Differences in access to privacy information can partly explain digital inequalities in privacy literacy and self-efficacy

ABSTRACT

Users of digital technologies are still held legally responsible for managing their personal data. However, not all users have the same opportunities for privacy management as researchers find systematic sociodemographic differences in, for example, users’ privacy literacy and self-efficacy – two important predictors of privacy management. The present study argues that one reason for such digital inequalities is how easily people have access to privacy information in their everyday lives (e.g. through their profession or social contacts). Analysing data of a representative sample of German internet users (N = 3978) by means of a Bayesian structural equation model, we find that men and more educated persons report easier access to privacy information which, in turn, positively relates to both privacy literacy and self-efficacy. Older persons feel less confident about privacy protection while men and more highly educated persons have higher privacy literacy levels. In conclusion, the present study reveals that casual access to privacy information can be important in learning and being confident about privacy management, but it cannot fully explain digital inequalities in online privacy self-efficacy and literacy.

KEYWORDS:

• Digital inequalities
• privacy literacy
• privacy self-efficacy
• online privacy management
• Bayesian inference

Over the past few decades, researchers have become aware that not all persons have the same opportunities to use digital technologies. While differences in technology access have been largely balanced in western developed countries (Lutz 2019), inequalities in people’s abilities, behaviours, and use experiences have moved into focus. These disparities are termed digital inequalities and describe differences between social classes regarding the use (experiences) of digital technologies (Hargittai 2021; Robinson et al. 2015). Past studies indicate that, for example, younger, more highly educated, and more skilled persons are more likely to adopt mobile health apps (Bol, Helberger, and Van Weert 2018) or that younger and more educated persons experience more positive effects on well-being by incorporating social media into their lives (Bekalu, McCloud, and Viswanath 2019). Another area in which digital inequalities have been observed is people’s management of personal information. For instance, more highly educated persons tend to have higher digital knowledge and skills (Büchi et al. 2021; Epstein and Quinn 2020; Park 2013; Schäwel et al. 2021) and older persons and women appear to apply less privacy protection measures than younger persons and men (Büchi et al. 2021; Epstein and Quinn 2020; Matzner et al. 2016; Meier and Krämer 2023; Park 2013; Schäwel et al. 2021). Reduced abilities to manage personal information online and avoid ubiquitous surveillance practices by private companies or governments could lead to experiencing more negative outcomes (Büchi et al. 2021) like economic exploitation, behavioural manipulation, or algorithmic discrimination (Bol et al. 2020; Mann and Matzner 2019). As long as legal regulations like the US California Consumer Privacy Act or the EU General Data Protection Regulation primarily rely on individual responsibility in privacy management and protection (Kröger, Lutz, and Ullrich 2021; Van Ooijen and Vrabec 2019), inequalities in privacy management are likely to persist as it depends on individual knowledge and abilities. Therefore, it remains a crucial empirical task to better understand the reasons for digital inequalities regarding privacy online and to find ways for a collective privacy protection (Baruh and Popescu 2017).

Because it is not yet fully understood why user groups with different demographic characteristics differ from one another (e.g. why men supposedly protect their privacy better than women), the present study makes a novel attempt in explaining how such digital inequalities might evolve. On the one hand, we examine sociodemographic disparities among two central predictors of people’s privacy protection behaviours: privacy literacy and privacy self-efficacy (Bartsch and Dienlin 2016; Baruh, Secinti, and Cemalcılar 2017; Büchi, Just, and Latzer 2017; Dienlin and Metzger 2016; Epstein and Quinn 2020). On the other hand, we argue that one possible explanation why sociodemographic differences for these variables exist is unequal access to information about privacy protection in people’s daily lives. We will test whether sociodemographic variables (i.e. age, sex, education, and migration background) shape internet users’ access to privacy information, privacy literacy, and privacy self-efficacy, and, furthermore, whether access to privacy information relates to both privacy literacy and self-efficacy. Therefore, this study can help to understand whether certain segments of society are systematically disadvantaged in obtaining privacy information which might have detrimental effects on their knowledge about privacy aspects and confidence in their abilities.

Literature review

Privacy literacy and self-efficacy

The management and protection of one’s privacy online comprises a complex set of behaviours which are associated with a plethora of variables (e.g. Boerman et al., 2021 ; Büchi, Just, and Latzer 2017; Matzner et al. 2016; Meier and Krämer 2023). Among the most vividly discussed factors that positively affect privacy protective efforts are privacy literacy (i.e. knowledge about privacy threats and how to avoid them) and privacy self-efficacy (i.e. confidence in one’s own abilities to shield privacy intrusions; Epstein and Quinn 2020). Privacy literacy includes knowledge about digital privacy aspects (e.g. knowledge about specific privacy threats; i.e. factual knowledge), knowledge and capabilities to manage personal information online (i.e. procedural knowledge; Trepte et al. 2015), and the ability to reflect one’s own privacy needs and behaviours and identify possible risks (Masur 2020). As such, privacy literacy enables internet users to protect their personal information from intrusions by others and assert informational self-determination (Trepte et al. 2015). Empirical findings corroborate that internet users who have higher literacy than others engage in higher privacy protection activities (Bartsch and Dienlin 2016; Baruh, Secinti, and Cemalcılar 2017; Park 2013; Schäwel et al. 2021). However, privacy literacy is unequally distributed in the population since multiple studies imply that older persons, less educated persons, and women have a lower privacy literacy than younger individuals, more educated ones, and men (Büchi et al. 2021; Epstein and Quinn 2020; Park 2013; Schäwel et al. 2021).

To successfully engage in privacy protective efforts, not only knowledge and skills seem to be important factors, but also the conviction and confidence that one’s actions can actually result in effective protective behaviours. Within the theoretical arguments of the protection motivation theory (Rogers 1983), self-efficacy plays a central role in the coping appraisal process which describes people’s evaluation of, for example, being able to engage in a protective response against privacy intrusions (e.g. Boerman, Kruikemeier, and Zuiderveen Borgesius 2021; Meier et al. 2020). Yao (2011) further proposed that individuals with a high self-efficacy will be more confident in applying protective strategies and willing to try new protective options. Several studies yield support for these claims as they find positive relationships between people’s belief in their own protection abilities and their protection intentions or behaviours (Boerman, Kruikemeier, and Zuiderveen Borgesius 2021; Chen and Chen 2015; Dienlin and Metzger 2016; Epstein and Quinn 2020; Meier et al. 2020). Studies that focus on digital inequalities and privacy self-efficacy are scarce, however. There appears to be only evidence from other digital behaviours. For instance, Hoffmann and Lutz (2021) found that younger and more highly educated persons and males had a higher social media self-efficacy which was positively related to using various digital services. Park (2021) showed that older and less educated persons felt less confident in managing health information and higher confidence was in turn positively associated with using digital health services. These studies indicate that forms of digital self-efficacy are connected to sociodemographic variables. The objectives of the present study are to examine whether we find sociodemographic inequalities in privacy self-efficacy and whether these can be explained by access to privacy information.

Access to privacy information

For people to gain privacy knowledge and skills, they must have access to accurate information about privacy risks and adequate management and protection strategies. Because internet and communication technologies are constantly and rapidly evolving, it is important that users have access to the most recent information about privacy management (Trepte et al. 2015). People can obtain such information as part of school-based media literacy education programmes (Livingstone, Stoilova, and Nandagiri 2020), due to personal privacy-management experiences (Bartsch and Dienlin 2016), and due to their media diet (Morrow 2022). Moreover, it is conceivable that people learn about privacy risks and management during their studies, within their profession, or through social contacts. Consequently, we define access to privacy information as people’s exposure and engagement with various sources of information related to protecting their privacy online. This includes talking to friends and colleagues, passively encountering or actively seeking relevant information in the media, and receiving information through other channels like one’s employer. Empirical and theoretical work suggests that regularly receiving information about privacy and data protection helps to increase people’s knowledge about protection and to foster positive beliefs in one’s abilities which can result in increased protective efforts (Boerman, Strycharz, and Smit 2023; Livingstone, Stoilova, and Nandagiri 2020; Morrow 2022). For instance, Morrow (2022) found that people who frequently turn to privacy news articles have an increased privacy literacy. Consequently, having access to privacy information can be helpful in acquiring the knowledge and skills to protect one’s privacy. Concerning self-efficacy, the protection motivation theory proposes that information about potential threats should provide information about the severity and probability of the threat on the one hand. On the other hand, people must also be informed about protective measures, for example, to increase their self-efficacy (Rogers 1983). Boerman, Strycharz, and Smit (2023) found support for this claim by showing that providing people with information about privacy protection strategies can boost people’s privacy self-efficacy. This indicates that especially information which describes easily applicable strategies can contribute to users’ confidence in applying these protective measures. In the present study, we pursue the question whether access to such important information might be distorted along different societal classes. It is conceivable that due to certain life circumstances like a particular school or university education, one’s profession, or one’s social environment, some persons have easier access to privacy information than others.

Homophily and digital inequalities

The homophily principle describes that people tend to be embedded in homogeneous networks with others who share similar attributes, such as a common sociodemographic background or common interests (Lazarsfeld and Merton 1954; McPherson, Smith-Lovin, and Cook 2001). In this way, homophily can limit the information people receive through their social environment (McPherson, Smith-Lovin, and Cook 2001) both offline and online (Robinson et al. 2015). For example, in homophilic social networks on Twitter, members receive more like-minded political information (Halberstam and Knight 2016) and relying on homophilic friends or colleagues as sources for health information can positively influence people’s health decisions (Berry et al. 2018). Moreover, sociodemographic homophily has been found to affect people’s interest in different news topics (Monti et al. 2023). Regarding accessing privacy information, persons of different ages, genders, and educational levels might be embedded in circumstances (e.g. a particular social environment or profession) in which such information is more or less readily available. For example, because younger or higher educated persons are more likely to have high privacy knowledge and skills (Büchi et al. 2021; Epstein and Quinn 2020; Park 2013; Schäwel et al. 2021), being embedded in a homophilic social network with younger and more educated friends and colleagues should increase the probability of having social ties who possess higher privacy knowledge. Also, men and women seem to differ in their interests in, for example, technological and social professions respectively (Tellhed, Bäckström, and Björklund 2017). Consequently, men and women might receive unequal amounts of information about privacy management through their employers. Moreover, Morrow (2022) found evidence that men and more highly educated people consume more privacy news than women and less educated people. This means that homophily may not only facilitate or limit access to information through one’s (homophilic) ties, but also through similar information-seeking behaviours that occur within social classes. One reason for this could be higher interest in technological topics among younger persons and men (Monti et al. 2023). Therefore, we argue that the sociodemographic factors age, sex, and education affect people’s access to privacy information.

As a sociodemographic variable that has been rarely studied, we will additionally look at people’s migration background as another factor through which digital inequalities might become visible. Because the current study uses a German sample and Germany is one of the most popular immigration countries worldwide with around 28% of the population having a migration background (Federal Statistical Office of Germany 2023), it is important to study whether migrants constitute a particularly vulnerable group when it comes to online privacy management. A migration background describes that either oneself or at least one parent immigrated to the current country of residence from another country. Studies indicate that immigrants face digital inequalities such as having lower media literacy (Liubiniene and Thunqvist 2015) and lower digital skills (Alam and Imran 2015) compared to non-migrant populations. Moreover, ethnicity is an important factor in building homophilic relationships (McPherson, Smith-Lovin, and Cook 2001). This could mean that due to a homophilic network, one has limited access to information, for instance, about privacy management. Although there is some work implying that belonging to an ethnical minority (i.e. African American) can be associated with slightly lower privacy literacy (Epstein and Quinn 2020), there appears to be a lack of studies examining whether people with a migration background experience digital inequalities especially in the realm of privacy, potentially due to language barriers, distinct cultural norms, or different education programmes (Vassilakopoulou and Hustad 2023). Based on these empirical and theoretical considerations, we assume that people with a migration background may receive less information about how to protect one’s privacy online, have lower privacy literacy, and lower privacy self-efficacy compared to the non-migrant population.

Summed up, the present study will examine whether sociodemographic factors (i.e. age, sex, education, and migration background) are related to access to privacy information, privacy literacy, and privacy self-efficacy. By investigating if access to privacy information directly relates to both privacy literacy and self-efficacy, the study further tests whether these digital inequalities can be partly explained. Finally, although both privacy literacy and self-efficacy seem to be positively related to privacy protective efforts, studies that link both variables are scarce. Epstein and Quinn (2020) even found a negative relationship between literacy and self-efficacy although both variables were positively related to privacy protection. This can be explained by a study showing that some persons can develop an overconfidence in their privacy literacy, that is they think to know more than they actually do (e.g. Ma and Chen 2023). Contrarily, it could also be that others only have little confidence in their skills although they possess high privacy knowledge. Thus, we aim to further investigate the association between these two variables. Based on the literature review presented above, we pose the following hypotheses and research questions:

Research Question 1: Will participants’ age be related to a) access to privacy information, b) privacy self-efficacy, and c) privacy literacy?

Research Question 2: Will participants’ sex be related to a) access to privacy information, b) privacy self-efficacy, and c) privacy literacy?

Research Question 3: Will participants’ education be related to a) access to privacy information, b) privacy self-efficacy, and c) privacy literacy?

Research Question 4: Will participants’ migration background be related to a) access to privacy information, b) privacy self-efficacy, and c) privacy literacy?

Research Question 5: Are privacy self-efficacy and privacy literacy related and what is the direction of the relation?

Hypothesis 1: Access to privacy information is positively related to a) privacy self-efficacy and b) privacy literacy.

In Figure 1, the integrative model is depicted showing all hypotheses and research questions.

Figure 1. Overview of the hypotheses and research questions.

Method

Open science

We created a secondary data preregistration at the platform of the Open Science Framework (OSF) to time-stamp the hypotheses, research questions, and analytical methods before analysing the data as data collection was already completed: https://osf.io/v7jqu. We have uploaded the items used in the present work, the dataset, and the R-script to the OSF platform: https://osf.io/n5e6g/.

Sample

This study is part of a large longitudinal project with three measurement waves that were collected from October 2018 to November 2019. The department’s ethical committee approved the conduct of the study. Respondents were surveyed either via telephone or participated in an online survey. In the present study, only the data of the first wave are used since the variables of interest were only measured in this wave. The sample of the first wave comprises 4085 participants and was representative of the German population regarding age (above 16 years) and sex (binary). For the current analysis, only those who used the Internet are considered. We also decided to only include participants who identify as either man or woman because of the focus on biological sex in parts of the analysis. Three participants who stated ‘other’ or ‘N/A’ as their gender were excluded leading to a final sample of 3978 respondents (2101 women, 1877 men) aged 16–89 (M = 43.76, SD = 16.21). 398 persons indicated having a migration background (i.e. at least one parent or oneself immigrated to Germany). Table 1 presents an overview of sociodemographic variables divided by sex.

Table 1. Overview of participants' age, education, and employment status divided by sex.

	Women (n = 2,101)	Men (n = 1,877)
Age	M = 42.3, SD = 16.2	M = 45.3, SD = 16.1
Education
No graduation	n = 23	n = 25
‘Hauptschulabschluss’^a	n = 183	n = 173
‘Realschulabschluss’^b	n = 783	n = 530
University entrance level	n = 631	n = 553
University graduation	n = 461	n = 557
PhD	n = 20	n = 39
Migration background	n = 205	n = 193
Employment Status
Pupils/students/trainees	n = 292	n = 188
Employees	n = 1,154	n = 1,069
Self-employed	n = 98	n = 117
Civil Servants	n = 54	n = 94
Unemployed	n = 34	n = 46
Homemakers/pensioners	n = 456	n = 350

Note. ^alow German school graduation, ^bmedium German school graduation.

Measures

Access to privacy information was assessed with seven original items (e.g. ‘In my private environment (e.g. friends and family), people talk about how to protect their data on the Internet’) on a five-point scale from 1 = ‘never’ to 5 = ‘always’. Although we did not expect the scale to form one homogenous factor because the items cover various areas where people can come into contact with privacy information, we calculated a confirmatory factor analysis (CFA) to control for reliability and internal consistency. Reliability and internal consistency were acceptable (Cronbach’s α = .81, McDonald’s ω = .81), but the average variance extracted of the items explained by the latent factor was lower than 50% (AVE = .39).

Privacy self-efficacy was measured through eight items developed by Neubaum et al. (2023) on a five-point Likert scale (from 1 = ‘do not agree at all’ to 5 ‘fully agree’) divided into a horizontal/social (e.g. ‘I believe that I have the ability to control what other Internet users do with my personal information online’) and a vertical/institutional dimension (e.g. ‘I feel I have control over which companies can see my personal information on the Internet’). We tested the scale’s reliability and internal consistency by means of a CFA in which we combined the two dimensions into a one-factorial latent variable of self-efficacy due to better fit and higher internal consistency. After deleting one item (i.e. ‘I have confidence that other Internet users will not harm me by using my personal information online’), reliability, internal consistency, and the average variance extracted were satisfactory (Cronbach’s α = .88, McDonald’s ω = .88, AVE = .52).

Privacy literacy was assessed with eight items from the online privacy literacy scale developed by Trepte et al. (2015) which is composed of true and false statements. We selected items from three dimensions based on their focus on knowledge about privacy management and protection which appeared to be most relevant for the context of this study. One example item for every dimension is ‘Operators of social networks (e.g. Facebook) also collect and process information from people who do not use this network at all’ [knowledge about institutional practice], ‘According to German law, users of online applications that collect and process personal data have a right to see the data stored about them’ [knowledge about data protection law], and ‘Surfing in private browsing mode can make it more difficult to reconstruct one’s own surfing behaviour, since no browser information is stored’ [knowledge about data protection strategies]. Participants had the options to rate these items as ‘true’, ‘false’, or ‘I don’t know’ which resulted in a score from zero (only wrong or ‘I don’t know’ responses) to eight (only correct responses).

Moreover, respondents’ sociodemographic background was assessed. Participants indicated their age with a free text input field. Regarding education, they were able to choose from a list of common degrees in Germany and they had the option to disclose a further degree by means of a text field. Sex was assessed by four options (male, female, other, and no answer). Finally, migration background was measured with the items ‘do you have a migration background?’ (0 = ‘no’, 1 = ‘yes’) and ‘from which country do you or your parents come?’.

Discriminant validity

To assess discriminant validity, we used the Fornell-Larcker criterion (Fornell and Larcker 1981) which states that the shared variance between latent variables should be smaller than the variance unique to one latent variable. Accordingly, we compared the squared correlations to the average variance extracted. As can be seen in Table 2, discriminant validity can be assumed.

Table 2. Assessment of discriminant validity.

	AVE	1	2	3
1 Privacy Info. Access	.39	–	.18	.01
2 Self-Efficacy	.52	.43***	–	.00
3 Privacy Literacy	.34	.11***	−.04***	−

Note. Below diagonal: zero-order correlations. Above diagonal: squared correlations. AVE = average variance extracted.

Bayesian data analysis

We analysed the data in R (version 4.2.2) using a Bayesian structural equation model (BSEM; see Merkle & Rosseel, 2018) and uninformative priors. Access to privacy information and privacy self-efficacy were modelled as latent factors whereas we used the sum score of privacy literacy. Compared to frequentist approaches, Bayesian inference has several advantages, for example, displaying uncertainty of the data in the results, being able to accept null values, and remaining undecided about whether an effect exists or not (Kruschke and Liddell 2018). Hence, we will not rely on point estimates and p-values common in frequentist approaches like null hypothesis significance testing (NHST), but on the 95% highest density intervals (HDI) of the posterior distributions. A 95% HDI contains the 95% most probable values of the estimated parameter (Kruschke 2018). Moreover, the height or density of the HDI provides an indication of parameter likelihood while its width depicts the uncertainty of parameter estimation. To make inferences about whether the posterior distributions describe meaningful effects, we will define a region of practical equivalence (ROPE) around the null value (Kruschke 2018). By comparing the 95% HDI of the posterior distribution to the ROPE, the presence or absence of relationships can be evaluated. If the HDI falls entirely inside or outside the ROPE, there is strong evidence for or against the null value, respectively. For the case that HDI and ROPE overlap, we define some boundary conditions. If less than 5% of the HDI are inside the ROPE, we will still accept evidence against the null value, since the most credible and dense values are outside the ROPE. If less than 5% of the HDI are outside the ROPE, we will still accept evidence for the null value because the most credible and dense values are inside the ROPE. If more than 5% of the HDI are in- or outside the ROPE, we will remain undecided. Based on recommendations to choose ROPEs that are half the size of a small effect size (in this case β = |.10|) (Kruschke 2018), we decided for a narrow ROPE ranging from −.05 to .05. We imputed missing data (about 0.2%) using the predictive mean matching method.

We tested all hypotheses and research questions by means of one BSEM and evaluated the model fit using model fit indices adapted for BSEMs. Although cutoff criteria are not recommended for incremental fit indices because all sample characteristics may not be known (Garnier-Villarreal and Jorgensen 2020), the following decision rules can be used: BRMSEA values of below .08 indicate acceptable or close fit and Γ_adj. should approach values of 1 (Garnier-Villarreal and Jorgensen 2020). Incremental fit indices (i.e. BCFI, BTLI, BNFI) imply a well-fitting model the closer they are to 1 and conventional cutoffs indicate good fit for CFI and TLI from .9 upward (Hu and Bentler 1999). As can be seen in Table 3 the model fit the data well.

Table 3. Model fit indices for Bayesian SEMs.

	BRMSEA	Γadj.	BCFI	BTLI	BNFI
Mean	.055	.942	.922	.919	.916
95% HDI	.055 – .055	.941 – .943	.921 – .922	.918 – .920	.915 – .917

Note. BRMSEA = Bayesian root mean square error of approximation, BCFI = Bayesian comparative fit index, BTLI = Bayesian Tucker-Lewis index, Bayesian normed fit index.

Results

Before reporting the results of the BSEM, we report the descriptive statistics of the three main variables. Participants’ privacy literacy was medium to high with around five correct responses (M = 4.96, SD = 1.87), respondents had rather little access to privacy information (M = 2.60, SD = .57), and a low privacy self-efficacy (M = 2.47, SD = .68). In the following, the results of the BSEM are reported separated for each dependent variable.

Access to privacy information

In RQs1a-4a, we asked whether participants’ age, sex, education, and migration background were related to access to privacy information. The posterior distributions are depicted in Figure 2. Regarding the factor age, the evidence remains inconclusive because a large portion of the HDI overlaps with but more than 5% are outside the ROPE (M_β = −.04, 95% HDI [−.08 to −.01], 74.4% in ROPE). Contrary, we find evidence for positive relationships between participants’ sex and access to privacy information (M_β = .11, 95% HDI [.08 – .14], 0% in ROPE) as well as education and access to privacy information (M_β = .12, 95% HDI [.08 – .15], 0% in ROPE). Regarding participants’ migration background there is a strong tendency for no relationship between the two variables, although the final evidence must be evaluated as inconclusive because more than 5% of the HDI are different from the null region (M_β = .03, 95% HDI [−.01 to .06], 92.1% in ROPE). In sum, the data reveal that men and higher educated persons have more frequent access to information about how to protect one’s privacy while there is inconclusive evidence regarding the factors age and migration background.

Figure 2. Posterior distributions of the relations between sociodemographic variables and access to privacy information.

Note. Dashed lines mark the ROPE (−.05 – .05). Dark lines inside the posterior distributions represent the mean of the standardised regression coefficients (β). Gray areas under the posterior distributions mark the 95% HDIs.

Privacy self-efficacy

H1a assumed a positive relation between access to privacy information and privacy self-efficacy and RQs1b-4b asked for relationships between participants’ age, sex, education, migration background and privacy self-efficacy which are visualised in Figure 3. The data reveal support for a positive association between access to privacy information and privacy self-efficacy (M_β = .41, 95% HDI [.38 – .44], 0% in ROPE) confirming H1a. Moreover, we find evidence for a negative relationship between age and privacy self-efficacy (M_β = −.23, 95% HDI [−.26 to −.20], 0% in ROPE) and evidence for no relation between education and self-efficacy as only 2% of the most credible values are different from the ROPE (M_β = −.02, 95% HDI [−.05 to .01], 98.1% in ROPE). However, there is inconclusive evidence for sex (M_β = .04, 95% HDI [.01 – .07], 69.1% in ROPE) and migration background (M_β = .05, 95% HDI [.02 – .08], 39.9% in ROPE). In conclusion, persons who report easy access to privacy information and younger persons are more confident about their own privacy protection abilities while education is unrelated to being confident about privacy protection. There is inconclusive evidence regarding the relationships between self-efficacy and people’s sex and migration background.

Figure 3. Posterior distributions of the relations between access to privacy information, sociodemographic variables, and privacy self-efficacy.

Note. Dashed lines mark the ROPE (−.05 – .05). Dark lines inside the posterior distributions represent the mean of the standardised regression coefficients (β). Gray areas under the posterior distributions mark the 95% HDIs.

Privacy literacy

Finally, in H1b we hypothesised a positive relationship between access to privacy information and privacy literacy, in RQs1c-4c, we asked for relations between people’s sociodemographic variables and their privacy literacy, and RQ5 asked about a possible relationship between privacy literacy and privacy self-efficacy. The posterior distributions (except RQ5) can be seen in Figure 4. H1b was supported as we found evidence for a positive association between access to privacy information and privacy literacy although about one percent of the 95%HDI overlaps with the ROPE (M_β = .08, 95% HDI [.05 – .11], 1.2% in ROPE). Regarding age, the data point to a negative relationship, however, the evidence is equivocal as there is an HDI-ROPE overlap of more than five percent (M_β = −.07, 95% HDI [−.10 to −.04], 8.1% in ROPE). Turning to sex and education, the data reveal positive associations between being male (M_β = .17, 95% HDI [.14 – .20], 0% in ROPE) as well as having a higher education (M_β = .13, 95% HDI [.10 – .16], 0% in ROPE) and privacy literacy. Finally, despite a tendency of a negative relation between having a migration background and privacy literacy, the HDI-ROPE overlap is too big to yield conclusive evidence (M_β = −.07, 95% HDI [−.10 to −.04], 14% in ROPE). Turning towards RQ5, the data reveal a negative relationship between privacy self-efficacy and privacy literacy (M_β = −.09, 95% HDI [−.12 to −.05], 0% in ROPE). Summed up, the results indicate that persons who report having easier access to privacy information, men, and persons with a higher education have higher levels of privacy literacy while those with higher literacy have a slightly lower privacy self-efficacy. We must remain inconclusive regarding the relationships between people’s age and migration background and privacy literacy.

Figure 4. Posterior distributions of the relations between access to privacy information, sociodemographic variables, and privacy literacy.

Note. Dashed lines mark the ROPE (−.05 – .05). Dark lines inside the posterior distributions represent the mean of the standardised regression coefficients (β). Gray areas under the posterior distributions mark the 95% HDIs.

Exploratory analysis

Although not part of the preregistration, we were interested how the main variables would be distributed along the participants’ employment status. Therefore, we plotted the means and 95% confidence intervals of the main variables for each employment group. As can be seen in Figure 5, the employment groups do only scarcely differ regarding access to privacy information and privacy self-efficacy with the highest scoring groups being (self-) employees and civil servants and the lowest scoring groups being pupils, students, unemployed and pensioners. There are somewhat larger differences regarding privacy literacy. Again, (self-) employees and civil servants seem to have the highest literacy scores and pupils, students, unemployed and pensioners have the least privacy literacy. However, we have to note that the employment-groups varied greatly in size which affects the accuracy of the estimations. In addition, employment status should be assessed more precisely in the future to detect more meaningful differences.

Figure 5. Means and 95% Confidence Intervals of the main variables split into employment statusses

Discussion

The current work had the objectives of studying whether easy access to information about privacy protection would positively relate to both privacy literacy and self-efficacy and whether sociodemographic variables could shape access, literacy, and self-efficacy, thus, potentially contributing to digital inequalities in people’s privacy protection and self-management behaviours. By using a large and representative national sample, the study contributes to current theoretical and empirical works about digital inequalities and privacy and has practical implications for legal regulations that build on privacy self-management. What distinguishes this work from previous studies is its focus on people being passively embedded in information networks rather than actively seeking information (e.g. Morrow 2022) or being trained (e.g. Boerman, Strycharz, and Smit 2023) and the attempt to better understand digital inequalities in self-efficacy and privacy literacy as dependent rather than independent variables (e.g. Epstein and Quinn 2020).

Access to privacy information

A central theoretical claim of this work is the assumption that sociodemographic differences in access to information about privacy protection can explain inequalities in privacy protection self-efficacy and privacy literacy. The results confirmed these assumptions partly. Both men (compared to women) and more highly educated persons (but not older persons) reported having easier access to privacy information through their environment which confirms assumptions of the homophily principle (Lazarsfeld and Merton 1954; McPherson, Smith-Lovin, and Cook 2001). These sociodemographic factors will be elaborated in greater detail below. Persons who reported having easier access to privacy information had a higher privacy self-efficacy and a higher privacy literacy. This indicates that being embedded in environments in which information about how to protect one’s personal information online is frequently communicated can be beneficial for people. Not only do people who report having more access to privacy information in their daily routine have higher privacy knowledge, they also have more confidence in their abilities to manage their privacy online. This corroborates findings of previous studies showing that exposure to news articles about privacy is associated with higher levels of privacy literacy (Morrow 2022) or that teaching people how to protect oneself increases privacy self-efficacy (Boerman, Strycharz, and Smit 2023). We expand the literature by showing that also mundane and incidental contact with privacy information among friends, at the workplace, or as part of one’s media consumption can be beneficial to users. Importantly, the relationship between access to privacy information and privacy self-efficacy is considerably larger than the association between access and privacy literacy. Thus, people who are frequently exposed to information about privacy protection only have a small gain in privacy literacy but a much larger gain in privacy self-efficacy which may potentially lead to an overestimation of one’s actual knowledge (see Ma and Chen 2023). This is especially visible in the negative relation between literacy and self-efficacy which supports previous findings (Epstein and Quinn 2020). This might indicate that with higher literacy people become aware of the fact that a full individual privacy protection is never feasible due to the power imbalances between users and platforms (Baruh and Popescu 2017; Masur 2020; Meier and Krämer 2023). Moreover, being too confident about one’s privacy management skills might have adverse effects on one’s actual level of protection when it is not aligned with privacy knowledge.

At this point, we must emphasize the fact that empirical findings regarding privacy literacy and privacy self-efficacy as predictors of privacy protection are rather mixed. For both the association between privacy literacy and privacy protection and self-efficacy and protection, there are studies finding positive associations (Bartsch and Dienlin 2016; Baruh, Secinti, and Cemalcılar 2017; Büchi, Just, and Latzer 2017; Epstein and Quinn 2020), but also one’s that find negative or no meaningful relations (e.g. Boerman, Kruikemeier, and Zuiderveen Borgesius 2021; Choi 2023; Dienlin and Metzger 2016; Ma and Chen 2023; Meier et al. 2020). This means that higher knowledge and higher confidence in one’s skills do not necessarily translate into higher protection. One reason for these mixed findings is that with higher knowledge, people might become aware of the power asymmetries between users and platforms that translate into severely limited options in protecting individual and collective privacy (Baruh and Popescu 2017; Masur 2020) which might ultimately result in privacy cynicism or resignation (see Hoffmann, Lutz, and Ranzini 2024). Future studies could further examine under which circumstances people over- or underestimate their level of protection. Finally, despite controlling the results for access to privacy information, the data still revealed direct relationships between sociodemographic variables and privacy literacy and self-efficacy. This observation implies that although access to privacy protection information could be an important factor in distorting knowledge and self-efficacy between social groups, there appear to be further factors shaping literacy and self-efficacy which are associated with sociodemographic variables. Future studies could pursue the questions what those factors are and examine further causes for sociodemographic differences.

Age

The findings of the present study point to age-related inequalities in people’s confidence in their own abilities to manage and protect personal information in digital environments. This can be explained by the fact that older Internet users are less experienced and, compared to younger users, only came into contact with digital technologies at a much older age (Dodel 2023). Although the data indicated a tendency that older internet users have lower privacy literacy, the results are inconclusive in the end as neither the presence nor absence of this relationship can be clearly elucidated. This, however, indicates that in our dataset older internet users are not per se disadvantaged when it comes to access to and knowledge about basic information about privacy protection in digital environments. This contradicts the assumptions of the homophily principle and indicates that older persons still receive information about digital topics which seems to contribute to their knowledge about how to engage in privacy protection. Still, older individuals feel less capable of applying these protective strategies probably because they are less used to using digital technologies than younger persons. Hence, lower levels of privacy protection among older persons that have been observed in previous studies (Epstein and Quinn 2020; Matzner et al. 2016; Meier and Krämer 2023; Park 2013) might not be the result of reduced privacy literacy but lower confidence in one’s abilities to engage in privacy protection which might lower one’s motivations to engage in protective behaviours (Yao 2011). Future studies should examine whether reduced self-efficacy among older persons hinders them from protecting and managing their personal data online or what other causes for reduced protective efforts might be.

Sex

In the present study, men reported easier access to privacy protection information in their daily routine and had a higher privacy literacy than women. These results are largely consistent with previous studies that found women to have a lower privacy literacy and (as a potential consequence) adopting less privacy protective measures online than men (Büchi et al. 2021; Matzner et al. 2016; Meier and Krämer 2023; Schäwel et al. 2021). Consequently, women seem to be disadvantaged when compared to men when it comes to receiving information about how to protect one’s privacy online which seems to be reflected in their level of actual privacy knowledge. These findings can be explained by societal gender-stereotypes and stereotypical role expectations (Frener 2023) which may be similar to gender-stereotypical expectations in the labour market: women were found having lower interest in and self-efficacy to succeed in STEM (i.e. science, technology, engineering, and mathematics) professions and higher interest and self-efficacy in HEED (i.e. healthcare, elementary education, and domestic spheres) occupations than men (Tellhed, Bäckström, and Björklund 2017). The advertising industry seems to reinforce such gender stereotypes, for instance, by targeting men with ads about technological topics and women with ads about health topics (Bol et al. 2020). Similar forms of stereotypical role expectations might also apply to the context of online privacy protection which may have been learned through socialisation (Frener 2023). Interestingly, the present study does not suggest that women are less confident in their ability to protect privacy than men, which argues against the assumption that women perceive themselves as less competent and conform to stereotypical views. Rather, the results suggest that women are at a disadvantage in obtaining information about privacy protection, which could explain lower levels of privacy literacy. However, these disadvantages could in turn be related to various stereotypical views, such as a lower interest in technology and online privacy management (Monti et al. 2023; Morrow 2022).

Although it is important to study whether sociodemographic variables have effects on technology use and usage skills, an atheoretical view can also contribute to reinforcing stereotypical views on categories such as sex (Frener and Trepte 2022). Therefore, it is of great importance that future studies examine the reasons for these gender differences. One possibility would be to adopt a non-binary gender perspective (Frener 2023). Future studies could also adopt intersectional perspectives as it seems that less educated women have the worst access to privacy information which is also reflected in low privacy literacy while highly educated men have most access and literacy.

Education

The results of this study revealed that more educated persons reported easier access to privacy information and had a higher privacy literacy which is consistent with previous studies (Büchi et al. 2021; Epstein and Quinn 2020; Park 2013; Schäwel et al. 2021). This finding suggests that people with a lower education might have difficulties in acquiring knowledge about privacy issues, are possibly embedded in networks in which such information is less prevalent, or lack such information as part of school, university, or professional training. Interestingly, although less educated persons had a decreased level of privacy literacy, they were not less confident about their abilities to manage personal data online. This observation indicates that less educated persons are probably not aware of the fact that they have deficits in managing their privacy (see Ma and Chen 2023) and are potentially more vulnerable to privacy threats. Previous studies indicated that less educated persons use the internet less, are less able to benefit from internet usage, but experience greater harms from using the internet at the same time (Blank and Lutz 2018). Consequently, the present study underlines the importance of education for properly using digital technologies. Future studies could investigate how such knowledge gaps could be bridged by digital training, for example.

Migration background

The current study did not find conclusive evidence whether a migration background constitutes a general factor that might lead to digital inequalities in the privacy field when controlled for age, sex, and education. We must note, however, that the group of participants with a migration background was (a) rather heterogenous in itself including persons who immigrated for themselves and those who were born in Germany and (b) underrepresenting migrants compared to the German population (10% in the sample compared to 28% in the population; Federal Statistical Office of Germany 2023). These factors might limit the informative value of these findings. Furthermore, persons who have language difficulties – which might contribute to digital inequalities (Vassilakopoulou and Hustad 2023) – were not able to participate in the study. Therefore, future studies need to adopt distinct methodological approaches to include all parts of the society and better understand digital inequalities among the most vulnerable segments of society. Within these limitations, the results of the present study indicate that persons with a migration background have the same access to privacy information, privacy self-efficacy, and privacy literacy compared to the rest of the German population.

Implications

The present work reveals systematic differences in people’s access to information about how to manage and protect one’s personal data online from misuse, people’s confidence in handling personal information, and their knowledge about privacy and protection strategies. Older persons, women, and less educated people seem to constitute especially vulnerable groups. Hence, researchers, companies, and policy makers should find ways of how to balance these digital inequalities. Although a large body of empirical research focused on transparency mechanisms and training of digital skills, digital inequalities remain largely unaddressed (see Meier 2023). Moreover, the results of the present study underline that self-data management practices which are required by several privacy regulations such as the GDPR or CCPA ignore that certain user segments are less confident or literate to engage in privacy management practices. Providing disadvantaged user groups with more information about how to manage and protect one’s privacy online could bridge some of these gaps but is still unlikely to completely balance the inequalities in privacy literacy found in the present study. Hence, policy makers should come up with additional solutions to not contribute to reinforcing societal inequalities.

Despite these inequalities in people’s access to privacy information, the data indicate that a regular contact with information about privacy protection is beneficial for users as it might contribute to increases in knowledge and confidence. Consequently, we argue that information campaigns can be an important step in assisting users of digital technologies in their privacy self-management efforts. Such campaigns could be part of school and university education, workplace trainings, or consumer protection programmes. Providing individuals with privacy information can increase their literacy and self-protection behaviours (Boerman, Strycharz, and Smit 2023; Morrow 2022). However, despite the potentials of these strategies, we must point to the fact that privacy self-management is and remains an insufficient and very limited approach (Baruh and Popescu 2017; Kröger, Lutz, and Ullrich 2021).

Finally, we want to emphasize that it is important to recognise the sociodemographic variables as proxies for other factors that create digital inequalities to avoid stereotypes towards certain social classes. This means that the examined sociodemographic factors are not the causes of digital inequalities but that persons associated with certain sociodemographic attributes are more likely to possess or lack respective experiences or abilities. For example, the relationship between sex and privacy literacy might be because of stereotyped gender role expectations (Frener 2023; Frener and Trepte 2022) and age could be associated with privacy self-efficacy because older persons lack experience with digital technologies (Dodel 2023). This invites researchers to study the factors underlying sociodemographic disparities to understand and address digital inequalities in a better way.

Limitations

One important limitation of the current work is the fact that the data are of cross-sectional nature. This means that we cannot draw any causal conclusions from the relations between access to privacy information and privacy literacy and privacy self-efficacy. Consequently, there is a need for experimental or longitudinal works that can determine whether having increased access to information about privacy protection can actually increase people’s knowledge and self-efficacy. Moreover, all data are based on self-reports. For instance, participants should indicate how often they receive information about privacy protection strategies in their daily routine which is a highly subjective question. A related issue is that we did not assess participants’ privacy behaviour. This means that we cannot say whether better access to information or better privacy literacy would be related to more protection. Another issue concerns the privacy literacy scale that we used. This scale is not exhaustive and asks rather general questions which might not fully cover all aspects of privacy management and protection. Finally, the results of the present study are limited by the cultural context of the sample, that is Germany. Therefore, future studies also need to examine digital inequalities in the privacy context in a comparative manner.

Conclusion

The present study expands the literature on digital inequalities and online privacy by showing that less educated persons and women have reduced access to information about privacy protection in their personal environment. Access to privacy information turned out to be positively associated with privacy self-efficacy and privacy literacy which are important predictors of privacy management. Thus, access to privacy information partly explains digital inequalities regarding people’s privacy knowledge and self-efficacy. However, the results still revealed that older individuals feel less confident in managing their privacy online while less educated persons and women have lower privacy literacy. Hence, occasional access to privacy information only seems to be one among several causes for digital inequalities in the field of online privacy. Altogether, the present study contributes to an understanding that parts of the society are disadvantaged in protecting and managing their personal information in digital environments which may lead to an increased vulnerability towards privacy invasions. Therefore, these results call the idea of self-data management into question which is inherent to several privacy regulations (e.g. GDPR, CCPA) and will ultimately result in certain social groups being better protected while others remain poorly protected. As long as the responsibility for privacy-management is largely shifted onto the users of digital technologies, digital inequalities in people’s privacy perceptions, skills, and behaviours are likely to persist.

Disclosure statement

No potential conflict of interest was reported by the author(s).

Additional information

Funding

This work was funded by the German Federal Ministry of Education and Research [grant number 16KIS0743].