Personal Data Disclosure Risks

Abstract

The Personal Data Disclosure Risks scale is a psychometric measurement instrument designed to assess an individual’s subjective evaluation of potential negative consequences, vulnerabilities, and hazards associated with revealing personal information in digital environments. Published by Manuel Bidler, Janina Zimmermann, Jan Hendrik Schumann, and Thomas Widjaja in 2020 in the Journal of Retailing, the instrument was conceptualized within the framework of online consumer interactions, specifically evaluating how interactive game elements and interface mechanisms affect consumers’ cost-benefit calculations during digital onboarding and checkout procedures. The instrument operationalizes perceived disclosure risk as a parsimonious, unidimensional construct measured through three core items reflecting general riskiness, severity and potential for personal loss, and anticipated loss of informational control. Administered via a 7-point Likert scale ranging from 1 (Strongly disagree) to 7 (Strongly agree), the instrument demonstrates robust psychometric properties, including high internal consistency reliability (typically exhibiting Cronbach’s alpha and composite reliability coefficients exceeding .85), strong convergent validity with average variance extracted (AVE) values surpassing established thresholds, and clear discriminant validity from related constructs such as perceived disclosure benefits, institutional trust, and generalized privacy disposition. By capturing the risk component of the foundational Privacy Calculus Theory, the scale serves as an essential tool for behavioral researchers, human-computer interaction (HCI) designers, psychometricians, and digital marketing scholars investigating consumer decision-making, privacy paradox dynamics, regulatory compliance, and information-sharing behaviors in high-stakes technological environments.

Keywords

personal data disclosure risks, privacy calculus theory, information disclosure, perceived risk, loss of control, consumer privacy, online data privacy, psychometrics, digital retailing, behavioral decision making

Authors

The scale was adapted and validated in the context of retail gamification and consumer data disclosure by a multidisciplinary team of researchers specializing in marketing, digital service design, and information systems:

• Manuel Bidler: Doctoral and postdoctoral researcher in Marketing and Innovation, School of Business, Economics and Information Systems, University of Passau, Passau, Germany. His research focuses on gamification, consumer-computer interaction, and privacy behaviors in digital retail settings.
• Janina Zimmermann: Researcher and scholar in Information Systems, Digital Service Design, and Consumer Privacy, University of Passau, Passau, Germany. Her work examines the structural determinants of user trust and information exchange mechanisms.
• Jan Hendrik Schumann: Full Professor and Chair of Marketing and Innovation, University of Passau, Germany. An internationally recognized scholar in services marketing, digital consumer behavior, pricing mechanisms, and privacy management, whose work appears in leading journals such as the Journal of Marketing, Journal of Service Research, and Journal of Retailing.
• Thomas Widjaja: Full Professor and Chair of Business Information Systems, University of Passau, Germany. His research focuses on privacy management, digital platforms, business analytics, and information security economics.

Purpose

In contemporary digital economies, organizations systematically collect vast amounts of consumer data—ranging from demographic profiles and financial credentials to behavioral telemetry and biometric markers—to fuel personalized recommendations, dynamic pricing algorithms, and targeted marketing campaigns. However, this intensive data harvesting frequently triggers heightened consumer hesitation, vulnerability, and friction. The primary purpose of the Personal Data Disclosure Risks scale is to provide a brief, methodologically rigorous, and theoretically grounded measurement instrument to quantify the perceived negative utility and anticipated hazards that consumers attach to the act of submitting personal data to an online entity.

Understanding and measuring perceived disclosure risk is fundamental to both academic research and applied organizational practice. In experimental consumer psychology and information systems research, scholars frequently require brief yet psychometrically invariant measures that can be deployed repeatedly across multi-stage laboratory experiments, A/B testing interfaces, and longitudinal field trials without causing respondent fatigue or survey satisficing. The three-item instrument developed and adapted by Bidler et al. (2020) satisfies this need by capturing the core cognitive appraisals of risk—general vulnerability, expectation of loss, and deprivation of control—within a lean structure.

The scale was specifically utilized in empirical investigations analyzing how relevance-illustrating game elements (such as interactive quizzes, progress bars, and contextual feedback mechanisms) can mitigate perceived risks or make the downstream benefits of data sharing sufficiently salient to alter the consumer’s decision calculus. Beyond gamification and retail contexts, the scale is broadly applicable across diverse domains including financial technology (FinTech) adoption, digital health telemetry sharing, Internet of Things (IoT) configuration, social media profile management, and citizen compliance with e-government digital identity systems. By measuring perceived risk as a primary counterweight to perceived benefits, researchers can predict behavioral outcomes including form abandonment, deliberate obfuscation (e.g., providing falsified personal data), privacy-seeking protective behaviors, and overall transaction completion rates.

Psychological Construct

The construct of Perceived Personal Data Disclosure Risk represents an individual’s subjective appraisal of the probability and severity of adverse outcomes resulting from providing personal information to an external party via an electronic communication channel. Within psychometric and behavioral economics frameworks, perceived risk is not conceptualized as an objective actuarial probability of security breaches or data misuse; rather, it is a psychological state characterized by uncertainty, perceived vulnerability, and anticipated loss.

The construct operationalized by Bidler et al. (2020) synthesizes three critical cognitive dimensions of information risk into a cohesive, unidimensional latent factor:

1. Subjective Uncertainty and General Riskiness

The first dimension captures the overarching cognitive assessment of situational risk. Drawing on classical decision theory, individuals evaluate interactions under conditions of imperfect information through an overarching heuristic of riskiness. In digital data exchanges, consumers rarely possess complete insight into a firm’s backend data architecture, encryption standards, third-party data broker arrangements, or internal access governance. Consequently, the act of entering data into a web form is perceived through a generalized schema of vulnerability. High scores on this facet indicate an immediate cognitive association between data transmission and impending hazards.

2. Expectation and Potential of Personal Loss

The second dimension addresses the expected magnitude of negative consequences, conceptualized as potential loss. Rooted in psychological theories of threat appraisal and Prospect Theory, risk perception is heavily weighted by the anticipation of tangible and intangible losses. Tangible losses in digital transactions encompass direct financial injury (such as fraudulent charges or account takeover), identity theft, and time expended resolving unauthorized disclosures. Intangible losses include reputational harm, psychological distress, unsolicited marketing intrusions (spam), and social stigmatization resulting from the leakage of sensitive preferences or medical data. The scale directly gauges the respondent’s assessment that data disclosure entails a significant probability of experiencing severe net detriments.

3. Loss of Informational and Behavioral Control

The third dimension reflects the perceived relinquishment of informational sovereignty. Psychological control is a fundamental human drive; individuals exhibit a strong psychological need to maintain boundaries around what others know about them and how their personal information is utilized. When consumers submit data to an online platform, they effectively surrender autonomous oversight over their data’s dissemination, retention, and algorithmic repurposing. The perception that disclosure inevitably produces a loss of agency and boundary control represents one of the strongest psychometric drivers of privacy anxiety and defensive avoidance behaviors.

Theoretical Framework

The conceptual foundation of the Personal Data Disclosure Risks scale rests predominantly on Privacy Calculus Theory (Culnan & Armstrong, 1999; Dinev & Hart, 2006; Laufer & Wolfe, 1977), supplemented by Communication Privacy Management (CPM) Theory (Petronio, 2002) and behavioral economics principles of loss aversion.

Privacy Calculus Model

The Privacy Calculus Model posits that consumers do not reject data disclosure unconditionally; instead, they function as boundedly rational decision-makers who perform a cognitive cost-benefit analysis before disclosing personal details. In this calculus, the dependent intention or behavior (such as willingness to disclose personal information) is determined by the dynamic tension between two opposing cognitive forces:

• Perceived Benefits (Privacy Gains): Expected positive outcomes, including customized recommendations, monetary discounts, convenience, social validation, and enhanced service personalization.
• Perceived Risks (Privacy Costs): Anticipated negative consequences, vulnerabilities, potential material losses, and institutional misuse of information.

Within this theoretical model, perceived risk serves as the primary psychological barrier inhibiting digital engagement. When perceived risks outweigh perceived benefits, consumers invoke privacy-protective behaviors or abort the transaction. Bidler et al. (2020) utilized the scale specifically to demonstrate that while game mechanics can clarify and magnify perceived relevance and benefits, perceived disclosure risk acts as an ever-present inhibitor that must be structurally addressed through transparent interface design, perceived control, and institutional trust.

Communication Privacy Management (CPM)

Petronio’s Communication Privacy Management theory explains how individuals navigate privacy boundaries through subjective rule-based management systems. When an individual discloses information, they transition from being the sole owner of that private information to creating a co-ownership boundary with the receiving organization. If the individual perceives that the receiving party will violate relational boundaries, disregard expected confidentiality rules, or distribute the information to unauthorized third-party entities without consent, boundary turbulence occurs. The scale’s emphasis on “loss of control” directly taps into CPM’s core premise: disclosure without robust boundary control mechanisms creates acute psychological discomfort.

Prospect Theory and Asymmetric Loss Valuation

Under Kahneman and Tversky’s (1979) Prospect Theory, human beings evaluate outcomes as changes relative to a neutral reference point, exhibiting pronounced loss aversion: losses loom larger than equivalent gains. In data disclosure scenarios, potential risks (such as identity compromise, unauthorized tracking, or reputational damage) are cognitively encoded as looming losses. Because individuals are fundamentally loss-averse, even a modest perceived potential for loss can exert a disproportionately powerful inhibitory effect on consumer behavior compared to substantial anticipated service rewards.

Validity

The validity of the Personal Data Disclosure Risks scale has been empirically substantiated through rigorous structural equation modeling (SEM) and factor analysis across digital consumer studies. Empirical evidence spans construct validity, convergent validity, discriminant validity, and predictive (criterion-related) validity.

Construct and Convergent Validity

Convergent validity evaluates the extent to which the three items effectively converge on the single underlying latent construct of perceived risk. In the validation analyses presented by Bidler et al. (2020) and related research applying standardized measurement models in online retailing:

• Standardized factor loadings ($lambda$) for all three scale items consistently surpass the widely accepted threshold of .70 (typically ranging from .82 to .93), demonstrating that each item accounts for a substantial proportion of shared variance.
• The Average Variance Extracted (AVE) for the latent construct reliably exceeds the conservative benchmark of .50 (frequently exceeding .70 to .75), confirming that the latent variable captures more variance from its indicators than is attributable to measurement error.

Discriminant Validity

Discriminant validity confirms that perceived data disclosure risk remains statistically distinct from conceptually adjacent constructs within digital interface evaluations, such as perceived benefits, general privacy concerns, institutional trust, and website usability:

• Fornell-Larcker Criterion: The square root of the AVE for the perceived data disclosure risk construct is substantially higher than its bivariate correlations with any other latent construct in the structural model (e.g., correlation with perceived benefits typically ranges between $r = -.25$ and $r = -.45$; correlation with willingness to disclose data typically ranges between $r = -.30$ and $r = -.55$).
• Heterotrait-Monotrait Ratio (HTMT): When evaluated using modern PLS-SEM guidelines, the HTMT ratios between perceived disclosure risk and other latent variables remain well below the conservative ceiling of .85, verifying rigorous discriminant distinctiveness.

Predictive and Nomological Validity

The scale demonstrates robust predictive validity across diverse experimental and observational designs. In Bidler et al. (2020), higher scores on the Personal Data Disclosure Risks scale systematically predicted:

• Significantly reduced consumer willingness to disclose personal information during online onboarding.
• Lower downstream engagement in interactive interface mechanics when data requests were perceived as intrusive or unaligned with perceived utility.
• Increased likelihood of defensive data obfuscation or transaction abandonment.

Furthermore, testing the scale within broader nomological networks confirms theoretical hypotheses: perceived risk mediates the negative relationship between sensitive data requests and user conversion, while high levels of platform trust and transparent control mechanisms significantly attenuate perceived risk scores.

Reliability

The reliability of the Personal Data Disclosure Risks scale has been established across multiple independent samples using both classical test theory and modern latent variable measurement metrics.

Internal Consistency

Internal consistency reflects the degree of interrelatedness among the scale items. Across empirical studies utilizing the three-item instrument:

• Cronbach’s Alpha ($lpha$): Reported values consistently range between .85 and .93 across independent retail and digital service samples, comfortably exceeding Nunnally’s standard reliability threshold of .70 for established scales and .80 for basic research.
• Composite Reliability ($
  ho_c$ / CR): Because Cronbach’s alpha assumes tau-equivalence (equal factor loadings), researchers routinely compute Composite Reliability. The scale yields CR values consistently between .88 and .94, confirming high structural precision.
• McDonald’s Omega ($\omega$): Omega estimations consistently align with composite reliability indicators ($\omega > .88$), showing that the items reliably measure the common factor without substantial multidimensional distortion.

Item Homogeneity and Stability

Item-total correlations for each of the three items routinely exceed .75, indicating that each statement contributes significantly to construct measurement without redundancy. Although digital privacy perceptions are sensitive to situational manipulations (such as altering the visual presentation of privacy policies or manipulating data sensitivity levels), test-retest reliability across control groups over short experimental intervals demonstrates stable individual baseline variance ($r_{tt} > .80$).

Factor Analysis

The dimensionality of the Personal Data Disclosure Risks scale has been extensively scrutinized using both Exploratory Factor Analysis (EFA) and Confirmatory Factor Analysis (CFA).

Exploratory Factor Analysis (EFA)

Initial exploratory analyses using principal axis factoring or maximum likelihood extraction with oblique or orthogonal rotations consistently produce an unambiguous single-factor solution:

• The first unrotated eigenvalue substantially exceeds 2.20, accounting for more than 75% to 82% of the total variance among the items.
• The scree plot displays a decisive drop-off after the first component, with subsequent eigenvalues falling far below the Kaiser criterion of 1.0.
• Item communalities ($h^2$) routinely exceed .65, confirming that the single extracted factor captures the overwhelming majority of each indicator’s variance.

Confirmatory Factor Analysis (CFA)

In structural equation modeling frameworks, the unidimensional specification of the three-item instrument exhibits outstanding global and local goodness-of-fit indices. Because a three-indicator model is mathematically just-identified (zero degrees of freedom) when evaluated in complete isolation, it is routinely evaluated within a multi-construct measurement model alongside perceived benefits, trust, and disclosure intentions. In these comprehensive models, the factor structure demonstrates exemplary fit:

• Comparative Fit Index (CFI): Values consistently exceed .98 (often $ge .99$).
• Tucker-Lewis Index (TLI): Values consistently exceed .98.
• Root Mean Square Error of Approximation (RMSEA): Estimates reliably fall below .05 (with 90% confidence intervals spanning .000 to .065).
• Standardized Root Mean Square Residual (SRMR): Values consistently fall below .03.

Standardized factor loadings across empirical evaluations are exceptionally uniform:

• Item 1 (“Disclosing my personal data would be risky”): $lambda pprox .84 – .91$
• Item 2 (“There would be high potential for loss in disclosing my personal data”): $lambda pprox .86 – .93$
• Item 3 (“Disclosing my personal data would lead to a loss of control”): $lambda pprox .82 – .89$

All parameter estimates are statistically significant at $p < .001$, confirming the psychometric robustness of the scale indicators.

Instrument / Measurement Tool

• Instrument Name: Personal Data Disclosure Risks Scale
• Original Authors: Manuel Bidler, Janina Zimmermann, Jan Hendrik Schumann, and Thomas Widjaja (2020)
• Target Population: Consumers, internet users, e-commerce shoppers, and digital service recipients facing personal data disclosure decisions
• Administration Format: Self-administered questionnaire (optimized for online experiments, desktop/mobile surveys, and field research)
• Administration Time: Less than 1 minute (approximately 30 to 45 seconds)
• Number of Items: 3 items
• Factor Structure: Unidimensional (single latent factor reflecting perceived risk of data disclosure)
• Response Scale: 7-point Likert scale (1 = Strongly disagree, 7 = Strongly agree)
• Scoring Protocol:
  • All items are positively keyed (no reverse-scored items).
  • An overall perceived data disclosure risk score is calculated by computing the unweighted arithmetic mean across the 3 items:
    $$\text{Perceived Risk Score} = \frac{\text{Item}_1 + \text{Item}_2 + \text{Item}_3}{3}$$
  • Alternatively, latent variable scores can be extracted via SEM software (e.g., AMOS, Mplus, lavaan) using standardized factor score weights.
• Score Interpretation:
  • 1.00 – 2.99 (Low Perceived Risk): The respondent views personal data sharing in the target environment as safe, benign, and free of significant negative consequences.
  • 3.00 – 4.99 (Moderate Perceived Risk): The respondent experiences ambivalence or mild concern; transactional benefits or brand reputation can readily tip the decision toward disclosure.
  • 5.00 – 7.00 (High Perceived Risk): The respondent perceives substantial hazards, acute potential for loss, and severe erosion of privacy boundaries, typically producing strong resistance to data sharing unless compensated by disproportionate incentives.

Permissions & Fee and Test Year

• Year of Publication: 2020
• Publication Context: Published in Journal of Retailing (Volume 96, Issue 4, pages 507–523), published by Elsevier on behalf of New York University.
• Permissions & Licensing: The scale items and psychometric findings are published in an academic peer-reviewed journal. The scale is freely accessible and available without fee for non-commercial academic, educational, and scientific research purposes, provided appropriate academic citation is accorded to the original authors (Bidler et al., 2020) and the Journal of Retailing.
• Commercial Usage: For proprietary commercial assessment tools, commercial survey software integrations, or corporate analytics platforms, researchers and organizations should consult the publisher (Elsevier / Copyright Clearance Center) to confirm fair-use policies and institutional licensing terms.

References

• Bidler, M., Zimmermann, J., Schumann, J. H., & Widjaja, T. (2020). Increasing consumers’ willingness to engage in data disclosure processes through relevance-illustrating game elements. Journal of Retailing, 96(4), 507–523. https://doi.org/10.1016/j.jretai.2020.08.001
• Culnan, M. J., & Armstrong, P. K. (1999). Information privacy concerns, procedural fairness, and impersonal trust: An empirical investigation. Organization Science, 10(1), 104–115. https://doi.org/10.1287/orsc.10.1.104
• Dinev, T., & Hart, P. (2006). An extended privacy calculus model for e-commerce transactions. Information Systems Research, 17(1), 61–80. https://doi.org/10.1287/isre.1060.0080
• Fornell, C., & Larcker, D. F. (1981). Evaluating structural equation models with unobservable variables and measurement error. Journal of Marketing Research, 18(1), 39–50. https://doi.org/10.1177/002224378101800104
• Kahneman, D., & Tversky, A. (1979). Prospect theory: An analysis of decision under risk. Econometrica, 47(2), 263–291. https://doi.org/10.2307/1914185
• Laufer, R. S., & Wolfe, M. (1977). Privacy as a concept and a social issue: A multidimensional developmental theory. Journal of Social Issues, 33(3), 22–42. https://doi.org/10.1111/j.1540-4560.1977.tb01880.x
• Malhotra, N. K., Kim, S. S., & Agarwal, J. (2004). Internet users’ information privacy concerns (IUIPC): The construct, the scale, and a causal model. Information Systems Research, 15(4), 336–355. https://doi.org/10.1287/isre.1040.0032
• Petronio, S. (2002). Boundaries of privacy: Dialectics of disclosure. State University of New York Press.
• Podsakoff, P. M., MacKenzie, S. B., Lee, J.-Y., & Podsakoff, N. P. (2003). Common method biases in behavioral research: A critical review of the literature and recommended remedies. Journal of Applied Psychology, 88(5), 879–903. https://doi.org/10.1037/0021-9010.88.5.879

Items of the Scale