Abstract
As children’s and teens’ internet use has reached record highs, the protection of their online privacy is a pressing issue for parents, consumer groups, social media firms, and federal, state, and international agencies. Even with strategies to help children protect their personal information, questions remain as to what children really know about the risks of interacting online. Thus far, much of the online privacy research has relied on subjective measures of adult beliefs and attitudes, which may not be predictive of children's online privacy behaviors. To address these issues, the authors develop and test a children's online privacy scale tapping different content domains of objective knowledge about online privacy for children and young teens (age 6–15 years). From this conceptualization, evidence is offered in two pretests and four studies supporting the scale's structure, reliability, and validity and its relationships with online privacy education, age categories, personality traits, intent to share personal information online, and online privacy behaviors. Implications for child and young teen online privacy policy are offered.
Worldwide, about one in three online users is a child under age 18 who uses computers or phones to search for information, complete schoolwork, watch videos, play games, and interact socially (Stalker et al. 2019). Children age 8–12 years in the United States currently spend approximately four to six hours a day online, with teens spending up to nine hours online (American Academy of Child & Adolescent Psychiatry 2020). Yet as LinkedIn's vice president and head of global privacy notes, “today's children are a generation being raised without protection,” and the senior counsel at Common Sense Media indicates that now is “a moment like no other in the past 10 to 20 years” for legislative change to better protect children's online privacy (Bryant 2021).
As a result, technology companies are facing increased accountability for children's privacy. Recent examples include Apple's delayed release of new features for child safety, Instagram's pause of its Instagram Kids project focusing on an application for children under age 13, and Facebook's internal research showing that some content may cause harm to children (Lalani 2021). Although existing research has considered consumer control and willingness to disclose information (Acquisti, John, and Loewenstein 2012; Tucker 2014), and whether individuals understand the privacy risks and trade-offs involved with online interactions (Beke et al. 2021; Martin, Borah, and Palmatier 2017), most privacy studies have not addressed children's online privacy.
Even with recent strategies and proposed legislation to help children protect their personal information, questions remain as to what children really know about the risks of interacting online. Examining what children know is important in order to empower them to protect themselves and/or design protective policies and strategies. Much privacy research to date has relied on subjective measures of an individual's beliefs about privacy, with some observing a “privacy paradox” in which individuals express concern about their privacy, yet they do not act to protect their own privacy in the same context (Blank, Bolsover, and Dubois 2014; Norberg, Horne, and Horne 2007; Trepte et al. 2015). Further, few studies have attempted to address children's and teens’ objective privacy knowledge/literacy (e.g., see work on privacy literacy education such as Andrews, Walker, and Kees [2020] and Desimpelaere, Hudders, and Van de Sompel [2020]). We address this gap by examining and measuring objective privacy knowledge/literacy of children and young teens as an important influence on online privacy intent and related behaviors.
Therefore, our primary research objective is to develop and validate a Children's Online Privacy Scale (COPS) tapping five content domains of objective knowledge/literacy about online privacy. Our research proceeds as follows. We first conceptualize the COPS on the basis of the importance of protecting online privacy for children and young teens and their online literacy and privacy knowledge. We then offer a framework with hypotheses for testing the validity of the COPS. This is followed by the procedures used to develop and validate (in terms of structure, internal consistency, and validity) the COPS with two pretests and four studies.
Conceptualizing Children's Online Privacy
Importance of Protecting Children's Personal Information Online
Many individuals struggle to protect their personal information online and often surrender to the convenience of technology, facing potential harm and uncertain long-term risk (Walker 2016). As noted in the Children's Online Privacy Protection Act (COPPA; 1998), the term “personal information” (also referred to as “personally identifiable information” or PII), means “individually identifiable information about an individual collected online.” This includes a first and last name; a home or other physical address including street name and name of a city or town; an email address; a telephone number; a social security number; any other identifier that permits the physical or online contacting of a specific individual, as determined by the Federal Trade Commission (FTC); or information concerning the child and/or the parents of that child that discloses the child's identity.
Although young children are found to be more tech-savvy than their parents (60 Minutes 2022; SWNS 2020), they still take risks online (White, Gummerum, and Hanoch 2015) and are often dependent on others for protection of their personal information (i.e., they are a vulnerable population). Thus, children's online privacy is an important issue for parents, consumer groups, privacy researchers, and companies as well as federal (FTC 2019a, b), state, and international agencies. As an example, the increasing “datafication” of children, or an organization's collection of information about children as they interact online, may shape their future opportunities as the data are used for education, career, insurance, and other screening purposes (Lupton and Williamson 2021).
Children's ability to consent to the exchange of information is a growing issue for regulation and policy (Livingstone, Stoilova, and Nandagiri 2019). This is demonstrated by attempts to update the COPPA and to expand protection and limit access to children's personal information (e.g., Protecting the Information of our Vulnerable Children and Youth Act, H.R. 4801 [2021]). Newly proposed legislation to protect children online involves extending protection to age 16 from age 12 and a ban on advertising without consent (e.g., Children and Teens’ Online Privacy Protection Act, S. 1628 [2022]). It also imposes responsibility for online platforms to act in the best interest of minors, as well as equipping parents and minors under age 16 with more safeguards (e.g., Kids Online Safety Act, S. 3663 [2022]).
In recent years, children’s and young teens’ online use has reached record highs (American Academy of Child & Adolescent Psychiatry 2020; Anderson and Jiang 2018). Although parents often claim they check what their teens and children do online (Anderson 2016), reviews of the most popular video websites (e.g., YouTube) indicate that child protection mechanisms are breaking down (Wendling 2017). Research shows that over half of parents with children between ages 5 and 11 indicate that their child uses a smartphone (Auxier et al. 2020), and the ability of parents and children to understand the complexity of the digital environment is becoming increasingly challenging (Livingstone, Stoilova, and Nandagiri 2019). Even devices intended to help parents monitor their children's online activities (e.g., smartwatches) are found to be a “privacy and security nightmare” (Greenberg 2020) and child/teen “workarounds” to get around protections are common (60 Minutes 2022). Some parents are even actively involved with public online oversharing of their children’s private content (Fox and Hoy 2019). Research also shows potential privacy issues with children's apps, noting that there may be a “financial incentive to ignore privacy violations” in these apps and that “limiting (data) collection efforts” may reduce revenue (Reyes et al. 2018, p. 77).
Other examples abound. YouTube's volunteer “Trusted Flaggers” report that for the 526 complaints made to YouTube's abuse page, only 15 responses were received from the service (Wendling 2017). The reports were made primarily against accounts that left objectionable comments (often sexually explicit) on videos made by young teens or children. The FTC and the New York attorney general levied a $170 million fine on YouTube for collecting personal information from children without their parents’ consent (FTC 2019a). That same year, the FTC fined Musical.ly (TikTok) $5.7 million for violating both COPPA and FTC rules by collecting PII from children without consent (FTC 2019c).
Musical.ly (TikTok) recently agreed to pay $92 million for collecting personal data without consent, mostly from minors, with some as young as age six (Allyn 2021). The data collection included the sharing of personal information with third parties, some of which were based in other countries. Other investigations have revealed how Musical.ly (TikTok) (Wall Street Journal 2021) and Meta (aka Facebook/Instagram) (Horowitz and Wells 2021) have used their algorithms to serve increasingly harmful content to children. One study showed that 20% of videos watched on YouTube by children age eight and younger contained ads deemed inappropriate for that age (i.e., violence, sex, or drugs/alcohol; Radesky et al. 2020). Live streaming platforms and apps with children's content (e.g., YouTube Gaming), which allow interactions between users, also face compliance issues with regard to the collection of personal information and potential COPPA violations. Since 2000, the FTC has filed almost 30 cases involving violations of COPPA (FTC 2020b).
Adding to the problem is the lack of children’s engagement in safe privacy behaviors. Only 61% of 10-to-18-year-olds have enabled privacy settings on their social network profiles; 52% do not turn off their location or GPS across apps, leaving their locations visible to strangers; and 14% have posted their home addresses online, a 27% increase from the previous year's results (McAfee 2014). Even with the FTC's Children's Online Privacy Protection Rule (2000), a study of online children's apps showed that more than 50% failed to protect data (Egelman 2017). The evolving technical aspects of online privacy and data protection complicate the practices of institutions and online service providers and attempts to update privacy laws protecting children. This continuous evolution also exacerbates potential privacy threats or risks, makes consistent strategy for individual privacy control challenging, and complicates efforts to educate children about privacy.
Online Literacy and Privacy Knowledge Among Children and Young Teens
Online literacy refers to “a variety of skills associated with using information and communication technologies to find, evaluate, create, and communicate information” (Clark and Visser 2011, p. 39). The focus of our research is on the skills and information aspects of this definition with respect to objective privacy knowledge/literacy of children and young teens. What children and young teens objectively know about online privacy may affect their sharing of information online and the associated risks of doing so (Walker 2016). For example, studies show that when children as young as age seven know the actual risks of sharing personal information online (objective knowledge), they become more diligent on websites and are more likely to deny requests for personal information or check with parents first before sharing information (Kennedy, Baig, and Chiasson 2017). Others also note that children's online objective knowledge plays an important role in understanding, managing, and safeguarding their privacy (Stoilova, Nandagiri, and Livingstone 2021). This includes placing restrictions on their information by using privacy settings, creating different email accounts, viewing online content with private mode(s), and so forth. Work by Brough and Kelly (2020) further emphasizes the importance of accounting for such factual/practical knowledge in assessing privacy actions.
From previous privacy literacy research (e.g., Blank, Bolsover, and Dubois 2014; Trepte et al. 2015), we conceptualize objective knowledge of online privacy as what children and young teens age 6 to 15 actually know across five privacy content domains identified by public policy and academic scholars (e.g., Children’s Online Privacy Protection Rule 2000; Trepte et al. 2015): (1) knowledge about practices of institutions and online service providers, (2) knowledge about technical aspects of online privacy and data protection, (3) knowledge about potential privacy threats and risks, (4) knowledge about basic laws/legal aspects of data protection in the United States, and (5) knowledge about strategies for individual privacy control. Our research develops and tests the COPS, which taps these five verifiable content domains.
Validity-Related Hypotheses
We conceptualize COPS in a broader nomological framework that offers testable hypotheses to establish the scale's validity (see Figure 1). We predict that (1) COPS scores are affected by cognitive defense conditions; (2) child and young teen age groups will show predicted differences in COPS scores; (3) COPS scores will be predictive of children’s and young teens’ intent to share personal information online and online privacy behaviors; and (4) COPS scores will offset (moderate) the effect of key personality traits and social media usage on intent to share personal information online. We expand on these key hypotheses (H1 through H4) as the article progresses.

Youth Objective Online Privacy Knowledge via COPS: Effects on Intent and Behaviors.
Cognitive Defense Conditions and COPS
We predict that objective privacy knowledge/literacy (COPS score) will be strengthened via cognitive defense conditions (i.e., quiz with feedback and educational video vs. a control nonexposure group; Figure 1). In comparison with those not exposed to a defense condition, children and teens viewing an online privacy quiz with feedback and an educational video about online safety (identical in content with the quiz) showed higher scores on agreement with online safety beliefs and less willingness to share a YouTube video watched (Andrews, Walker, and Kees 2020). This suggests that carefully developed online quizzes and educational videos providing important objective privacy safety information should be reflected in higher COPS scores. Thus, we predict that objective knowledge/literacy with regard to online privacy measured via the COPS will be stronger for those exposed to such educational efforts. Experimental support for such a prediction would offer causal evidence for the “known-group validity” of the COPS. In this type of validity, the understanding of a construct leads us to expect groups to differ with respect to mean scores on the construct's measure based on a theoretical premise (Cronbach and Meehl 1955), in this case educational interventions. We test this hypothesis in Study 1.
COPS and Child or Young Teen Age Groups
According to child cognitive development and information processing research, older children are likely to possess greater online privacy knowledge than younger children. Research suggests three stages of cognitive development for children to separate central and incidental material: limited (under age 8), cued (age 8–12), and strategic (over age 12) (Gregan-Paxton and Roedder John 1997; Roedder 1981). Brucks, Armstrong, and Goldberg (1988) suggest that children must reach the strategic processing stage (age 13) before they can generate spontaneous cognitive responses, whereas children age 8–12 may need a defense strategy cue or prompt to focus their attention and counterargue information that may be harmful. Andrews, Walker, and Kees (2020) show that older children/teens (age 13–15) had stronger online safety beliefs than other age groups. Thus, as further evidence of known-group validity, we predict that age groups will show mean-level differences in COPS scores, with the expectation that the older groups will exhibit higher COPS scores than the youngest group. We test this prediction in Studies 1 through 4.
COPS, Personality Traits, and Social Media Usage
In addition to a COPS → intent to share personal information online effect, we examine the COPS's ability to moderate the effect of three key antecedents of intent to share private information online: the personality traits of (1) needing to be popular and (2) thrill seeking; and (3) social media usage. First, in support of the predictive validity of the COPS, the greater the objective knowledge in a given domain, the more one is likely to perform positive within-domain behaviors or avoid negative ones in that domain (Alba and Hutchinson 2000). This premise has found support in several application areas, including nutrition (Andrews, Netemeyer, and Burton 2009), physical health (Waters et al. 2018), and personal finance (Ward and Lynch 2019). Thus, we expect COPS scores to be negatively related to intent to share private information online (tested in Studies 1 through 4). We also predict that COPS scores will be positively related to an index of “safe” online privacy behaviors (tested in Study 4).
With respect to children’s and young teens’ need to be popular, thrill seeking, and social media usage, several studies suggest that these antecedents can affect intent to share personal information online (Anderson and Jiang 2018; Fitzsimons and Moore 2008; FTC 2019a; Helsper and Smahel 2020; Livingstone, Stoilova, and Nandagiri 2021; Martin et al. 2013). However, their linear effects are not important for the purposes of our research. Rather, the ability of COPS scores to moderate their effects on intent to share personal information online is of interest.
An important element of construct validity is external validity, which includes the degree to which the construct may interact with key background factors (e.g., values, personality traits, behaviors) in affecting an outcome (Lynch 1999). Through an examination of interaction effects, the external validity of the COPS is enhanced by a more thorough understanding of how and when COPS scores might interact with such background factors operationalized as moderator variables (Cook and Campbell 1979). We expand on the reasoning for these moderated predictions in Studies 2 through 4.
Developing the COPS Measure
Our scale development procedures are summarized in Table 1. According to our prior review of the importance of online safety and children's privacy principles and domains (e.g., Children’s Online Privacy Protection Rule 2000; Trepte et al. 2015), we conducted an open-ended solicitation of thoughts from children and young teens to draft an initial pool of items to tap the five content domains of the COPS. Next, a group of experts on children’s and teens’ online privacy judged and trimmed this initial pool for further analyses. The COPS was then finalized in Studies 1 and 2 using item response theory (IRT) methods (Embretson and Hershberger 1999), and the scale's factor structure, reliability, and validity were assessed (DeVellis 2017; Netemeyer, Bearden, and Sharma 2003). In Studies 3 and 4, we further validated the COPS by assessing its ability to offset (moderate) the effects of children’s and young teens’ thrill-seeking tendency, need to be popular, and social media use on intent to share personal information online, and we connect the COPS to an index of online behaviors related to personal information sharing over a one-month period.
COPS Scale Development.
Notes: From scale development work by Drolet et al. (2021); see also Embretson and Hershberger (1999), DeVellis (2017), and Netemeyer, Bearden, and Sharma (2003).
COPS Item Generation and Initial Filtering: Pretest 1
We first generated an initial pool of items to tap the five content domains of children's online privacy knowledge in Pretest 1. All items were adapted or written for children/young teens age 6–15, and average grade-level readability scores were assessed (e.g., Flesch-Kincaid, Lexile: fourth grade). The items were based on our literature review, several sources of external information on children's online privacy (e.g., FTC 2020a), and an open-ended online survey of children for their thoughts regarding their online behavior and beliefs toward internet privacy. For the open-ended survey, we screened for child presence, age, parental or guardian consent, child/young teen assent, online usage, and reading ability. We surveyed 100 children/teens in Pretest 1, equally split across gender and the three age categories (6–7 years; 8–12 years; 13–15 years). The initial pool consisted of 50 online personal information privacy items, with 10 items for each of the five content domains identified.
Kantar Lightspeed, a vendor specializing in collecting research data with children, conducted the study with its online panel of parents with children and teens. Two trained independent coders matched the responses with thought categories to provide intercoder reliability (Ir) indices for each question. Following screener and consent questions, children were asked: “What are some of your favorite things that you do online?” Top response categories (in order) included “play video games,” “watch videos,” “social media,” “chat with friends,” and “listen to music” (agreement = .86, Ir = .85). Specific social media sites and apps visited included YouTube (general and YouTube Kids), Facebook, Instagram, Snapchat, TikTok, and game sites.
Sample questions then tapped the five content domains of children's online privacy objective knowledge/literacy. For knowledge about company privacy practices (Content Domain 1) and technical aspects of privacy (Content Domain 2), we asked: “What types of information do you think companies collect from children and teens?” Top response categories included age, address/location, likes/interests, online activity, names, and other personal information (agreement = .963, Ir = .962). To also assess these content domains, we asked: “What do you think companies do with the information they collect from children and teens?” Leading response categories included “to help sell/make new products,” “create targeted ads,” “sell the information,” “track you/your activity,” and “for rewards/gifts” (agreement = .966, Ir = .965). For Content Domain 3 (privacy threats/risks), we asked: “Are there any risks in providing personal information online?” The top response categories were “getting stalked/harassed,” “access to personal information,” “identity theft,” “getting hacked,” “bad people can find you,” and “too many ads” (agreement = .901, Ir = .896).
Content Domain 4 addressed basic knowledge of any privacy laws or regulations in the United States. The major response categories mentioned were “none/not sure,” “specific information collected,” and “yes—there are laws” (agreement = 1.00, Ir = 1.00), indicating a need for greater literacy in this domain (e.g., COPPA), especially for teens. Finally, Content Domain 5 addressed strategies for privacy control with the question “If you try to keep your information private while online, explain how you do this” (87% of respondents answered this question by first saying that they try to keep their personal information private). The leading response categories for privacy control were “not sharing personal information,” “changing privacy settings,” “using fake information/fake names,” “parental controls,” and “not talking to strangers” (agreement = .883, Ir = .875).
In general, children and young teens strongly agreed on a seven-point scale (1 = “not very important at all,” and 7 = “extremely important”) that it was important to keep their personal information private online (M = 6.01, SD = 1.28). Also, an attention check question asked respondents if they saw a picture of a nonrelevant character in any of the information presented, and 91% correctly indicated that they did not. At least 60% of the children/teens participants spent between 7 and 14 hours a week online. Finally, 75% of the children indicated that their parents restricted what they watched online. The 50 items were then reviewed by expert judges to further reduce the pool of items for the empirical studies that followed.
Ratings, Trimming of Items, and Content Validity: Pretest 2
To reduce the initial pool of 50 items to approximately 20 (i.e., four items for each of the five content domains) in Pretest 2 and help establish the items’ content validity in their respective domains, we asked 12 experts on children’s and teens’ online/social media habits and privacy issues to rate the items as “very representative,” “representative,” or “not representative” of each online privacy domain. The experts included five people with PhDs in marketing or information technology, one writing expert and nonprofit educator, and six young adults with online/social media expertise. Four nonredundant items with the top-rated scores in each of the five domains were retained for further testing in Studies 1 and 2. All items were multiple-choice questions with a “don’t know” option. In all analyses that follow, correct answers were scored as 1, and incorrect and “don’t know” answers were scored as 0.
Finalizing the COPS Items: Factor Structure and Reliability via Studies 1 and 2
Overview and procedures
Studies 1 and 2 were conducted to further reduce the number of items for a final COPS measure and to assess item characteristics via IRT, factor structure, and reliability methods. Study 1 sampled 150 children age 6 to 15, and Study 2 sampled 300 children age 6 to 15, relatively evenly split across age categories and gender. For Studies 1 and 2, we used professional online panel data providers to source the data and the same screeners as in the item generation stage. The professional panel companies ensured different respondents across pretests and studies. Both samples responded to the 20 COPS items retained from the expert ratings, as well as a number of potential outcomes, controls, and/or variables that might be moderated by COPS. We finalized the scale over numerous analysis iterations using data from Studies 1 and 2.
Given the objective nature of the COPS items (e.g., correct and incorrect or “don’t know” answers), we used a combination of IRT item analyses, factor analyses, and reliability testing to finalize the COPS (DeVellis 2017; Linacre 2020; Netemeyer, Bearden, and Sharma 2003). Several scholars suggest that using such a combination of IRT and classical test theory methods is advisable for developing and testing the psychometric properties of objective scales or measures (DeVellis 2017; Embretson and Hershberger 1999). Web Appendix A provides greater detail on all measures used in scale validation. Web Appendix B provides information on confirmatory factor structure or loadings for an initial 20-item COPS (Web Appendix B, Table W1) and the final 15-item COPS (Web Appendix B, Table W2) from our scale development process. The final 15-item COPS is shown in the Appendix.
IRT analyses
Across Studies 1 and 2 concurrently, we used a one-parameter logistic Rasch IRT model via the R statistical package to assess item fit and the overall scale goodness of fit for the original 20 items. We examined four measures of fit: (1) infit and outfit mean-square statistics, (2) point-measure correlations, (3) separation and discrimination indices, and (4) reliability scores. We deleted items that consistently showed poor values across Studies 1 and 2. This resulted in the 20 items being reduced to 15, with three items for each of the five content domains.
Across these 15 items, infit mean-square values ranged from .69 to 1.26 (M = .99) in Study 1 and from .82 to 1.32 (M = 1.00) in Study 2; outfit mean-square values ranged from .50 to 1.46 (M = 1.00) and from .48 to 1.62 (M = 1.00), respectively. These values fall within the acceptable range of fit (Linacre 2020). In terms of item point-measure correlations, observed values were all positive as desired, ranging from .29 to .69 in Study 1 and from .30 to .65 in Study 2, suggesting acceptable fit (Linacre 2020). We also calculated item separation indices and reliability scores. The former help infer how well a sample of individuals can separate the items, with higher values being better, and the latter function similarly to Cronbach's alpha. For Study 1, scores were 9.61 and .82 for item separation and reliability; for Study 2, scores were 10.01 and .81. The five items deleted from the IRT analysis showed lower correct response percentages (43.3%, 54.0%, 64.6%, 58.0%, and 51.3% in Study 1 and 43.3%, 51.3%, 54.3%, 58.0%, and 64.7% in Study 2), and the overall scale reliability score improved once those items were deleted.
Factor analyses
To examine the factor structure of the 15-item COPS, we took two approaches, again analyzing the data concurrently across Studies 1 and 2. We first conducted a principal components factor analysis. For Study 1, the 15 items produced three factors with eigenvalues of 5.68, 1.26, and 1.08, with the first factor explaining 38% of the variance, and a strong clear break in the scree plot after the first factor. Standardized factor loadings ranged from .41 to .81 (M = .58). For Study 2, the 15 items produced two factors with eigenvalues of 5.52 and 1.11, with the first factor explaining 37% of the variance, and a strong clear break in the scree plot after the first factor. Standardized factor loadings ranged from .36 to .72 (M = .58). Both results suggest the presence of a single underlying factor.
Next, we conducted a set of confirmatory factor analyses for categorical data using Mplus for both the initial 20-item COPS and the final 15-item COPS measure (Muthén and Muthén 2012). In Study 1 (see Web Appendix B, Table W1), the initial 20-item COPS for a single factor fit the data well (χ2 = 210.74, d.f. = 170, comparative fit index [CFI] = .97, Tucker–Lewis index [TLI] = .96, root mean square error of approximation [RMSEA] = .049), with standardized loadings ranging from .49 to .97 for retained items (t-values from 5.39 to 36.00, p < .001). A higher-order factor of one latent COPS construct with the five content domains (four items per content domain) as first-order factors also fit the data well (χ2 = 218.39, d.f. = 165, CFI = .97, TLI = .97, RMSEA = .046), with first-order factor loadings for the higher-order factor ranging from .88 to .98 (t-values from 11.83 to 29.85, p < .001). Similar to the IRT analysis, 5 of the 20 items were deleted due to lower and/or nonsignificant estimates (see Web Appendix B, notes to Tables W1 and W2).
For the final 15-item COPS in Study 1, a single factor fit the data well (χ2 = 138.47, d.f. = 90, CFI = .98, TLI = .97, RMSEA = .04), with standardized loadings ranging from .43 to .88 (t-values from 5.67 to 15.70). A higher-order factor of one latent COPS construct with the five content domains (three items per content domain) as first-order factors also fit the data well (χ2 = 105.34, d.f. = 85, CFI = .99, TLI = .99, RMSEA = .03), with first-order factor loadings to the higher-order factor ranging from .87 to .98 (t-values from 5.88 to 12.92, p < .001). For Study 2, a one-factor model fit the data well (χ2 = 138.48, d.f. = 90, CFI = .98, TLI = .98, RMSEA = .04), with standardized loadings ranging from .43 to .88 (t-values from 5.68 to 25.50, p < .001). A higher-order factor of one latent COPS construct with the five content domains as first-order factors also fit the data well (χ2 = 105.37, d.f. = 85, CFI = .99, TLI = .97, RMSEA = .03), with first-order factor loadings to the higher-order factor ranging from .87 to .99 (t-values from 18.20 to 32.30, p < .001).
Finally, we summed the item scores within each of the five content domains and used these five indicators to fit a one-factor confirmatory factor analysis. The fit was strong in Study 1 (χ2 = 10.04, d.f. = 5, CFI = .97, TLI = .97, RMSEA = .08), with standardized factor loadings ranging from .64 to .83 (t-values ranging from 7.03 to 8.86, p < .001). Coefficient alpha for the five indicators comprising the summed-item content domains was .84 (item-to-total correlations ranged from .49 to .79). The fit also was strong in Study 2 (χ2 = 6.46, d.f. = 5, CFI = .99, TLI = .99, RMSEA = .02), with standardized factor loadings ranging from .67 to .81 (t-values ranging from 11.64 to 13.61, p < .001). Coefficient alpha for the five indicators comprising the summed-item content domains was .85 (item-to-total correlations ranged from .61 to .73).
Reliability estimates
The final 15 items showed Kuder–Richardson formula 20 internal consistency estimates of α = .877 in Study 1 (item-to-total correlations ranged from .31 to .73) and .876 in Study 2 (item-to-total correlations ranged from .30 to .64). These 15 items also showed consistent reliability across age groups. In Study 1, coefficient alpha equaled .851 for 6-to-7-year-olds, .902 for 8-to-12-year-olds, and .864 for 13-to-15-year-olds; for Study 2, coefficient alpha equaled .890 for 6-to-7-year-olds, .849 for 8-to-12-year-olds, and .851 for 13-to-15-year-olds.
Study 1: COPS Construct and Predictive Validity
Procedures, Measures, and Predictions
Recall that the sample for Study 1 consisted of 150 participants (80 female, 70 male); 46 were age 6–7, 53 were age 8–12, and 51 were age 13–15. In addition to developing the COPS, another major purpose of Study 1 was to initially test the construct's role in the conceptual framework shown in Figure 1, and thus its validity. In this regard, Study 1 was actually set up as an experiment in which children or young teens were randomly assigned to one of three “cognitive defense” conditions: an online privacy quiz with feedback (n = 54), an online privacy video (“Be a Smart Cookie”; n = 50), or a control condition without a quiz or video (n = 46). As the quiz and video have been shown to be successful in helping children and teens build defenses in restricting their sharing of personal information online (Andrews, Walker, and Kees 2020; Desimpelaere, Hudders, and Van de Sompel 2020), H1 predicted there would be a significant difference in the mean COPS scores of those exposed to these educational defenses and those in the control condition. The quiz and video contained identical information on privacy protection with the difference being the delivery of the content.
Study 1 also assessed other measures for validity purposes. We assessed a single, seven-point item measure of intent to share personal information online as the primary dependent variable. As control variables, we also gathered a single-item measure of child/young teen perception of their parents restricting their online behavior (“yes” or “no”); the demographic variables of age group, gender, and race; and a five-item measure of prior (initial) online privacy beliefs. The rationale for these measures is as follows.
Both theory and empirical research suggest that parental influence may have an effect on a child's intentions and behavior, particularly with respect to online activities (Livingstone and Smith 2014; Stoilova, Nandagiri, and Livingstone 2021), and our item generation study revealed that 75% of children/teens interviewed stated that their parents restricted their online activities. Thus, we use perception of parents restricting online behavior as a control variable in predicting intent. Likewise, the demographics of child/teen gender, age, and race have been shown to be related to risky behaviors in general, and specifically online behaviors and intent (Helsper and Smahel 2020; Livingstone and Smith 2014). Thus, as a more rigorous test of the validity of COPS to predict intent to share privacy information online (H3a), we control for demographics and for parents restricting their child’s/teen's online viewing.
Prior beliefs have been shown to be a significant predictor of behavioral intentions in numerous social and consumer behavior contexts (Ajzen 1991; Sheppard, Hartwick, and Warshaw 1988), but such beliefs may be biased in that they are not always predictive of intent and behaviors, including those for privacy (Trepte et al. 2015), and particularly for children and young teens (Blank, Bolsover, and Dubois 2014). Children and young teens have been shown to meander from simple inferencing and initial beliefs due to a lack of actual knowledge and experiences (Bem 1972; Bonawitz 2010). Thus, our focus is on the ability of the COPS to explain incremental variance in intent after accounting for the effect of prior beliefs as a control variable. Table W3 of Web Appendix B shows summary statistics and correlations among Study 1 variables.
Data Checks
The survey also included a number of data checks geared at ensuring that the child and young teen respondents completed the survey free of parental involvement. At the beginning of the survey, we implemented screening questions on child presence, ability to read, online use, child assent, and parent and child age, and we gave instructions for parents to leave the room once parental consent was granted. In the middle of the survey, we also asked the child respondents for their age and matched each child’s response to the parent's response of the child's age. All of these checks were affirmed, giving us confidence that the child (rather than a parent/adult) completed the survey. Web Appendix A shows these data check questions. Further, the mean and median amounts of time to complete the survey were 14.78 and 11.47 minutes. These mean times did not differ by age group (age 6–7 years, M = 16.30 minutes; age 8–12 years, M = 14.25 minutes; age 13–15 years, M = 13.72 minutes; F(2, 148) = .60, p = .55).
Analyses and Results
Cognitive defenses and age groups
Recall that we predicted that COPS scores are a function of educational efforts to increase cognitive defenses (H1) and are a function of a child's age group (H2). We first conducted a one-way analysis of variance (ANOVA) on the COPS as a function of the three cognitive defense conditions: educational video, quiz with feedback, and nonexposure control (F(2, 147) = 3.26, p = .041, eta2 = .042). Pairwise comparisons showed that the educational video group mean (M = 11.32) did not differ from the quiz with feedback group mean (M = 11.29, p = .929). However, as predicted, the means for these two treatment conditions (video and quiz groups) were significantly greater than the control condition mean (M = 9.59, p = .032 and p = .023).
From this result, we pooled the video and quiz groups into one cognitive defenses group and conducted a 2 (cognitive defense conditions vs. control) by 3 (age groups: 6–7 years; 8–12 years; 13–15 years) factorial ANOVA. We did not observe a significant interaction (F(2, 144) = .341, p = .711). Main effects were found for cognitive defense conditions and age. Those in the cognitive defense conditions scored significantly higher on the COPS (M = 11.36) than those in the control condition (M = 9.40; F(1, 144) = 8.108, p = .005, eta2 = .053), supporting H1.
The older age groups showed higher mean scores on the COPS relative to the youngest age group (F(2, 144) = 3.450, p = .034, eta2 = .046). Pairwise comparisons showed that the COPS mean for the 13-to-15-year age group (M = 11.33 of 15; 76% correct) was greater than that of the 6-to-7-year age group (M = 9.11 of 15; 61% correct; p = .011), and the COPS mean of the 8-to-12-year age group (M = 10.71 of 15; 71% correct) was marginally greater than that of the 6-to-7-year age group (p = .068). These results largely support H2.
Intent to share information online
We used hierarchical regression analyses to examine ability of the COPS to predict children's intent to share personal information online, controlling for demographics, parents’ restriction of online behavior, and initial online privacy beliefs. Given the preceding results, we also controlled for the cognitive defense versus control manipulation by coding it as 0 or 1. The second and third columns of Table 2 show the results.
Study 1 and Study 2 Intent to Share Regression Results.
*p < .10, **p < .05, ***p < .01.
Notes: The 13-to-15-year-old age category was used as the reference category for age. Although we assessed several categories of race, the samples were predominantly White. Thus, we coded race as 1 = White and 0 = other. In Study 1, 74% classified themselves as White, 9.3% as African American (non-Hispanic), 8% as Hispanic, 4% as Asian American, 1.3% as Native American, and 3.3% as other. In Study 2, 73.2% classified themselves as White, 5.7% as African American (non-Hispanic), 8.4% as Hispanic, 7.7% as Asian American, .3% as Native American, .3% as Pacific Islander, and 2.7% as other; 1.7% refused to answer. Values are unstandardized regression coefficients, with standardized regression coefficients in parentheses.
Model 1 (F(7, 142) = 2.448, p = .021, R2 = .108) in Table 3 with just the control variables (covariates) shows that male participants are more likely than female participants to share their personal information online (β = 1.066, t = 3.048, p = .003). Initial beliefs showed a marginally significant effect (β = −.300, t = 1.814, p = .072). Model 2 (Fchange(1, 141) = 43.231, p < .001, R2 = .317) shows that COPS score was significantly related to intent to share (β = −.264, t = 6.575, p < .001): an increase of one correct answer on the COPS scale was associated with a .264 decrease on the seven-point scale of intent to share personal information online. This finding supports H3a.
Study 3 and Study 4 Intent to Share Information Online: Regression Results.
*p < .10, **p < .05, ***p < .01.
Notes: The 13-to-15-year age category was used as the reference category for age. Race was again coded as 1 = White and 0 = other. In Study 3, 71% classified themselves as White, 6.4% as African American (non-Hispanic), 9.7% as Hispanic, 9% as Asian American, .3% as Native American, and 2.7% as other; .7% refused to answer. In Study 4, 68.8% classified themselves as White, 8.4% as African American (non-Hispanic), 11.2% as Hispanic, 6.5% as Asian American, .5% as Native American, .3% as Pacific Islander, and 3.4% as other; .7% refused to answer. Values are unstandardized regression coefficients, with standardized regression coefficients in parentheses.
Study 2: COPS Construct and Predictive Validity
Procedures, Measures, and Predictions
Participants in Study 2 were 300 children or young teens (different from the participants in the pretests and Study 1) recruited by a professional online survey company (Prodege). We had four nonresponses across several measures, giving us an effective sample of 296 participants (157 female, 139 male); 76 were age 6–7 years, 107 were age 8–12 years, and 113 were age 13–15 years.
Participants completed an online survey containing the 20 multiple-choice COPS items, which were further reduced to 15 items for all subsequent analyses of Study 2 on the basis of our prior results. The same data checks of Study 1 were used in Study 2, and all were affirmed, lending confidence that children completed the survey free of parental involvement. The mean and median amounts of time to complete the Study 2 survey were 12.77 and 10.18 minutes, respectively. These mean times did not differ by age group (age 6–7 years, M = 12.76 minutes; age 8–12 years, M = 13.48 minutes; and age 13–15 years, M = 11.94 minutes; F(2, 293) = .886, p = .414). The survey included three five-point items summed and averaged to measure intent to share personal information online as the primary dependent variable. The survey also included the same measure of prior online privacy beliefs; assessment of child age, race, and gender; and a question asking children if their parents/guardians restrict what they watch online. With these variables, we sought to replicate the results of Study 1.
To offer further evidence of the validity of the COPS, Study 2 included two more measures: a three-item measure of child/young teen subjective knowledge of staying safe online and a four-item measure of need to be popular among friends/peers adapted for children and adolescents (Netemeyer et al. 2015). Recent evidence suggests that child/teen subjective knowledge of online safety predicts online safety attitudes (Macauley et al. 2019), and the “feeling of knowing” endemic to subjective knowledge provides confidence for individuals to act in a positive manner, particularly in matters of youth use of online platforms (Helsper and Smahel 2020). Thus, to more accurately assess the COPS → intent relationship, we first control for a subjective knowledge → intent relationship.
As for need to be popular, it is well accepted that childhood and adolescence are times of an increased need to “fit in” and be popular (Fitzsimons and Moore 2008; Martin et al. 2013). Children or young teens who exhibit a high need to be popular show higher levels of engaging in maladaptive behaviors, ranging from smoking and alcohol use to abuse of prescription opioids (Ford 2008; Netemeyer et al. 2015). A psychological mechanism that has been advanced as affecting these behaviors is a lower risk perception of harm because the behaviors have become normative or viewed as “cool and popular” with peers (Heirman, Walrave, and Ponnet 2013). In fact, the Youth Justice Board (2016) reports that a higher use of social media among children and adolescents is related to being viewed as popular. Thus, we expect that a need to be popular will be positively related to intent to share information online.
Important to the COPS, though, is the degree to which COPS scores may offset the effects of a need to be popular, which would lend confidence to the external validity of the COPS (Lynch 1999). As previously noted, an important element of construct validity is external validity, which includes the degree to which the construct may interact with key background factors (e.g., values, personality traits, behaviors, etc.) in affecting an outcome (Cook and Campbell 1979).
In general, high levels of knowledge have shown the ability to counteract personality traits leading to negative outcomes. In this respect, high COPS scores may have the ability to moderate the effect of need to be popular on intent to share by acting as a defense mechanism increasing one's sense of volition to resist the urges of a need to be popular. This premise is consistent with persuasion theory and Self-Determination Theory (Friestad and Wright 1994; Ryan and Deci 2000), in that high COPS scores may empower children/teens by acting as a self-regulation mechanism to avoid sharing personal information online (Youn and Shin 2020). Thus, we predict that a high score on the COPS will moderate the effect of need to be popular on intent to share (H4a). Web Appendix A shows all measures, and Table W4 of Web Appendix B shows summary statistics and correlations among measures.
Analyses and Results
COPS age group differences
As with Study 1, we expected that the older age groups would show higher mean scores on the COPS, compared with the youngest age group. A one-way ANOVA supported this prediction (F(2, 293) = 15.605, p < .001, eta2 = .096). Pairwise comparisons showed that both the 13-to-15-year age group’s COPS mean (M = 12.03 of 15; 80% correct) and the 8-to-12-year age group’s COPS mean (M = 11.35 of 15; 76% correct) were greater than that of the 6-to-7-year age group (M = 9.03 of 15; 60% correct; p < .001). There was no difference between the 13-to-15-year and 8-to-12-year age groups (p = .174). This finding supports H2.
Intent to share information online
We first mean-centered the COPS and the need to be popular to create the COPS × need to be popular interaction term (Cohen et al. 2003). The last three columns of Table 2 show the hierarchical regression results for intent to share personal information online. Model 1 with control variables only (F(8, 288) = 5.475, p < .001, R2 = .132) shows the expected effects of prior beliefs (β = −.152, t = 2.191, p = .029), subjective knowledge (β = −.149, t = 2.243, p = .026), and need to be popular (β = .226, t = 4.507, p < .001). Model 2 (Fchange(1, 287) = 44.438, p < .001, R2 = .248) shows the predicted effect of COPS (β = −.093, t = 6.666, p < .001). Note that the effect of prior beliefs becomes nonsignificant when COPS is included in the model. Model 3 (Fchange(1, 286) = 6.121, p < .001, R2 = .264) adds the COPS × need to be popular interaction. It was significant (β = −.031, t = 2.474, p < .014). These results support our predictions with respect to the linear and moderating effects of COPS (H3 and H4a). Figure 2 plots the COPS × need to be popular interaction.

Study 2: Interaction Effect of COPS × Need to Be Popular on Intent to Share.
Figure 2 shows that when need to be popular is low (one standard deviation below its mean) and the COPS score is high (one standard deviation above its mean), we see the lowest intent to share personal information online (M = 1.588); when the COPS score is high and need to be popular is high, we see a mean of 1.710 for intent to share. These two means did not differ. Low COPS scores produced higher intent to share when the need to be popular is high (M = 2.631) or low (M = 2.026). Both combinations of high COPS scores and need to be popular had lower means for intent to share than the combinations of low COPS scores with need to be popular (p = .014). In sum, a high COPS score offsets the effect of need to be popular on a child's intent to share personal information online.
Study 3: COPS Construct and Predictive Validity
Overview
Study 3 further validates the COPS by examining its ability to moderate one more perceptual variable known to affect child/teen behavior, namely thrill-seeking tendencies, and a behavioral measure shown to affect online sharing of information, namely social media usage.
Thrill seeking
Late childhood and early adolescence are times of increased risk taking and thrill seeking with a shift from a parent-centered existence to a predominance of peer affiliation in the process of developing identity. The ability to think past initial consequences and consider potential risks involved in child/adolescent behaviors is variable and depends on psychosocial development (Giedd 2012; Knowles et al. 2014). Thrill seeking in children and adolescents is associated with greater vulnerability to unintentional injuries, substance use, and rule-breaking behavior (Haas et al. 2019). Thrill seeking is also related to a greater propensity for risk-taking behavior online. For example, Munro (2011) reports that thrill-seeking youth are four times more likely to have met someone offline after online contact and sharing of personal information. Both Helsper and Smahel (2020) and Livingstone and Smith (2014) also show that thrill-seeking tendencies are a prime predictor of children’s or teens’ engaging in negative online behavior. Thus, we expect thrill seeking to be positively related to intent to share personal information online.
That stated, the degree to which high COPS scores may offset the effects of thrill seeking is of greater importance to the validity of the COPS. As with need to be popular, we argue that the objective knowledge embedded in the COPS may act as a self-regulating mechanism increasing one's resistance to thrill-seeking urges associated with sharing personal information online (Friestad and Wright 1994; Ryan and Deci 2000). Thus, we expect that high COPS scores will moderate the effect of thrill-seeking tendencies on intention to share personal information online (H4b).
Social media usage
There is evidence that social media usage (e.g., Facebook, Instagram, Snapchat, TikTok, YouTube) is associated with divulging more personal/private information online, particularly among children and teens (Anderson and Jiang 2018; FTC 2019a; Livingstone, Stoilova, and Nandagiri 2021). Could high objective knowledge via a high COPS score offset the intention to share personal information online associated with using social media? We think so. Again, objective knowledge is associated with the competence dimension of Self-Determination Theory and the ability to understand the risks of sharing information relevant to persuasion theory. When this knowledge is high (a high COPS score), children/teens are better equipped to fight the urge to share personal/private information when engaging with social media platforms (Livingstone, Stoilova, and Nandagiri 2021; Youn and Shin 2020). We therefore predict that the COPS score will moderate the effect of social media usage on intent to share personal information online (H4c).
Sample and Measures
The initial sample of Study 3 consisted of 300 children/young teens (different from those of all other samples). We again had a few nonresponses across several measures, giving us an effective sample of 296 participants (154 female, 142 male); 86 were age 6–7 years, 108 were age 8–12 years, and 102 were age 13–15 years. The same data vendor (Prodege) of Study 2 was used for Study 3. The same data checks of the previous studies were used in the Study 3 survey; all were affirmed. The mean and median amounts of time to complete the survey were 12.23 and 10.63 minutes. The mean times did not differ by age group (age 6–7 years, M = 11.82 minutes; age 8–12 years, M = 13.16 minutes; and age 13–15 years, M = 11.48 minutes; F(2, 293) = 1.87 p = .156).
Participants competed an online survey containing the final 15-item COPS (coeff. α = .864), the same dependent variable measure of intent to share personal information online, and the same measures of prior online beliefs, subjective knowledge, parents restricting online behavior, and age, gender, and race as used in Study 2. We included a five-item measure of thrill-seeking tendencies (Netemeyer et al. 2015), adapted for children and adolescents from the Mehrabian and Russell (1974) “excitement from risk” factor of the Arousal Seeking Tendency Scale. To assess social media usage, we included a self-reported measure of the average number of hours spent on TikTok, Facebook, Snapchat, Instagram, YouTube, and Twitter. Web Appendix A shows all measures. Table W5 of Web Appendix B shows summary statistics and correlations.
COPS age group differences
A one-way ANOVA supported our age group differences hypothesis (H2) with respect to the COPS (F(2, 293) = 12.407, p = .001, eta2 = .078). Pairwise comparisons showed that the COPS mean for the 13-to-15-year age group (M = 12.25 of 15; 82% correct) was greater than that of the 6-to-7-year age group (M = 9.55 of 15; 64% correct; p < .001). The difference between the COPS mean of the 8-to-12-year age group (M = 11.12 of 15; 74% correct) and that of the 6-to-7-year age group was also significant (p = .004). Further, the COPS mean of the 13-to-15-year age group was greater than that of the 8-to-12-year age group (p = .028).
Intent to share information online
Table 3 shows the results for intent to share information online. Model 1 (F(9, 285) = 10.003, p < .01, R2 = .240) with just the control variables shows significant effects for race (β = −.242, t = 2.222, p = .027), prior beliefs (β = −.295, t = 3.750, p < .001), thrill seeking (β = .318, t = 5.705, p < .001), and social media usage (β = .034, t = 3.694, p < .001) and a marginally significant effect for the 6-to-7-year age group (β = .225, t = 1.683, p = .093). Model 2 (Fchange(1, 284) = 57.313, p < .01, R2 = .368) shows that COPS was significant (β = −.103, t = 7.571, p < .001), supporting H3a. Prior beliefs become nonsignificant in Model 2 when COPS is included as a predictor. Model 3 (Fchange(2, 282) = 8.664, p < .01, R2 = .404) adds the interaction terms and shows that the COPS × thrill seeking (β = −.031, t = 2.535, p = .012) and the COPS × social media usage interactions (β = −.004, t = 2.310, p = .022) were significant, supporting H4b and H4c.
Figures 3 and 4 plot these interactions. Figure 3 shows that when the COPS score is high, it lowers intent to share when thrill seeking is high (M = 1.368) or low (M = 1.231). Both of these points were significantly lower (p = .012) than the low COPS score–high thrill seeking mean (M = 2.319), but not significantly lower than the low COPS score–low thrill seeking mean (M = 1.754).

Study 3: Interaction Effect of COPS × Thrill Seeking on Intent to Share.

Study 3: Interaction Effect of COPS × Social Media Usage on Intent to Share.
Figure 4 indicates that when the COPS score is high, it lowers intent to share when social media use is high (M = 1.368) or low (M = 1.239). Both of these points were significantly lower (p = .022) than the low COPS score–high social media usage mean (M = 2.272), but not significantly lower than the low COPS score–low social media usage mean (M = 1.801).
Study 4: Validation of the COPS with a Behavioral Index over Time
Overview and Predictions
Studies 1 through 3 examined the COPS → intent relationship with cross-sectional, same-survey data. With Study 4, we demonstrate that the COPS has predictive validity for an index of actual behaviors over time. Further, intent has not always been predictive of behavior (Chandon, Morwitz, and Reinartz 2005), and thus we wanted to demonstrate that controlling for intent, the COPS has incremental predictive validity with regard to behaviors. Thus, Study 4 further validates COPS scores measured at Time 1 with a behavioral index of online privacy behaviors over a one-month period measured at Time 2 (H3b). We also attempt to replicate the findings of Studies 1, 2, and 3.
Sample and Measures
Data were again sourced from the professional online panel company Prodege. The Time 1 sample comprised 777 children (different from those of Studies 1, 2, and 3), split evenly across gender and age categories, passing the attention screener, and receiving parent/guardian permission to participate. At Time 1, all participants responded to the same measures of Study 3, including the COPS (coeff. α = .863) with the changes noted subsequently. Study 4 assessed thrill-seeking tendencies and need to be popular, and we used a single-item measure of social media usage (see Web Appendix A). We also gathered a five-item short-form version of the Crowne–Marlowe social desirability responding scale to add as a control when predicting online child/teen privacy-related behaviors (Hays, Hayashi, and Stewart 1989). The same data checks of the previous studies were affirmed in Study 4. The mean and median amounts of time to complete the Time 1 survey were 12.32 and 10.43 minutes. The mean times did not differ by age group (age 6–7 years, M = 11.89 minutes; age 8–12 years, M = 12.80 minutes; and age 13–15 years, M = 12.11 minutes; F(2, 578) = .842, p = .428).
At Time 2 (one month later), the same participants responded to a behavioral index of what are considered safe and unsafe online privacy-related behaviors. These behaviors were adapted from COPS issues and were vetted through an expert judgment process similar to that of the expert judging of the original 50 COPS items. We originally drafted 32 behavioral items, and on the basis of responses of 12 expert judges with considerable expertise on child/teen online privacy, we initially retained 26 items. Following a further refinement on COPS-targeted issues, we retained a final set of 16 items for Time 2. Web Appendix A shows the 16 items scored as “yes” or “no.” Items were coded or recoded such that a positive online privacy-related behavior was scored as 1, and then the scores were summed to form an index that could range from 0 to 16. The final data set consisted of 581 of the 777 respondents of Time 1 (or 75%), matched by unique identifiers provided by the professional panel data provider (278 female, 303 male); 157 were age 6–7 years, 218 were age 8–12 years, and 206 were age 13–15 years. The mean and median amounts of time to complete the Time 2 survey were 2.70 and 1.89 minutes. The mean times did not differ by age group (age 6–7 years, M = 2.35 minutes; age 8–12 years, M = 2.91 minutes; and age 13–15 years, 2.68 minutes; F(2, 578) = 1.36, p = .256). Table W6 of Web Appendix B shows summary statistics and correlations among study variables.
Time 1 Analyses and Results
COPS age group differences
A one-way ANOVA supported our age group differences hypothesis (H2) with respect to the COPS (F(2, 578) = 27.829, p < .001, eta2 = .088). The COPS mean of the 13-to-15-year age group (M = 12.35 of 15; 82% correct) was greater than that of the 6-to-7-year age group (M = 9.54 of 15; 64% correct; p < . 001) and that of the 8-to-12-year age group (M = 11.09 of 15; 74% correct; p < .001). The 8-to-12-year age group also showed a greater mean COPS score than the 6-to-7-year age group (p < .001).
Intent to share information online
Accounting for full values on the social desirability questions, the sample size for the regression models was n = 571. Columns 4, 5, and 6 of Table 3 show the results for intent to share information online. Model 1 (F(11, 559) = 18.201, p < .001, R2 = .264) shows significant effects for the control variables of gender (β = −.150, t = 2.260, p = .024), parents restricting online behavior (β = −.180, t = 2.099, p = .032), prior beliefs (β = −.130, t = 2.743, p = .006), thrill seeking (β = .198, t = 4.980, p < .001), need to be popular (β = .201, t = 5.878, p < .001), and social media use (β = .146, t = 4.983, p < .001).
In Model 2 (Fchange(1, 558) = 11.237, p < .001, R2 = .278) the COPS was again significant (β = −.033, t = 3.175, p < .001), supporting H3a. Again, prior beliefs become nonsignificant in Model 2 when COPS scores are included as a predictor. Model 3 adds the interaction terms (Fchange(3, 555) = 4.038, p = .007, R2 = .294) and shows that the COPS × social media usage interaction was significant (β = −.019, t = 2.888, p = .004); thus, H4c is supported. Figure 5 plots this effect.

Study 4: Interaction Effect of COPS × Social Media Usage on Intent to Share.
When the COPS score is high and social media usage is low, intent to share information online is at its lowest (M = 1.958). This point was significantly lower (p = .004) than just the low COPS score–high social media usage mean (M = 2.521). No other combinations differed (i.e., high COPS score–high social media use: M = 2.089; low COPS score–low social media use: M = 2.032).
Time 2 Analyses and Results
We used a similar hierarchical regression approach for predicting the behavioral index with a focus on the degree to which COPS scores were significant in Model 2 after controlling for these covariates in Model 1: age, gender, race, social desirability bias, parents restricting online behavior, initial beliefs, intent to share, thrill seeking, need to be popular, and social media use. Model 1 (F(12, 558) = 3.623, p < .01, R2 = .072) showed significant effects for race (β = .342, t = 2.060, p = .040), prior beliefs (β = .242, t = 2.218, p = .027), and social media usage (β = −.166, t = 2.417, p = .016) and a marginally significant effect of intent to share (β = −.179, t = 1.845, p = .066). No other predictor was significant. Model 2 (Fchange(1, 557) = 11.829, p < .01, R2 = .092) shows that COPS was significant in predicting the index of online behaviors (β = .080, t = 3.493, p < .001), supporting H3b.
General Discussion, Summary of Findings, and Implications
Children and teens today face many privacy issues in navigating the online world, including cyberbullying, harassment, unwanted contact, biometric tracking, and the collection of personally identifiable information (Allyn 2021; FTC 2019a, c; Horowitz and Wells 2021; 60 Minutes 2022). Although much has been written about risks for youth online (Livingstone, Stoilova, and Nandagiri 2019, 2021; Lupton and Williamson 2021; Radesky et al. 2020), little has been done in a proactive sense to determine exactly what children or teens know about online privacy. Such objective privacy knowledge is important in helping youth restrict PII they provide and in making better decisions online. With few available options short of banning online access and use, hoping current privacy regulations expose violators, and updating individual protective policies, challenges to protect children's privacy persist. One exception has been the development of cognitive defense strategies for children or teens to encourage restricting the exchange of personal information online (Andrews, Walker, and Kees 2019, 2020).
Given these challenges, our studies provide three key contributions: (1) developing a measure of children's objective knowledge of online privacy protection (COPS), (2) testing the COPS’s psychometric, factor structure, and predictive validity properties with regard to intent to share information online and an index of privacy-related online behaviors, and (3) demonstrating that the COPS has the ability to offset certain personality traits and behaviors that may lead children or young teens to share personal information online.
Summary of Findings
Across studies, we find support for the reliability and validity of the COPS. In Study 1, we find that the COPS is influenced by a cognitive defense experimental manipulation, as predicted. This suggests that education efforts to increase objective knowledge pertinent to children’s or young teens’ online privacy knowledge have efficacy; thus the COPS may be a useful tool to assess these educational efforts. In general, we also find expected mean score age differences for the COPS. Consistent with the child cognitive development literature, the 13-to-15-year age group scored higher than the 6-to-7-year age group across the four studies, and in three of the four studies, the 8-to-12-year age group scored higher than the 6-to-7-year age group.
In terms of predictive validity, the COPS (1) explained incremental variance in intent to share personal information online across all four studies controlling for a host of covariates known to predict intent; (2) explained incremental variance in an index of online privacy behaviors in Study 4; and (3) moderated the effects of need to be popular, thrill seeking, and social media usage in four of six predictions across the four studies. The introduction of the COPS also reduced the effect of initial online privacy beliefs to nonsignificance on intent and behaviors. The totality of these results suggests that the objective knowledge/literacy embedded in the COPS can predict both intent and behaviors related to online privacy, and, more importantly, offset the tendencies of some pervasive child/teen personality traits and behaviors known to be associated with sharing personal information online. This speaks favorably for the validity of the COPS and the use of the COPS as a screening tool to assess child/teen online privacy knowledge.
Public Policy Implications
The development and testing of the COPS offers several important implications for privacy policy. First, restricting everything that children and teens view online is undesirable, is improbable, and has been shown to be unsuccessful in many cases (60 Minutes 2022; Wendling 2017). At the same time, little is known about exactly what children/teens know and do not know about online privacy protection. Our reliable and valid COPS measure can help provide insight on the privacy knowledge/literacy that children acquire and can illustrate potential threats and risks to children. Such knowledge can benefit government organizations, tech companies, service providers, and educational organizations working to revise federal regulations (e.g., FTC and Congress with the revision of the COPPA; Kids Online Safety Act) and improve industry self-regulation (e.g., the BBB National Programs' Children's Advertising Review Unit).
Understanding how much children and teens know about privacy via the COPS can help determine when children or teens are sharing information (i.e., actively protecting their information and exhibiting trust in the interaction) or surrendering information (i.e., passively protecting their information and exhibiting faith) (Walker 2016). Since trust plays a crucial role in marketing exchanges, the COPS can be a useful tool for social responsibility issues involving children as a vulnerable population. The ability to identify whether children are surrendering or sharing information online is essential for assessing risk and preventing potential harm (Walker 2016). Emerging student privacy issues involve children's use of educational technology for learning at school and at home (Walker et al. 2022). Since digital literacy is often taught in schools, the COPS can be useful for assessing risks associated with educational technology.
In addition, the COPS measure can impact the practices of institutions and online service providers, inform the technical aspects of privacy protection, and improve strategies for individual privacy control. For instance, the COPS may be especially useful with legislation that places legal obligations on companies, such as the California Age-Appropriate Design Code Act (2022) requiring online platforms to promote privacy for children by default. This act compels companies that design any digital product or service to proactively assess the privacy and protection of children. Interestingly, the act specifically speaks of privacy as a child's right by noting that the United Nations Conventions on the Rights of the Child “recognizes that children need special safeguards and care in all aspects of their lives” (California Age-Appropriate Design Code Act [2022], Section 1.a.1).
The COPS can also serve as a beneficial baseline for measuring change and longitudinal work, much like that of other measures assessing adolescent risky behaviors, such as with tobacco, e-cigarette, and drug use (e.g., University of Michigan's Monitoring the Future, the Center for Disease Control and Prevention's Youth Risk Behavior Surveillance System, and the National Institutes of Health and Food and Drug Administration's Population Assessment of Tobacco and Health). In addition, the COPS can serve as an important measure for the evaluation of possible national, evidence-based privacy education campaigns. With proper message testing and controls, such campaigns can be effective in reducing youth risk behaviors (Farrelly et al. 2017). Recently, for example, the United Kingdom launched a “Twisted Toys” campaign (with Share Bear and Stalkie Talkie characters) showing how tech companies have at times preyed on children’s or teens’ private online data (Zakrewski 2021).
Limitations and Future Research
Limitations in the development and testing of the COPS are as follows. Although we implemented several data checks across studies, we still cannot completely rule out the possibility that parents may have helped their children complete the studies. While the general pattern of results we offer in Tables 2 and 3 and Web Appendix B Tables W3 to W6 are consistent with children or young teens completing the survey, parental involvement still may have occurred with online data collection. Although this limitation is inherent in any online studies with children or teens as participants, more rigorous tests will be needed to further validate the COPS, especially with younger age groups to evaluate their reading comprehension level with respect to the COPS items. This will require a controlled face-to-face setting in which only a trained researcher administers the COPS to children, with parental consent but without the possibility of parental involvement.
Second, other variables beyond the ones used in our studies could be used for further validity testing of the COPS. Online technology and privacy regulations can evolve over time, and the COPS may need revision in the future to account for such fundamental changes. In addition, obtaining and/or tracking actual behaviors of children, rather than self-reported behaviors, in academic research may prove challenging with Institutional Review Board guidelines and restrictions.
Future research might also involve testing the COPS more rigorously with underrepresented groups based on gender, race, and ethnicity. Our sample sizes ranged from 150 to 571 participants, with few respondents classifying themselves in categories other than “White.” For example, it is uncertain whether the results we reported would hold in studies with much larger and more representative samples of respondents classifying themselves as Black or African American, Hispanic/Latinx, Asian American, Native American, and/or multiracial. With much larger samples, it would be interesting to examine interactions of COPS × race and COPS × race × gender on important outcome variables for children's online privacy issues. We believe that efforts in this regard will be helpful in measuring exactly what children and teens know and do not know about privacy protection and in helping them protect their personal information and interactions online.
Supplemental Material
sj-pdf-1-ppo-10.1177_07439156231165250 - Supplemental material for Helping Youth Navigate Privacy Protection: Developing and Testing the Children's Online Privacy Scale
Supplemental material, sj-pdf-1-ppo-10.1177_07439156231165250 for Helping Youth Navigate Privacy Protection: Developing and Testing the Children's Online Privacy Scale by J. Craig Andrews, Kristen L. Walker, Richard G. Netemeyer and Jeremy Kees in Journal of Public Policy & Marketing
Footnotes
Appendix: Children's Online Privacy Scale (Correct Answers in Bold)
Editor
Maura L. Scott
Associate Editor
Frank Germann
Declaration of Conflicting Interests
The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.
Funding
The author(s) received no financial support for the research, authorship, and/or publication of this article.
References
Supplementary Material
Please find the following supplemental material available below.
For Open Access articles published under a Creative Commons License, all supplemental material carries the same license as the article it is associated with.
For non-Open Access articles published, all supplemental material carries a non-exclusive license, and permission requests for re-use of supplemental material or any part of supplemental material shall be sent directly to the copyright owner as specified in the copyright notice associated with the article.
