Generation Y and Internet Privacy

Privacy in India: Attitudes and Awareness V 2.0

The Quest for Information Privacy in Africa: A Review Essay

BackgroundHospital apps are increasingly being adopted in many countries, especially since the start of the COVID-19 pandemic. Web-based hospitals can provide valuable medical services and enhanced accessibility. However, increasing concerns about personal information (PI) and strict legal compliance requirements necessitate privacy assessments for these platforms. Guided by the theory of contextual integrity, this study investigates the regulatory compliance of privacy policies for internet hospital apps in the mainland of China.ObjectiveIn this paper, we aim to evaluate the regulatory compliance of privacy policies of internet hospital apps in the mainland of China and offer recommendations for improvement.MethodsWe obtained 59 internet hospital apps on November 7, 2023, and reviewed 52 privacy policies available between November 8 and 23, 2023. We developed a 3-level indicator scale based on the information processing activities, as stipulated in relevant regulations. The scale comprised 7 level-1 indicators, 26 level-2 indicators, and 70 level-3 indicators.ResultsThe mean compliance score of the 52 assessed apps was 73/100 (SD 22.4%), revealing a varied spectrum of compliance. Sensitive PI protection compliance (mean 73.9%, SD 24.2%) lagged behind general PI protection (mean 90.4%, SD 14.7%), with only 12 apps requiring separate consent for processing sensitive PI (mean 73.9%, SD 24.2%). Although most apps (n=41, 79%) committed to supervising subcontractors, only a quarter (n=13, 25%) required users’ explicit consent for subcontracting activities. Concerning PI storage security (mean 71.2%, SD 29.3%) and incident management (mean 71.8%, SD 36.6%), half of the assessed apps (n=27, 52%) committed to bear corresponding legal responsibility, whereas fewer than half (n=24, 46%) specified the security level obtained. Most privacy policies stated the PI retention period (n=40, 77%) and instances of PI deletion or anonymization (n=41, 79%), but fewer (n=20, 38.5%) committed to prompt third-party PI deletion. Most apps delineated various individual rights, but only a fraction addressed the rights to obtain copies (n=22, 42%) or to refuse advertisement based on automated decision-making (n=13, 25%). Significant deficiencies remained in regular compliance audits (mean 11.5%, SD 37.8%), impact assessments (mean 13.5%, SD 15.2%), and PI officer disclosure (mean 48.1%, SD 49.3%).ConclusionsOur analysis revealed both strengths and significant shortcomings in the compliance of internet hospital apps’ privacy policies with relevant regulations. As China continues to implement internet hospital apps, it should ensure the informed consent of users for PI processing activities, enhance compliance levels of relevant privacy policies, and fortify PI protection enforcement across the information processing stages.

BackgroundPulse oximeter apps became of interest to consumers during the COVID-19 pandemic, particularly when traditional over-the-counter pulse oximeter devices were in short supply. Yet, no study to date has examined or scoped the state of privacy policies and notices for the top-rated and most downloaded pulse oximeter apps during COVID-19.ObjectiveThe aim of this study was to examine, through a high-level qualitative assessment, the state and nature of privacy policies for the downloaded and top-rated pulse oximeter apps during the COVID-19 pandemic to (1) compare findings against comparable research involving other mobile health (mHealth) apps and (2) begin discussions on opportunities for future research or investigation.MethodsDuring August-October 2020, privacy policies were reviewed for pulse oximeter apps that had either at least 500 downloads (Google Play Store apps only) or a three out of five-star rating (Apple Store apps only). In addition to determining if the apps had an accessible privacy policy, other key privacy policy–related details that were extracted included, but were not limited to, app developer location (country); whether the app was free or required paid use/subscription; whether an ads disclosure was provided on the app’s site; the scope of personal data collected; proportionality, fundamental rights, and data protection and privacy issues; and privacy safeguards.ResultsSix pulse oximeter apps met the inclusion criteria and only 33% (n=2) of the six apps had an accessible privacy policy that was specific to the pulse oximeter app feature (vs the app developer’s website or at all). Variation was found in both the regulatory nature and data privacy protections offered by pulse oximeter apps, with notable privacy protection limitations and gaps, although each app provided at least some information about the scope of personal data collected upon installing the app.ConclusionsPulse oximeter app developers should invest in offering stronger privacy protections for their app users, and should provide more accessible and transparent privacy policies. This is a necessary first step to ensure that the data privacy of mHealth consumers is not exploited during public health emergency situations such as the COVID-19 pandemic, where over-the-counter personal health monitoring devices could be in short supply and patients and consumers may, as a result, turn to mHealth apps to fill such supply gaps. Future research considerations and recommendations are also suggested for mHealth technology and privacy researchers who are interested in examining privacy implications associated with the use of pulse oximeter apps during and after the COVID-19 pandemic.

Personal health care and medical treatment information are both personal information which can be used as a sign to identify each individual. Such information shall be under the control of the owner. The comprehensiveness of personal health care and medical treatment information makes it more valuable than the simplex personal information. The controlling right of personal health care and medical treatment information is irretrievable once deprived. The rights of controlling, managing and using regarding personal health care and medical treatment information can be separated appropriately. The right of privacy is an independent personality right. For the protection of public interests, the right of personal privacy shall be appropriately limited. Meanwhile, the government shall be responsible for the protection of personal health care and medical treatment information.

최근 미국은 트럼프 행정부의 시작과 더불어 종래 오바마 정부의 개인정보 보호정책과 궤를 완전히 달리하여 개인정보 보호보다는 기업친화적인 정보활용에 중점을 두는 방식으로 전환하였다. 따라서 Opt-out을 기조로 하여 개인정보의 보호를 크게 의식하지 않고 무역을 희망하는 미국과 Opt-in을 기조로 하는 유럽지역 국가들 간에는 당연히 마찰이 증가하게 되었으며 이러한 상황은 유럽과 같은 개인정보 보호방식을 따르고 있는 우리나라에도 영향을 미쳐, 미국 기업에게 동일한 수준의 개인정보 보호요청을 강요하는 경우 무역 분쟁이 발생할 소지가 커졌다. 이와 같은 상황에서 유럽과 미국의 개인정보 보호제도의 핵심적인 차이를 파악하고 최근 미국 행정부의 개인정보 보호법제의 변화와 동향을 파악하는 것은 매우 의미 있는 일이라고 할 수 있다. 따라서 이러한 목적 하에 본 논문은 미국의 개인정보 보호법제 제·개정 연혁 및 최근 동향을 분석하였다. 먼저 미국에서도 개인정보 보호법제는 변화를 겪었으므로, 연대기 순으로 정보보호 법제의 흐름을 살펴볼 필요가 있다. 특히 행태정보의 수집·활용 및 규제에 관한 측면을 먼저 검토하고, 오바마 행정부의 소비자 프라이버시 권리장전(2012), FTC의 Protecting Privacy in an Era of Rapid Changing(2012), FCC의 ISP privacy rule(2016) 등 미국의 개인정보 보호관련 법제의 흐름과 최근 동향을 살펴보았다. 그리고 2017년 4월 3일 트럼프 대통령이 FCC 프라이버시규칙을 폐기하는 법안에 서명함에 따라, 미국 내 개인정보보호에 대한 심각한 우려가 발생하게 되었다. 인터넷서비스사업자들에 대한 개인정보 규제 완화로 개인정보 활용 산업의 발전이 기대되는 한편, 개인정보의 무분별한 사용과 프라이버시 침해에 대한 우려도 확산되었다. 따라서 트럼프 행정부의 개인정보 보호 정책의 방향을 분석하여 우리에게 필요한 시사점을 얻기 위하여, 생체정보, 빅데이터, 사물인터넷 등 신기술 관련 미국의 데이터 활용 및 개인정보 보호정책과 EU GDPR 발효에 따른 제약과 이에 대응한 미국 정부, 기업의 대응노력 등을 분석하면서, 제4차 산업혁명의 시기에 개인정보의 보호와 활용을 균형 있고 조화롭게 양립하기 위한 논의가 필요하다는 점을 강조하였다.With the start of the Trump administration, the U.S. recently shifted its focus to business-friendly use of information rather than privacy protection, completely different from the previous Obama administration s privacy policy. Thus, friction between the U.S. and the European countries that want to trade with the U.S. without much awareness of the protection of personal information under the Opt-out stance has naturally increased. Such differences have also affected Korea, and Korea, which is following the Private Privacy Act such as Europe, has increased the possibility of a trade dispute if it forces U.S. companies to ask for the same level Against this backdrop, it is very meaningful to identify the key differences in the privacy protections of Europe and the U.S. and to identify recent changes in the U.S. administration s privacy laws. Therefore, for this purpose, this paper analyzed the years and recent trends of the personal information protection Act of the U.S.. First of all, since the privacy laws have undergone changes in the U.S., we need to look at the trend of the information protection laws in chronological order. In particular, This article first reviewed aspects of the collection, utilization and regulation of behavioral information, and recently reviewed the trends in U.S. privacy laws, including the Obama administration s Consumer Privacy Bill (2012), the FTC s Protecting Privacy in an Era of Rapid Change (2012), and the FCC s ISP Privacy Rule (2016). And as President Trump signed a bill to scrap FCC privacy rules on April 3, 2017, serious concerns arose over privacy in the U.S.. While the development of the personal information utilization industry was expected due to the easing of regulations on personal information for Internet service providers, concerns over the reckless use of personal information and the violation of privacy were also spread. Thus, in order to obtain the necessary implications for Korea by analyzing the direction of the Trump administration s privacy policy, the U.S. data utilization and privacy policy related to new technologies such as biometric information, big data, and the Internet of Things, and the restrictions imposed by the EU GDPR, the U.S. government and corporate efforts to respond to them, stressing the need for a balanced and balanced discussion on the protection and utilization of personal information during the fourth industrial revolution.

Online platforms process personal data through privacy policies while pledging to protect users' personal information. Although derived from traditional privacy concepts, privacy policies differ significantly in nature-personal information protection carries stronger public law attributes, rendering privacy policies primarily compliance instruments that should integrate both self-regulation and government regulation approaches. With the rapid expansion of platforms' private power, privacy policies, despite their enhanced role, have exhibited alienating effects: failures in self-regulation, erosion of user rights, and circumvention of governmental oversight. To address these issues, a meta-regulatory approach is imperative, requiring tripartite collaboration among platforms, users, and regulatory authorities to refine privacy policy frameworks.

BackgroundCOVID-19 digital contact-tracing apps were created to assist public health authorities in curbing the pandemic. These apps require users’ permission to access specific functions on their mobile phones, such as geolocation, Bluetooth or Wi-Fi connections, or personal data, to work correctly. As these functions have privacy repercussions, it is essential to establish how contact-tracing apps respect users’ privacy.ObjectiveThis study aimed to systematically map existing contact-tracing apps and evaluate the permissions required and their privacy policies. Specifically, we evaluated the type of permissions, the privacy policies’ readability, and the information included in them.MethodsWe used custom Google searches and existing lists of contact-tracing apps to identify potentially eligible apps between May 2020 and November 2021. We included contact-tracing or exposure notification apps with a Google Play webpage from which we extracted app characteristics (eg, sponsor, number of installs, and ratings). We used Exodus Privacy to systematically extract the number of permissions and classify them as dangerous or normal. We computed a Permission Accumulated Risk Score representing the threat level to the user’s privacy. We assessed the privacy policies’ readability and evaluated their content using a 13-item checklist, which generated a Privacy Transparency Index. We explored the relationships between app characteristics, Permission Accumulated Risk Score, and Privacy Transparency Index using correlations, chi-square tests, or ANOVAs.ResultsWe identified 180 contact-tracing apps across 152 countries, states, or territories. We included 85.6% (154/180) of apps with a working Google Play page, most of which (132/154, 85.7%) had a privacy policy document. Most apps were developed by governments (116/154, 75.3%) and totaled 264.5 million installs. The average rating on Google Play was 3.5 (SD 0.7). Across the 154 apps, we identified 94 unique permissions, 18% (17/94) of which were dangerous, and 30 trackers. The average Permission Accumulated Risk Score was 22.7 (SD 17.7; range 4-74, median 16) and the average Privacy Transparency Index was 55.8 (SD 21.7; range 5-95, median 55). Overall, the privacy documents were difficult to read (median grade level 12, range 7-23); 67% (88/132) of these mentioned that the apps collected personal identifiers. The Permission Accumulated Risk Score was negatively associated with the average App Store ratings (r=−0.20; P=.03; 120/154, 77.9%) and Privacy Transparency Index (r=−0.25; P<.001; 132/154, 85.7%), suggesting that the higher the risk to one’s data, the lower the apps’ ratings and transparency index.ConclusionsMany contact-tracing apps were developed covering most of the planet but with a relatively low number of installs. Privacy-preserving apps scored high in transparency and App Store ratings, suggesting that some users appreciate these apps. Nevertheless, privacy policy documents were difficult to read for an average audience. Therefore, we recommend following privacy-preserving and transparency principles to improve contact-tracing uptake while making privacy documents more readable for a wider public.

Do Companies' Online Privacy Policy Disclosures Match Customer Needs?

The Privacy Journal (2003), a print newsletter and Web site devoted to privacy matters, defines the present-day use of the word privacy as “the right of individuals to control the collection and use of personal information about themselves.” Similar definitions are provided by law specialists (Gavison, 1980; Warren &amp; Brandies, 1890). The networked society changes the way in which privacy rights are defined, used and interpreted, because: a. The IT-enabled channels of communication change the rules of personal and commercial interaction; b. The participation in the networked society implies a diminishing of individual privacy rights. The fundamental principle of the networked society is information sharing and processing (Kling &amp; Allen, 1996). Advances in computing technology—that represents the infrastructure of the networked society—make possible to collect, store, analyze, and retrieve personal information created in the process of participation. The manifestation and the protection of individual privacy rights represent the field of conflict between various disciplines and social events. The heterogeneous nature of this phenomenon is mirrored in this paper, which aims to present the complex nature of privacy rights in the context of the networked society. The study proposes a negotiating model of online privacy rights, and analyses the necessary conditions for the implementation of this model on the Internet. The new economy is redefined on the basis of information entrepreneurism (Kling &amp; Allen, 1996; Zwick &amp; Dholakia, 1999). This cultural paradigm emphasizes the use of data-intensive analysis techniques for designing and implementing effective marketing and management strategies. This has as a direct consequence the use of an information superpanopticon–a concept derived from Foucault’s panopticon, a system of perfect surveillance and control. Online privacy is a major concern for Internet users (Ackerman, Cranor, &amp; Reagle, 1999). For the individual Internet user, the privacy threats fall into two main categories: a. Web tracking devices that collect information about the online behavior of the user (e.g., cookies); b. The misuse of the personal information provided by the online user in exchange of specific benefits: increased personalization, Web group membership, etc. The databases, intelligent agents and tracking devices are surrounding the Internet users with a Web of surveillance, which is often hidden and unknown to the users. The surveillance is initiated by the simple act of presence on the Internet. Specialized software applications, such as cookies are tracking the online behavior of Internet users, feeding the data into databases, which create and permanently update a profile of online consumers. These profiles are then used for segmenting the market and targeting the most profitable consumers. A company can use cookies for various valid reasons: security, personalization, marketing, customer service, etc., however, there is an important distinction between cookies, which are active only within a specific Web site, and the ones that can track the user’s activity across unrelated Web sites. Recently, some aggregator networks have deployed hidden ‘pixel beacon’ technology that allows ad-serving companies to connect unrelated sites and overcome the site-specific nature of traditional cookies (Mabley, 2000). Additionally, some companies are now connecting this aggregated data with offline demographic and credit card data. Eventually, these resulting databases can be used or sold as powerful marketing tools. Exercising control of information, after it was voluntarily released, presents another critical problem. The misuse of personal information covers many possible aspects, which can be defined as any use which is not explicitly defined in the company’s privacy disclaimer, or which is not approved by the informed customer. For example, in 2000, Toysurus.com was subject to intense debate and controversy, when it was discovered that shoppers’ personal information was transferred through an unmarked Internet channel to a data processing firm, for analysis and aggregation. This operation was not disclosed in the company’s privacy disclaimer, and therefore, online customers were not aware of it. Regulators and legislators have addressed the controversial privacy issue quite differently across the world (Nakra, 2001). The USA, the largest world’s financial and Internet market, has not yet adopted a national, standard-setting privacy law (Jarvis, 2001). U.S. privacy statutes have primarily focused so far on protecting consumers’ financial data, health information, and children’s personal information (Desai, Richards, &amp; Desai, 2003; Frye, 2001). In comparison with the American official opinion that online privacy protection is a matter of voluntary self-regulation by market-driven companies, the Europeans consider that it is more effective to enforce specific legislation regarding this issue. The current European approach is based on three basic tenets: 1. Individuals have the right to access any data relating to them and have it kept accurate and up-to-date; 2. Data cannot be retained for longer than the purpose for which it was obtained, nor used or disclosed “in a matter incompatible with that purpose”, and must be kept only for “lawful purposes”; 3. Those who control data have “a special duty of care” in relation to the individuals whose data they keep. Data commissioners oversee these rights in each European country and require most “data controllers”—people who handle data—to register with them to track what information is being collected and where. They are charged also with investigating all complaints from citizens. These principles have been incorporated in the European Data Directive, which came into effect in 1998, and more recently, in the European Directive on Privacy and Electronic Communications, adopted in 2002. Despite these legislative efforts, it is not yet clear how effective are the measures implemented by EU States. The direct involvement of governmental institutions can be considered as a form of censorship that can undermine the freedom and the flexibility of the Internet domain.

This research paper investigates Saudi users’ awareness levels about privacy policies in Social Networking Sites (SNSs), their privacy concerns and their privacy protection measures. For this purpose, a research model that consists of five main constructs namely information privacy concern, awareness level of privacy policies of social networking sites, perceived vulnerability to privacy risks, perceived response efficacy, and privacy protecting behavior was developed. An online survey questionnaire was used to collect responses from a sample of (108) Saudi SNSs users. The study found that Saudi users of social networking sites are concerned about their information privacy, but they do not have enough awareness of the importance of privacy protecting behaviors to safeguard their privacy online. The research results also showed that there is a lack of awareness of privacy policies of Social networking sites among Saudi users. Testing hypothesis results using the Structural Equation Modeling (SEM) showed that information privacy concern positively affects privacy protection behaviors in SNSs and perceived vulnerability to privacy risks positively affects information privacy concern.

The rapid growth of the Internet has been accompanied by a proliferation of e-services targeting consumers. E-services are available for banking, shopping, learning, government online, and healthcare. However, each of these services requires a consumer’s personally identifiable information (PII) in one form or another. This leads to concerns over privacy. In order for e-services to be successful, privacy must be protected (Ackerman, Cranor, &amp; Reagle, 1999). An effective and flexible way of handling privacy is management via privacy policies. In this approach, a consumer of an e-service has a personal privacy policy that describes what private information the consumer is willing to give up to the e-service, with which parties the provider of the e-service may share the private information, and how long the private information may be kept by the provider. The provider likewise has a provider privacy policy describing similar privacy constraints as in the consumer’s policy, but from the viewpoint of the provider, (i.e., the nature of the private information and the disclosure/retention requirements that are needed by the e-service). Before the consumer engages the e-service, the provider’s privacy policy must match with the consumer’s privacy policy. In this way, the consumer’s privacy is protected, assuming that the provider complies with the consumer’s privacy policy. Note that policy compliance is outside the scope of this work but see Yee and Korba (July, 2004). Initial attempts at conserving consumer privacy for e-services over the last few years have focused on the use of Web site privacy policies that state the privacy rules or preferences of the Web site or service provider. Some of these policies are merely statements in plain English and it is up to the consumer to read it. This has the drawback that very few consumers take the trouble to read it. Even when they do take the time to look at it, online privacy policies have been far too complicated for consumers to understand and suffer from other deficiencies (Lichtenstein, Swatman, &amp; Babu, 2003; Jensen &amp; Potts, 2004). Still other privacy policies are specified using P3P (W3C) that allows a consumer’s browser to automatically check the privacy policy via a browser plug-in. This, of course, is better than plain English policies but a major drawback is that it is a “take-it-or-leave-it” approach. There is no recourse for the consumer who has a conflict with the Web site’s P3P policy, except to try another Web site. In this case, we have advocated a negotiations approach to resolve the conflict (Yee &amp; Korba, Jan., May, 2003). However, this requires a machine-processable personal privacy policy for the consumer. We assume that providers in general have sufficient resources to generate their privacy policies. Certainly, the literature is full of works relating to enterprise privacy policies and models (e.g., Barth &amp; Mitchell, 2005; Karjoth &amp; Schunter 2002). Consumers, on the other hand, need help in formulating machine-processable privacy policies. In addition, the creation of such policies needs to be as easy as possible or consumers would simply avoid using them. Existing privacy specification languages such as P3P, APPEL (W3C; W3C, 2002), and EPAL (IBM) are far too complicated for the average internet user to understand. Understanding or changing a privacy policy expressed in these languages effectively requires knowing how to program. Moreover, most of these languages suffer from inadequate expressiveness (Stufflebeam, Anton, He, &amp; Jain, 2004). What is needed is an easy, semi-automated way of seeding a personal privacy policy with a consumer’s privacy preferences. In this work, we present two semi-automated approaches for obtaining consumer personal privacy policies for e-services through seeding. This article is based on our work in Yee and Korba (2004). The section “Background” examines related work and the content of personal privacy policies. The section “Semi-Automated Seeding of Personal Privacy Policies” shows how personal privacy policies can be semi-automatically seeded or generated. The section “Future Trends” identifies some of the developments we see in this area over the next few years. We end with ”Conclusion”.

Log in or Register Subscribe to journalSubscribe Get new issue alertsGet alerts Enter your Email address: Wolters Kluwer Health may email you for journal alerts and information, but is committed to maintaining your privacy and will not share your personal information without your express consent. For more information, please refer to our Privacy Policy. Subscribe to eTOC Secondary Logo Journal Logo All Articles Images Videos Podcasts Blogs Advanced Search Toggle navigation Subscribe Register Login Articles & Issues Current IssueArchivesePub Ahead-of-Print Collections Acute/Critical CareContinuing EducationCOVID-19 Disaster and Emergency PreparednessEnvironmental Health and IssuesEthics Evidence-Based Practice, Step by StepFamily CaregiversGeriatric NursingHolistic NursingIn The CommunityInfectious DiseaseInternational TopicsLegal ClinicMental HealthNurse WellbeingNursing Research, Step By StepNursing ResourcesPalliative CarePatient SafetyPolicy and PoliticsProfessional Development, Leadership and ScholarshipProfessional Partners Supporting Diverse Family Caregivers Across SettingsQI: Quality ImprovementResearchSocial Media and Information TechnologySpecial SupplementsStrip SavvySupporting Family Caregivers: No Longer Home AloneSystematic Reviews Step by StepTeaching For PracticeTransforming Care at the Bedside (TCAB)Uniforms (Nursing)Uniting States, Sharing StrategiesWomen's HealthWriting Resources Videos Videos WebinarsFor Authors Call for ManuscriptsSubmit a ManuscriptInformation for AuthorsLanguage Editing ServicesAuthor Permissions Journal Info About the JournalAdvertising and BusinessAward WinnersBook of the Year AwardsContact InfoEditorial BoardInformation for FacultyInformation for MediaInformation for Peer ReviewersLetters to the EditorNurse Faculty Scholars / AJN Mentored Writing AwardOpen AccessReprintsRights and PermissionsSubscription ServicesNurses: Submit Your Photos! All Articles Images Videos Podcasts Blogs Advanced Search

The European Union's General Data Protection Regulation (GDPR) went into effect on May 25, 2018. Its privacy regulations apply to any service and company collecting or processing personal data in Europe. Many companies had to adjust their data handling processes, consent forms, and privacy policies to comply with the GDPR's transparency requirements. We monitored this rare event by analyzing the GDPR's impact on popular websites in all 28 member states of the European Union. For each country, we periodically examined its 500 most popular websites - 6,579 in total - for the presence of and updates to their privacy policy. While many websites already had privacy policies, we find that in some countries up to 15.7 % of websites added new privacy policies by May 25, 2018, resulting in 84.5 % of websites having privacy policies. 72.6 % of websites with existing privacy policies updated them close to the date. Most visibly, 62.1 % of websites in Europe now display cookie consent notices, 16 % more than in January 2018. These notices inform users about a site's cookie use and user tracking practices. We categorized all observed cookie consent notices and evaluated 16 common implementations with respect to their technical realization of cookie consent. Our analysis shows that core web security mechanisms such as the same-origin policy pose problems for the implementation of consent according to GDPR rules, and opting out of third-party cookies requires the third party to cooperate. Overall, we conclude that the GDPR is making the web more transparent, but there is still a lack of both functional and usable mechanisms for users to consent to or deny processing of their personal data on the Internet.

PurposePrivacy is a sensitive issue in business because it involves how a platform uses consumer personal data. In terms of consumer rights, personal information needs to be protected in the privacy policy (PP). This study describes several aspects of the PP that consumers need to pay attention to, especially points prone to misuse of personal information.Design/methodology/approachThis research used a taxonomy of consumer privacy concerns in e-commerce to reveal general and specific privacy concerns. The privacy calculus theory was also applied to explore consumer rationalization using (1) consumer knowledge about PP, (2) subjective perception, and (3) proximity to the PP features. Furthermore, the netnographic approach was used to combine the interrelation between technology and social construction. A sample of 378 young consumers in several major cities in Indonesia participated online and offline. Semi-structured interviews were also conducted to gain more in-depth comprehension.FindingsThe results showed that most young consumers have sufficient basic knowledge of the important points of PP. Furthermore, they tend not to read the PP because it is long and cumbersome, and therefore do not wish to expend much cognitive effort on it.Originality/valueThis study provides several results that can be utilized by policymakers or e-commerce companies to pay more attention to PPs for young groups. In addition, e-commerce companies can increase the knowledge of the privacy situation of Internet users in general.Peer reviewThe peer review history for this article is available at: https://publons.com/publon/10.1108/IJSE-11-2022-0740