Privacy Concerns (Control of Information) (PC)

Abstract

The Privacy Concerns (Control of Information) (PC) subscale is a psychometric instrument developed by Naresh K. Malhotra, Sung S. Kim, and James Agarwal in 2004 as a core foundational dimension of the Internet Users' Information Privacy Concerns (IUIPC) framework. Rooted in social contract theory and psychological theories of personal autonomy, the PC subscale conceptualizes individual privacy concerns not merely through the volume of data surrendered, but through the perceived loss of agency, governance, and self-determination over personal data transactions. Composed of three carefully operationalized items evaluated on a 7-point Likert scale ranging from 1 (Strongly Disagree) to 7 (Strongly Agree), the instrument quantifies an individual's conviction that privacy fundamentally resides in the right to decide if, how, and with whom personal information is collected, processed, and disseminated.

Extensive psychometric evaluations across digital commerce, human-computer interaction, and organizational behavior literature establish the subscale's robust psychometric properties. The scale consistently exhibits high internal consistency, with Cronbach's alpha coefficients and composite reliability estimates routinely exceeding 0.85 across diverse cross-sectional and experimental samples. Confirmatory factor analyses (CFA) demonstrate clear factorial distinctiveness, strong convergent validity with average variance extracted (AVE) surpassing 0.65, and excellent discriminant validity against parallel privacy dimensions such as collection concerns and awareness of privacy practices. As a pivotal predictor within digital behavioral models, the PC scale reliably accounts for significant variance in consumer trusting beliefs, risk perceptions, personal disclosure intentions, and protective behaviors such as utilizing privacy-enhancing technologies or providing falsified personal data. This profile outlines the theoretical foundations, operational characteristics, empirical validity, and practical applications of the Privacy Concerns (Control of Information) instrument.

Keywords

Information Privacy Concerns, Control of Information, IUIPC, Malhotra Kim Agarwal, Digital Autonomy, Social Contract Theory, Boundary Regulation, Consumer Privacy, Perceived Control, Online Disclosure

Authors

The Privacy Concerns (Control of Information) subscale was conceptualized, operationalized, and psychometrically validated by a prominent research team specializing in marketing analytics, management information systems, and consumer behavior:

• Naresh K. Malhotra, Ph.D.: Regents' Professor Emeritus of Marketing at the Scheller College of Business, Georgia Institute of Technology, Atlanta, Georgia, USA. A globally recognized scholar in marketing research methodologies, psychometrics, and consumer psychology.
• Sung S. Kim, Ph.D.: Professor of Information Systems, formerly affiliated with the Foster School of Business at the University of Washington, Seattle, Washington, and the School of Business at the University of Wisconsin–Madison, Madison, Wisconsin, USA. Specializes in behavioral information systems, human-computer interaction, and digital privacy dynamics.
• James Agarwal, Ph.D.: Professor of Marketing and former McCaig Research Chair at the Haskayne School of Business, University of Calgary, Calgary, Alberta, Canada. Renowned for structural equation modeling, international marketing, and ethical dimensions of digital consumer relationships.

Purpose

The primary objective of the Privacy Concerns (Control of Information) (PC) scale is to isolate and measure an individual's fundamental beliefs regarding personal agency, governance, and sovereignty over their private digital footprint. During the late 1990s and early 2000s, empirical investigations into digital privacy were largely dominated by instruments such as the Concern for Information Privacy (CFIP) scale, developed by Smith, Milberg, and Burke (1996). Although the CFIP was foundational, its orientation was tailored primarily to traditional, offline corporate data environments, conceptualizing privacy through organizational misdeeds such as improper access, data storage errors, and unauthorized secondary use.

Recognizing the paradigm shift catalyzed by the interactive internet, Malhotra, Kim, and Agarwal (2004) posited that modern internet users are not passive subjects of bureaucratic record-keeping. Instead, users actively engage in continuous, bilateral micro-transactions in which personal information serves as a primary currency. In this online ecosystem, the defining threat to privacy shifted from passive organizational mishandling to an active deprivation of user agency. The PC subscale was formulated to operationalize this specific psychological core: the conviction that online privacy is fundamentally defined by the individual's autonomy to govern decisions regarding information acquisition, processing trajectories, and third-party distribution.

From an applied research perspective, the instrument addresses several critical psychological and behavioral phenomena:

• Investigating the Privacy Paradox: Researchers employ the scale to reconcile the persistent divergence between stated privacy concerns and actual online disclosure behavior, demonstrating that users disclose data when they perceive high situational control, even if objective systemic security is fragile.
• Evaluating Digital Consent Mechanisms: The scale enables user experience (UX) and digital policy analysts to evaluate how interface architectures—such as opt-in vs. opt-out checkboxes, cookie management dashboards, and granular permission sliders—modulate users' psychological sense of control and subsequent trust.
• Predicting Consumer Coping Mechanisms: In organizational behavior and e-commerce contexts, elevated PC scores reliably forecast defensive behavioral adaptations, including the installation of ad-blockers, virtual private networks (VPNs), data obfuscation (providing falsified demographic information), or complete platform abandonment.
• Informing Regulatory Compliance and Legal Frameworks: Psychometric data gathered via the scale provide empirical support for legal architectures such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), both of which center their normative legal protections on the consumer's right to informational self-determination.

Psychological Construct

The psychological construct captured by the Privacy Concerns (Control of Information) scale is rooted in informational self-determination—the psychological need and subjective right of individuals to maintain mastery over their boundary conditions relative to the external social world. The construct operates as a cognitive schema and value orientation, reflecting how deeply an individual links the abstract concept of personal liberty to the active control of their personal digital footprint.

Core Facets of the Construct

Within the psychometric architecture of Malhotra et al. (2004), “Control” represents one of three intercorrelated first-order dimensions forming the second-order IUIPC meta-construct, alongside “Collection” and “Awareness.” However, control is distinguished conceptually as the normative, operational backbone of privacy orientation:

• Volitional Autonomy: The belief that information disclosure must be entirely voluntary. When individuals are coerced or nudged into surrendering personal data without explicit, uncoerced consent, their psychological autonomy is violated, eliciting psychological reactance.
• Procedural Governance: The expectation that data transactions operate under explicit procedural rules where the user maintains ongoing oversight. Control is not exhausted at the point of initial collection; rather, the user asserts continuous governance over how data are manipulated, analyzed through predictive algorithms, and shared with secondary or tertiary actors.
• Boundary Deprivation as Privacy Loss: Crucially, the construct specifies that privacy invasion is psychologically equated with the attenuation of control. A privacy violation does not merely occur when tangible economic harm or public embarrassment happens; the cognitive perception of invasion is triggered immediately when corporate mechanisms limit, obscure, or extinguish the individual's ability to steer their own data stream.

Behavioral Manifestations and Psychological Contrasts

To fully understand the construct, it must be contrasted with the related yet distinct constructs within the privacy domain:

While the Collection dimension measures an individual's affective apprehension regarding the sheer quantity of personal data archived by online entities, the Control dimension measures the structural and procedural conditions governing that data. An individual may not inherently object to extensive data profiling (e.g., streaming music recommendations or health metric monitoring) provided they maintain total administrative authority over those records. Conversely, an individual possessing extremely high control concerns will register profound privacy alarm over the extraction of minimal, innocuous data points if that extraction occurs surreptitiously or through involuntary default configurations.

Similarly, while Awareness of Privacy Practices assesses consumer knowledge and cognitive comprehension of corporate privacy policies and regulatory disclosures, Control captures the operational leverage the consumer exercises. Knowledge without operational control breeds heightened cynicism, whereas perceived control empowers the individual to navigate digital ecosystems with elevated trusting beliefs and lower perceived vulnerability.

Theoretical Framework

The conceptual formulation of the Privacy Concerns (Control of Information) scale is underpinned by an integration of classical socio-philosophical paradigms and modern psychological theories of human behavior.

Social Contract Theory

The foundational bedrock of the IUIPC framework is Social Contract Theory, particularly as articulated in normative business ethics by Donaldson and Dunfee (1994) in their Integrative Social Contracts Theory (ISCT). In digital commerce, social contract theory posits that commercial exchanges between consumers and firms rely on unwritten, normative behavioral expectations. Consumers accept the surrender of personal information in exchange for personalized services, functional utility, or digital convenience, but this exchange is fundamentally conditioned on procedural fairness and normative justice.

Malhotra et al. (2004) argued that control over personal information constitutes the most critical hypernorm within this digital social contract. When companies deploy tracking cookies, fingerprinting scripts, or data-broker syndication pipelines without consumer control, they unilaterally breach this macro-social covenant. The PC scale directly quantifies the individual's adherence to this normative expectation: privacy exists when the social contract guarantees informational sovereignty; privacy is breached when corporate power asymmetry invalidates consumer control.

Westin's and Altman's Theories of Privacy and Boundary Regulation

At the psychological level, the scale draws directly from Alan Westin's (1967) seminal treatise, Privacy and Freedom, which famously defined privacy as:

“…the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others.”

This definition places informational control at the center of the privacy concept. Westin maintained that privacy is not total seclusion or complete secrecy, but rather an active, dynamic state of self-governed boundary maintenance.

This formulation was complemented by Irwin Altman's (1975) Privacy Regulation Theory, which conceptualizes privacy as an interpersonal, dialectic boundary management process. Altman described how humans continuously regulate their social boundaries through an optimization process, balancing the desire for social interaction against the need for psychological sanctuary. In digital environments, this boundary regulation functions almost entirely through informational control mechanisms. When digital interfaces eliminate the consumer's boundary regulation tools (e.g., mandatory data sharing without opt-out avenues), boundary homeostasis collapses, resulting in psychological distress, defensive withdrawal, or aggressive counter-behaviors.

Communication Privacy Management Theory (CPM)

The operational logic of the scale also aligns with Sandra Petronio's (2002) Communication Privacy Management Theory. CPM posits that individuals believe they own their private information. Because they perceive ownership, they believe they possess the sovereign right to control that information through personal privacy rules. When individuals disclose data to a digital platform, the platform becomes a “co-owner” or “authorized trustee” of that data. The items in the PC scale measure the user's unyielding demand that this co-ownership must adhere to mutual boundary coordination rules: the user must retain the right to govern the lifecycle of the shared data, and any unauthorized secondary disclosure by the trustee constitutes an intolerable boundary turbulence.

Validity

The construct, convergent, discriminant, and predictive validity of the Privacy Concerns (Control of Information) scale have been established across numerous empirical investigations.

Construct and Convergent Validity

In the seminal psychometric validation study conducted by Malhotra, Kim, and Agarwal (2004), the construct validity of the Control scale was established through a series of iterative empirical phases:

• Initial Qualitative and Content Validation: An initial pool of scale items was developed from comprehensive reviews of privacy literature, legal statutes, and cognitive interviews with active internet users. Expert panels specializing in measurement methodology verified content validity, ensuring that each statement cleanly mapped onto the theoretical domain of personal autonomy and decision governance.
• Convergent Validity Metrics: In the large-scale cross-sectional validation study involving 756 active internet consumers, the standardized factor loadings for the three Control items were extraordinarily high, ranging from 0.79 to 0.88 ($p < 0.001$). The Average Variance Extracted (AVE) for the Control dimension easily exceeded the standard 0.50 benchmark recommended by Fornell and Larcker (1981), achieving values above 0.68. These metrics confirm that the scale items capture a large proportion of variance attributable to the underlying theoretical construct rather than measurement error.

Discriminant Validity

Discriminant validity was established using multiple rigorous statistical procedures:

• Fornell-Larcker Criterion: The square root of the AVE for the Control subscale ($pprox 0.825$) was substantially greater than its bivariate correlations with the other primary dimensions of the IUIPC model: Collection ($r = 0.54$) and Awareness ($r = 0.46$). This demonstrated that while the dimensions share common variance under the overarching umbrella of general privacy concern, Control represents an independent psychometric entity.
• Nested Model Comparisons: Malhotra et al. (2004) performed nested $\chi^2$ difference tests comparing an unconstrained three-factor measurement model against constrained models where inter-factor correlations were fixed to unity. In every instance, the unconstrained model demonstrated a statistically superior fit ($\Delta\chi^2$ values significant at $p < 0.001$), firmly verifying the discriminant boundaries between Control, Collection, and Awareness.

Nomological and Predictive Criterion Validity

The scale exhibits robust nomological validity through its well-documented structural relationships within structural equation models (SEM):

• Impact on Trusting Beliefs: In Malhotra et al.'s structural model, control concerns exerted a significant negative influence on consumers' trusting beliefs toward internet companies ($eta = -0.31, p < 0.001$). When users perceive that corporate practices inherently strip them of personal autonomy, institutional and transactional trust degrades sharply.
• Amplification of Risk Perceptions: Heightened scores on the Control scale directly drive perceived risk in online transactions ($eta = 0.38, p < 0.001$). The psychological realization that one lacks operational mechanisms to retract or regulate data amplifies the perceived probability and severity of potential corporate opportunism.
• Predicting Disclosure Intentions and Protective Actions: Downstream in the nomological network, the scale indirects predictive power toward transactional willingness and protective actions. Subsequent empirical applications (e.g., Xu et al., 2011; Dinev et al., 2013) have demonstrated that the Control subscale accurately predicts both real and simulated disclosure decisions, willingness to authorize smartphone location tracking, adoption of end-to-end encryption tools, and the deliberate provision of fraudulent demographic information during website registration.

Reliability

The reliability of the Privacy Concerns (Control of Information) scale has been supported across diverse demographic cohorts, national contexts, and study methodologies.

Internal Consistency Metrics

The scale items demonstrate high inter-item correlations and internal consistency:

• Cronbach's Alpha ($lpha$): In the initial validation study by Malhotra et al. (2004), the Cronbach's alpha for the three-item Control subscale was recorded at 0.84. Subsequent replications across management, marketing, and computer science literature report alpha coefficients between 0.82 and 0.89, demonstrating that the scale exceeds the standard threshold of 0.70 for basic research and approaches the 0.90 threshold desired for clinical and diagnostic assessment.
• Composite Reliability (CR): Structural equation modeling evaluations yield composite reliability scores routinely calculated between 0.85 and 0.88, confirming that the latent variable is measured with high precision.
• Corrected Item-Total Correlations: Across validation trials, corrected item-total correlations for each of the three individual items consistently exceed 0.68, well above the 0.40 psychometric rule of thumb. This indicates that each individual statement aligns cohesively with the core psychological continuum without introducing extraneous conceptual noise.

Replication and Cross-Cultural Stability

The instrument has demonstrated stable cross-cultural reliability across numerous translated adaptations. Studies administering adapted versions of the IUIPC in European, East Asian, and Middle Eastern cultural contexts (e.g., investigating GDPR impacts in Germany, mobile app adoption in South Korea, or digital banking behaviors in the UAE) have documented internal consistency coefficients consistently spanning the 0.80 to 0.88 range. Test-retest reliability evaluations over intervals of two to four weeks have yielded stability coefficients exceeding $r = 0.76$, indicating that while situational cues (e.g., recent news of a corporate data breach) can temporarily modulate overall concern levels, an individual's foundational attitude toward control remains a durable dispositional trait over time.

Factor Analysis

The latent structure of the Privacy Concerns (Control of Information) scale has been repeatedly corroborated using both exploratory (EFA) and confirmatory (CFA) factor analytic techniques.

Exploratory Factor Analysis (EFA)

During the developmental phase conducted by Malhotra et al. (2004), initial item pools reflecting all candidate IUIPC dimensions were subjected to principal components analysis and principal axis factoring with oblique rotations (promax and oblimin), reflecting the theoretical expectation that privacy dimensions are naturally correlated. The three items designated for the Control construct demonstrated clean, robust psychometric behavior:

• The items loaded onto a single distinct factor with an initial eigenvalue comfortably exceeding the Kaiser criterion threshold of 1.0.
• Item factor loadings were uniformly strong, exceeding 0.75, with cross-loadings onto secondary factors (Collection, Awareness) remaining negligible (typically $< 0.25$).
• The items accounted for over 65% of the total variance extracted among the candidate control statements, confirming structural parsimony.

Confirmatory Factor Analysis (CFA)

To confirm the factorial integrity of the scale within the broader IUIPC architecture, CFA was executed using maximum likelihood estimation in structural equation modeling software (such as LISREL and AMOS). The measurement model evaluated the three first-order factors (Control, Collection, Awareness) both as correlated dimensions and as indicators of a higher-order overarching IUIPC construct.

The statistical fit indices reported in Malhotra et al. (2004) and supported by subsequent validation studies demonstrate exemplary fit to the empirical data:

• Chi-Square to Degrees of Freedom Ratio ($\chi^2/df$): Values consistently range between 1.45 and 2.30, falling well beneath the conservative threshold of 3.0, indicating that the implied covariance matrix does not differ significantly from the observed sample covariance matrix.
• Comparative Fit Index (CFI): Reported CFI values exceed 0.98, surpassing the rigorous 0.95 cutoff established by Hu and Bentler (1999) for well-fitting models.
• Tucker-Lewis Index (TLI / NNFI): TLI estimates routinely exceed 0.97, demonstrating minimal structural penalty for model parameters.
• Root Mean Square Error of Approximation (RMSEA): RMSEA point estimates are consistently low, ranging between 0.031 and 0.048, with the 90% confidence interval falling entirely below the 0.05 benchmark for close fit.
• Standardized Root Mean Square Residual (SRMR): Typical SRMR metrics register at or below 0.035, confirming negligible absolute residual error.

In competitive model testing, researchers frequently compare this three-factor structure against a unidimensional “global privacy concern” model where all IUIPC items are forced to load onto a single latent factor. In all published comparisons, the unidimensional model demonstrates unacceptable fit (CFI $< 0.80$, RMSEA$> 0.12$), providing definitive statistical proof that informational control must be modeled as a distinct, specialized psychometric construct.

Instrument / Measurement Tool

The Privacy Concerns (Control of Information) scale is structured as a brief, high-precision self-report inventory. It can be administered as an independent psychometric assessment or embedded within broader batteries evaluating human-computer interaction, digital marketing, cybersecurity habits, or consumer rights.

Scale Specifications

• Instrument Designation: Privacy Concerns (Control of Information) (PC) Subscale.
• Original Authors: Naresh K. Malhotra, Sung S. Kim, and James Agarwal (2004).
• Measurement Format: Self-administered psychological rating scale.
• Item Count: 3 items.
• Response Scale: 7-point Likert scale:
  • 1 = Strongly Disagree
  • 2 = Disagree
  • 3 = Somewhat Disagree
  • 4 = Neutral
  • 5 = Somewhat Agree
  • 6 = Agree
  • 7 = Strongly Agree
• Administration Modality: Paper-and-pencil, online web survey, mobile computer-assisted personal interviewing (CAPI), or embedded post-interaction software prompt.
• Completion Duration: Approximately 1 to 2 minutes.

Scoring Protocol and Interpretation

• Item Keying: All three items are positively worded and keyed in the direct direction of the construct. There are no reverse-scored items.
• Calculation Method:
  • Mean Scoring (Recommended): Calculate the arithmetic mean of the three completed items: $$\text{PC Mean} = \frac{\text{Item 1} + \text{Item 2} + \text{Item 3}}{3}$$. This retains the intuitive 1.00 to 7.00 metric.
  • Summed Scoring: Sum the raw ratings across all three items: $$\text{PC Total} = \text{Item 1} + \text{Item 2} + \text{Item 3}$$, producing an integer score spanning from 3 to 21.
• Score Interpretation:
  • Low Control Concern (Mean 1.00 – 2.99 / Sum 3 – 8): Indicates low psychological sensitivity regarding corporate data governance. The individual exhibits high complacency or minimal ideological investment in managing informational boundaries online.
  • Moderate Control Concern (Mean 3.00 – 4.99 / Sum 9 – 14): Represents a balanced or situational orientation. The user values data autonomy under certain conditions (e.g., financial transactions) but exhibits pragmatic willingness to relinquish control for standard commercial convenience.
  • High Control Concern (Mean 5.00 – 7.00 / Sum 15 – 21): Reflects an intense, inflexible demand for personal autonomy and institutional transparency. Individuals in this category view any lack of data control as an egregious breach of their fundamental privacy rights, exhibiting heightened risk perceptions and a strong propensity toward defensive or evasive behaviors.

Permissions & Fee and Test Year

• Publication Year: 2004.
• Original Publisher: Institute for Operations Research and the Management Sciences (INFORMS), published in Information Systems Research.
• Fee and Financial Cost: The scale is available free of charge for non-commercial academic, psychological, and scientific research purposes. No licensing fees or royalties are required by the authors for scholarly investigation.
• Permissions Guidelines: Standard scholarly fair use practices apply. Academic researchers may utilize the three-item instrument within surveys, theses, dissertations, and peer-reviewed studies without formal written permission, provided that full bibliographic attribution is granted to Malhotra, Kim, and Agarwal (2004). Commercial entities seeking to embed the scale within proprietary commercial assessment software, enterprise diagnostic platforms, or fee-based consulting products should contact the authors or INFORMS permissions department to secure explicit commercial rights.

References

• Altman, I. (1975). The Environment and Social Behavior: Privacy, Personal Space, Territory, Crowding. Brooks/Cole Publishing Company.
• Dinev, T., & Hart, P. (2006). An extended privacy calculus model for e-commerce transactions. Information Systems Research, 17(1), 61–80. https://doi.org/10.1287/isre.1060.0080
• Dinev, T., Xu, H., Smith, J. H., & Hart, P. (2013). Information privacy and correlates of its components: A cross-cultural study. Information Systems Journal, 23(4), 389–433. https://doi.org/10.1111/isj.12014
• Donaldson, T., & Dunfee, T. W. (1994). Toward a unified conception of business ethics: Integrative social contracts theory. Academy of Management Review, 19(2), 252–284. https://doi.org/10.5465/amr.1994.9410210749
• Fornell, C., & Larcker, D. F. (1981). Evaluating structural equation models with unobservable variables and measurement error. Journal of Marketing Research, 18(1), 39–50. https://doi.org/10.1177/002224378101800104
• Hu, L. T., & Bentler, P. M. (1999). Cutoff criteria for fit indexes in covariance structure analysis: Conventional criteria versus new alternatives. Structural Equation Modeling: A Multidisciplinary Journal, 6(1), 1–55. https://doi.org/10.1080/10705519909540118
• Malhotra, N. K., Kim, S. S., & Agarwal, J. (2004). Internet users' information privacy concerns (IUIPC): The constructs, the scale, and a causal model. Information Systems Research, 15(4), 336–355. https://doi.org/10.1287/isre.1040.0032
• Petronio, S. (2002). Boundaries of Privacy: Dialectics of Disclosure. State University of New York Press.
• Smith, H. J., Milberg, S. J., & Burke, S. J. (1996). Information privacy: Measuring individuals' concerns about organizational practices. MIS Quarterly, 20(2), 167–196. https://doi.org/10.2307/249677
• Westin, A. F. (1967). Privacy and Freedom. Atheneum.
• Xu, H., Dinev, T., Smith, H. J., & Hart, P. (2011). Information privacy concerns: Linking individual perceptions with institutional privacy assurances. Journal of the Association for Information Systems, 12(12), 798–824. https://doi.org/10.17705/1jais.00281

Items of the Scale