Perceived personal and societal data harms shape users’ data control preferences

Introduction

Social media platforms have fundamentally transformed our understanding of privacy through pervasive behavioural data harvesting and commodification that systematically transcends user visibility and identifiability (Matzner, 2014; Zuboff, 2019). Despite growing user awareness, proactive individual measures cannot effectively counter ubiquitous data collection (Dencik & Cable, 2017; Draper & Turow, 2019), creating broader societal challenges that demand regulatory attention (Couldry & Meijas, 2019; Smuha, 2021). When aggregate data enables citizen profiling and manipulation during electoral processes, the potential harm threatens democratic legitimacy itself (Smuha, 2021; Zuiderveen Borgesius et al., 2018). This shift from personal privacy concerns to wider societal harms has sparked calls for comprehensive regulation, particularly within the European Union’s developing AI regulation framework.

Although both personal and societal harms from data practices are widely recognised (Muller, 2020; Shelby et al., 2023; Smuha, 2021), we do not know how citizens’ perceptions of these harms might shape their regulatory preferences. When perceiving harm to oneself, do citizens primarily seek individual control? When concerned about societal damage, do they turn to government intervention? Or do they want both approaches working together? Our study addresses these questions by examining the relationship between citizens’ perceptions of data harms and their preferences for different control mechanisms.

Addressing the relationship between harm perceptions and control preferences matters for several reasons: First, regulations focusing solely on personal harm have created an illusion of control rather than actual protection (e.g., Brandimarte et al., 2013; Bendix & MacKay, 2022). Second, public support for regulatory efforts largely depends on how severe people perceive the harms to be (Slovic, 1987). Third, democratic institutions risk losing trust if citizens feel that powerful entities ignore or fail to address major societal problems.

Drawing on control theory and compensatory control theory, we analyse survey data from six EU countries collected in early 2021. This period constitutes a uniquely informative window, because it captures perceptions roughly one year into the COVID-19 pandemic and the wide deployment of digital methods for the management of the health crisis, that triggered concerns about privacy and intrusion from government (Ioannou & Tussyadiah, 2021) and corporate surveillance (Vitak & Zimmer, 2023). It also is a time in which distinctions and tensions between individual and societal harms have come into sharp relief, as governments have weighed the protection of public health against the importance of individuals’ right to privacy (van Kolfschooten & de Ruitjer, 2020). By examining how citizens perceive data harms, we offer a baseline for understanding the evolving relationship between perceived risks and governance preferences in an era of ubiquitous platformisation and data harvesting (Couldry & Meijas, 2019).

Theoretical background

Privacy concerns have traditionally centered on user disclosure and horizontal privacy risks (Hargittai & Marwick, 2016; Masur, 2020), with focus on individual control over information about oneself and the degree of access others have to this information (Nissenbaum, 2010; Xu et al., 2012). It was generally possible for users to know what they disclosed and to whom, they could reasonably anticipate specific adverse outcomes (i.e. harms) such as reputational damage, discrimination, or harassment, thus fitting the traditional risk frameworks that presume that actors can predict outcomes and assign (at least roughly) probabilities to them (Scoones, 2019). However, the contemporary communication environments of social media platforms have fundamentally transformed the conditions under which people can meaningfully anticipate outcomes of their actions.

Through pervasive backend data collection and commodification (Couldry & Meijas, 2019; Zuboff, 2019), behaviour is reduced to predictive features and cross-contextual inferences (Birch et al., 2021; Matzner, 2014), meaning that relevant “information” does not necessarily stem from deliberate disclosure but from opaque aggregation and inference processes. AI-based predictive analytics amplify this shift by generating new informational categories from data that users neither see nor meaningfully control (Mühlhoff, 2023). Platforms’ backend operations make it difficult for users to know how their data are combined, inferred from, or repurposed across contexts, thus creating uncertainty through complexity and opacity (Mackenzie, 2019). As a result, individuals cannot reliably assess what harms might arise, how severe they may be, or whether their own behaviour can meaningfully mitigate them. Thus, since outcomes and their likelihoods cannot be meaningfully anticipated (Knight, 1964), we can say that contemporary platform infrastructures operate under uncertainty rather than risk.

In the following, we draw on the ideas of complexity and uncertainty as background context for understanding how diffuse, hard-to-attribute harms affect people’s perceptions of control. This makes the nature of the harm itself a critical point of differentiation, since some harms are more-or-less perceptible and self-referent while others are rather diffuse, cumulative and collective (e.g., Shelby et al., 2023). Our study focuses specifically on two key dimensions of possible harm that we review next.

Personal harms

Drawing on Solove’s (2006) taxonomy of privacy harms, four practices are critical in potentially inducing harms to individuals: 1) surveillance, in which routine collection of behavioural data erodes the boundary around private life; 2) aggregation and secondary use, where data are repurposed for aims such as political advertising; 3) disclosure, which exposes individuals to unforeseen uses and judgments through third-party sharing; and 4) invasion, as when governmental access to platform data encroaches on informational self-determination. Under Nissenbaum’s (2010) theory of contextual integrity, each of these practices constitutes a breach of the norms governing information flows, potentially undermining autonomy, creating reputational risks, and triggering concerns about future misuse.

Empirical work on platform-related harms reinforces this theoretical framing. Boerman et al. (2021) show that users often experience such practices as a threat to their personal interests, prompting protective or compensatory responses. Shelby et al. (2023) extend this view by situating privacy violations within a broader set of sociotechnical harms. In their account, privacy violations extend beyond disclosure to include predictive inference from seemingly innocuous data, cross-context repurposing without consent, and affect-based or ubiquitous surveillance – all of which can heighten feelings of exposure and loss of control even without formal rule-breaking. Specifically related to micro-level harms, Shelby et al. (2023) identify interpersonal harms such as loss of agency, diminished well-being, and technology-facilitated abuse; and quality-of-service harms including alienation, additional user labour, and performance disparities. As they note, harms may be directly or indirectly felt, can accumulate over time, and often overlap with other harm types, meaning individual experiences are better understood as part of a wider harm ecology.

In response, users often experience privacy resignation, defined as a psychological state where individuals believe they cannot meaningfully protect their privacy despite desiring to do so (Draper & Turow, 2019). This resignation stems not from apathy but from recognition that meaningful control is practically impossible under current conditions (Dencik & Cable, 2017; Hargittai & Marwick, 2016). Dencik and Cable (2017) call this state “surveillance realism.” Conceptually, the regime of data uncertainty has also given rise to critical theoretical perspectives like “algorithmic alienation,” which describes the growing separation between individuals and their data as it is processed through opaque computational systems (Andrejevic, 2013). Both privacy resignation and algorithmic alienation reflect responses to uncertainty rather than risk, where meaningful prediction of data trajectories becomes impossible (Scoones, 2019). Building on this, we focus on perceived personal harms to denote a self-referent risk appraisal: respondents’ judgement of how much platform data practices could negatively affect them personally. Although many data harms are diffuse and hard to pinpoint, people still form self-focused appraisals of that diffuse exposure.

Societal harms

Beyond individual stakes, platforms can imperil collective democratic processes and institutional integrity. Regan (1995) argued early on that a privacy frame limited to individual interests cannot capture the wider risks to social order when information flows escape normative bounds. More recently, Renieris (2023) called to reinterpret the right to privacy, that underpins data protection and security efforts, through a more collective lens. Relatedly, Smuha (2021) defines societal harm as the thwarting of one or more interests of society, including democracy, human rights, and the rule of law (also Muller, 2020). Habermas (2023) underscores that transparent, inclusive discourse is a precondition for legitimate governance, yet opaque platform algorithms and undisclosed data sharing compromise these conditions (Couldry & Mejias, 2019). Empirically, Zuiderveen Borgesius et al. (2018) show how algorithmic micro-targeting and profiling can distort political deliberation through filter bubbles and subliminal persuasion, undermining democratic legitimacy. Finally, high-level incidents, such as the Facebook/Cambridge Analytica scandal (e.g., Nyabola, 2020) and instances of algorithmic censorship in both democratic and authoritarian contexts (Cevallos, 2025), illustrate how aggregated personal data can be weaponised to manipulate electoral outcomes or stifle dissent.

Societal harms differ from personal harms not only in scale but in their often indirect, diffuse, and accumulative character. Shelby et al. (2023) emphasise that such harms may occur downstream from the originating practices, are frequently experienced collectively, and may not be immediately recognized by those affected. Together, this literature positions societal-level platform harms as qualitatively distinct from individual privacy threats, demanding collective – and often regulatory – responses to safeguard democratic processes (Smuha, 2021; Shelby et al., 2023). Against this background, in this study, we define perceived societal harms as users’ beliefs – again, potentially diffuse – about the extent to which platform data practices threaten democracy in a broad sense. In doing so, we are interested in distinguishing between people’s recognition of collective-level risks and the more immediate individual-level harms addressed above.

Compensatory control theory and control preferences

Perceptions of personal and societal harm from datafication can unsettle a sense of order at both the individual and collective level (e.g., Dencik & Cable, 2017; Andrejevic, 2013; Smuha, 2021). Compensatory Control Theory (CCT) explains how people respond to such perceived threats: when primary sources of control appear compromised, individuals seek to restore order either through their own actions or by relying on external systems such as institutions (Kay et al., 2009; Landau et al., 2015). Thus, a key proposition of CCT is the substitution logic: when one source of control falters, people may shift toward another. The substitution mechanism provides the conceptual bridge to two preferred control outcomes: individual control, where the self is the control agent, and proxy control, where powerful others such as regulators act as the agent (Bandura, 2001; Xu et al., 2012). The preferred locus of control expresses normative orientations (i.e., where control should be located) rather than on respondents’ beliefs about the current distribution of control.

Individual control in platform environments can be approached from (at least) two perspectives. In the psychological tradition, it refers to an individual’s belief in their ability to take meaningful action to manage their digital footprint, in turn producing desired outcomes and preventing undesired ones through available tools (Skinner, 1996; Baruh et al., 2017). In the sociological tradition, such beliefs are understood as socially and structurally situated, reflecting the interplay between user agency and the structural constraints of platform environments (Giddens, 1984; Orlikowski, 2007). Our approach aligns with this latter view: we treat perceived individual control as the belief that ordinary users possess or lack meaningful power over the governance of digital data, recognising that these beliefs are shaped by the broader platform ecosystem in which they are formed (similarly, Pauer et al., 2024). Accordingly, we conceptualise preferred individual control as a belief that ordinary users ought to have greater capacity to govern their own digital data.

When individuals perceive harm but doubt the effectiveness of user control, they may prefer to outsource control to more capable entities (Bandura, 2001). Xu et al. (2012) characterise government legislation as “the most powerful approach for the execution of proxy control” (p. 1350). On a regulatory continuum, this ranges from “hands-off” self-regulation by corporations to full governmental authority over corporate data use (Bendix & MacKay, 2022; Milberg et al., 2000). By extension, we conceptualise preferred regulatory control as the belief that institutions should have greater authority over platform data practices (Miltgen & Smith, 2015; Okazaki et al., 2009).

From a CCT perspective, harm perceptions can increase support for either or both preferred control outcomes (H1–H4, see below), but the balance between them depends on which control agents are seen as currently effective or trustworthy. We address this in the next section as potential moderators of the harm – control preference relationship.

Key moderators

Perceived individual control

In contrast to preferred individual control as a normative expectation, perceived individual control (PIC) reflects beliefs about the current distribution of control, i.e. the extent to which ordinary users believe to possess or lack meaningful power over the governance of digital data. Meta-analytic evidence indicates that capability proxies such as privacy literacy are positively associated with protective behaviour, and that privacy concerns generally motivate self-protection (Baruh et al., 2017), suggesting that PIC enables harm to translate into self-directed responses. Xu et al. (2012) show that personal control can substitute for proxy control provided by legislation. Cross-domain evidence reinforces this: Pauer et al. (2024) demonstrate that when personal control is low, trust in authorities plays a stronger role in shaping threat evaluation and responses; Fritsche et al. (2022) review multiple studies in which low personal control fosters a turn toward collective or proxy control solutions.

Under CCT, when people feel personally in control of managing a threat, additional triggers have less impact on their desire for further self-directed control. High PIC therefore dampens harm-driven increases in preferred individual control. When PIC is low, harms are more likely to prompt a shift toward external solutions, strengthening harm–regulatory control links (Xu et al., 2012; Fritsche et al., 2022). When PIC is high, perceived harms should have a weaker effect on preferred individual control, as individuals already feel empowered to act. When PIC is low, harms should more strongly increase preference for regulatory control, as individuals turn outward for solutions. This logic underlies H1a–H4a (see Hypotheses).

Perceived regulatory control

Perceived regulatory control (PRC) refers to an individual’s belief that external authorities, and most notably governments, already have enough power to oversee platform data practices effectively. Xu et al. (2012) find that institutional assurances can increase perceived control and reduce privacy concerns, implying that high PRC dampens the perceived need for self-help. Milberg et al. (2000) show that low perceived adequacy of governmental involvement strengthens calls for stronger privacy laws. Jiang and Yang’s (2023) study of ride-hailing drivers in China found that perceived government regulation positively influenced drivers’ intention to participate in platform governance. Here, the perceived regulatory agency served as a safety signal that negative platform issues are being addressed (Jiang & Yang, 2023; Xu et al., 2012). In contrast, when regulatory bodies are perceived as lacking expertise or enforcement power relative to platforms (Neudert, 2023), their effectiveness as proxy control agents likely diminishes. Evidence from other domains supports the same substitution mechanism: Kay et al. (2010) demonstrate a substitution mechanism between external control systems, with threats to government stability prompting shifts to other external systems (belief in God/divine control), and Pinto et al. (2024) show that low perceived formal control efficacy amplifies support for alternative proxy control forms such as vigilantism (akin to individuals taking back control). Shockley and Fairdosi (2015) report that perceived proxy competence can buffer threat responses in participants with high PRC. Accordingly, we expect PRC to moderate harm–control preference relationships in two main ways. First, high PRC should weaken the association between perceived harm and preferred individual control, as effective oversight reduces the need for personal action. Second, low PRC should strengthen the association between perceived harm and preferred regulatory control, as weak oversight increases pressure for expanded intervention. This logic underlies H1b–H4b (see Hypotheses).

Institutional trust

Institutional trust refers to confidence that public authorities act in the public interest, are competent, and operate with integrity (Adams & Osman, 2023). Classic definitions treat trust as a willingness “psychological state comprising the intention to accept vulnerability based upon positive expectations of the intentions or behavior of another” (Rousseau et al., 1998, p. 395), and so do “irrespective of the ability to monitor or control that other part” (Mayer et al., 1995, p. 712). According to Mayer, Davis and Schoorman’s (1995) seminal model, trust is formed when an entity is perceived as able (i.e., having expertise in a relevant domain), benevolent (i.e., having good intentions) and displays integrity (e.g., by adhering to a set of principles). For the purposes of this paper, we treat institutional trust as a general orientation toward government as a credible and legitimate actor in managing data-related risks. We distinguish it from perceived regulatory control: trust concerns motives and aligns with the public interest, whereas PRC concerns capacity and effectiveness.

In risk management contexts, institutional trust has been shown to guide whether publics rely on institutional versus individual channels for addressing threats (Ahn & Noh, 2020). Shepherd and Kay (2012) find that high institutional trust attenuates the effect of perceived threat on personal control preferences while amplifying preference for institutional solutions. Pauer et al. (2024) show that when personal control is low, benevolence-based trust in authorities can reduce perceived threat and thereby weaken individual engagement with policy matters, consistent with trust functioning as a delegating heuristic. Lou et al. (2025) and Ahn and Noh (2020) also report that trust in managing authorities can directly promote engagement with institutional channels. Thus, under CCT, high trust in an external system can make it a more attractive target for compensatory control delegation following a threat. Conversely, high trust can also reduce the harm–individual control association, as individuals rely more on trusted institutions and feel less need to act themselves. Specifically, we expect high institutional trust to weaken harm–individual control and strengthen harm–regulatory control relationships. This logic underlies H1c–H4c (see Hypotheses).

Conceptual model and hypotheses

In sum, our hypotheses posit that both personal- and societal-level harm perceptions drive support for greater individual and regulatory control, but that these relationships are contingent on perceptions of control and trust in institutions.

Perceived personal harm will positively predict preferred individual control (H1). This effect will be weaker among individuals with (a) high perceived individual control (H1a), (b) high perceived regulatory control (H1b), and (c) high institutional trust (H1c).

Perceived personal harm will positively predict preferred regulatory control (H2). This effect will be stronger when perceived individual control is low (H2a), but weaker at high perceived regulatory control (H2b) and stronger at high institutional trust (H2c).

Perceived societal harm will positively predict preferred individual control (H3). This effect will be stronger among individuals with (a) high perceived individual control (H3a), but weaker at (b) high perceived regulatory control (H3b) and (c) high institutional trust (H3c).

Perceived societal harm will positively predict preferred regulatory control (H4). This effect will be stronger when perceived individual control is low (H4a), but weaker at high perceived regulatory control (H4b) and stronger at high institutional trust (H4c).

Method

Study context: Young people in the European Union

The data were collected in February and March 2021 via the online panel provider Respondi (N = 2,889) in six European countries: Germany, France, Greece, Italy, Poland, and Sweden. The countries included in the study were chosen following the logic of regional diversity of European Union (EU) countries in terms of geography (North/South/East/West) and size, bearing in mind similarities and differences in education systems and economic standards. We also strived to exemplify diverse media and communication regulations, following the categorization proposed by Humprecht et al. (2022) based on political, economic, media system, and regulatory dimensions. In our study, Germany and Sweden typify the “democratic-corporatist” country type, France and Italy the “hybrid” type, and Poland and Greece the “polarized pluralist” type. As such, our sample provides an opportunity to study a geographically and politically unified entity governed by the General Data Protection Regulation (GDPR). While we sampled these different countries to increase variance and improve the general EU-level estimation of associations, the goal was to test relationships that travel across contexts rather than to explain cross-national differences. Specifically, we were interested in how young Europeans, subjected to the EU’s standardised data protection framework, perceive individual and collective privacy threats. Although the EU strives for regulatory harmonisation and economic-social development convergence, variations among European countries persist, as evident in periodic Eurobarometer surveys (EU-wide population surveys on a variety of policy issues).

Young adults are a suitable population to study for several reasons. Firstly, they heavily engage with social media platforms for various purposes, including entertainment, sociability, lifestyle, and politics (Bolin, 2017; Hargittai & Marwick, 2016), thereby continuously generating abundant behavioural data that can be commodified. As such, the current youth generation constitutes a cohort socialised into wide commodification of user data (Bolin, 2017), often willingly sharing information to optimize services like public transport and healthcare (European Commission, 2020) or news exposure (Schaetz et al., 2023). However, this generation has also grown up in a time of increased public attention towards the risks of data collection and regulations regarding privacy and data processing (European Commission, 2021). Lastly, considering the heightened awareness surrounding societal impacts of climate change, as exemplified by the climate movement led by young people, we anticipate that individuals aged 18 to 30 may demonstrate awareness of both personal and broader societal consequences associated with data commodification, akin to the awareness seen in discussions on climate change. According to the European Qualification Framework (EQF), out of the participants in our sample, 18.8% had a low level (i.e., primary or lower secondary), 53.9% had a medium level (i.e., upper secondary or post-secondary non-tertiary), and 27.3% had a high level (i.e., Bachelor’s, Master’s, or doctoral degree) of education.

The survey was the same across all countries. The original survey was developed in English and then translated into the national languages of the selected countries with the support of cooperation partners in the respective countries and professional translators at online panel provider company Respondi. For a more detailed overview of the methodological approach, see Gagrčin et al. (2021).

Measures

Independent variables

Personal harm perceptions were measured using four items (ω = .86) adapted from Boerman et al. (2021), asking participants “To what extent do you think that the following may harm you?” regarding social media companies: (1) collecting data about online behaviour, (2) using data for political advertisements, (3) sharing data with other companies, and (4) sharing data with the government (1 = “not at all” to 7 = “to a very large extent”). The items reflected a one-dimensional latent variable according to Confirmatory Factor Analysis (CFA; ω = .86). Societal harm perceptions used the same four items but asked about harm to democracy (ω = .86).

Moderators

Perceived individual control¹was measured with a single item from Pew Research Center's American Trends Panel (Auxier et al., 2019): “In your view, how much power do individual users have in deciding what happens to our digital data?” (1 = “completely powerless” to 7 = “completely powerful”; M = 3.83, SD = 1.66). The same wording was used to measure perceived regulatory control, only asking for government power²(M = 4.44, SD = 1.56). Institutional trust was assessed with a single item from the International Social Survey Programme: Citizenship II (ISSP Research Group, 2016): “Overall, to what extent do you trust the government in your country?" (1 = “completely distrust” to 7 = “completely trust”; M = 3.54, SD = 1.78).

Dependent variables

Preferred individual control and preferred regulatory control were measured using single items adapted from Pew (Auxier et al., 2019), asking “How much power should these actors have in deciding what happens to our digital data?” for users (M = 5.36, SD = 1.65) and government (M = 4.53, SD = 1.67), respectively, on the same 7-point scale.

Control variables

We controlled for age (M = 24.71, SD = 3.77), gender (50% female), subjective social class using Kraus et al.’s (2009) ladder measure (M = 5.84, SD = 1.92), minority status (9% identified as minority), and country of residence. Participants were residents of either Germany (n = 481), France (n = 487), Greece (n = 477), Italy (n = 483), Poland (n = 463), or Sweden (n = 498). In order to distinguish perceptions of personal capacity from structural agency, we use privacy self-efficacy (ω = .85) adapted from Boerman et al. (2021) – understood as a respondent’s perceived ability to enact privacy behaviours – as a covariate (since capability typically shifts baseline propensities rather than conditioning the harm, see Baruh et al., 2017; Ahn & Noh, 2020). We asked about the extent to which people agree/disagree with the following statements: “I am able to protect my personal information online,” “I feel confident that I can secure my privacy online,” and “I can ensure that companies cannot collect my personal information online.” By controlling for self-efficacy, we ensure that our key moderation tests (perceived individual control and perceived regulatory control) capture structural beliefs about who holds power over data practices.

Analysis

Since our primary predictors and outcomes were latent variables, we chose Structural Equation Modelling (SEM) to test our hypotheses. Although our data were nested within countries, we decided against a multilevel model for two reasons. First, we did not aim to explain differences between the countries in our sample, and how these differences interact with our variables of interest. Second, with only six countries, there were too few observations at Level 2 for robust modelling (Maas & Hox, 2005). We ultimately created a fixed-effects SEM, using dummy variables to control for the differences between countries (see Measures section).

To avoid inflated estimates, we first checked for possible multicollinearity among all predictors in the model. The only problematic relationship was found between perceptions of individual and societal harm (τ = .72), and this was handled by letting them covary in the model. We then created the SEM, which fit the data sufficiently well (Gibbs et al., 2023; Kay et al., 2009), 𝛘2(257) = 1412.688, p < .001, CFI = 0.964, RMSEA = 0.04, 90% CI = [0.042, 0.046], SRMR = 0.03³. Figure 1 visualizes the SEM and significant paths, and Table 1 contains all model coefficients.

Results

The results showed that participants from Greece (β = -0.141, 95% CI [-0.198, -0.084], p < .001), Poland (β = -0.117, 95% CI [-0.177, -0.056], p < .001), and Sweden (β = -0.101, 95% CI [-0.156, -0.046], p < .001) wished for less individual data control than participants from Germany. The opposite applied to regulatory data control, with participants from France (β = 0.072, 95% CI [0.019, 0.125], p = .008), Greece (β = 0.147, 95% CI [0.092, 0.201], p < .001), Italy (β = 0.106, 95% CI [0.053, 0.160], p < .001), and Sweden (β = 0.057, 95% CI [0.003, 0.112], p = .04) scoring higher than participants from Germany.

Contrary to H1, perceived personal harm was negatively associated with the preferred individual control (β = -0.129, 95% CI [-0.188, -0.07], p < .001). This unexpected finding suggests that as individuals perceive greater personal harm, they become less inclined to seek individual control. The relationship between personal harm and preferred individual control was negatively moderated by perceived individual control (β = -0.077, 95% CI [-0.145, -0.009], p = 0.025), supporting H1a and indicating that individuals who already feel some level of control are even less likely to pursue additional individual control mechanisms. Perceived regulatory control (H1b; β = 0.050, 95% CI [-0.018, 0.117], p = 0.149) and institutional trust (H1c; β = 0.002, 95% CI [-0.068, 0.071], p = 0.959) did not significantly affect the relationship between personal harm and preferred individual control.

Further, we found no overall relationship between perceived personal harm and preferred regulatory control (H2; β = 0.055, 95% CI [-0.002, 0.113], p = 0.057). However, this null main effect masks a conditional pattern: the relationship was stronger when perceived regulatory control was high (H2b; β = 0.078, 95% CI [0.025, 0.131], p = 0.004). Perceived individual control (H2a; β = 0.016, 95% CI [-0.039, 0.072], p = 0.562) and institutional trust (H2c; β = -0.048, 95% CI [-0.105, 0.009], p = 0.097) did not significantly affect the (null) relationship between perceived personal harm and preferred regulatory control.

Perceived societal harm was positively associated with preferred individual control (β = 0.384, 95% CI [0.324, 0.443], p < .001), providing support for H3. This association was negatively moderated by perceived regulatory control (β = -0.088, 95% CI [-0.154, -0.021], p = 0.010), corroborating H3b. H3a and H3c were not supported, indicating no significant moderating effects of perceived individual control (β = -0.012, 95% CI [-0.080, 0.055], p = 0.719) and institutional trust (β = -0.055, 95% CI [-0.125, 0.014], p = 0.120) on this relationship.

Finally, H4 was supported: perceived societal harm was also positively associated with the preferred regulatory control (β = 0.119, 95% CI [0.061, 0.178], p < .001). This relationship was positively moderated by institutional trust (β = 0.061, 95% CI [0.004, 0.118], p = 0.037), supporting H4c, but negatively by perceived regulatory control (β = -0.116, 95% CI [-0.170, -0.062], p < .001), supporting H4b. We find no evidence for a moderation by perceived individual control (H4a; β = 0.005, 95% CI [-0.051, 0.061], p = 0.870).

Note. Interactions are printed in italics; control variables are printed in grey.

Note. All displayed effects are significant at p < .05.

Discussion

This paper set out to explain how perceptions of data harms map onto preferences for who should exercise control over platform data practices. Drawing on control theory and compensatory control theory, we argued that both personal and societal harm perceptions could trigger demands for control, but that the balance between individual and regulatory loci would depend on beliefs about existing control and trust in institutions.

A first, integrative takeaway is that personal and societal harm perceptions are not only conceptually but also empirically close. Sitting under conditions of complexity and data uncertainty where outcomes and probabilities are hard to specify and harms can be diffuse and cumulative (Stirling, 2019; Shelby et al., 2023), personal and societal harm are strongly correlated, which likely reflects a common risk appraisal about the digital environment. Still, they feed into different control preferences, meaning that while related, they are not isomorphic, and shouldn’t be treated as a proxy for the other but rather kept analytically distinct.

Against H1, we find that perceived personal harm is negatively associated with preferred individual control. Self-focused harm appears to erode perceived efficacy at the individual locus, thus making “more settings, more consent” less attractive when harm is salient. This reading is reinforced by the negative moderation effect of perceived individual control (H1a), as well as the negative correlation between privacy self-efficacy (controlled for) and preferred individual control. Although we did not directly measure resignation, surveillance realism, or algorithmic alienation (perceived individual control serves as a proxy for these dynamics, albeit an oversimplified one), they can help interpret this finding. Privacy resignation might explain why citizens may abandon individual control efforts when they perceive the task as overwhelming (Draper & Turow, 2019); surveillance realism reflects the recognition that datafication is inescapable (Dencik & Cable, 2017), while algorithmic alienation -where individuals become separated from their data as data becomes “a power on its own” (Marx, 1974, p. 325, as cited in Andrejevic, 2013) - how users lose connection to their data through opaque aggregation and analysis processes. Put simply: once people feel they already do what can be done, additional levers seem futile in the face of fundamental limitations of personal measures against massive data harvesting and appropriation (Couldry & Meijas, 2019; Zuboff, 2019). In this sense, the result does not overturn the CCT but rather signals a boundary condition, suggesting that individual control preferences may decline when harm salience coexists with a sense of already “doing all one can.” Future work could operationalize these concepts as distinct but related dimensions the erosion of individual efficacy in the face of datafication: alienation as an expression of the structural relationship between users and their data, realism reflecting the cognitive assessment, and resignation the affective response (see also Gagrčin et al., 2024 for a similar dimensionalisation).

Further, we found no significant relationship between personal harm perception and preferred regulatory control (H2). At the same time, and in contrast to H2b, this relationship was stronger when perceived regulatory control was high. Since our measure of perceived regulatory control indexes perceived capacity, this moderation can be read as a boundary condition. CCT predicts shifts toward external agents when those agents are seen as efficacious, so when citizens experience resignation, develop realism about structural limitations, and feel alienated from their data, they may perceive data governance as beyond both individual and governmental control, particularly under conditions where even regulators face significant information asymmetries compared to platforms (Neudert, 2023). In other words, endorsement of regulation is contingent on perceived regulatory capacity and trust, not merely on perceived harm.

By contrast, societal harm predicts higher preference for both individual and regulatory control, in line with H3–H4. The positive link between societal harm and individual control is a classic CCT effect: when external order looks shaky, people upweight personal agency to reassert predictability. In addition, since research shows that privacy concerns predict protective behaviour (Baruh et al., 2017), so too can a rise in broad, system-related concern plausibly increase desire for individual safeguards. The supported H4 aligns with previous findings that perceptions of harm extending beyond the individual relate to support for restrictive policies (Snider et al., 2021) and governmental regulation (Huang & Cao, 2023; Riedl et al., 2022). Together, H3–H4 suggest that collective threats do not necessarily crowd out personal agency but prompt people to hedge at multiple control instances (e.g., Goode & Keefer, 2016; Rodríguez-López et al., 2022). This is also in line with Shelby et al. (2023) who show that harms are experienced across micro–meso–macro levels and can travel between them, so simultaneous responses at multiple control loci are theoretically plausible.

Both H3 and H4 relationships were weaker when respondents perceived regulators as already effective (H3b, H4b), consistent with a substitution–safety signal account: when authorities are seen as already effective, the marginal need for extra control (whether individual or regulatory) diminishes (Ahn & Noh, 2020; Xu et al., 2012). In contrast, institutional trust strengthened the relationship between societal-harm and preferred regulatory control (H4c), consistent with delegating control to credible institutions (Auxier et al., 2019). However, institutional trust shows no moderating effect on societal harm-individual control relationship. This pattern is also consistent with work showing that when domains feel complex and people feel dependent, trust in government rises and functions as a cue for delegation rather than self-help, thus orienting citizens toward institutional solutions and, potentially, avoidance of the threatening topic altogether (Ahn & Noh, 2020; Shepherd & Kay, 2012). In our setting, that helps explain why trust strengthens the move to regulation but does not alter the impulse to demand for individual control. Together, these patterns suggest that responses to system-level threats are layered: people hedge with personal control mechanisms and back collective solutions, but the strength of each route depends on whether regulators are seen as powerful and trustworthy enough.

The strong relationship between harm perceptions and regulatory oversight might also reflect our research context across six EU countries that may have “a strong reputation for enforcing government legislation” (like Singapore in Xu et al., 2012, p. 1358). However, we find some notable cross-country differences: France, Greece and Italy demonstrated stronger preferences for regulatory data control compared to Germany, while respondents from Greece, Poland, and Sweden showed comparably lower preferences for individual data control mechanisms. These cross-national differences underscore that specific national contexts matter for citizens’ perspectives on data governance (Arner et al., 2022; Dammann & Glasze, 2023), suggesting that while European citizens broadly recognize the relationship between societal harm and regulatory needs, their approaches to proxy control vary significantly (Xu et al., 2012). Future research should consider multilevel analyses that account for country-specific regulatory traditions, cultural attitudes toward privacy, or other institutional factors explaining these differences. That said, it should be noted that while our theoretical lens applies to adults generally, results here should be interpreted within the scope of a young-adult sample. The patterns we observe may differ among older cohorts with distinct digital socialisation histories (Bolin, 2017), so a replication with more age-diverse samples is warranted.

Taken together, individual and regulatory control read as complementary rather than competing approaches, whose relative weight depends on perceived control and trust. The negative relationship between personal harm and preferred individual control signals that at the level of the self, young Europeans see diminishing returns to user-centric levers when harms feel diffuse and structurally produced; at the same time, societal-harm salience moves along with support for both personal and policy levers, with perceived regulatory control and institutional trust governing how much extra control people want to layer on.

In terms of policy, our study suggests that because individual and societal harm perceptions are closely related but not interchangeable, regulators should treat them as distinct inputs when designing interventions. Measures that only address individual protection may fail to mitigate perceived harms at the collective level, while interventions aimed to protect society at large may not address individual-level dynamics. Specifically, an overreliance on individual control mechanisms (such as consent requirements and transparency tools) in regulatory approaches are not only insufficient but might even be counterproductive. For people who already perceive privacy related harms, individual control mechanisms may feel like band-aid solutions that fail to address deeper structural issues. That is, individual control mechanisms inadvertently shift the burden of data governance onto citizens, asking them to navigate opaque algorithmic processes, rather than addressing the conditions that give rise to data appropriation in the first place. Worse, they may legitimize data harms by framing them as acceptable so long as a formal consent process has been followed. Our results further indicate that societal harms are drivers of both individual and collective preferences for stronger governance. This underscores the importance of addressing societal dimensions of data harms in regulatory frameworks. Risk-based regulatory frameworks, such as the EU AI and Digital Services Act, represent an important step in this direction, as they rightfully recognize the need for societal-level protection and attempt to confront the conditions that generate both individual and collective harms.

Limitations

Let us start with obvious shortcomings: our cross-sectional design limits our ability to establish causality or track evolving perceptions and our data are from 2021 and thus may not fully reflect more recent shifts in public discourse, policy developments, and technological adoption, especially in regards to AI. While we acknowledge these limitations, we argue that this period captures a uniquely informative snapshot: the widespread use of digital health management tools heightened concerns about government intrusion and corporate surveillance, while making tensions between individual and societal data harms (particularly the trade-off between public health protection and privacy rights) especially visible. Secondly, the fundamental relationships we identify between perceived harms and regulatory preferences likely remain relevant to current policy discussions given the stable nature of such attitudes. Nevertheless, as the EU continues to implement and refine its approach to AI regulation and platform governance, longitudinal studies are needed to track shifts in citizens’ perceptions of harm and control preferences over time, while accounting for additional variables like ideology and algorithm literacy (Gagrčin et al., 2024; Huang & Cao, 2022).

Further, several measurement limitations warrant acknowledgment. First, unlike individual control (where people have tangible experiences with privacy settings), assessing regulatory effectiveness involves complex institutional factors most individuals presumably do not engage with deeply. Second, several key constructs are measured using single items. While we have taken steps to ensure statistical validity regardless, we recognize that multi-item scales would better capture these constructs’ full dimensionality. Third, our focus on national governments overlooks the multilevel governance reality in Europe, where the EU plays a crucial regulatory role. Though we provided, in our opinion, compelling reasons for this approach, especially given our young sample, excluding EU institutions may misrepresent how young Europeans conceptualise regulatory control. Further, our predictors use an abstract frame (“ordinary users”), while personal harm is self-referent. Here, we acknowledge that difference in item framing can induce third-person perceptions and shift absolute levels. Future work should compare self vs abstract wording within respondents. While we distinguish between individual and societal harm, our measures do not capture the full spectrum of potential harms (e.g., Shelby et al., 2023) that might influence control preferences differently. This calls for more contextual, domain-specific, and potentially platform-specific approaches to harm perceptions and control preferences (Gagrčin et al., 2024).

Finally, while we discuss complexity and uncertainty as structural features of platforms that theoretically shape how harms are perceived, we did not directly measure uncertainty or complexity perceptions. Because these factors served as contextual framing rather than testable mechanisms, we believe that this limitation does not affect our main results. Still, future research should assess perceived uncertainty as a potential antecedent or moderator of harm appraisal and control preferences. We also do not measure dispositional need for control, which is relevant for understanding individual experiences under uncertainty; PIC, PRC, and institutional trust capture beliefs about who can act effectively, not the underlying control motive. Incorporating direct measures of perceived uncertainty and control dispositions would allow future work to clarify the psychological pathways through which data harms translate into control preferences.