal details, which is supported by the majority of empirical findings in prior research (Dinev et al. 2013; Hann et al. 2007; Ward et al. 2005; Xu et al. 2011b). Hence, we hypothesize that benefit of information disclosure helps to reduce IPC (H6).

Interaction Management Dimension

Under the interaction management dimension of MDT, we identify privacy protection as a salient direct approach, and social presence as an important indirect approach to interaction management of IPC. Although prior research has found reputation of the website to be also a salient factor, it is excluded due to practical relevance because it is less subject to manipulation through the Web interface design.

Privacy Protection refers to the technical solutions and practices that are adopted by websites to protect online users’ privacy (Culnan and Bies 2003). In order to reduce individuals’ privacy concern, websites have adopted many privacy protection practices and tools. These include seeking users’ authorization before release of their personal information (Culnan and Bies 2003; Eastlick et al. 2006; Singh and Hill 2003), inclusion of privacy policy statements on the websites (Awad and Krishnan 2006; Hui et al. 2007; Pollach 2005; Resnick and Montania 2003; Tsai et al. 2011; Turner and Dasgupta 2003), utilization of privacy protection seals such as TRUSTe (Caudill and Murphy 2000; Etzioni 2019; Hui et al. 2007; Singh and Hill 2003; Xu et al. 2005), ensuring users’ awareness of information collection (Culnan and Bies 2003; Sheehan 2002; Sheehan and Hoy 2000; Singh and Hill 2003), and removing identifiable personal information from databases (Garfinkel et al. 2007; Li and Sarkar 2006). In general, prior research has found that privacy protection is effective in reducing IPC (Xu et al. 2011a). Thus, we hypothesize that privacy protection can help to reduce IPC (H7).

Social Presence is defined as the extent to which a medium, e.g., a website, is perceived as truly conveying the presence of the communicating participants, e.g., the presence of a seller behind the website (Pavlou et al. 2007; Rice 1993; Short et al. 1976). One major disadvantage of e-commerce is the lack of face-to-face interaction. By creating an online environment that closely resembles a physical interaction with a seller, social presence helps to bring a website closer to its consumers (Choi et al. 2001). And closing the social distance between buyers and sellers may help to reduce IPC, which is partly a result of separation between online buyers and sellers. Thus, we hypothesize that social presence on websites has a negative effect on IPC (H8).

Methodology

Our research context was set in Hong Kong, which is one of the most connected cities in the world. According to the report by the Census and Statistics Department of Hong Kong (2018), 100% of population is covered by mobile cellular telephone network and public Internet access. 80.2% of households have personal computers (PCs) at home connected to the Internet and 88.6% of people aged 10 and above have smartphones. The majority of people in Hong Kong (89.4%) used the Internet during the last 12 months. Among these people, they used either PCs (88.3%) or smartphones (98.1%) to access the Internet.

In terms of culture, Hong Kong can be characterized using Hofstede et al. (2010)’s cultural dimensions, including power distance, individualism, masculinity, uncertainty avoidance, long-term orientation, and indulgence (Table 1). Hofstede Insights (2018) indicate that (1) Hong Kong people are willing to accept unequally distributed power in institutions and organizations (high score of 68 on power distance), (2) Hong Kong has a collectivist culture where people act in the interests of the group (low score of 25 on individualism), (3) Hong Kong is somewhat a masculine society that is success oriented and driven (moderate score of 57 on masculinity), (4) Hong Kong people are comfortable with ambiguity (low score of 29 on uncertainty avoidance), (5) Hong Kong has a pragmatic culture where people show an ability to adapt traditions easily to changed conditions (high score of 61 on long-term orientation), and (6) Hong Kong people are restrained and control the gratification of their desires (low score of 17 on indulgence). Overall, Hong Kong is notably different from western countries (e.g., United States, United Kingdom, Germany, and France) on many cultural dimensions, while it is quite comparable with other Asian countries (e.g., China, South Korea, Thailand, and Vietnam) (see Table 1).

Table 1 Hofstede’s scores for selected countries (Hofstede Insights 2018)
Full size table

In 2014, we posted a banner advertisement of our survey on a popular local website. At the time of the survey, this website allowed people to schedule appointments with government agencies and booking community services, such as recreational facilities. Hence, our sampling frame included both potential and existing users of the Internet, and also both experienced and novice Internet users. A lucky draw to win mobile phones that was restricted to those aged 18 years and above was used as an incentive to encourage participation in the survey. A total of 2417 valid responses were collected over a one-month period. Our final sample consisted of 43.3% males and 56.7% females. Their age ranged from 18 to 60 years. The majority of respondents had a bachelor degree (40.2%), a high school diploma (28.2%), or a vocational school certificate (16.5%). Their monthly income ranged from 0 (unemployed) to more than HK $30,000 with a mean income of HK$10,000. There was a wide spectrum of occupations, including senior management (5.3%), professionals (20.4%), clerical staff (21.5%), professional assistants (7.8%), sales assistants (6.4%), students (22.3%), and others (including factory workers, farmers, and fishermen). Their Internet experience ranged from less than 1 year to more than 11 years, with a mean of 7.5 years and a standard deviation of 2.3 years. Their average weekly Internet usage was 22.5 h, with the majority of the sample (47%) reporting their weekly usage under 15 h. Finally, 44.6% of respondents had previously provided personal information (e.g., name, email address, credit card number, etc.) to commercial websites (e.g., Amazon.com) for online shopping or payment. In summary, our sample is diverse in terms of respondents’ demographic and Internet usage.Footnote 7

We used established instruments whenever possible to measure the constructs (see Appendix B). A seven-point Likert scale with anchors ranging from ‘strongly disagree’ to ‘strongly agree’ was used for all constructs, except for previous privacy invasion experience which used a seven-point Likert scale with anchors ranging from “not at all” to “very much”. IPC, the dependent variable, was conceptualized as a third-order construct with two second-order constructs (i.e., interaction management and information management) and six first-order constructs (i.e., collection, secondary usage, errors, improper access, control, and awareness), following Hong and Thong’s (2013) conceptualization. We measured the six first-order constructs with three items each, adapted from Hong and Thong (2013). A sample item for collection is “It usually bothers me when websites ask me for personal information.” A sample item for secondary usage is “I am concerned that when I give personal information to a website for some reason, the website would use the information for other reasons.” A sample item for errors is “I am concerned that websites do not take enough steps to make sure that my personal information in their files is accurate.” A sample item for improper access is “I am concerned that databases that contain my personal information are not protected from unauthorized access.” A sample item for control is “It usually bothers me when I do not have control of the personal information that I provide to websites.” A sample item for awareness is “It usually bothers me when online privacy policy does not have a clear and conspicuous disclosure.”

As for the independent variables, familiarity with government legislations was measured by two newly-developed items. A sample item is “I am fully aware that the Hong Kong government has a Privacy Policy to protect my privacy.” Previous privacy invasion experience was assessed by two items used in prior studies (Malhotra et al. 2004; Smith et al. 1996; Xu et al. 2005). A sample item is “How often have you personally experienced incidents whereby your personal information was used by some website without your authorization?” We used three items from Xu et al. (2005) to measure the individual’s risk avoidance. A sample item is “I would rather be safe than sorry.” Internet knowledge was measured by two items adapted from Singh and Hill (2003). A sample item is “I am knowledgeable about the Internet and its related privacy issues.” For the information and interaction management factors, in line with Hong and Thong’s (2013) general conceptualization of IPC, we measured user perceptions towards websites in general, rather than towards a specific website. Information sensitivity and benefit of information disclosure were typically manipulated in prior studies (e.g., Malhotra et al. 2004; Phelps et al. 2000; Sheehan and Hoy 2000). We developed two items each for these two constructs by closely following their definitions. A sample item for information sensitivity is “Websites tend to ask me for sensitive personal information in order to obtain their services.” A sample item for benefit of information disclosure is “I value the benefits that I can obtain by providing my personal information to websites.” Popular privacy protection practices adopted by websites include seeking authorization before collecting personal information, provision of privacy protection tools, privacy statements, and informing individuals of personal information collection (Awad and Krishnan 2006; Hui et al. 2007; Singh and Hill 2003). Based on these popular practices, we created a four-item instrument for privacy protection. A sample item is “In general, websites would ask for my authorization before collecting my personal information.” Finally, social presence was measured by three items taken from Pavlou et al. (2007). A sample item is “There is a sense of human contact in websites.” The survey was delivered in Chinese, the main lingua franca in Hong Kong. The original measurement items (in English) were translated to Chinese and back-translated to English by professional translators. Minor wording discrepancies were discussed and resolved. The measurement scales were then pilot tested on 318 subjects drawn from the general population through an online survey. Analysis of the pilot test data confirmed that the scales were reliable and valid. We then proceeded with the main data collection.

Data Analysis

We used partial least squares (PLS), a component-based structural equation modeling (SEM) technique, to analyze our data. We chose PLS for multiple reasons. First, PLS can handle higher-order constructs and complex models with fewer restrictions than covariance-based techniques (Ringle et al. 2012; Ruiz-Palomino and Martinez-Cañas 2011). PLS is appropriate for testing our complex model with eight independent variables and one third-order dependent variable that consists of eight underlying dimensions (i.e., IPC). Second, PLS is suitable for studies that aim to examine the predictive power of the exogenous variables on the endogenous variables (Peng and Lai 2012). Given that the objective of our work is to consolidate previous disjointed findings and examine a comprehensive list of antecedents of IPC, PLS is an appropriate tool as it is prediction-oriented (Hair et al. 2011). Third, given our large sample, some spurious relationships may be found. PLS allows the use of some advanced analytical approaches to validate our results. In particular, we used the analysis of unobserved heterogeneity (Becker et al. 2013; Esposito Vinzi et al. 2008) to confirm the significance of our proposed factors. Finally, we acknowledge that there is a debate on the use of PLS. Previous simulation studies showed that the differences between PLS and covariance-based SEM (e.g., LISREL, AMOS) estimates are very small (e.g., Goodhue et al. 2012; Reinartz et al. 2009). The results of PLS and covariance-based SEM will be similar, provided that the sample size is large and a large number of indicator variables are used to measure the latent constructs (Hair et al. 2011), which is true in our case. To alleviate the concern of biased estimates, we also tested our model using LISREL. The LISREL results were consistent with the PLS results.

Table 2 presents descriptive statistics and correlations for all the constructs. For all constructs, both Cronbach’s alpha and composite reliability were above 0.70, indicating the constructs had adequate reliability. The average variance extracted (AVE) for each construct was greater than the recommended 0.50 level, and the correlations between constructs were all below the square root of AVE of either construct. Also, we conducted a confirmatory factor analysis for all constructs. Appendix C showed that all factor loadings were above 0.7 and all cross-loadings were low, thus supporting convergent and discriminant validity of the scales (Fornell and Larcker 1981). Finally, we used the repeated indicators approach (Wetzels et al. 2009; Wijethilake et al. 2018) to model IPC as a third-order construct, following Hong and Thong’s (2013) conceptualization. This helps to reduce the complexity of the structural equation model by reducing the number of relationships between IPC and its antecedents (Wijethilake et al. 2018). All loadings of the sub-constructs on the higher-order constructs exceeded 0.80 and were significant at p < 0.001. In summary, the measurement model demonstrated adequate reliability, convergent validity, and discriminant validity.

Table 2 Descriptive statistics and correlations
Full size table

Figure 2 presents the results of the hypotheses testing.Footnote 8 Specifically, familiarity with government legislation reduced IPC (β = − 0.05, p < 0.05), supporting H1. Both previous privacy invasion experience (β = 0.20, p < 0.001) and risk avoidance (β = 0.22, p < 0.001) increased IPC, supporting H2 and H3. Internet knowledge reduced IPC (β = − 0.07, p < 0.001), supporting H4. Further, IPC was higher when individuals perceived the information required as more sensitive (β = 0.31, p < 0.001), and was lower when individuals perceived the benefit of information disclosure as high (β = − 0.16, p < 0.001), supporting H5 and H6. Finally, both privacy protection (β = − 0.04, p < 0.05) and social presence on websites (β = − 0.21, p < 0.001) reduced IPC, supporting H7 and H8. The variance explained was 42%.

Fig. 2
figure 2

Hypotheses testing results

Full size image

Prior research has noted that unobserved heterogeneity in structural equation models may pose a threat to the validity of findings and lead to misinterpretations and invalid conclusions (Becker et al. 2013; Esposito Vinzi et al. 2008). To validate our findings, we conducted an analysis of unobserved heterogeneity (see Appendix D). The results showed that, despite the existence of heterogeneous segments in our sample, all of the factors (except for Internet knowledge and privacy protection) had significant, consistent (either positive or negative) effects on IPC across the segments, thus providing support for the validity of our earlier model testing results (see Table 9 of Appendix D). Further, the results suggested that although the demographic variables (i.e., gender, age, education, income, and Internet experience) were not significantly different across the segments, the individual factors (i.e., previous privacy invasion experience, risk avoidance personality, and Internet knowledge) could potentially account for the unobserved heterogeneity leading to the differential effects of the factors across segments (see Table 10 of Appendix D). The results of moderation analysis confirmed this conjecture and showed significant moderating effects of the individual factors (see Table 3).

Table 3 Results of moderation analysis
Full size table

Following Aiken and West (1991), we plotted the significant interactions (see Fig. 3) and performed simple slope tests. First, previous privacy invasion experience moderated the effects of information sensitivity and privacy protection. The positive effect of information sensitivity on IPC was stronger for individuals who had low previous privacy invasion experience (β = 0.35, p < 0.001) than for those who had high previous privacy invasion experience (β = 0.27, p < 0.001). The effect of privacy protection on IPC was significant and negative for individuals who had low previous privacy invasion experience (β = − 0.10, p < 0.001), but was non-significant for those who had high previous privacy invasion experience (β = 0.01, p>0.05). Second, risk avoidance moderated the effects of information sensitivity and social presence. The positive effect of information sensitivity on IPC was stronger for individuals who had low risk avoidance (β = 0.35, p < 0.001) than for those who had high risk avoidance (β = 0.27, p < 0.001). The negative effect of social presence on IPC was stronger for individuals who had low risk avoidance (β = − 0.22, p < 0.001) than for those who had high risk avoidance (β = − 0.16, p < 0.001). Finally, Internet knowledge moderated the effects of information sensitivity and social presence. The positive effect of information sensitivity on IPC was stronger for individuals who had high Internet knowledge (β = 0.36, p < 0.001) than for those who had low Internet knowledge (β = 0.26, p < 0.001). The negative effect of social presence on IPC was stronger for individuals who had high Internet knowledge (β = − 0.24, p < 0.001) than for those who had low Internet knowledge (β = − 0.15, p < 0.001).

Fig. 3
figure 3

a Previous Privacy Invasion Experience (PREEXP) × Information Sensitivity (INFSEN). b Previous Privacy Invasion Experience (PREEXP) × Privacy Protection (PROT). c Risk Avoidance (RISK) × Information Sensitivity (INFSEN). d Risk Avoidance (RISK) × Social Presence (SOC). e Internet Knowledge (KNOW) × Information Sensitivity (INFSEN). f Internet Knowledge (KNOW) × Social Presence (SOC)

Full size image

Discussion

Compared with prior research, this study provides a more nuanced understanding of the drivers and inhibitors of IPC. The results show that the four dimensions of the MDT have both direct and interaction effects on individuals’ IPC. First, the information management dimension plays an important role in determining IPC. On the one hand, the sensitivity of information solicited on websites has the strongest positive effect on IPC among all independent variables. In particular, for individuals who have greater Internet knowledge, the positive effect of information sensitivity on IPC will be stronger; and interestingly, for individuals who are more risk-averse and who have more previous privacy invasion experience, their IPC will not increase as much as expected along with the increase in information sensitivity, possibly due to the already relatively high level of their IPC. On the other hand, if websites offer benefits in return for information disclosure, individuals’ IPC will be reduced.

Second, the interaction management dimension is critical in shaping IPC. Social presence was found to be the strongest inhibitor of IPC among all independent variables. In particular, for individuals who have greater Internet knowledge, the negative effect of social presence on IPC will be stronger; and interestingly, for individuals who are more risk-averse, they will be less responsive to social presence, possibly due to their already high IPC. Next, contrary to the common belief that adopting privacy protection practices automatically reduces privacy concern, we found that these practices are effective only for individuals with little previous privacy invasion experience.

Third, the individual dimension also has a role to play in affecting IPC. Specifically, individuals who had experienced privacy invasion previously are likely to have higher IPC, as such experience will cause individuals to be more cautious about providing personal information to websites. In addition, individuals who are risk-averse will be more concerned about the potential negative consequences of privacy invasion, and thus, have higher IPC. On the contrary, knowledgeable Internet users are likely to be more skillful at protecting their online privacy, and thus, have lower IPC.

Last but not least, the environment dimension also plays a significant role in determining IPC. Individuals who are familiar with government legislations are less concerned about their online privacy.

Theoretical Implications

This paper makes multiple theoretical contributions. First, we have used the MDT as a guiding theoretical lens to advance our understanding of the antecedents of individuals’ privacy concerns. The MDT was previously used to examine the conceptualization and measurement of IPC (Hong and Thong 2013), focusing on website practices related to the dimensions of information management and interaction management only. However, the MDT has not been used to investigate the factors that influence an individual’s formation of IPC. We extend this line of research by using the complete set of dimensions in the MDT to study the antecedents of IPC. MDT provides a comprehensive and multidimensional framework which takes into account multiple sources of factors that together affect an individual’s privacy perception. It provides a good supplement to the risk-benefit paradigm of privacy investigation (such as the social contract theory), and emphasizes the importance of environmental, individual, information management, and interaction management factors in shaping IPC. By considering the multiple dimensions of MDT, researchers can develop a more complete view of the formation of an individual’s IPC. Our post hoc analysis further identifies the boundary conditions of MDT and illustrates a refinement of MDT by considering the interaction between the individual dimension and the other three dimensions. Overall, our work demonstrates the utility in applying MDT to examine the drivers and inhibitors of IPC. In particular, our focus on an individual’s IPC towards websites in general, rather than IPC towards a specific website (e.g., Facebook) or IPC formed under a particular circumstance (e.g., the Cambridge Analytica scandal), enables researchers to better understand the formation of IPC in spite of temporary fluctuations due to discrete incidents. Such IPC may help to explain why different individuals react differently to the same privacy situation (e.g., some Facebook users may choose to close their account after the Cambridge Analytica scandal, while others may not care much.)

Second, we have conducted a comprehensive review of antecedents of IPC and other relevant types of privacy concerns by using MDT as the guiding framework. Our review supplements existing work on information privacy (e.g., Bélanger and Crossler 2011; Pavlou 2011; Smith et al. 2011), with a particular focus on antecedents of IPC. We found that prior studies have collectively examined factors pertaining to the four dimensions of MDT, highlighting the relevance and utility of MDT in understanding antecedents of IPC. However, prior research has not examined the factors pertaining to multiple dimensions of MDT in the same study, resulting in a disjointed consideration of potentially relevant factors. Also, we observed mixed findings for some of the factors identified in our review. These observations highlight the fragmented nature of extant research in this domain and suggest the need to consolidate and validate previous findings.

Third, based on the literature review, we have incorporated salient factors under each dimension of MDT to formulate an integrated model. The resulting model synthesizes previous findings and provides a foundation to guide future research on understanding and managing online privacy, which is currently inadequate in the business ethics literature (e.g., Ashworth and Free 2006; Martin 2016; Sarathy and Robertson 2003). By simultaneously including factors from multiple dimensions of MDT, our work sheds light on the relative impacts of different dimensions on IPC. Our results show that all dimensions of MDT have significant impacts on IPC. This indicates the need to consider factors from various dimensions jointly in investigating the factors shaping individuals’ IPC.

Fourth, our post hoc analysis provides a more nuanced evaluation of the effects of the various antecedents on IPC. The results of the analysis for unobserved heterogeneity show that while most of the antecedents have significant, consistent effects on IPC, certain antecedents could have differential effects on IPC across the heterogeneous segments in a sample (see Table 9 of Appendix D). Further, the results of moderation analysis show that the individual factors (i.e., previous privacy invasion experience, risk avoidance personality, and Internet knowledge) significantly moderated the effects of the factors pertaining to the information management dimension (i.e., information sensitivity) and interaction management dimension (i.e., privacy protection or social presence) (see Table 3; Fig. 3). This finding is consistent with Laufer and Wolfe’s (1977) claim that the meaning and experience of privacy in any specific situation can be circumscribed by the interaction of the dimensions of MDT and the elements within them. In summary, the relationships between IPC and its antecedents may be more intricate. Future research could consider alternative ways to model IPC and its antecedents to yield new insights and contextual understanding of the formation of IPC (Hong et al. 2014).

Finally, our study helps to extend and validate prior findings on the antecedents of IPC in an Asian context. In general, our results show that the identified antecedents appear to be significant and consistent across western and Asian contexts. However, it should be noted that some of the antecedents may be prone to cultural variation, as reflected by Hofstede et al. (2010)’s cultural dimensions. For example, the effect of familiarity with government legislation is relatively weak in our sample. This could be because people in Hong Kong are comfortable with ambiguity (a very low score on uncertainty avoidance) and their adherence to laws and rules may be flexible to suit the actual situation (Hofstede et al. 2010). Thus, the presence and enforcement of legislations may not play a major role in their privacy decision making. Relatedly, despite the very low score on uncertainty avoidance, risk avoidance has a strong effect in our sample. This finding suggests that individual traits play a more prominent role in affecting individual privacy decision making, as compared to the country-level cultural values that may not apply to every case. In addition, information sensitivity is the strongest predictor of IPC in our sample. This could be attributed to the restrained culture in Hong Kong (a very low score on indulgence), where people have a tendency toward cynicism and pessimism (Hofstede et al. 2010) and thus be more cautious about the negative consequences of disclosing sensitive information. Also, the strong effect of social presence in our sample could be attributed to the collectivist culture of Hong Kong (a low score on individualism), where people place a high value on personal relationships. In sum, cultural differences could potentially influence an individual’s perceptions of IPC and its antecedents, which warrants further research.

Practical Implications

There are practical implications for governments, individuals, and website designers. First, government legislation is an important baseline protection of individuals’ information privacy. Our results showed that not only it is important to have government legislations in place, but also individuals have to be aware and familiar with these legislations. Similar to other government programs where awareness is key (Yap and Thong 1997; Yap et al. 1994), governments need to educate their citizens about privacy regulations and laws, so that their citizens would know what privacy rights are protected by law. In addition, it is important to enforce compliance by websites through legislations.

Second, individuals need to educate themselves about the latest privacy protection technologies, including privacy statements, tools, seals, etc., available on the Internet. With adequate knowledge in place, they will be in a better position to judge whether a particular website is trustworthy in terms of handling their personal information. As a result, they can be more proactive in ensuring their personal information in the online environment are protected and manage their levels of IPC.

Third, our results provide useful advice to website designers. It is critical for websites to carefully balance the sensitivity of the information they ask for and the products/services/benefits provided in return. Websites should not ask for sensitive personal information unless absolutely necessary. If they do, they should explain why this information is requested, so that individuals can evaluate the benefits from providing this information. Further, websites should take appropriate actions to protect the information provided by individuals and use them only for the purpose agreed. By doing so, these individuals will have lower IPC and be more willing to provide personal information to websites.

Fourth, websites typically rely on technical measures to reduce individuals’ privacy concerns, including privacy statements, providing third-party seals, and so on. While these technical measures are effective, websites can more effectively lower individuals’ IPC by increasing their social presence through making their interface design appear more ‘human’. For example, by including a picture of a sales person or mimicking the layout of a physical store online, websites can induce potential online consumers to feel closer to them (by providing a similar experience as shopping in a physical store), which results in lowered privacy concern.

Finally, the significant interactions involving the individual dimension highlight the challenges in mitigating privacy concerns for different individuals. Our results suggest that for individuals who have previous privacy invasion experience and who are highly risk-averse, they have relatively higher IPC and are less likely to be subject to manipulation by information sensitivity, privacy protection, and social presence. This finding underscores the importance of not raising unnecessary privacy concerns in the first place and the need for more effective mitigation measures that can be tailored to users’ privacy requirement, such as customized privacy protection (e.g., Zhou and Piramuthu 2015).

Conclusion

This study used MDT as a framework to organize the many antecedents of IPC identified in our literature review. We then tested the utility of MDT by examining the effects of selected antecedents from its various dimensions on individuals’ IPC. The results support the utility of MDT for understanding and predicting individuals’ IPC. All four dimensions of MDT have significant impact on individuals’ IPC, and there are also significant interactions among the dimensions. The MDT framework can serve as a foundation for future research investigating the antecedents of IPC.