Who is responsible for customers' privacy? Effects of first versus third party handling of privacy contracts on continuance intentions

E-commerce data management has become an extensive network of interrelated players that links companies providing goods or services (first parties) with companies that analyse, manage or otherwise use customers’ data (third parties). In consequence, privacy is now the combined responsibility of first and third parties. We introduce the concept of privacy contract to investigate the effect of first versus third party privacy handling on customer reactions, including privacy contract fulfilment versus privacy contract breach. An online experiment with 296 participants confirmed that differences in privacy contract handling affects continuance intentions. This link is mediated through perceived contract fulfilment and feelings of violation. Although first party actions led to somewhat stronger reactions, both first and third party privacy contract (mis)handling affected continuance intentions and cognitive and affective reactions. Our findings demonstrate that individuals make little distinction between first and third party responsibilities, indicating that privacy contracts extend beyond the original relationship between customer and online retailer. It further demonstrates that privacy contracts offer a strong theoretical framework to understand customer reactions across different privacy situations. Conceptually, our study shifts privacy from a dualistic towards a network perspective of subjectively held privacy obligations, offering important pointers to guide organizations’ privacy management.