Online Advertising in time of the GDPR:
Personalization versus Privacy
Name: Judith van Dellen Student number: 10192506 Date: January 26th 2018 Supervisor: mw. Dr. F.H. Mattison-Thompson Program: MSc. Business Administration – Marketing Track Abstract Many successful firms increasingly rely on the collection and use of detailed customer information to design personalized offerings and micro target specific audiences. However, on the 25th of May 2018 the General Data Protection Regulation (GDPR) will take effect in the European Union to give back control to individuals over their personal data and privacy. It is expected that this regulation will have a large impact on personalized advertising, because companies will only be allowed to store and process personal data when the individual explicitly gives permission. In this study the effect of the GDPR (due to a change in perceived privacy control) on the relationship between personalization and click-through intentions was examined. This relationship was expected to be negatively mediated by privacy violations, and positively mediated by ad relevance. A quantitative study by means of an experiment with a 3 (no, moderate or high personalization) x 2 (before or after GDPR) between-subjects design (N = 315) was conducted. Results show that personalized ads are more effective than non-personalized ads in terms of click-through intentions. Moreover, in determining clicking on the ad, consumers’ perceived relevance of the ad is almost five times more influential than perceived privacy violation. Nevertheless, the GDPR manipulations did not have the expected effects. Even though perceived privacy control indeed increased in the after-GDPR scenario, no significant moderated mediation effects on click-through intentions were found. Possible explanations and suggestions for future research are discussed.
2
Statement of originality
This document is written by Student Judith van Dellen who declares to take full responsibility for the contents of this document. “I declare that the text and the work presented in this document is original and that no sources other than those mentioned in the text and its references have been used in creating it.” The Faculty of Economics and Business is responsible solely for the supervision of completion of the work, not for the contents.3
Table of Contents
1. Introduction 4 2. Literature review 7 2.1 Personalization 7 2.2 Personalization and Ad Relevance 10 2.3 Privacy Concerns and the “Privacy Paradox” 11 2.4 Reactance to Personalization 14 2.5 Perceived Privacy Control 15 2.6 Conceptual Model 16 3. Method 18 3.1 Sample and Data Collection 18 3.2 Stimuli 19 3.3 Measures 22 3.4 Procedure 24 4. Results 27 4.1 Correlation Analysis 27 4.2 Manipulation Checks 28 4.3 Randomization Checks 29 4.4 Hypotheses Testing 30 5. Discussion 36 5.1 Theoretical Implications 37 5.2 Managerial Implications 40 5.3 Limitations and Future Research 41 6. Conclusion 43 References 44 Appendices 48 Appendix A: Survey 484
1. Introduction
Many successful firms increasingly rely on the collection and use of detailed customer information to design personalized offerings and micro target specific audiences (White, Zahay, Thorbjørnsen, & Shavitt, 2008). Therefore, it is not surprising that companies wish to maintain the right to collect, use and in some cases sell customer information. However, on the 25th of May 2018 the General Data Protection Regulation (GDPR) will take effect in the European Union, with the aim to give back control to individuals over their personal data and to protect their privacy (European Union, 2016). It is expected that this regulation will have a huge impact on the current way of personalized advertising, because when this regulation becomes enforceable companies will only be allowed to store and process personal data when the individual explicitly gives permission for these (advertising) purposes (Kolah & Foss, 2015).As the GDPR is aimed at increasing privacy control of individuals, this raises the question how privacy control is related to individuals’ reactions to personalized advertisements. Inconclusive results of the effectiveness of personalization have shown that it is a very complex concept which calls for further research: personalization can be both an effective and an ineffective marketing strategy, depending on the context (Aguirre, Mahr, Grewal, de Ruyter, & Wetzels, 2015). It can improve advertising effectiveness, because an increase in personal relevance of an ad can generate more favourable consumer responses (De Keyzer, Dens, & De Pelsmacker, 2015). In other words, consumers might see personalized ad content as more appealing and more connected to their interests and needs than non-personalized ads, resulting in higher click-through intentions. However, if consumers feel that their privacy is violated in the personalization process, the perceived lack of control about personal information may
5
result in the opposite behaviour. Several researchers (Edwards, Li, & Lee, 2002; White, Zahay, Thorbjørnsen, & Shavitt, 2008) have shown that personalized ads in that case can lead to a process of ‘reactance’, where consumers deliberately resist ads that they perceive as coercive (Tucker, 2014). It could be argued that in turn increasing privacy control, which is also intended with the GDPR, could reduce the state of reactance and therefore possibly alter the relationship between personalization and click-through intentions. However, the only research (to my knowledge) that has been done on this topic by Tucker (2014) was conducted by means of a non-profit campaign with an appealing cause (providing educational scholarships in East Africa for underprivileged girls), for which consumers may ascribe more benevolent motives to the usage of personalized advertising. Therefore, more research is necessary to see if the effects also hold in a commercial setting.
More insights on the underlying decision processes of consumers would be extremely useful for marketers, especially in the uncertain times of the GDPR, because it could help them improve their advertising strategies when they can no longer covertly collect and use personal data. The goal of this research is thus to examine how perceived privacy control affects the relationship between the personalization of advertisements on the one hand and click-through intentions on the other. The following research question will be examined: How do perceived ad relevance and perceived privacy violation mediate the relationship between personalization and click-through intentions, and how does perceived privacy control in turn moderate the mediation effect of perceived privacy violation? Please note that the term perceived privacy violation is used here to make a distinction between the privacy concerns for the specific scenario or advertisement (ad
6
hoc), and general privacy concerns (a priori), which are used as a control variable in this research.
To answer the research question, a quantitative study by means of an online experiment was conducted with a 3 (personalization: non, moderate or high) x 2 (perceived privacy control: scenario before or after GDPR) between-subjects design (N = 315), in which participants were exposed to hypothetical scenario in which a travel guide advertisement appeared on their Facebook timeline.
The structure of this thesis is as follows. First, the relevant literature regarding personalization and privacy will be reviewed. Next, the research design and method will be discussed, followed by a thorough analysis of the results. Finally, implications of these results and suggestions for future research are provided to end with a general
7
2. Literature review
To shed light on the empirical work that has addressed the relationship between privacy and the effectiveness of personalization, this chapter provides an extensive overview of the relevant literature on these subjects. First, the concept of personalization is explained by providing a definition, making a distinction between online and offline personalization, and discussing the value of personalization to both firms and consumers. Next, the concepts privacy concerns and “the privacy paradox” are discussed, because (as the definition will show) personalization inevitably involves giving up some privacy. Subsequently it is hypothesized that the effects of personalization on click-through intentions depend on a trade-off between personalization value (such as ad relevance) and privacy concerns: the privacy calculus. In the last paragraph the concept of privacy control and the possible moderating role on this trade-off are described. Finally, a conceptual model is provided to graphically illustrate all the hypothesized relationships.
2.1 Personalization
Firms routinely practice personalization, both offline and online: from vendors adjusting their behaviours toward each customer, such as referring to a customer by name or modifying service to accommodate customers’ needs, to reflecting a user’s online behaviour in targeted advertisements (Aguirre et al., 2015). Personalization can be defined as “the ability to proactively tailor products and product purchasing experiences to tastes of individual consumers based upon their personal and preference information” (Chellappa & Sin, 2005, p. 181).
8
In terms of online advertising, personalization can be seen as a continuum ranging from no personalization to full personalization (De Keyzer et al., 2015). Non-targeted, generic online advertising of a random product or service in the form of a banner can be regarded as non-personalized online advertising. Full personalization is completely tailored or addressed to a particular individual based on for example name, previous searches, web page visits, or viewed content. In between these two ends of the continuum one can think of general (or moderate) personalization such as sending local bridal shop ads to women whose relationship status is “engaged” (De Keyzer et al., 2015).
For vendors personalization is of great strategic significance: it enables for one-to-one marketing communication, targeting of prospective audiences, and obtaining measurable responses (Kim & Kim, 2011). It can also help managing retention strategies, increasing customer loyalty and preventing customers from switching (Chellappa & Sin, 2005). However, although the effect of personalization has been examined in many prior studies across different domains, what seems confusing in the literature is whether a personalized message or advertisement is always more effective than a standardized one (Li & Liu, 2017).
Some researchers have found only modest or non-significant differences between the effects of more versus less personalized appeals (White et al., 2008). For example, research on the impact of contact type on web survey response rates showed that personalization of email contact had little impact on response rates (Porter & Whitcomb, 2003). An explanation for this outcome could be that many people are used to receiving countless unwanted (spam) emails from marketers and thus do not perceive the email as completely personalized. This would be in line with results of a more recent study (Li,
9
2016), that showed that a personalization process does not automatically yield more favourable effects, because perceived personalization (instead of actual personalization) is the underlying psychological mechanism of message effectiveness. The concept of perceived personalization is used in some studies but not in others, which could also explain the different outcomes of sometimes very similar studies.
There are also cases known in which personalized advertising can even decrease click-through rates, for example when customers realize that their personal information has been collected without their knowing or consent (Aguirre et al., 2015). In this particular case of Aguirre et al. (2015) it should be noted that financial information was used in the experiment, which respondents perceived as very sensitive. It is unclear if these effects would hold in cases where less sensitive information is used.
In contrast to these findings, most personalization studies show an increase in advertising effectiveness like click-through rates and intentions (Postma & Brokke, 2002; Arora et al., 2008; Kalyanaraman & Sundar, 2006; Pavlou & Stewart, 2000; Tam & Ho, 2005; De Keyzer et al., 2015). For example Postma and Brokke (2002) showed that the average click-through rates doubled in the case of full personalization of email newsletters based on the preferences indicated by the subscribers. Results of Kalyanaraman and Sundar (2006) also reveal that greater levels of personalized content (in this case of a website) engender more positive attitudes. More recent results of De Keyzer et al. (2015) in an advertising context also showed that personalization based on gender has a positive effect on consumer responses on Facebook.
The effectiveness of personalization thus seems to depend on the context. However when critically looking at the previous studies, personalization generally increases the effectiveness of advertisements, mainly because the relevance of
10 personalized ads is higher than generic ads, which will be explained in further detail in the next paragraph. Therefore it is hypothesized that:
H1: There is a positive relationship between personalization and click-through intentions.
2.2 Personalization and Ad Relevance
For consumers, the value of personalization primarily stems from the fit that a product or service provides, and the convenience of having it delivered in a proactive fashion. Personalization enables a quick focus on what consumers really want because relevant communication messages are based on their preferences, minimizing the time that consumers spend searching for information through an entire product assortment to find precisely what they want (Baek & Morimoto, 2012). Personalized messages are generally also more effective than non-personalized messages in terms of being more memorable, more likeable, and sparking behavioural change (Noar, Benac, and Harris 2007; Sohl and Moyer 2007 in De Keyzer et al., 2015). Personalization is said to increase the appeal of an ad, because the user is more likely to assume that there is a match between his/her self and the product (Malheiros, Jennett, Patel, Brostoff, & Sasse, 2012). Thus, consumers might see personalized ad content as more appealing and more connected to their interests. Therefore, it is hypothesized that:
H2: The relationship between personalization and click-through intentions is positively mediated by perceived ad relevance.
H2a: There is a positive relationship between personalization and ad relevance.
H2b: There is a positive relationship between ad relevance and click-through intentions.
11
2.3 Privacy Concerns and the “Privacy Paradox”
As previously discussed, personalized advertising is advertising created for an individual using information about the individual (Yu & Cude, 2009, p. 506). Therefore, personalization is critically dependent on two factors: firms’ ability to acquire and process consumer information, and consumers’ willingness to share information and use personalization services (Chellappa & Sin, 2005). The usage of consumers’ personal information makes personalization infeasible to achieve without some loss of privacy. Privacy is defined by Westin (1967) as “the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others”. Information privacy thus involves the ability of the individual to personally control information about one’s self (Stone, Gueutal, Gardner, & McClure, 1983). Privacy concerns in turn can be defined as “the degree to which a consumer is worried about the potential invasion of the right to prevent the disclosure of personal information to others” (Baek & Morimoto, 2012).
Individuals are increasingly concerned about their privacy and the potential negative consequences associated with sharing information (Awad & Krishnan, 2006; Baruh, Secinti, & Cemalcilar, 2017). People are becoming aware of the power of internet technologies to monitor user behaviour and to gather information about them, with or without their knowledge (Dinev & Hart, 2004). Specific privacy risks that internet users face range from inadvertent disclosure of personal information, to unwanted contact (e.g. spam mail), to use of personal data by third parties, to hacking and identify theft (Kim & Kim, 2011). These concerns about information privacy practices can be divided into several dimensions, such as concerns about collection of data or the unauthorized
12
secondary use of data for other purposes than the purpose for which the data was collected (Smith, Milberg, & Burke, 1996).
An important aspect of online information privacy that differs from offline transactions is the fact that virtually all forms of electronic access leave a trail (Chellappa & Sin, 2005). This trail of consumer information collected online can broadly be classified into three categories: anonymous information, which for example refers to information gathered about page visits (e.g. IP address); personally unidentifiable information, which, taken alone, cannot be used to identify the individual (such as age, gender, income, interests, etc.); and personally identifiable information (such as email address, name, credit card number, etc.) (Federal Trade Commission, 2000, in Chellappa & Sin, 2005). Online personalization involves the collection and use of each of these various types of information. However, the more personalized an ad, the more personal information is used, and thus the more privacy is lost. As Aguirre et al. (2015) showed, feelings of vulnerability arise when consumers confront a personalized cue. Even though Aguirre et al. (2015) used highly sensitive (financial) information in their experiment, it is hypothesized that also when less sensitive information is used an increase in personalization results in an increase in privacy concerns. To make a distinction between general privacy concerns (in this research measured a priori and used as a control variable) and privacy concerns regarding a specific situation (or advertisement), here the term perceived privacy violation is used. Thus, it is hypothesized that:
H3: The relationship between personalization and click-through intentions is negatively mediated by perceived privacy violation.
H3a: There is a positive relationship between personalization and perceived privacy violation.
13
Even though one might expect that these privacy concerns would result in the associated behaviour of disclosing less information, this is not (always) the case. To date studies on the relationship between privacy concerns and privacy protective behaviours have provided inconclusive results (Baruh et al., 2017). Research has shown that in some cases there are discrepancies between consumers’ privacy concerns and actual behaviours, which is also known as the “privacy paradox”. For example, research on Facebook users showed that individuals that are concerned about their privacy still join the network and reveal great amounts of personal information (Acquisti & Gross, 2006). Yet, there is also a growing number of studies which report a significant correlation between privacy concerns and privacy-management behaviour (e.g. Wu, Huang, Yen, & Popova, 2012; Utz & Kramer, 2009, in Baruh et al., 2017). Within the domain of e-commerce, for example, concerns about online privacy are associated with engaging in privacy protective behaviours such as removing one’s personal information from commercial databases (e.g., Son & Kim, 2008), deleting cookies (e.g., Lutz & Strathoff, 2014), and refraining from self-disclosure (e.g., Spiekermann, Krasnova, Koroleva, & Hildebrand, 2010, in Baruh et al., 2017).
The large recent meta-analysis by Baruh et al. (2017) confirmed these contradicting results of the effect of privacy concerns on privacy-management behaviour. In line with the premise of the privacy paradox, privacy concerns did not predict social network site use. However, users concerned about privacy were less likely to use online services and share information and were more likely to utilize privacy protective measures (Baruh et al., 2017). As a potential explanation for this discrepancy between privacy concerns and behaviour, Baruh and co-workers suggest that social network sites serve more expressive needs for users than other forms of online services
14
such as online shopping sites, so that many users may continue using these social network sites despite their privacy concerns (Baruh et al., 2017, p. 45).
This explanation is in line with results of other researchers indicating that individuals may be willing to share their personal information and preferences if they realize that there are benefits to be obtained in return (Laufer & Wolfe, 1997; Chellappa & Sin, 2005). According to Culnan and Bies (2003) consumers behave as if they are performing a “cost-benefit” analysis, or what they refer to as the “privacy calculus”, in assessing the outcomes they receive as the result of providing personal information to organizations. Based on such an analysis, a positive net outcome should mean that people are more likely to accept the loss of privacy that accompanies any disclosure of personal information, as long as an acceptable level of risk accompanies the benefits.
2.4 Reactance to Personalization
Personalized advertisements could also result in a negative outcome of the privacy calculus, indicating that consumers feel constrained in the sense of being too identifiable or observable by the firm. When an inappropriate level of familiarity with consumers’ preferences and behaviours is shown, consumers might feel that their privacy is violated and perceive the ad as creepy or off-putting (Tucker, 2014). In other words, when an advertisement gets too personal, consumers can become less willing to respond favourably to the offer (White et al., 2008). This can be explained by a motivational state called ‘reactance’: when behavioural freedoms are reduced or threatened with reduction, individuals will be motivationally aroused to behave in the opposite way to the one intended (Brehm, 1966).
15
White et al. (2008) show that reactance to personalized advertising is larger for ads that use more unique information about the consumer. It should be noted that the research of White et al. (2008) focused on email personalization and that the demonstrated effects were relatively small. However, also other researchers found similar results. Malheiros et al. (2012) for example examined the effects of personalized ads in which photos of the participants were used and results indicated that the negative effects of highly personalized messages depend on the degree to which the personal information used in the message uniquely identifies the recipient. Also for example knowing that a preference is relatively rare might make users more concerned they were being tracked by the advertiser in a privacy-violating manner, provoking reactance and making consumers deliberately resist the ad (Edwards et al., 2002; Tucker, 2014; White et al., 2008). Thus, it is hypothesized that:
H3b: There is a negative relationship between perceived privacy violation and click- through intentions.
2.5 Perceived Privacy Control
Reactance can be reduced (and thus the effectiveness of personalized advertisements can be increased) by strengthening privacy control (Tucker, 2014). As previously discussed, information privacy involves the ability of the individual to personally control information about one’s self (Smith et al., 1996). Increasing this degree of privacy control is also the aim of the GDPR. This means that identifiable information should not be generally available to others, and that the individual should be able to exercise a substantial degree of control over information and its use when the information is possessed by another party (Clarke, 1999, in van Dyke et al., 2007).
16
Perceived privacy control, or what Van Dyke et al. (2007) call “perceived privacy empowerment”, is thus a psychological construct related to the individual’s perception of the extent to which they can control the distribution and use of their personally identifying information. Aguirre et al., (2015) show that personalization only leads to greater click-through intentions when firms inform their customers about their data collection efforts. When firms do not, the use of personal information may cue customers that their information has been collected without their consent, which in turn leads to greater perceived vulnerability. Because once the GDPR becomes enforceable consumers have to give permission for data collection efforts, the same effect is expected. This would be in line with Fournier and Avery (2011) who claim that to succeed in the new world of social media, brands must relinquish control. Moreover, Van Dyke et al. (2007) show that an increase in privacy control has a significant negative effect on the level of privacy concerns. It is therefore hypothesized that an increase in perceived privacy control decreases the effect of perceived privacy violation on the relationship between personalization and click-through intentions. Hence:
H4: The relationship between personalization and perceived privacy violation is moderated by perceived privacy control.
2.6 Conceptual Model
An illustration of the hypothesized relationships between personalization and click-through intentions is presented in the conceptual model in Figure 1. In summary, it is expected that the relationship between personalization and click-through intentions is mediated by two counteractive variables: perceived ad relevance and perceived privacy violation. This means that when an advertisement is more personalized, consumers
17
might perceive the ad as more relevant resulting in higher intentions to click on it, but at the same time they might feel that their privacy has been violated which causes the opposite effect. The latter is explained by a psychological concept called ‘reactance’. These two counteractive variables are expected to cause a cost-benefit analysis, for which perceived ad relevance has a relatively stronger effect, resulting in a positive net outcome or effect (Chellappa & Sin, 2005; Culnan & Bies, 2003). It is also expected that by increasing the perceived control of individuals about how their personal information is used could reduce the state of reactance and thus reduce perceived privacy violation. In the next chapter the method of how to examine these hypothesized relationships is discussed. Figure 1. Conceptual Model.
18
3. Method
This chapter contains the empirical part of the study. First, the research design, data collection method and characteristics of the collected sample are outlined. Second, the stimuli that were used to manipulate the conditions are described. Third, the measurement scales of the variables are listed and finally, the (statistical) procedure is described.
3.1 Sample and Data Collection
To test the hypotheses, a quantitative study by means of an online experiment was conducted with a 3 (personalization: non, moderate or high) x 2 (perceived privacy control: scenario before or after GDPR) between-subjects design. The Qualtrics Survey Software tool was used as the survey distribution and data collection instrument. By spreading the link between 28 November and 7 December 2017 via e-mail, Whatsapp, Facebook, Survey-Circle and Poll-Pool a non-probability convenience sample of 344 participants was gathered. Out of these participants, 29 did not finish the survey (8.4%), so in total, 315 participants completed the questionnaire. However, of 62 participants the answer to the control question did not correspond with the actual personalization condition they were in, indicating that they had not carefully read or had misunderstood the scenario. Therefore, these cases were filtered out (for a more detailed description see paragraph 3.4: Procedure), leaving a data set of 253 cases (39.1% female; Mage = 29.3
years, SDage = 10.59).
The majority of the participants were highly educated (37.9% Bachelor’s degree, 38.3% Master’s degree, 12.3% higher vocational education (i.e. Dutch HBO), 7.9% high school). The large majority of the participants had the Dutch nationality (81.0%) and of
19
the other nationalities (19.0%) most respondents were German (15.2%), Italian (10.9%), and Chinese, British or Canadian (all 6.5%). On average, most participants used social media every day (55.3%) or even every hour (40.7%). Of these social media, Whatsapp (95.3%) and Facebook (90.1%) were mostly used, followed by YouTube (79.8%), LinkedIn (73.1%), Instagram (66.0%), Snapchat (44.7%), Pinterest (26.9%) and Twitter (18.2%).
3.2 Stimuli
Participants were randomly assigned to one of the six conditions (non-personalized pre-GDPR N = 30, moderately-personalized pre-GDPR N = 51, highly-personalized pre-GDPR N = 45, non-personalized post-GDPR N = 38, moderately-personalized post-GDPR N = 46, highly-personalized post-GDPR N = 43). A control question about what kind of ad was shown was used to check if the participants had read the scenario carefully. To answer the control question, respondents had to indicate whether they had been exposed to ‘a general (unpersonalized) social media advertisement’, ‘an advertisement based on online search/buying behaviour’ or ‘an advertisement based on information shared in chat messages’. Most cases that were deleted as a consequence of an incorrect answer the control question were in the non-personalized condition (see paragraph 5.1: General Discussion, for a possible explanation). Therefore, these conditions were left with a slightly smaller sample.
GDPR
Participants were exposed to a short description about the General Data Protection Regulation (GDPR) and the purpose of this regulation, i.e. that it is aimed at giving back control to individuals over their personal data:
20
Next year, on 25 May 2018, the General Data Protection Regulation (GDPR) becomes enforceable in the European Union. This regulation is aimed at giving back control to individuals over their personal data and requires businesses to protect the personal information and privacy of EU citizens.
From this date on, companies will only be allowed to store and process personal data when the individual explicitly consents for the purposes. The individual should also have a reasonable opportunity to review the information that a firm has collected about him/her.
Participants were then randomly assigned to one of the two scenarios in which they were asked to picture themselves either before (N = 126) or after the GDPR had become enforceable (N = 127). It was also emphasized that the participants either had or had not explicitly given any permission to use personal data for personalized offerings by emphasizing: “For the following questions, please imagine that this regulation is already [not yet] in force [and that companies obey this regulation]. Also please imagine that you have [not] explicitly given firms (e.g. Facebook) permission to use your personal data for personalized offerings.” (See Appendix A.) These scenarios had to manipulate the degree of perceived privacy control. Personalization
An advertisement of a Lonely Planet travel guide of Bolivia was put into a Facebook timeline setting using Photoshop (see Figure 2). Facebook was selected as the setting, considering the importance of promotions through social media and Facebook’s vast popularity (Aguirre et al., 2015). In the current study, 90.2% of the participants said to be a Facebook user so were expected to be able to easily picture themselves in the scenario. The other participants received a conditional text saying “For the following
21
questions, please try to imagine that you do use Facebook or that you see the displayed advertisement on another web page.” No participants indicated in the comments that they had any trouble doing so. Furthermore, a travel guide was selected because it is a relatively gender – and age neutral stimulus.
The personalization continuum proposed by De Keyzer et al. (2015) (as described in paragraph 2.1) was used to generate the three personalization conditions. For the non-personalized condition participants were asked to imagine themselves in a scenario in which they randomly saw the travel guide advertisement on their Facebook timeline, without ever having searched online for anything related to Lonely Planet or Bolivia. For the moderate personalization condition, participants were asked to imagine themselves in a scenario in which they had just booked a flight to Bolivia with an online travel agency on a different website. In the high personalization condition, participants were asked to picture themselves in a scenario in which they had just talked to a friend about wanting to travel to Bolivia someday in private chat messages on Facebook Messenger.
Figure 2. Stimulus material.
22
3.3 Measures
First, some demographic information regarding age, gender, nationality, education level and social media usage were collected. Participants were asked to fill out their age manually. The gender variable was a multiple choice question with the values ‘female’, ‘male’ or ‘other’. For the education level, participants had to choose their highest completed level ranging from ‘none’ to ‘University (PhD)’. Respondents could either select Dutch or ‘other, namely…’ for which they could write down their nationality. Privacy concerns General privacy concerns (a priori) were measured with a six-item scale using a seven-point Likert scale (“strongly agree” to “strongly disagree”) on which participants had to rate with the following statements: “In general, I believe that personal data is misused too often”, “I am concerned that companies use my personal data inappropriately”, “I feel uncomfortable when my personal data is used and/or shared without my permission”, “I am worried that my personal data is not being stored safely”, and “Privacy is an important issue to me” (α = .86) (Baek & Morimoto, 2012). These questions were asked at the start of the survey to diminish the potential effect of being influenced by the privacy context of the other questions.
Perceived privacy control
Perceived privacy control was measured with a four-item scale using a seven-point Likert scale (“strongly agree” to “strongly disagree”) with the following statements: “I am in control of how my personal information is used”, “Firms communicate their information practices (e.g. what information they collect and how they use it) to me before collecting personal data”, “I am provided with choices as to how my personal data
23
is used” and “I am offered reasonable access to the information that is collected about me”. This scale was adjusted from Van Dyke et al., (2007) (α = .80) and Kim & Kim (2011) (α = .89) that was based on website usage.
Click-through intentions
Directly after being exposed to the advertisement, click-through intentions were measured with a single item, “How likely is it that you would click on this advertisement?”, using a seven-point Likert scale (“extremely unlikely” to “extremely likely”) (Aguirre et al., 2015; White et al., 2008).
Perceived Personalization
As argued by Li (2016) it is important to measure perceived personalization separately from actual personalization, because sometimes personalized messages are perceived as non-personalized and vice versa. To check if participants in the three different personalization conditions also differed in perceived personalization, a two-item scale (Li & Liu, 2017) was used. Participants had to indicate the degree to which they believed the ad was customized to their (hypothetical) situation and to which the ad seemed to be designed specifically for him/her using a seven-point Likert scale (“strongly agree” to “strongly disagree”). Perceived ad relevance Perceived ad relevance was measured with a two-item scale, on which participants had to indicate the degree to which they agreed to the following statements: “This ad is relevant for my situation” and “This ad is useful for my situation”, using a seven-point Likert scale (“strongly agree” to “strongly disagree”).
24 Perceived privacy violation Perceived privacy violation was measured with a two-item scale: “I feel uncomfortable that my personal data was used for this ad” and “I feel like this ad violates my privacy” using a seven-point Likert scale (“strongly agree” to “strongly disagree”). Brand attitude
Finally, the control variable brand attitude was measured with three items on a five-point semantic differential scale on which participants had to indicate their general attitude towards Lonely Planet (good/bad, favourable/unfavourable, and pleasant/unpleasant) adjusted from Dahlén (2005) (α = .92) and Cruz, Leonhardt, and Pezzuti (2017) (α = .96).
3.4 Procedure
To perform the statistical analyses SPSS version 23 was used. The survey consisted of mostly forced-response questions, which limited the amount of missing data. The 29 incomplete cases of unfinished questionnaires were excluded list wise so that only the 315 cases without missing data were used. Next, the answers to the control question (about the kind of ad that was shown) were compared to the actual conditions the participants were in. 62 cases did not correspond. Comparing the means of the cases in which the answers did not correspond to the means of the answers that did (by a one-way ANOVA and Tukey post hoc test), showed significant differences especially for the non-personalized condition, for example in click-through intentions, perceived personalization, ad relevance and perceived privacy violation. This could possibly be due to participants not reading the scenario carefully. Therefore, the 62 cases that did not correspond were filtered out leaving a data set of 253 cases.
25
No counter-indicative items were used so no items had to be reversed. Descriptive statistics, skewness, kurtosis and normality tests were computed for all variables. No variables were normally distributed (as most variables contained Likert scales, which are ordinal). Reliability checks were run to examine the internal consistency of the scales of brand attitude, privacy concerns, perceived ad relevance and perceived privacy violation. As exhibited in Table 1, all variables have a Cronbach’s alpha over .70, which indicates high level of internal consistency. Next, scale means were computed into new variables.
Even though disagreement exists amongst scholars about whether Likert data should be analysed with parametric statistics, research shows that for example the t-test and the Mann-Whitney-Wilcoxon generally have similar power (De Winter & Dodou, 2010). Therefore, an independent-samples t-test was conducted to compare perceived privacy control in the before GDPR and after GDPR scenario manipulations. A one-way between subjects ANOVA was conducted to compare the perceived personalization in no-personalization, medium-personalization and high-personalization conditions. A one-way between subjects ANOVA was also used to compare perceived ad relevance, perceived privacy violation and click-through intentions between the three conditions. In order to test the mediating effects of perceived ad relevance and perceived privacy violation, Model 4 of the SPSS macro PROCESS v3.0 (Hayes, 2017) was used. In addition, Model 7 was used to test the moderated mediation effect of privacy control as a result of the GDPR. The SPSS extension tests indirect effects using a regression-based path. Due to violation of the normality assumption, bootstrapping (5000 bootstraps) was applied. Confidence intervals were set on a 95% interval.
Table 1 Means, Standard Deviations, Correlations M SD 1 2 3 4 5 6 7 8 9 10 1. Gender .61 .49 - 2. Age 29.35 10.59 -.165** - 3. Nationality .19 .39 .099 -.203** - 4. Social Media 1.64 .62 -.055 .307 .067 - 5. Brand Attitude 3.68 1.04 .083 -.171** .007 -.024 (.974) 6. Privacy Concerns 5.21 1.11 .025 .244** .019 .213** -.172** (8.49) 7. GDPR 2.08 .78 -.054 .027 -.123 .079 -.056 .022 - 8. Personalization 1.50 .50 -.054 .009 -.049 -.007 .010 -.022 -.051 - 9. Ad Relevance 4.38 1.77 -.023 -.083 -.073 -.067 .150* -.071 .022 .638** (.928) 10. Privacy Violation 4.77 1.69 .064 .217** .063 .098 -.193** .461** -.002 .465** .198** (.867) 11. CTI 2.96 1.87 .102 -.142* -.050 -.045 .244** -.202** -.019 .308** .544** -.072 Note: N = 253. Reliabilities are reported along the diagonal. **. Correlation is significant at the 0.01 level (2-tailed). *. Correlation is significant at the 0.05 level (2-tailed).
4. Results
In this chapter first the correlation analysis (see Table 1) is discussed. Subsequently the results of the manipulation checks and randomization checks are discussed. In the last paragraph the results of the hypothesis tests of the moderated mediation model are outlined. 4.1 Correlation Analysis The mean, standard deviation, correlations and reliabilities are provided in Table 1. First of all the table shows that age is significantly negatively correlated to brand attitude (r = -.171, p < .01) and click-through intentions (r = -.142, p < .05) and positively to privacy concerns (r = .244, p < .01) and perceived privacy violation (r = .217, p < .01). This indicates that older participants had a less favourable attitude towards Lonely Planet and were generally more concerned about their privacy (both a priori and in the specific scenarios).
General privacy concerns were positively correlated to social media usage frequency (r = .213, p < .01), which is in line with the privacy paradox (i.e. that privacy concerns do not always correspond with privacy-management behaviour such as decreasing social media usage), but could also indicate the other way around that more frequent social media users are more concerned about their privacy. Furthermore, a significant positive relationship was found between general privacy concerns and the privacy concerns regarding the specific situation, i.e. perceived privacy violation (r = .461, p < .01). Privacy concerns was also significantly negatively correlated to brand attitude (r = -.172, p < .01) and click-through intentions (r = -.202, p < .01). Significant correlations were also found between brand attitude on the one hand and perceived ad
28
relevance (r = .150, p < .05), perceived privacy violation (r = -.193, p < .01) and click-through intentions (r = .244, p < .01) on the other.
The manipulated personalization conditions were positively correlated to perceived ad relevance (r = .638, p < .01), perceived privacy violation (r = .465, p < .01), and click-through intentions (r = .308, p < .01). Furthermore, a significant positive correlation was found between perceived ad relevance and perceived privacy violation (r = .198, p < .01), just like between perceived ad relevance and click-through intentions (r = .544, p < .01). Finally, no significant correlations were found with the GDPR scenarios.
4.2 Manipulation Checks
Perceived Privacy Control
An independent-samples t-test was conducted to compare perceived privacy control in the before GDPR and after GDPR scenarios. There was a statistically significant difference between the before GDPR (Mppc = 2.97, SDppc = 1.21) and after GDPR (Mppc =
4.14, SDppc = 1.46) conditions; t (251) = -6.96, p < .001. These results suggest that
people perceive the control they have about how their personal information is used to be higher after the regulation becomes enforceable (in this hypothetical situation).
Perceived Personalization
To compare perceived personalization in the no-personalization, moderate-personalization and high-moderate-personalization conditions, a one-way between subjects ANOVA was conducted. There was a statistically significant difference at the p <.001 level between the three conditions (F(2,250) = 170.743, p < .001).
29
Post hoc comparisons using the Tukey HSD test indicated that participants in the no-personalization condition (Mpp = 2.32, SDpp = 1.07) perceived the advertisement
significantly less personalized than participants in the moderate-personalization condition (Mpp = 5.34, SDpp = 1.13) and in the high-personalization condition (Mpp = 5.37, SDpp = 1.25). However, the moderate- and high-personalization conditions did not
significantly differ from each other. These results suggest that people feel that both ads based on previous online buying behaviour and ads based on information from private chat messages are more customized to their situation than random ads, but that they do not differ from each other. This also means that this manipulation was not completely successful. 4.3 Randomization Checks To ensure that the participants were randomly assigned to the conditions, the different groups were compared in terms of age, gender, nationality, education level, social media usage, general privacy concerns, and brand attitude. Independent-samples t-tests showed no significant differences between the group in the before-GDPR and after-GDPR scenarios, except for nationality. There was a statistically significant difference between the before-GDPR (Mnat = .24, SDnat = .43) and after-GDPR (Mnat = .14, SDnat = .35)
conditions; t (251) = 1.96, p < .001. These results indicate that there were more participants with Dutch nationality in the after-GDPR condition. However, because subsequent independent-samples t-tests did not indicate significant differences between Dutch and non-Dutch nationalities in terms of CTI, perceived privacy violation and perceived privacy control, it is not expected that the difference in nationality between the two conditions will affect the results. Furthermore, one-way ANOVA was used for
30 the randomization check of the personalization conditions. No significant effects across the conditions were found. Therefore the randomization was successful. 4.4 Hypotheses Testing Personalization and Click-Through Intentions
A one-way between subjects ANOVA was conducted to compare the click-through intentions in the no-personalization, medium-personalization and high-personalization conditions. There was a statistically significant difference at the p < .001 level between the three manipulated personalization conditions (F(2,250) = 16.013, p < .001).
Post hoc comparisons using the Tukey HSD test indicated that the mean score for the no-personalization condition (MCTI = 1.94, SDCTI = 1.33) was significantly lower than
the medium-personalization condition (MCTI = 3.23, SDCTI = 1.89) and the
high-personalization condition (MCTI = 3.47, SDCTI = 1.92) (see Figure 3). However, the
medium- and high-personalization conditions did not significantly differ from each other. These results suggest that personalized ads are more effective than non-personalized ads in terms of click-through intentions, however that there are no significant differences between personalized ads based on previous online buying behaviour and ads based on information retrieved from private chat messages. As argued in the previous paragraph, there was no significant difference in perceived personalization between the moderate-personalization and high-personalization condition either. Therefore, no conclusions can be drawn about the differences in moderate and high-personalization. However the results do indicate that personalization versus no personalization result in higher click-through intentions.
31 Personalization and Perceived Ad Relevance
Another one-way between subjects ANOVA was conducted to compare perceived ad relevance in the no-personalization, medium-personalization and high-personalization conditions. There was a statistically significant difference at the p < .001 level between the three manipulated personalization conditions (F(2,250) = 137.878, p < .001).
Post hoc comparisons using the Tukey HSD test indicated that the mean score for the no-personalization condition (Mpad = 2.28, SDpad = 1.13) was significantly lower than the medium-personalization condition (Mpad = 5.03, SDpad = 1.37) and the high-personalization condition (Mpad = 5.28, SDpad = 1.13) (see Figure 3). However, again, the medium- and high-personalization conditions did not significantly differ from each other. These result suggest that personalized ads are perceived as more relevant than non-personalized ads, however that there are no significant differences between personalized ads based on previous online buying behaviour and ads based on information retrieved from private chat messages (which again could be due to the failed manipulation). Personalization and Perceived Privacy Violation Another one-way between subjects ANOVA indicated a statistically significant difference at the p < .001 level between the three manipulated personalization conditions in terms of perceived privacy violation (F(2,250) = 34.648, p < .001). Post hoc comparisons using the Tukey HSD test indicated that the mean score for the no-personalization condition (Mppv = 3.65, SDppv = 1.54) was significantly lower than the medium-personalization
condition (Mppv = 4.74, SDppv = 1.59) and the high-personalization condition (Mppv = 5.67, SDppv = 1.35) (see Figure 3). Also, the medium-personalization and high-personalization
32
suggest that the perception that privacy is being violated is higher when information about the individual’s previous shopping behaviour is used than when a random ad is shown, and even higher when information of the individual is retrieved from personal chat messages.
Figure 3. The differences between the three personalization conditions in terms of perceived personalization, ad relevance, privacy violation and click-through intentions.
Mediation Effects
To test the indirect effects of personalization on click-through intentions through perceived ad relevance and perceived privacy violation, the PROCESS macro for mediation (Model 4) was used (Hayes, 2017). Gender, age, nationality, general privacy concerns and brand attitude were taken into account as control variables. Results show that these control variables explained 19.46% of the variance (p < .001), whereas the whole model explained 36.62% (p < .001).
As shown in Table 2, the direct effect of personalization on click-through intentions is positive but not significant (c’ = .105, t(244) = 17.621, p = .568). However, the indirect effects through perceived ad relevance and perceived privacy violation were 1 2 3 4 5 6 7 No
personalization personalization Moderate personalization High Personalization Effects
Perceived Personalization Perceived Ad Relevance Perceived Privacy Violation Click-Through Intentions
33
significant, as will be discussed next. Thus, hypothesis 1, proposing a positive relationship between personalization and click-through intentions, is partially accepted: only an indirect relationship was found.
The effect of personalization on perceived ad relevance a1 (1.43) is statistically different from zero, t = 13.186, p < .001, with a 95% confidence interval from 1.217 to 1.645. This means that hypothesis 2a, proposing that there is a positive relationship between personalization and perceived ad relevance, is supported.
The effect b1 = .553 indicates that two individuals who experience the same level of personalization but differ by one unit in their level of perceived ad relevance are estimated to differ by .553 units in click-through intentions (those relatively higher in ad relevance are estimated to be higher in click-through intentions). This effect is statistically different from zero, t = 7.684, p < .001, with a 95% confidence interval from .411 to .695. This means that hypothesis 2b, proposing that there is a positive relationship between perceived ad relevance and click-through intentions, is supported. The indirect effect of .791 means that two individuals who differ by one in personalization group are estimated to differ by .791 in click-through intentions as a result of perceiving the more personalized ad as more relevant. This indirect effect is statistically different from zero, as revealed by a 95% BC bootstrap confidence interval that is entirely above zero (.593 to 1.00). Thus, hypothesis 2, i.e. that the relationship between personalization and click-through intentions is positively mediated by perceived ad relevance, is supported.
The effect of personalization on perceived privacy violation a2 (1.046) is statistically different from zero, t = 10.516, p < .001, with a 95% confidence interval
34
from .850 to 1.242. This means that hypothesis 3a, proposing that there is a positive relationship between personalization and perceived privacy violation, is supported. The effect b2 = -.157 indicates that two individuals who experience the same level of personalization but differ by one unit in their level of perceived privacy violation are estimated to differ by -.157 units in click-through intentions (those relatively higher in perceived privacy violation are estimated to be lower in click-through intentions). This effect is statistically different from zero, t = -2.004, p = .046, with a 95% confidence interval from -.312 to -.003. Thus, hypothesis 3b is supported, indicating that there is a positive relationship between perceived privacy violation and click-through intentions. The indirect effect of -.165 means that two individuals who differ by one in personalization condition are estimated to differ by -.165 in click-through intentions as a result of perceiving the more personalized ad as a higher violation of their privacy. This indirect effect is statistically different from zero, as revealed by a 95% BC bootstrap confidence interval that is entirely below zero (-.339 to -.007). Thus, hypothesis 3, i.e. that the relationship between personalization and click-through intentions is mediated by perceived privacy violation, is supported.
Moderated mediation
Next, it was tested if the indirect effect of personalization on click-through intentions through perceived privacy violation depends on the before and after GDPR scenarios (due to an increase in privacy control) by using Model 7 of the PROCESS macro (Hayes, 2017). However, the results indicate that this interaction effect does not take place (β = 0.628, p = 0.756). See Figure 4 for a visualization of the effects.
Table 2
Mediation Effects Perceived Privacy Violation and Perceived Ad Relevance
Consequent
Perceived Ad Relevance (M) Perceived Privacy Violation (M) Click-Through Intentions (Y)
Antecedent Coeff. SE p Coeff. SE p Coeff. SE p
Personalization (X) a1 iM1 1.431 - - -.021 -.013 -.256 -.024 .219 1.429 .11 - - .18 .01 .22 .08 .08 .75 < .001 - - .907 .149 .250 .765 < .01 .058 a2 iM2 1.046 - - .348 .020 .411 .637 -.184 -1.695 .10 - - .16 .01 .20 .07 .08 .69 < .001 - - .033 .011 .044 < .001 .017 .014 c1’ b1 b2 iY .105 .553 -.157 .447 -.003 -.071 -.133 .201 .464 .18 .07 .08 .20 .01 .25 .10 .09 .86 .568 < .001 .046 .027 .803 .779 .199 .038 .589 Perceived Ad Relevance (M) Perceived Privacy Violation (M) Control Variables: Gender Age Nationality General Privacy Concerns Brand Attitude constant R2 = .435 F(6,246) = 31.5547, p<.001 R2 = .480 F(6,246) = 37.857, p<.001 R2 = .366 F(8,244) = 17.6215, p<.001
Effect SE p LLCI ULCI
Direct effect c1’ .105 .18 .568 -.256 .466
Total effect c1 .731 .14 <.001 .462 1.00
Boot SE Boot LLCI Boot ULCI
Indirect effects a1b1 .791 .105 .593 1.002 a2b2 -.165 .085 -.339 -.007 a1b1 + a2b2 .627 .137 .353 .891 Figure 4. Coefficients of the effects of personalized advertising on click-through intention through perceived ad relevance, perceived privacy violation and perceived privacy control.
Note: N = 253. * p < .05 ** p < .01 *** p < .001 (two-tailed).
5. Discussion
In this chapter the most evident findings of this study are discussed by linking the results to the theory and answering the research question: How do perceived ad relevance and perceived privacy violation mediate the relationship between personalization and click-through intentions, and how does perceived privacy control in turn moderate the mediation effect of perceived privacy violation? Furthermore, besides theoretical implications also managerial implications are presented. Finally, the limitations of this study and suggestions for future research are given.
5.1 Theoretical Implications
In line with other studies of Postma and Brokke (2002), Tam and Ho (2005), Kalyanaraman and Sundar (2006), Aguirre et al. (2015), and De Keyzer et al. (2015), results show that personalized ads are more effective than non-personalized ads in terms of click-through intentions. However, between the moderate and high personalization conditions (personalized ads based on previous online buying behaviour and ads based on information retrieved from private chat messages), no significant difference in perceived personalization, click-through intentions and perceived ad relevance was found, even though a significant difference did show for the perception that privacy had been violated. This indicates that the manipulation was not completely successful, because the distinction between the moderate and high personalization conditions was focused on privacy instead of personalization. This could have been avoided by a sufficient pre-test, which was omitted due to time constraints. A suggestion for future research would be to look at targeting based on preferences or likes on Facebook (in this scenario for example liking a travel page) as the option in
37
between the no personalization and full personalization condition, as described in the personalization continuum of De Keyzer et al. (2015).
An important outcome of this research concerns the personalization trade-off that is at base of the click-through decision, which answers the first part of the research question. The relationship between personalization and click-through intentions was positively mediated by ad relevance, indicating that because consumers perceive advertisements that are personalized as more useful and relevant to their situations, they are more likely to click on it. This finding was also in line with previous findings of Tam and Ho (2005) and De Keyzer et al. (2015). However, while consumers’ perceived relevance of personalized ads positively affects their intention to click on it, as expected this intention was at the same time negatively affected by the corresponding perception of privacy violation (Aguirre et al., 2015; Chellappa & Sin, 2005; Edwards et al., 2002; Tucker, 2014; White et al., 2008). In absolute terms relevance was almost five times (.79 vs. -.17) more influential than privacy violation in determining clicking on an ad. Moreover, no direct effect was found between personalization and click-through intentions, which indicates that the relationship was fully mediated by perceived ad relevance and privacy violation. These results were somewhat in line with Chellappa and Sin (2005) who found that the consumers’ value for personalization is almost two times (.59 vs. -.34) more influential than the consumers’ concern for privacy in determining usage of personalization services. However, in their research they made no distinction between personalization of websites for browsing and purchasing versus personalization based on individual specific information. Therefore the current study contributes to the academic literature by confirming the personalization trade-off in an advertising context.
38
Another relevant and novel finding concerns the potential effect of the GDPR. Based on the results a (small) increase in perceived privacy control could be expected when the regulation becomes enforceable. However, even after this increase, perceived privacy control remains relatively small. One possible explanation for this is that individuals might be sceptical about the practical implications of the regulation. As one of the participants stated in the comments: “Even with the new regulation I don’t believe that it will be clear for what exactly I give permission. Won’t it just be illegible long terms and conditions again?”
Finally, the moderated mediation effect of perceived privacy control in the scenarios before and after the GDPR was not significant. Based on these results it can therefore not be concluded that increasing privacy control can decrease perceived privacy violation and by that affect click-through intentions. These outcomes are not as expected and contradicting to results of Van Dyke et al. (2007) and Tucker (2014), who showed that an increase in privacy control had a significant negative effect on the level of privacy concerns. One possible explanation could be that in the experiment of Van Dyke et al. (2007) participants had visited the web shop they used for the basis of their response before, and as discussed by Mcknight, Kacmar, and Choudhury (2004) the relationships between factors affecting trust might be different for first time visitors or buyers (or in this case individuals who had previously clicked on ads of Lonely Planet). Furthermore, the research by Tucker (2014) was conducted by means of a non-profit campaign. Therefore, the results could indicate that the effects do not hold in a commercial setting. Moreover, as mentioned earlier, the change in perceived privacy control before and after the GDPR was relatively small and no significant differences
39
were found between the moderate and high personalization conditions, which might also have influenced the results.
5.2 Managerial Implications
In addition to theoretical contributions, this study also bears practical implications. Personalized advertising leads to more positive consumer responses than non-personalized advertising. This is mainly because personalized ads are perceived as more relevant. When an ad is perceived as personally relevant, click intentions will improve. Even when the way in which personal data is collected (such as through personal chat messages) might strengthen the perception that privacy has been violated, this is much less influential in the clicking decision. It is therefore suggested that managers should personalize their advertisements and focus on being relevant to their target audience if they wish to improve effectiveness of their campaigns. It is however important that consumers also recognize personalized advertisements as personalized (De Keyzer et al., 2015). In some cases personalization and perceived personalization do not correspond. For example even when individuals are randomly exposed to an ad, they might perceive it as customized to their situation. This might change with the GDPR, as individuals then have to right to see the information that firms have collected about them and have to give permission on how this information is used. Based on the results of this study, the GDPR will also make individuals feel slightly more in control about their privacy, but this will not change their click-through intentions. This is something that managers can keep in mind when adjusting their marketing strategies to the new regulation.
40
5.3 Limitations and Future Research
One limitation of this study is the experimental context in which the predictions are tested because of limitation in access to actual click-through rates of personalized advertisements. Although the scenarios resemble reality, actual consumer behaviour could differ in terms of clicking on advertisements from the intent to do so. Therefore a field experiment with actual advertisements would be a suggestion for future research. Another limitation stems from the sampling method, which for example has resulted in a relatively large amount of highly educated respondents. Although non-probability convenience sampling allows for the collection of a larger amount of data in a short timeframe, a limitation is that it reduces the generalizability of the data.
Surprisingly, the amount of individuals that answered the control question wrongly was significantly higher in the non-personalization condition, which indicates that participants might not have ‘believed’ that the advertisement was truly random instead of targeted. One possible explanation could be that people nowadays are so used to personalized advertisements that they automatically assume that this is the case when they see an ad on their timeline. Another possible explanation is that the description of the GDPR about the usage of personal information in the previous question could have influenced the answers. However, in order to measure the possible moderation effect of perceived privacy control this text and question had to be showed first. In future research a field experiment with actual advertisements could prevent this issue.
Another suggestion for future research is to look at different levels of information sensitivity. As one of the participants stated in the comments, perceived privacy violation can depend on the type of information that is used: “For me it would strongly
