Privacy Concerns (Disclosure of Information Usage) (PC)

1. Abstract

The Privacy Concerns (Disclosure of Information Usage) (PC) scale—alternatively conceptualized in psychometric literature as the Awareness of Privacy Practices dimension of the Internet Users' Information Privacy Concerns (IUIPC) framework—is a three-item, self-report psychometric instrument developed by Naresh K. Malhotra, Sung S. Kim, and James Agarwal in 2004. Designed to operationalize an individual's fundamental normative expectation that organizations collecting personal data must explicitly disclose their data gathering, storage, algorithmic processing, and dissemination procedures, the instrument serves as a critical indicator of consumer information privacy orientation. Administered using a 7-point Likert scale ranging from 1 (Strongly Disagree) to 7 (Strongly Agree), the measure captures epistemic expectations regarding organizational transparency and conspicuous notice in online transactions.

Psychometrically, the scale demonstrates robust internal consistency, yielding Cronbach's alpha coefficients typically exceeding 0.83 across empirical validation studies, composite reliability values surpassing 0.85, and average variance extracted (AVE) estimates comfortably surpassing the 0.50 threshold. Grounded theoretically in Social Contract Theory and procedural justice frameworks, the instrument differentiates itself from generalized risk or emotional paranoia by targeting the structural fairness of disclosure. It occupies a central position within structural equation models examining digital commerce, behavioral ad targeting, regulatory compliance (e.g., the European Union's General Data Protection Regulation), and the ubiquitous "privacy paradox." This article provides an exhaustive, multi-perspective examination of the instrument's theoretical foundations, psychometric architecture, validity evidence, and structural integration across behavioral information systems and applied psychology.

2. Keywords

Internet Users' Information Privacy Concerns, IUIPC, Information Privacy, Disclosure of Information Usage, Procedural Fairness, Social Contract Theory, Psychometrics, Transparency Expectations, Privacy Policies, Consumer Trust, Perceived Risk, Online Behavioral Tracking, Informational Self-Determination, Fair Information Practice Principles

3. Authors

The Privacy Concerns (Disclosure of Information Usage) measurement model was developed by a team of prominent scholars in marketing science, management information systems, and psychometrics:

• Naresh K. Malhotra, Ph.D.: Regents' Professor Emeritus of Marketing at the Scheller College of Business, Georgia Institute of Technology, Atlanta, Georgia, USA. A globally distinguished psychometrician and marketing methodologist, Dr. Malhotra has authored foundational textbooks in marketing research and published extensively on structural equation modeling, consumer choice behavior, and digital privacy attitudes.
• Sung S. Kim, Ph.D.: Professor of Operations and Information Management at the Wisconsin School of Business, University of Wisconsin–Madison, Madison, Wisconsin, USA. Dr. Kim's research centers on behavioral information systems, human-computer interaction, organizational IT adoption, and digital user privacy psychology.
• James Agarwal, Ph.D.: Professor of Marketing and the Haskayne Research Professor at the Haskayne School of Business, University of Calgary, Calgary, Alberta, Canada. His scholarship encompasses international marketing, relationship marketing, consumer ethics, and applied multivariate methodology.

4. Purpose

The primary purpose of the Privacy Concerns (Disclosure of Information Usage) scale is to quantify an individual's psychological and normative demand for organizational transparency regarding the collection, handling, and distribution of personal data in digital environments. Prior to the seminal publication by Malhotra, Kim, and Agarwal (2004), academic research in information privacy predominantly utilized the Concern for Information Privacy (CFIP) framework introduced by Smith, Milberg, and Burke (1996). While the CFIP captured organizational data mishandling across four subdimensions (collection, unauthorized secondary use, improper access, and errors), it was conceptualized primarily for offline, legacy corporate architectures (such as banking institutions and credit reporting bureaus) wherein transactional relationships were mediated through paper records and human staff.

With the commercialization and ubiquity of the World Wide Web, online user transactions underwent a fundamental paradigm shift characterized by asynchronous communication, passive tracking, programmatic digital footprinting, and third-party data aggregation. Users frequently found themselves unaware that personal attributes, browsing histories, and geographic locations were being systematically acquired. Malhotra and colleagues recognized that the psychological experience of online privacy concern is not solely dictated by an individual's apprehension about data theft or identity fraud; rather, it is intimately anchored in the psychological need for epistemic transparency—the demand to know whether, why, and how one's data are being processed.

In research contexts, this scale addresses crucial empirical questions concerning the determinants of user behavior in digital ecosystems. Specifically, it enables researchers to isolate whether consumer hesitancy to engage in electronic commerce, mobile application adoption, or interactive social media participation stems from an intrinsic resistance to data capture per se, or alternatively, from an absence of conspicuous, comprehensible disclosure mechanisms. By measuring this construct, scholars can operationalize the cognitive mechanisms underlying the "privacy paradox"—the observed disconnect between high stated privacy concerns and seemingly reckless digital data-sharing behaviors.

In applied corporate, legal, and clinical settings, the scale fulfills distinct diagnostic functions:

• Regulatory Auditing and Compliance: Frameworks such as the European Union's General Data Protection Regulation (GDPR; Articles 12, 13, and 14) and the California Consumer Privacy Act (CCPA) mandate explicit transparency, intelligible notices, and documented processing bases. The scale serves as an empirical metric to evaluate whether consumer perceptions of organizational disclosure align with statutory standards for informed consent.
• User Experience (UX) and Interface Design: Technology developers employ the instrument to determine how different presentations of privacy notices (e.g., visual layered dashboards, multi-page legal terms of service, just-in-time contextual permissions) mitigate consumer anxiety and cultivate relational trust.
• Organizational Risk Assessment: Enterprises utilize the scale within consumer sentiment audits to evaluate whether expanding data monetization practices will trigger acute brand alienation, consumer boycott intentions, or regulatory scrutiny.

5. Psychological Construct

The construct measured by this instrument—designated as Awareness within the tripartite Internet Users' Information Privacy Concerns (IUIPC) model and specifically isolated here as Disclosure of Information Usage (PC)—is defined as an individual's cognitive orientation and normative conviction that organizations must provide clear, conspicuous, and comprehensive notifications regarding how consumer data are acquired, manipulated, and shared.

To fully grasp this construct, it is necessary to contrast it with the other two core dimensions of the IUIPC architecture: Collection and Control:

• Collection: Reflects an individual's affective and cognitive discomfort regarding the sheer volume of personal data gathered by entities relative to the value returned. It represents an apprehension regarding data extraction magnitude.
• Control: Operates at an agentic level, tapping the user's psychological desire for actionable operational levers—such as opt-out switches, data modification privileges, and erasure capabilities—that empower the user to actively dictate the trajectory of their digital persona.
• Awareness (Disclosure of Information Usage): In sharp contrast, operates at an epistemic and procedural level. It does not mandate that the user physically intervene in data processing (as in Control), nor does it imply an absolute refusal to provide data (as in Collection). Instead, it taps the fundamental demand for information symmetry. It encapsulates the psychological position that informational self-determination cannot exist in the dark; transparency is the mandatory baseline enabling all subsequent cognitive appraisals.

Psychologically, the construct touches upon several cognitive and emotional states:

• Reduction of Informational Asymmetry: In transaction cost economics and behavioral decision theory, information asymmetry generates severe consumer vulnerability and perceived exploitation risk. When consumers score high on the Disclosure of Information Usage scale, they express an acute intolerance for opaque algorithmic operations, hidden tracker scripts, and obfuscated data brokerage arrangements.
• Expectation of Conspicuous Policy Architecture: The construct specifically measures beliefs regarding the medium and manner of disclosure. High scorers do not merely expect disclosure in abstract legal archives; they actively endorse the standard that policies must be prominent, easily accessible, and comprehensible rather than buried within impenetrable end-user license agreements.
• Epistemic Agency and Dignity: From a philosophical-psychological standpoint, the construct reflects an individual's demand to be treated as an autonomous agent rather than an unconsenting subject of data extraction. Transparency functions as an affirmation of user respect. When companies fail to disclose data usage, users experience psychological reactance, heightened suspicion, and an erosion of institutional goodwill.

6. Theoretical Framework

The development of the Privacy Concerns (Disclosure of Information Usage) scale is theoretically underpinned by an intersection of classical sociological, organizational, and psychological paradigms. Three primary theoretical frameworks provide its conceptual justification:

Social Contract Theory

Malhotra, Kim, and Agarwal (2004) explicitly derived the IUIPC model from Integrative Social Contract Theory (ISCT), formulated by Donaldson and Dunfee (1994). ISCT posits that economic and social interactions are governed by implicit social contracts formed between societal actors and institutions. These contracts derive their moral legitimacy from two levels: macrosocial "hypernorms" (universal principles of justice, human dignity, and fair play) and microsocial community norms (context-dependent expectations negotiated within specific domains).

Within digital commerce, privacy represents a dynamic social contract. In exchange for free digital services, customized search outcomes, or convenience, internet users implicitly license corporate entities to handle certain personal data. However, this microsocial contract is valid only if founded on informed mutual assent. Awareness/Disclosure constitutes a fundamental condition precedent of this contract. Without explicit organizational disclosure regarding data flows, the social contract is rendered fundamentally defective due to deceit or non-disclosure. Consequently, when corporations harvest data covertly, they violate the macrosocial hypernorm of procedural honesty, triggering consumer moral outrage and systemic distrust.

Organizational Justice Theory: The Procedural Dimension

The scale heavily operationalizes principles from Organizational Justice, specifically procedural justice as articulated by Thibaut and Walker (1975) and Lind and Tyler (1988). While distributive justice focuses on the equity of the final outcome (e.g., whether the digital service received is worth the data provided), procedural justice centers on the fairness of the protocols, practices, and rules used to reach those outcomes.

In online transactional contexts, privacy policies and disclosure banners constitute the primary operational mechanisms of procedural justice. Procedural justice theory asserts that individuals evaluate institutional legitimacy through criteria such as process control, transparency, consistency, ethicality, and information completeness. An organization that conspicuously discloses how data will be utilized satisfies the criterion of procedural propriety. Even if an individual acknowledges that a firm requires extensive personal data to deliver a service, the presence of proactive, candid disclosure establishes the entity as fair and legitimate, mitigating systemic threat perceptions.

Communication Privacy Management (CPM) Theory

Complementary insights emerge from Sandra Petronio's Communication Privacy Management (CPM) theory. CPM posits that individuals view their private personal information as personal property, enclosed within subjective mental boundaries. When personal information is shared with an external party, those boundaries expand to encompass the recipient, forming a boundary coordination system. This newly formed collective boundary requires explicit rules regarding who else may access the data, how it may be utilized, and how securely it will be preserved. The Disclosure of Information Usage scale measures the user's cognitive insistence on explicit rule-clarification: an individual demands that the entity entering this co-ownership boundary must openly disclose its internal data coordination rules before personal boundaries are breached.

7. Validity

The psychometric validity of the Privacy Concerns (Disclosure of Information Usage) scale has been systematically corroborated across diverse empirical investigations, multi-sample test sequences, and cross-cultural validation protocols.

Construct and Convergent Validity

Construct validity was initially established through an exhaustive multi-stage developmental pipeline in the landmark study by Malhotra et al. (2004). The authors executed exploratory factor analysis (EFA) on initial item pools followed by rigorous confirmatory factor analysis (CFA) across multiple independent samples (a student calibration sample, $N = 188$; a national cross-sectional consumer validation sample, $N = 753$).

The three items representing Disclosure of Information Usage demonstrated exceptionally high, statistically significant factor loadings ($p < .001$) on their designated construct, typically ranging from $lambda = 0.76$ to $lambda = 0.88$ across samples. The Average Variance Extracted (AVE) consistently exceeded the gold-standard benchmark of $0.50$ (reporting values between $0.62$ and $0.71$), demonstrating that the latent construct accounts for the substantial majority of the variance observed among its indicator items rather than measurement error.

Discriminant Validity

Demonstrating discriminant validity was paramount for Malhotra et al., given the historical dominance of Smith et al.'s (1996) CFIP. Using the Fornell-Larcker criterion, the square root of the AVE for the Awareness/Disclosure factor was consistently found to be substantially larger than the bivariate inter-factor correlations between this factor and the remaining IUIPC dimensions (Collection and Control), as well as related constructs such as general disposition to trust, general privacy concern, and computer anxiety. Furthermore, nested chi-square difference tests ($\Delta\chi^2$) comparing an unconstrained multi-factor measurement model against constrained models (where inter-factor correlations were fixed to unity) yielded statistically significant worsening of fit in every instance, verifying that Disclosure of Information Usage is psychometrically distinct from operational control and collection resistance.

Predictive and Nomological Validity

Nomological validity has been repeatedly substantiated by mapping the scale within broader structural equation models of consumer digital decision-making. Within Malhotra et al.'s (2004) baseline structural model, IUIPC served as an antecedent to two critical perceptual nodes: Trusting Beliefs and Perceived Risk, which subsequently drove users' Intention to Disclose Information to e-commerce vendors.

Empirical structural paths demonstrated that high scores on awareness and privacy concern significantly suppressed institutional trusting beliefs ($\gamma = -0.32$ to $-0.45$) while strongly magnifying perceived operational risk ($\gamma = 0.40$ to $0.56$). In subsequent replications across behavioral economics (Dinev & Hart, 2006; Xu et al., 2011), the Disclosure scale effectively predicted:

• Consumer refusal to authorize mobile app permissions.
• The deliberate deployment of privacy-enhancing technologies (e.g., ad-blockers, virtual private networks [VPNs], temporary email addresses).
• Consumer propensity to read privacy notices when presented in clean, standardized tabular formats versus traditional legal boilerplate.

8. Reliability

The three-item Disclosure of Information Usage instrument exhibits exemplary reliability across classic test theory indices and modern structural equation modeling metrics.

Internal Consistency Metrics

In the original instrument development studies conducted by Malhotra et al. (2004):

• Pilot / Calibration Stage ($N = 188$): Cronbach's alpha for the three-item Awareness factor was reported at $lpha = 0.83$.
• Cross-Validation Consumer Sample ($N = 753$): Cronbach's alpha reached $lpha = 0.85$, with a Composite Reliability (CR) of $
  ho_c = 0.86$.
• Item-Total Correlations: Corrected item-total correlations across validation studies consistently exceeded $0.68$, well above the conventional cut-off threshold of $0.40$, signifying uniform contribution to the underlying construct.

Subsequent independent studies in diverse technological domains have continually verified these reliability coefficients. For instance, in longitudinal inquiries assessing enterprise website privacy declarations, researchers observed Cronbach's alphas spanning from $0.81$ to $0.91$. Similarly, in specialized cross-cultural assessments spanning European, East Asian, and North American consumer bases, the scale maintained elevated composite reliability coefficients without exhibiting psychometric drift or item redundancy.

Stability and Standard Error of Measurement

Test-retest assessments over two- to four-week intervals have displayed temporal stability coefficients ranging from $r = 0.74$ to $r = 0.82$, confirming that the scale captures an enduring psychographic expectation and cognitive attitude rather than transient affective mood states. The Standard Error of Measurement (SEM) remains low (consistently calculated below $0.45$ on a 7-point scale), providing researchers with high diagnostic precision when assessing baseline individual differences in disclosure sensitivity.

9. Factor Analysis

The factorial validation of the Privacy Concerns (Disclosure of Information Usage) scale was executed through sequential exploratory and confirmatory factor analytical approaches within maximum likelihood structural equation modeling frameworks.

Exploratory Factor Analysis (EFA)

During initial item generation and refinement, Malhotra et al. subjected an extensive pool of candidate indicators reflecting various internet privacy dimensions to principal components analysis with varimax and promax rotations. Items designated to measure transparency and disclosure consistently coalesced onto a distinct single factor with eigenvalues exceeding $1.0$, capturing over 65% of the common variance within that specific operational domain. The three items exhibited cross-loadings onto non-target dimensions (such as physical collection or operational control) below $0.25$, demonstrating clear structural demarcation.

Confirmatory Factor Analysis (CFA) and Model Fit

In the structural validation phase, CFA was conducted using LISREL and AMOS to examine the first-order and second-order structural validity of the IUIPC. When evaluating the measurement model comprising the three first-order factors (Collection, Control, Awareness/Disclosure), the observed fit indices uniformly surpassed accepted psychometric thresholds:

• Goodness-of-Fit Index (GFI): $ge 0.95$
• Adjusted Goodness-of-Fit Index (AGFI): $ge 0.92$
• Comparative Fit Index (CFI): $ge 0.98$
• Tucker-Lewis Index (TLI / NNFI): $ge 0.97$
• Root Mean Square Error of Approximation (RMSEA): $le 0.048$ (with $90%$ confidence intervals strictly bounded below $0.06$)
• Standardized Root Mean Square Residual (SRMR): $le 0.035$

Standardized Item Loadings and Error Variances

In the validated confirmatory model, the standardized parameter estimates ($lambda$) for the three specific disclosure items were highly uniform:

• Item 1 ("Companies seeking information should disclose the way the data are collected, processed, and used"): $lambda pprox 0.81$, with error variance $ heta_delta pprox 0.34$.
• Item 2 ("A good consumer online privacy policy should have a clear and conspicuous disclosure"): $lambda pprox 0.86$, with error variance $ heta_delta pprox 0.26$.
• Item 3 ("It is very important to me that I am aware and knowledgeable about how my personal information will be used"): $lambda pprox 0.77$, with error variance $ heta_delta pprox 0.41$.

These loadings demonstrate that the second item—focusing specifically on clear and conspicuous policy disclosure—serves as the most potent empirical marker of the underlying latent dimension. Multigroup invariance testing across gender, age brackets, and internet usage experience has repeatedly confirmed metric and scalar invariance ($\Delta\chi^2$ non-significant, $Delta ext{CFI} < 0.01$), establishing that the factor loadings and item intercepts are invariant across heterogeneous user demographics.

10. Instrument / Measurement Tool

The Privacy Concerns (Disclosure of Information Usage) scale is a self-administered, standardized psychometric questionnaire. Below are its structured operational characteristics:

• Instrument Designation: Privacy Concerns (Disclosure of Information Usage) (PC) / IUIPC Awareness Subscale
• Author Origin: Naresh K. Malhotra, Sung S. Kim, and James Agarwal (2004)
• Measurement Paradigm: Classical Test Theory (CTT) and Structural Equation Modeling (SEM) Latent Factor Measurement
• Administration Format: Self-report paper-and-pencil or computerized/mobile survey instrumentation
• Target Population: Internet users, digital consumers, mobile device operators, and individuals engaging with digital platforms (adolescents aged 16+ through adults)
• Item Count: 3 authentic survey items
• Response Format: 7-point Likert scale (1 = Strongly Disagree to 7 = Strongly Agree), where higher numbers reflect greater psychological concern and demand for organizational disclosure
• Completion Time: Approximately 1 to 2 minutes
• Scoring and Computational Rules:
  • All 3 items are positively keyed; no reverse scoring is required.
  • Composite Mean Scoring: $\text{Awareness Score} = \frac{\text{Item}_1 + \text{Item}_2 + \text{Item}_3}{3}$, yielding an interpretable composite index ranging from $1.00$ to $7.00$.
  • Summed Scoring: Sum of the three items (range: $3$ to $21$).
  • Latent Variable Representation: In structural equation models, the three items serve as congeneric reflective indicators loading onto a common latent variable ($\eta_{ ext{Awareness}}$).

11. Permissions & Fee and Test Year

The instrument was officially published in the year 2004 in the peer-reviewed journal Information Systems Research, published by the Institute for Operations Research and the Management Sciences (INFORMS).

• Academic and Non-Commercial Research Usage: Under standard fair-use scholarly principles, the scale items may be utilized without monetary fee by academic researchers, doctoral candidates, and university faculties for non-commercial psychometric, behavioral, and educational investigations, provided appropriate citation to Malhotra et al. (2004) is maintained.
• Commercial Applications: Commercial enterprises, market intelligence organizations, or software firms seeking to embed the scale within proprietary consumer analytics platforms or monetized commercial auditing software should secure formal copyright permission via the INFORMS Copyright Clearance Center or by contacting the corresponding authors directly.

12. References

• Dinev, T., & Hart, P. (2006). An extended privacy calculus model for e-commerce transactions. Information Systems Research, 17(1), 61–80. https://doi.org/10.1287/isre.1060.0080
• Donaldson, T., & Dunfee, T. W. (1994). Toward a unified conception of business ethics: Integrative social contracts theory. Academy of Management Review, 19(2), 252–284. https://doi.org/10.5465/amr.1994.9410210749
• Lind, E. A., & Tyler, T. R. (1988). The Social Psychology of Procedural Justice. Springer Science & Business Media. https://doi.org/10.1007/978-1-4899-2115-4
• Malhotra, N. K., Kim, S. S., & Agarwal, J. (2004). Internet users' information privacy concerns (IUIPC): The constructs, the scale, and a causal model. Information Systems Research, 15(4), 336–355. https://doi.org/10.1287/isre.1040.0032
• Petronio, S. (2002). Boundaries of Privacy: Dialectics of Disclosure. State University of New York Press.
• Smith, H. J., Milberg, S. J., & Burke, S. J. (1996). Information privacy: Measuring individuals' concerns about organizational practices. MIS Quarterly, 20(2), 167–196. https://doi.org/10.2307/249677
• Thibaut, J. W., & Walker, L. (1975). Procedural Justice: A Psychological Analysis. L. Erlbaum Associates.
• Xu, H., Luo, X. R., Carroll, J. M., & Rosson, M. B. (2011). The personalization privacy paradox: An exploratory study of decision making process for location-aware marketing. Decision Support Systems, 51(1), 42–52. https://doi.org/10.1016/j.dss.2010.11.017

13. Items of the Scale