Search

With information misuse as a particularly salient form of risk online, respecting privacy is often closely tied to trust in consumer surveys. This study uses factorial vignette survey methodology to measure the relative importance of violating privacy expectations to consumers' trust in a website. The findings suggest consumers find violations of privacy expectations, specifically the secondary uses of information, to diminish trust in a website. Firms that violate privacy expectations are penalized twice: violations of privacy (1) impact trust directly and (2) diminish the importance of trust factors such as integrity and ability on trust. In addition, consumers with greater technology savvy place greater importance on privacy factors than respondents with less knowledge. Violations of privacy may place firms in a downward trust spiral by decreasing not only trust in the website but also the impact of possible mechanisms to rebuild trust such as a firm's integrity and ability.

This paper reports on a set of empirical studies that reveal how people think about location data, how these conceptions relate to expectations of privacy, and, consequently, what this might mean for law, regulation, and technology design. Despite the great debates, published commentary, court action, regulatory activity, and scholarly literature, not enough is known about how people understand location data, and what specifically about location affects people’s judgments about others’ access to their whereabouts. Further, despite efforts to stem location tracking, it remains rampant. Perhaps for the very reasons that people find it abhorrent, the trackers eagerly clutch this revealing window in our lives. Stern rules aimed at curtailing location tracking are a poor match for the ingenuity of seekers of this information who, among other tactics, exploit enormous ambiguity in how location is interpreted and operationalized, to make end runs around these rules. This conceptual ambiguity about location poses challenges even to good faith efforts to regulate location tracking and to represent and enforce it in systems in concert with the ways people conceive, interpret, and value it. In other words, technical and regulatory efforts to protect location privacy may stumble because of a failure to map the meaning that people assign to location with its representations in technical systems. Our studies offer insights into how people think about location data and the factors affecting how we evaluate common location-tracking practices. In so doing these studies may serve the needs of courts, regulators, and systems designers seeking to address diverse challenges without compromising the normative standing of privacy interests in location data. After a series of pilot studies used to test the design of the study, we deployed Knowledge Networks to achieve a nationally representative sample of 1,500 respondents. Using a factorial vignette survey, we asked respondents to rate the appropriateness (a range of ‘Definitely Not OK’ to ‘Definitely OK’) of a series of scenarios, in which contextual elements were systematically varied; these elements included who gathered the location data, how the data was gathered, how long it was stored, and what information was inferred about the subject from the location data. Respondents were placed in one of three conditions determined by vignettes in one of three categories: (1) a baseline category in which they were asked about the collection of location data by different actors, (2) #1 with duration of surveillance added, (3) #2 with inference about the individual included. Our results immediately debunk the idea that people have no expectations of privacy in public. Rather, the findings extend work revealing legitimate privacy interests in erstwhile public locations. The findings reinforce general objections to common practices involving amassing of location data by government and commercial entities, showing that these map onto expressed privacy expectations in systematic and specific ways. Further, the studies reveal that the ways we ask about location in surveys and regulate location in rules makes a difference to how people react. Adding details, such as the duration of collection, the place, and the inferences drawn about the individual decreases the degree to which the vignette are ‘ok.’ The results here show that drawing inferences about an individual's location or identifying the ‘place’ where they are significantly affects how appropriate people judge respective practices to be. This means that tracking an individual's place – home, work, shopping – is seen to violate privacy expectations, even without directly collecting GPS data, that is, standard markers representing location in technical systems. Although our findings, by themselves, do not support specific lines of legal regulation they leave little doubt of a damaging rift between how these beneficiaries of location surveillance communicate their practices and how we, its subjects, understand it. Only when this rift is repaired will it be possible adequately to regulate location surveillance – through policy, law, and technology – to meet privacy expectations and promote privacy’s societal value.

Currently, we frame individuals online as in a series of exchanges with specific firms, and privacy, accordingly, is governed to ensure trust within those relationships. However, the focus on the relationship between consumers and specific firms does not capture how the online environment behaves. The aggregation and secondary use of consumer data is performed by market actors behind the scenes without any relationship with consumers. Trusting a single firm is not enough; individuals must trust the online market in general. Such institutional trust has gone under-examined in regards to privacy online. Little has been done to measure how aggregating and using consumer data supports a larger online market and impacts institutional trust online. This paper explores how privacy governance should also be framed as protecting a larger market to ensure consumers trust being online. In a series of studies, I empirically examine (a) how typical secondary uses are judged along a generalized (for the good of the market) versus reciprocal (for the good of the consumer) exchange and impact institutional and consumer trust, and (b) whether governance mechanisms (limitations on the use of data such as adequate notice, auditing, non-identifiable information, limited storage, etc.) increase consumer trust in companies. I find: • Respondents find secondary uses of consumer data more appropriate if judged more within a generalized exchange (academic research) or within a reciprocal exchange (product search results) or both (credit security). However, most secondary uses of data are deemed privacy violations and decrease institutional trust online. • Using privacy notices is the least effective governance mechanism of those included here whereas being subject to an audit was as effective as using anonymized data in improving consumer trust. • Institutional trust online impacts a consumer’s willingness to engage with a specific online partner in a trust game experiment The findings have implications for public policy and practice. Secondary uses of information online need not only be justified in a simple quid-pro-quo exchange with the consumer but could also be justified as appropriate for the online context within a generalized exchange. However, the majority of secondary uses currently popular cannot be justified as within either a general exchange or a reciprocal exchange and are judged inappropriate, violations of privacy, and decrease both interpersonal and institutional trust. Second, if privacy violations hurt not only interpersonal consumer trust in a firm but also institutional trust online, then privacy would be governed similar to insider trading, fraud, or bribery — to protect the integrity of the market. Punishment for privacy violations would be set to ensure bad behavior is curtailed and institutional trust is maintained rather than to remediate a specific harm to an individual.

As individuals navigate their lives on websites and apps, their movements, searches, and actions are silently tracked. Streams of consumer data are then pooled by data aggregators and mined to identify potential vulnerabilities of consumers. These potential weaknesses, e.g. whether someone is in financial distress, having a health crisis, or battling an addiction, are valuable to marketers and ad networks in order to silently steer consumers’ market actions towards the manipulator’s interests. While identified early on as problematic within the economics of information broadly, the use of hyper-targeting to manipulate consumers is underappreciated as a threat to not only the autonomy of individuals but also the efficiency and legitimacy of markets. The phenomenon of interest in this article is targeted manipulation as the covert leveraging of a specific target’s vulnerabilities to steer their decisions to the manipulator’s interests. I position online targeted manipulation as undermining the core economic assumptions of authentic choice in the market. I then explore how important choice is to markets and economics, how firms gained positions of power to exploit vulnerabilities and weaknesses of individuals without the requisite safeguards in place, and how to govern firms in the position to manipulate. The power to manipulate is the power to undermine choice in the market. As such, firms in the position to manipulate threaten the autonomy of individuals, diminish the efficiency of transactions, and undermine the legitimacy of markets. The goal of this paper is to argue that firms merely in the position to manipulate, with knowledge of individual’s weaknesses and access to their decision making, should be regulated to ensure their interests are aligned with the target. The economic oddity is not that firms have data that render another market actor vulnerable, rather the oddity is that so many firms have data to covertly manipulate others without safeguards in place. Market actors regularly share information about their concerns, preferences, weaknesses, and strengths within contracts or joint ventures or within a relationship with professional duties. Online, companies have collected preferences and concerns without such safeguards in place. The point of manipulation is to covertly steer a target’s decision towards the manipulator’s interests and away from the target’s; as such, manipulation impedes a market actor’s ability to enact preferences through choice. This undermining of choice – rather than harms to the consumer – is the basis for additional safeguards on those in the position to manipulate. Governing targeted manipulation online will require additional safeguards on those firms in the position manipulate rather than attempting to identify each instance of targeted manipulation. First, additional safeguards are needed limiting data aggregators and ad networks – specifically any data trafficker without any relationship with consumers – to ensure the use of information is in the interests of the consumer. These obligations of care do not rely on any harm to be quantified or for a consumer to negotiate or enforce the obligation. Instead, internal and external governance structures will be required to ensure the duty of care is enforced including external auditing to ensure the data trafficker abides by standards of care and data integrity. Second, customer facing websites and apps act as gatekeepers by luring consumers in to have their data tracked by third parties and later to be targeted with manipulative content. In so doing, consumer facing companies should be responsible to ensure all third parties that access their users – either for the collection of data or for the targeting of content – abide by a standards of care that are audited. Companies are regularly held responsible for how third parties treat their customers, users, or employees; and, websites and apps should be held responsible for the third party ad networks, trackers, and data traffickers they invite to surveille and manipulate their users. Where scholarship has focused on identifying instances of manipulation to regulate, I argue that firms merely in the position to manipulate, with knowledge of the individual and access to their decision making, should be regulated to ensure their interests are aligned with the target.

The construct of an information dichotomy has played a defining role in regulating privacy: information deemed private or sensitive typically earns high levels of protection, while lower levels of protection are accorded to information deemed public or non-sensitive. Challenging this dichotomy, the theory of contextual integrity associates privacy with complex typologies of information, each connected with respective social contexts. Moreover, it contends that information type is merely one among several variables that shape people’s privacy expectations and underpin privacy’s normative foundations. Other contextual variables include key actors - information subjects, senders, and recipients - as well as the principles under which information is transmitted, such as whether with subjects’ consent, as bought and sold, as required by law, and so forth. Prior work revealed the systematic impact of these other variables on privacy assessments, thereby debunking the defining effects of so-called private information. In this paper, we shine a light on the opposite effect, challenging conventional assumptions about public information. The paper reports on a series of studies, which probe attitudes and expectations regarding information that has been deemed public. Public records established through the historical practice of federal, state, and local agencies, as a case in point, are afforded little privacy protection, or possibly none at all. Motivated by progressive digitization and creation of online portals through which these records have been made publicly accessible our work underscores the need for more concentrated and nuanced privacy assessments, even more urgent in the face of vigorous open data initiatives, which call on federal, state, and local agencies to provide access to government records in both human and machine readable forms. Within a stream of research suggesting possible guard rails for open data initiatives, our work, guided by the theory of contextual integrity, provides insight into the factors systematically shaping individuals’ expectations and normative judgments concerning appropriate uses of and terms of access to information. Using a factorial vignette survey, we asked respondents to rate the appropriateness of a series of scenarios in which contextual elements were systematically varied; these elements included the data recipient (e.g. bank, employer, friend,.), the data subject, and the source, or sender, of the information (e.g. individual, government, data broker). Because the object of this study was to highlight the complexity of people’s privacy expectations regarding so-called public information, information types were drawn from data fields frequently held in public government records (e.g. voter registration, marital status, criminal standing, and real property ownership). Our findings are noteworthy on both theoretical and practical grounds. In the first place, they reinforce key assertions of contextual integrity about the simultaneous relevance to privacy of other factors beyond information types. In the second place, they reveal discordance between truisms that have frequently shaped public policy relevant to privacy. For example, • Ease of accessibility does not drive judgments of appropriateness. Thus, even when respondents deemed information easy to access (marital status) they nevertheless judged it inappropriate (“Not OK”) to access this information under certain circumstances.• Even when it is possible to find certain information in public records, respondents cared about the immediate source of that information in judging whether given data flows were appropriate. In particular, no matter that information in question was known to be available in public records, respondents deemed inappropriate all circumstances in which data brokers were the immediate source of information. • Younger respondents (under 35 years old) were more critical of using data brokers and online government records as compared with the null condition of asking data subjects directly, debunking conventional wisdom that “digital natives” are uninterested in privacy. One immediate application to public policy is in the sphere of access to records that include information about identifiable or reachable individuals. This study has shown that individuals have quite strong normative expectations concerning appropriate access and use of information in public records that do not comport with the maxim, “anything goes.” Furthermore, these expectations are far from idiosyncratic and arbitrary. Our work calls for approaches to providing access that are more judicious than a simple on/off spigot. Complex information ontologies, credentials of key actors (i.e. sender and recipients in relation to data subject), and terms of access – even lightweight ones – such as, identity or role authentication, varying privilege levels, or a commitment to limited purposes may all be used to adjust public access to align better with legitimate privacy expectations. Such expectations should be systematically considered when crafting policies around public records and open data initiatives.

It is commonplace for those who support less restrictive privacy regulation on the collection and use of personal information to point out a paradox: in survey after survey, respondents express deep concern for privacy, oppose growing surveillance and data practices, and object to online tracking and behavioral advertising. Yet when confronted with actual choices involving the capture or exchange of information few people demonstrate restraint: we sign up for frequent flyer and frequent buyer programs, we are carefree in our use of social networks and mobile apps, and we blithely hop from one website to the next, filling out forms, providing feedback, and contributing ratings. Privacy skeptics suggest that actions should be considered a truer indicator than words. Even if people are honest in their positive valuation of privacy in surveys, in action and behavior they reveal even greater valuation of those benefits that might come at a privacy cost. In other words, people care about privacy, but not that much.The inconsistencies between survey responses and observed behaviors that skeptics gleefully observe require a nuanced interpretation – one that we have offered through our studies. We argue the disconnect between actions and survey findings is, not because people do not care about privacy but because individuals’ actions are finely modulated to contextual variables. Questions in surveys that do not fix such important contextual variables explicitly are highly ambiguous.A more nuanced view of privacy is able to explain away a great deal of what skeptics claim is a divergence of behavior from stated preference and opinion. People care about and value privacy – privacy defined as respecting the appropriate norms of information flow for a given context. When respondents are given a chance to offer more fine-grained judgments about specific information-sharing situations, these judgments are quite nuanced. This is problematic since public policy relies on survey measurements of privacy concerns – such as Westin’s measurement of individuals as privacy ‘pragmatists’ or ‘unconcerned’ – to drive privacy regulations. Specifically, Westin’s categories give credence to the regulation of privacy based by FIPPs, which relies heavily on assuring individuals notice and choice. We examine two historically influential measurements of privacy that have shaped discussion about public views and sentiments as well as practices, regulations, and policies: (1) surveys of individuals’ ratings of ‘sensitive’ information and (2) Alan Westin’s privacy categorization of individuals as fundamentalists, pragmatists, and unconcerned. In addition to replicating key components in these two survey streams, we used a factorial vignette survey to identify important contextual elements driving privacy expectations. A sample of 569 respondents rated how a series of vignettes, in which contextual elements of data recipient and data use had been systematically varied, met their privacy expectations. We find, first, that how well sensitive information meets privacy expectations is highly dependent on these contextual elements. Second, Westin’s privacy categories proved relatively unimportant in relation to contextual elements in privacy judgments. Even privacy ‘unconcerned’ respondents rated the vignettes as not meeting privacy expectations on average, and respondents across categories had a common vision of what constitutes a privacy violation. This study has important implications for pubic policy and research. For public policy, these results suggest that relying on one dimension – sensitive information, privacy categorization of respondent – is limiting. In particular, focusing on differences in privacy expectations across consumers obscures the common vision of what is appropriate use of information for consumers. This paper has significant public policy implications for the reliance on consumer choice as a necessary approach to accommodate consumer variance: our results suggest consumers agree as to the inappropriate use of information. Our study has called privacy concepts into question by showing ‘sensitivity’ of information and ‘concern’ about privacy are not stable in the face of confounding variables: privacy categories and sensitive labels prove to be highly influenced by the context and use of the situation. Our work demonstrates the importance of teasing out confounding variables in these historically influential studies.

Declining levels of stakeholder trust in business are of concern to business executives and scholars for legitimacy- and performance-related effects. Research in the area of stakeholder trust in business is nascent; therefore, the trust formation process has been rarely examined at the stakeholder level. Furthermore, the role of personal values as one significant influence in trust formation has been under-researched. In this paper, we develop a contingency model for stakeholder trust formation based on the effects of stakeholder-specific vulnerability and personal values of the trustor. Using a factorial vignette methodology, we find that Schwartz’s (J Soc Issues 50:19–45, 1994) value set interacts with stakeholder roles so that trustworthiness signals of competence and character play differing roles during trust formation. These results inform stakeholder trust research, organizational trust research, and research in personal values. The research also informs managers tasked with rebuilding stakeholder trust in business.

An increasing amount of social activity and commerce is performed using applications running on mobile devices such as phones and tablets. During these activities, mobile applications collect increasing amounts of personal data. Consumers, organizations, and regulators struggle to address privacy expectations for these new forms of data collection across a diverse set of activities. This paper describes findings from empirical research employing a context-based survey to understand consumers’ privacy expectations for mobile devices across diverse real-world contexts (e.g., consulting medical applications, navigating using map applications, or playing music or games, etc). The project tests the hypotheses that (a) individuals hold different privacy expectations based on the social context of their mobile activity, and (b) contextual factors such as who (the data collection actor, e.g. the application developer or mobile phone provider), what (data attributes, e.g. the type of information received or tracked by the primary organization), why (application purpose, e.g. playing games, checking the weather, participating in social networking, navigating using maps, listening to music, banking, shopping, and organizing personal productivity) and how (the use of data by the collector, e.g. the amount of time data is stored or how that data is reused) affect individuals’ privacy expectations. This paper reports on survey findings that identify contextual factors of importance in the mobile data ecosystem. Our survey demonstrated that overall, very common activities of mobile application companies such as harvesting and reusing location data, accelerometer readings, demographic data, contacts, keywords, name, images and friends do not meet users’ privacy expectations. But these differences are modulated by both information type and social context. Addressing privacy expectations for mobile devices is an explicit goal of US regulatory bodies and firms rely on understanding privacy expectations to gain the trust of users. Understanding how consumer privacy expectations change in different data use and business contexts can help regulators identify contexts that may require stricter privacy protections and help firms and managers better meet privacy expectations of users. Study results help us understand one aspect of mobile privacy: the expectations of consumers as they vary by context. These expectations have direct implications for researchers, business leaders, policy experts, and consumers.

Public trust in business, or the degree to which external stakeholders such as the public trust business in general is largely understudied. As the relevance of public trust in business becomes ever more obvious to practitioners and scholars, the levels of trust in business have reached alarmingly low levels. On the one hand, political, economic, societal and technical developments lead to more need for public trust in business, on the other hand organizations, especially corporations, are arguably further eroding public trust. Hence, a trust gap is emerging which is likely to impair successful business development. Therefore business executives and scholars have become interested in how organizations can reestablish and maintain public trust to remain legitimate and secure long-term survival. Before scholars and practitioners can answer this important question, we must better understand the concept of public trust. This paper suggests four domains of existing trust research that scholars of public trust in business can draw from. Then we propose several hypotheses which aim to predict the determinants of public trust and test these hypotheses using a factorial vignette methodology. These results provide scholars with more direction as this is, to our knowledge, the first empirical study of public trust. Furthermore the study will enable those companies interested in increasing public trust to better understand respective determinants of public trust.

Philosopher Richard Rudner (1953) eloquently argued that scientists, in their role as scientists and performing the tasks core to being a scientist, make value judgments. Scientists make decisions in assigning value, importance, and priority to overall endeavors, particular projects, and specific hypotheses which have moral implications. In other words, if we identify a minimal core of the scientific method which transcends context, which Rudner does, we find value judgments made by scientists. Scientists are not value-neutral or amoral in their endeavors. Rather, as he aptly titled his article, scientists, qua scientists, make value judgments (Rudner, 1953). In this paper, I argue that the entrepreneur qua entrepreneur - as the creator of future markets for goods and services (Venkataraman, 1997) - makes value judgments. Entrepreneurship and ethics scholarship recognizes that the entrepreneur as an organization theorist, small business owner, business partner, financier, accountant, and strategic partner makes value judgments. Yet, the core of the entrepreneurial process - the tasks that transcend particular industries, locations, or forms - is the creation of markets for goods and services (Venkataraman, 1997), and the recognition, evaluation, and exploitation of opportunities begets value-laden technologies that have been neglected in entrepreneurship scholarship. These technologies are designed and implemented by the entrepreneur and later impact stakeholders of technology. For example, a bottle is designed to be completely biodegradable, a social networking site is developed to leverage relationships for advertising, or airport surveillance is designed to monitor citizens. Capturing the implications of goods and services on society is difficult and complicated; hence, the entire field of Science and Technology Studies has developed for that purpose (Johnson, 2006). Rather than view goods and services as value-neutral (e.g., “Guns don’t kill people. People kill people”), technology is designed to facilitate certain behavior and beliefs. These goods and services, or these technologies, are studied closely within engineering schools as the technologies entrepreneurs take to market impact a variety of stakeholders. Rather than place the onus to analyze and modify the implications of goods and services on the adopting market, the entrepreneur can be viewed as uniquely positioned to oversee technology during a critical, formative stage of technological development. Within the ongoing analysis of entrepreneurship, we have yet to include a careful ethical examination of entrepreneurial goods and services. I leverage theoretical constructs within Science and Technology Studies to examine the moral implications of entrepreneurial goods and services. Through this expanded view of technology, we see the goods and services differently - less abstract and with more morally important features, biases, and values. Identifying the post-exploitation effects of goods and services on society has implications to the process of entrepreneurial activity. In turn, I revisit the role of entrepreneurs during the entrepreneurial process and suggest the implications to entrepreneurship and ethics scholarship when applying this new view of goods and services.As noted by Rudner, “To refuse to pay attention to the value decisions which must be made, to make them intuitively, unconsciously, haphazardly, is to leave an essential aspect of scientific method scientifically out of control.” (1953: 6). Similarly, by not explicitly acknowledging the values and biases of entrepreneurial goods and services, we are left with few tools to understand the moral implications of entrepreneurial decision making during the entrepreneurial process. This paper seeks to explicitly identify such value decisions of entrepreneurs by exploring whether, when, and how entrepreneurs qua entrepreneurs make value judgments in converting technical information into goods and services.

Employee monitoring has raised concerns from all areas of society - business organizations, employee interest groups, privacy advocates, civil libertarians, lawyers, professional ethicists, and every combination possible. Each advocate has its own rationale for or against employee monitoring whether it be economic, legal, or ethical. However, no matter what the form of reasoning, seven key arguments emerge from the pool of analysis. These arguments have been used equally from all sides of the debate. The purpose of this paper is to examine seven key arguments that have been made with respect to employee monitoring. None of these arguments are conclusive and each raises important managerial and moral consideration. We conclude that a more comprehensive inquiry with ethical concern at the center is necessary to make further progress on understanding the complexity of employee monitoring. The final section of this paper sketches out how such an inquiry would proceed.