Public information sharing in enterprise social networks: a communication privacy management perspective

The adoption of social networks (SNs) like Meta (Facebook), WeChat and Twitter in the business environment has spawned enterprise social networks (ESNs). Enterprise-led information technology (IT) platforms such as Workplace, WeCom and DingTalk allow employees to share information and collaborate (Leonardi, 2015; Wang et al., 2019). The coronavirus disease 2019 (COVID-19) pandemic has further increased the adoption of ESNs, wherein 81% of enterprises and nearly 100% of Fortune 500 companies use ESNs to share information (Goswami, 2023). ESNs effectively enable information sharing, but their rapid information dissemination poses challenges for information boundary management (Zhou et al., 2023). ESN users need to be mindful of information boundary management, as incorrectly managed information boundaries can cause serious problems. For example, in 2021, a misconfiguration in Microsoft Power Apps' setting led to 38 million pieces of sensitive information being exposed, affecting American Airlines, J.B. Hunt and several government bodies. Microsoft then changed the default “keep publicly accessible” information-control setting on Power Apps (Endicott, 2021).

Information sharing in ESNs, which involves two or more employees cooperating to exchange information (Laitinen and Sivunen, 2020), puts enterprises at risk of confidential information leakage (Golbeck, 2015), thereby justifying the study of information control in ESN contexts. Reducing information risk does not mean hiding information completely, but rather effectively managing information boundaries and controlling information access (Lin and Armstrong, 2019). Information control is the right to create information boundaries that limit access to personal information (Golbeck, 2015). Most ESNs feature information-control settings that can help users avoid confidential information leakage (Schwartz-Chassidim et al., 2020).

While researchers have increasingly recognized the importance of information control in ESNs (Fiesler et al., 2017), the emerging contexts and hard-to-observe information-control practices in ESNs pose three key challenges for studying information-control behaviors. First, most studies have explored the disclosure of ESN users' identity, workplace and location (Chen et al., 2020; Li et al., 2020; Pu et al., 2020), which parallels Internet privacy in general SNs (Ball et al., 2012) and are highly correlated with personal attributes. They failed, however, to capture the business attributes of information privacy in ESN information control, which if not managed properly, can lead to confidential information leakage (Bélanger and James, 2020; Golbeck, 2015). Second, existing studies have focused on a crucial information-sharing channel, “profile pages” (Venkatanathan et al., 2014), while considering information control in ESNs as static information disclosure on these profile pages. What they ignored is the non-stop information broadcasting that occurs in channels such as “wall posts” (Venkatanathan et al., 2014), where ESN users continuously employ different information-control settings that evolve to adapt to specific contexts (Wang et al., 2022). Finally, some studies have focused on users' sentiments (e.g., psychological expressions) when voicing concerns about information leakage, where they have reported intentions that were unverified (Habib et al., 2019; Wang and Fussell, 2020). Users' actual behaviors, however, rarely reflect this level of anxiety (Keith et al., 2014), a discrepancy known as the “privacy paradox” (Barth and de Jong, 2017; Duan and Deng, 2022). This underscores the need to use actual behaviors to accurately identify the mechanisms underlying users' information control in ESNs.

With increased attention to information control, some theories employed include privacy calculus proposed by Laufer and Wolfe (1977). They argued that willingness to share information is based on a rational trade-off between perceived risks and expected benefits, where individuals will share information when they perceive such benefits are worth the risks (Chen, 2018; Dinev and Hart, 2006). Privacy calculus, however, does not explain how risks and benefits work together in any given context, making it difficult to identify more factors that can explain the information privacy phenomenon, especially in the current IT environment. Anderson and Agarwal (2011) and Chen et al. (2020) suggested that the communication privacy management (CPM) theory, which incorporates other factors that emphasize motivation and context, is needed to gain a comprehensive understanding of information privacy issues. CPM theory is a framework developed by Petronio (1991) to fully explain how individuals manage their information boundaries and decide with whom to share information. The theory's emphasis on how boundary control should be responsive to immediate changes in context is highly relevant to ESN user practices, which emphasize the need to adapt information-control strategies to specific contexts. The theory describes the core maxim of information boundaries and clarifies criteria such as motivation (the intrinsic impetus to maintain boundaries), context and its immediate changes and the risk-benefit ratio when governing such boundaries (Petronio and Durham, 2015).

This study focuses on wall posts that provide users with an information-control interface to choose between public, private and custom settings (Figure 1). Given the work-oriented nature of ESNs and the business communication function of the wall posts channel, the study merges private settings (which are rarely found in practice) into custom settings and explores this public-custom binary (Fiesler et al., 2017; Golbeck, 2015). The study first applies CPM theory to theorize the factors affecting users' public sharing behavior and develops a model incorporating interaction effects. The model shows that users' disposition to value information refers to how users dispose of different information (Bassellier et al., 2015), reflecting their intrinsic need to manage information boundaries (Xu et al., 2011). Work-relatedness and information richness (which reflect immediate changes in the ESN context) can improve users' understanding of information-control issues (Xu et al., 2011). Such understanding may override their pre-existing disposition to value information Kehr et al. (2013). The risk-benefit ratio is also crucial (Chen et al., 2020; Li et al., 2020; Lin and Armstrong, 2019). The study validates the information-control strategy using actual behavioral data, and the results mainly confirm the direct and interaction effects, and it also deepens the theoretical research on CPM theory, expands the research boundaries of information-control behavior and can guide user information-control practices.

ESNs users' information-control behavior is related to information control in ESNs and CPM theory. This study explores the research and findings in these two areas.

Information control in SNs asserts the individuals' right to control information, allowing them to create information boundaries that limit others' access and reduce information leakage risk (Golbeck, 2015). SN users rely on information-control settings to target specific audiences (Schwartz-Chassidim et al., 2020), settings that are also used in ESNs. ESNs are the socialization of the enterprise and integrate SNs into the workplace (Wang et al., 2019). Their work-oriented nature prevents the autonomy that general SNs afford, as employees must authenticate using real names and preclude information sharing across multiple accounts (Vitak et al., 2012). ESN users are thus more concerned about confidential information leakage (Golbeck, 2015; Smith and Brunner, 2017). SN users can avoid information leakage by not sharing, but due to business processes, employees must share certain confidential information, making proper information-control settings even more important (Lin and Armstrong, 2019). Furthermore, ESNs' information-control focuses more on task- and project-related business attributes of information privacy in work scenarios than on highly private attributes of Internet privacy (e.g., real name and address) in SNs (Ball et al., 2012). These distinctions reinforce the need to study information control in the ESN-specific context (Vitak et al., 2012).

Research on information control in ESNs has revealed three main trends. First, studies have mainly focused on Internet privacy rather than information privacy in work scenarios (Ball et al., 2012). They discussed the fixed information disclosures posted on profile pages and the privacy risks arising from sharing information such as identity, workplace and location (Chen et al., 2020; Li et al., 2020; Pu et al., 2020; Wang et al., 2022). They did not address continuous information sharing or the adaptability of information control to changes in information privacy under specific contexts (Bélanger and James, 2020). Second, the antecedents of information control have not received sufficient attention, as most studies explored the endogenous and exogenous reasons for users' information sharing (Laitinen and Sivunen, 2020; Smith and Brunner, 2017). Choosing an appropriate information-control setting, however, has been viewed as superior for protecting information than not sharing it at all (Lin and Armstrong, 2019). That is, merely looking at whether users share information does not fully explain the information-sharing phenomenon (Schwartz-Chassidim et al., 2020). Third, a few studies on information control focused on users' reported sentiments and intentions without subjective verification (Keith et al., 2014; Wang and Fussell, 2020). Wang and Fussell (2020) conducted interviews to ascertain participants' privacy attitudes and noted that information control is a cognitive process that depends on information perception. The privacy paradox has indicated considerable differences between expressed attitudes and actual behaviors (Barth and de Jong, 2017), thus confirming how information-control intentions are poor predictors of behavior (Acquisti and Grossklags, 2004; Keith et al., 2014). This highlights the importance of using actual information-control behaviors rather than self-reported surveys (Schwartz-Chassidim et al., 2020). Furthermore, ESNs users need to put more effort into their use of information-control settings, yet little research has focused on this complex mechanism.

This study focuses on a specific aspect of information-control behaviors in ESNs: how employees manage shared information in their wall posts using information-control settings, which manifest as whether to share information publicly in immediately changing contexts. This study points out the importance of using actual behavioral data to analyze users' information-control mechanisms in ESNs. Exploring the public-custom binary is still a reasonable approach (Fiesler et al., 2017; Golbeck, 2015), although such mechanisms are complex. This is because the work-oriented nature and drive for business communication in ESN wall posts lead employees to limit their use of the private option.

Petronio's (1991) CPM theory explains information-sharing decisions by incorporating complex concepts of information boundary, boundary coordination and boundary turbulence while asserting that individuals can determine with whom to co-own information. The core maxim is the shared information boundary, which is co-created between owners and confidants who have control over access to information (Hinde and Ophoff, 2020). Shared information boundaries vary from being completely open to closed depending on the situation, thereby allowing for information to be shared publicly or kept private (Xu et al., 2011). The boundary thickens when public sharing is undesirable and information flow is restricted and thins when public sharing is encouraged and information flows freely (Petronio and Durham, 2015; Xu et al., 2011).

CPM theory articulates five boundary rules, categorized as “core” and “catalytic” (Petronio and Durham, 2015). Core rules are more durable and include cultural values and gender orientation, whereas the catalytic rules include motivation, context and risk-benefit ratio, which are more responsive to changes as circumstances require. The current study focuses on catalytic rules, as cultural values are not considered due to cultural homogeneity (Li et al., 2020; Xu et al., 2011), and gender is included as a control variable (Lin and Armstrong, 2019; Liu and Wang, 2018; Xu et al., 2011).

Motivation and context are found to influence information boundary formation (Petronio, 1991, 2002). Motivation reflects the individual intrinsic need to maintain information boundaries (Karwatzki et al., 2017; Xu et al., 2011), which is linked to an individual-specific factor and is associated with dyadic effects, reciprocity and rewards (Petronio, 2002). Factors such as trust (Petronio, 1991, 2002), commitment, reputation (Chen et al., 2020) and the disposition to value information (Kehr et al., 2013; Liu and Wang, 2018; Xu et al., 2011) have been identified as individual-specific. Context is shaped by physical, social and environmental factors (Petronio, 1991), while shocks-to-life circumstances can explain changes in immediate demand in certain situations, such as a new work environment or a new business process (Petronio, 2002). This study explores an ESN wherein users' physical and social macro-environment converges. The research is aligned with Laitinen and Sivunen's (2020) finding: immediate changes in context will pertain to the users' perceived micro-environment during information sharing (Xu et al., 2011). CPM theory also proposes that coexisting benefits and risks affect information boundaries (Petronio, 2002), where benefits can include self-presentation (Min and Kim, 2015), satisfying needs (Christofides et al., 2009), or gaining recognition (Christofides et al., 2009; Li et al., 2020); risks are potential losses (Malhotra et al., 2004; Xu et al., 2011) such as information leakage or misuse (Chen et al., 2020).

CPM theory has been applied to explain information privacy issues arising from new IT (Anderson and Agarwal, 2011; Li et al., 2020; Lin and Armstrong, 2019). It is also applicable when exploring employees' perceptions of privacy violations (Hinde and Ophoff, 2020) or context-specific limitations of information disclosure in the workplace (Smith and Brunner, 2017). Researchers who have applied CPM theory to ESNs, however, have focused more on information-sharing intentions, including facilitators and limitations of information-sharing (Laitinen and Sivunen, 2020). They did not incorporate information-control behaviors or consider that information control should be adapted to contextual changes. Furthermore, existing studies generally explored the independent effects of each boundary rule (Chen et al., 2020; Laitinen and Sivunen, 2020; Li et al., 2020) and reveal little about possible internal associations (Anderson and Agarwal, 2011; Krämer and Haferkamp, 2011; Lin and Armstrong, 2019). There have been calls to explore how motivational factors are overridden by contextual conditions, however (Kehr et al., 2013). These points have served as directions for the application and development of CPM theory in this study.

The proposed research model is based on ESN information-control research and CPM theory, as shown in Figure 2. It focuses on the three boundary rules that determine public sharing: the individual-specific factor (disposition to value information), context-specific factors (work-relatedness and information richness) and risk-benefit ratio (public benefit and public risk). Previous studies have explored the disposition to value information (Bassellier et al., 2015) and its relation to public sharing (Liu and Wang, 2018; Malhotra et al., 2004). Information-control issues are better understood in specific contexts (Xu et al., 2011) and factors such as work-relatedness and information richness need to be considered. Following Anderson and Agarwal (2011), this study designates context-specific factors as moderators and expects them to interact with the disposition to value information in influencing public sharing. Lastly, individuals perform “mental calculus” when managing information boundaries through trade-offs between benefits and risks (Laufer and Wolfe, 1977).

This study applies disposition to value information to the general practices of ESN users to protect the “information space” (Xu et al., 2011), which is initially concerned with awareness and perceptions related to information leakage (Campbell, 1997). Disposition to value information is the individual-specific factor that contributes to boundary formation (Petronio, 2002). Barth and de Jong (2017) proposed that information boundary decisions are driven by the disposition to value information (Kehr et al., 2013; Xu et al., 2011). Users inherently pay attention to information differently and show varied information disposal practices. The more attention users pay to information, the more cautious they are in information sharing, thus displaying a higher disposition to value information.

Information privacy studies have indeed confirmed that users with a high disposition to value information are deeply concerned about information privacy (Malhotra et al., 2004) and are more likely to limit sharing to avoid social punishment or disapproval (Min and Kim, 2015). Such users also exhibit higher IT proficiency (Bassellier et al., 2015), as those with greater knowledge of ESN functions will be more likely to use them to discreetly dispose of information (Saraf et al., 2007; Schwartz-Chassidim et al., 2020; Xu et al., 2011). In contrast, those with a low disposition to value information are less concerned with controlling information, do not seek to understand ESN functions and tend to share information more widely (Saraf et al., 2007; Xu et al., 2011). Moreover, Malhotra et al. (2004) demonstrated that users with higher concern for privacy were less likely to trust information sources (Chen, 2018), despite not finding a direct effect of the disposition to value information on information-sharing behavior. Regardless, it can be inferred that users with a higher disposition to value information in ESNs will limit boundaries when sharing information and are less likely to share it publicly (Saraf et al., 2007). This study thus proposes the following hypothesis:

Information sharing on work-oriented ESNs is greatly impacted by the context of the content (Laitinen and Sivunen, 2020). Work-related information on such platforms is a context-specific factor, and studies have shown that some users will share more work-related information to complete work due to the visibility of ESNs (Forsgren and Byström, 2018; Yang et al., 2021). Non-work-related information sharing can nonetheless positively affect employees' organizational engagement (Zhang et al., 2019) and innovation performance (Sun et al., 2021), leading users to appropriately share such information. Different information-control settings are used for work-related and non-work-related information for effective communication and privacy protection (Sun et al., 2021). The professional aspect of work-related information, however, suggests it is usually not shared publicly (Fox and McEwan, 2017; Liu and Kang, 2017) due to its sensitivity (Anderson and Agarwal, 2011; Malhotra et al., 2004). Liu and Kang's (2017) online experiment found that ESNs stimulate employees to share professional information with specific colleagues. Such custom sharing of information leads to more interpersonal attribution and projects a professional image that can gain respect from colleagues (Lee et al., 2019; Liu and Kang, 2017). Information privacy in work scenarios reflects important context considerations (Smith et al., 2011), as work-related information is often more sensitive (Anderson and Agarwal, 2011). Malhotra et al. (2004) and Anderson and Agarwal (2011) argued that all else being equal, sensitive information is more threatening to user information security (Cichy et al., 2021), negatively affecting users' public sharing in ESNs. This study therefore proposes:

Another important factor of ESNs is information richness, as supported by the media richness theory (MRT) proposed by Daft and Lengel (1986). MRT emphasizes the ability of the media's information load to facilitate understanding, wherein information richness manifests as differences between required and available information (i.e., uncertainty) and multiple conflicting interpretations (i.e., equivocality). ESNs can avoid such conflicting values (Krämer and Haferkamp, 2011) by properly managing information uncertainty (Yee et al., 2021) and providing equivocal information. High information richness leads to low uncertainty and is more likely to be misused (Liu and Wang, 2018), which can cause individuals to reduce sharing information publicly in general SNs (Hofstede, 2001). In work-oriented ESNs, however, relatively stable communication among colleagues can help avoid rich information misuse due to the implementation of real-name authentication and strict privacy policies (Li et al., 2020; Karwatzki et al., 2017). Sharing high-richness information publicly in ESNs can not only reduce uncertainty and equivocality (Daft and Lengel, 1986) but also narrow the imagination space (Lee et al., 2019) and decrease misunderstandings and value conflicts (Xu et al., 2011). The visibility of ESNs also helps to facilitate knowledge transfer and enhance users' online presence (Leonardi, 2015; Luo et al., 2017). Overall, richer information in ESNs can be more effectively interpreted and understood (Fiesler et al., 2017; Zhou et al., 2021) and can stimulate public sharing. Accordingly, this study proposes:

Research has indicated that the pre-existing disposition to value information may be overridden by contextual factors in ESNs (Kehr et al., 2013), as shown in this study. The disposition to value information is therefore presumed to interact with work-relatedness and information richness while acting on public sharing. Anderson and Agarwal (2011) proposed a CPM theory-based empirical model, hypothesizing that information sensitivity and privacy concerns affect the willingness to share health information. Their findings have suggested that compared to health information at the same sensitivity level, work-related information in ESNs is more sensitive, and its impact on public sharing is definitive (Fox and McEwan, 2017). Accordingly, it can be assumed that when the information shared is non-work-related, users' disposition to value information has a stronger negative effect on public sharing as the disposition to value information rises. A stronger negative effect on public sharing should exist for work-related information, while the negative effect of the disposition to value information on public sharing is diluted. That is, the negative effect of the disposition to value information on public sharing is weakened as work-relatedness increases. This study thus proposes:

Krämer and Haferkamp (2011) observed a conflict between providing rich information and the disposition to value information, which is seen as a barrier to sharing information publicly. After investigating privacy concerns and impression construction on SNs, they found that sharing rich information matches the goal of providing a detailed and accurate impression (Leonardi, 2015), but contradicts strategies to protect information privacy. According to MRT, rich information provides more means to communicate, including visual cues, compared to information with low richness (Zhou et al., 2021). This stimulus makes users more likely to ignore the negative effects of pre-existing disposition to value information. That is, the disposition to value information plays a stronger negative role for information with relatively low richness, as low-richness information implies greater uncertainty and users are less likely to share it publicly to avoid potential misunderstandings and conflicts. Nevertheless, as information richness increases, the negative role of disposition to value information gradually decreases, and users are more likely to share information publicly. Therefore, the study predicts:

CPM theory states that when users create or modify information boundaries, they weigh the benefits and risks (Laufer and Wolfe, 1977; Petronio, 1991). Such weighing, however, is subjective and potentially irrational (Min and Kim, 2015), as it can be intuitively or arbitrarily assigned by users (Acquisti and Grossklags, 2007). Public benefit awareness can enhance positive outcome beliefs and relationship-enhancing expectations of public sharing (Christofides et al., 2009), which can be economic or social (Barth and de Jong, 2017). When public sharing is encouraged, users will likely maintain a positive self-concept, develop meaningful relationships and gain a more accurate perception of real circumstances (Ellison et al., 2011; Min and Kim, 2015). The public benefits addressed in this study stem from social benefits that ESN users receive from public sharing, such as likes, comments, forwards and favorites (Barth and de Jong, 2017), which represent others' affirmation of the shared information value (Li et al., 2020). That is, users believe they have reaped considerable benefits from previous public sharing practices, spurring continued public sharing. Accordingly, this study infers:

Public risks are psychological and functional threats involving the potential negative consequences of individuals losing control over sharing information (Xu et al., 2012). Information privacy research has confirmed the importance of public risk in influencing information-sharing decisions (Dinev and Hart, 2006; Xu et al., 2011), although subjective or irrational decision-making denoted in the privacy paradox may lead to biased perceptions of public risk (Barth and de Jong, 2017). If users face significant risk threats, they may adopt appropriate information-control settings when sharing information (Cichy et al., 2021; Ellison et al., 2011). This study defines public risk in ESNs as the loss and severity of the negative consequences of public sharing (Cichy et al., 2021; Dinev and Hart, 2006; Xu et al., 2011). In this context, risk assessment is based on personal experiences related to privacy violations (Wisniewski et al., 2015), where users showed concern about threats posed by active disclosure or unreasonable use of profile information (Chen, 2018; Cichy et al., 2021; Laufer and Wolfe, 1977). Such threats evoke information-protective behaviors that affect public sharing behavior (Xu et al., 2011). This study is not concerned with how to reduce public risks (Min and Kim, 2015), but looks at how employees use ESN information-control settings to control information boundaries when faced with public risk threats. The study therefore assumes:

Gender is also a factor influencing public sharing behavior (Lin and Armstrong, 2019; Liu and Wang, 2018; Zhang et al., 2019) and is thus included as a control variable in this study. The model also controls for age (Fiesler et al., 2017; Schwartz-Chassidim et al., 2020), the total amount of shared information (Schwartz-Chassidim et al., 2020) and privacy experience (Xie et al., 2014). The total amount of shared information refers to the number of posts per ESN user, reflecting the intensity of use (Schwartz-Chassidim et al., 2020). Privacy experience measures ESNs users' preferred information-control settings (Xie et al., 2014), where users are more likely to share publicly if they have previously engaged in public information sharing (Fiesler et al., 2017; Habib et al., 2019; Liu and Wang, 2018).

This study explores an ESN maintained by a software-as-a-service provider in China that services a private digital workspace for employee collaboration. Employees submit personal details including name, gender and age to create an ESN profile and use different channels to share information. The study focuses on employees' information-control behaviors for specific information.

This study used system logs to collect information-sharing data from ESN's wall posts channel. The data gathered from April 2013 to April 2018 recorded the attributes of 238 employees (e.g., name, age and gender) and captured information attributes, including control settings, information content, information forms and information disposal module for 93,984 specific pieces of information shared by employees. Employee data and specific information data were cross-checked using MySQL, with mismatched data removed, leaving 93,281 specific information data nested as substructures in the records of 125 employees. Considering the business process perspective, this study removed the test data and data that was infrequently shared (i.e., less than 100 shared information pieces), leaving a total of 92,332 information data shared by 64 employees. Table 1 summarizes the employee demographics.

Table 2 yields descriptive statistics of variables, in which several aspects need clarification. First, this study uses $t$ to record the time order in which ESN users shared each piece of information, e.g., $t=1$ for the first time a user shared information, $t=2$ for the second time and so on. Second, disposition to value information is the information disposal practice of ESN users that inherently protects the information boundary, which is measured by functional module usage (Schwartz-Chassidim et al., 2020). Users who attach more importance to information value will consider the suitability of shared information and modules more carefully, leading to different information being disposed of in different modules (e.g., having a higher disposition to value information). The ESN contains 16 functional modules, including the general, task, file and project modules, and Figure 3 shows information shared in the task module. Third, work-relatedness tagging is achieved by textual classification of information content using the model Enhanced Representation through kNowledge IntEgration (ERNIE). This study trains the ERNIE model with as much data and prior knowledge as possible, and the validation set accuracy is around 0.84 to 0.89. Fourth, information richness is expressed as the richness of the presentation of specific information (Fiesler et al., 2017; Zhou et al., 2021), measuring how many different forms are there for the specific information. ESNs have seven categories of information forms, including text, image, video, audio, link, document and compressed file.

Finally, public benefit is related to information-sharing response (Christofides et al., 2009; Li et al., 2020) as superimposed by the number of likes, comments, forwards and favorites. Specifically, when user $i$ determines whether the $t$ th information is shared publicly, the public benefit $Benefitit$ depends on the ratio of the total number of responses received by all publicly shared information before $t−1$ to the total number of responses received by all $t−1$ information. Public risk is assessed by the completeness of the user's profile, which in addition to basic information, includes phone number, education, career, interests, personality, blood type, nation, address and zip code. To measure public risk, this study treats these nine categories of information as dummy variables (Schwartz-Chassidim et al., 2020) and uses a single-factor measurement model.

This study adopts the multilevel mixed-effects logistic regression method, meqrlogit, to test the hypotheses, as the data are multilayered and the dependent variable is a binary response that includes both fixed and random effects, making it suitable for modeling intra-cluster correlation. The fixed effects are specified as regression parameters and the random effects are the data structure grouping. The meqrlogit employs a Orthogonal triangular (QR) decomposition of the variance component matrix, which helps converge as the variance components approach parameter space bounds. The estimation process involves a set of iterations that refine the initial values and a set of gradient-based iterations, with the default algorithm being the Newton-Raphson method.

Consider a logistic regression with the dependent variable $Yit$⁠, for a series of $M$ independent users, conditioned on a set of random effects $ui$⁠, as shown in equation (1):

where $t$ is a time index for $i=1,……,M$ users and each user $i$ consists of $t=1,……,nt$ observations and $Yit$ is the dichotomous variable. The $1×p$ row vector $Xit$ is the fixed-effect covariate with regression coefficient $β$ and the $1×q$ row vector $Zit$ is the corresponding random-effect covariate, denoting the random intercept and random coefficient. $Φ(·)$ is the logistic cumulative distribution function, $Φ(v)=exp(v)/{1+exp(v)}$⁠.

Specifically, the dependent variable $Public$ is binary, and the key variables are $Disposition$⁠, $Work$⁠, $Richness$⁠, $Benefit$ and $Risk$⁠. This study considers a simple random intercept model with interaction effects and modifies it to have a random effect for each user $i$⁠, per equation (2):

The correlations between the variables were checked and the results reveal no significant multicollinearity and the variance inflation factor values of the variables were all less than 10. To mitigate the latent multicollinearity in the cross-sectional terms of the moderating effects, this study borrowed the method from Balli and Sørensen (2012) to perform intra-cluster mean centralization. This helps avoid the spurious capture of different individual slopes in the ordinary interaction term regression.

Figure 4 shows the fixed effects results in the form of an odds ratio (OR). OR value greater than 1 implies that public sharing is more likely to occur than private sharing and vice versa. The empirical results support most of the hypotheses. The direct effects of disposition to value information, work-relatedness and information richness on public sharing were significant, confirming H1 to H3. The interaction effects between the disposition to value information and work-relatedness and between the disposition to value information and information richness, were equally significant, supporting H4 and H5. As for H6, the results showed a significant positive effect of public benefits, but for H7, it was found to be insignificant, as the negative relationship between public risks and public sharing was not supported (β = 0.945, p = 0.769).

Some notable results warrant further discussion. First, the three direct hypotheses H1 to H3 are confirmed, with findings that are highly consistent with existing research. Results show that users with a higher disposition to value information in ESNs are wary of sharing information publicly. They inherently value their information boundaries (Xu et al., 2011) and view others' minor use of information as highly invasive (Malhotra et al., 2004). Furthermore, when it comes to work-related information, users will consider its potential professionalism (Liu and Kang, 2017) and sensitivity (Anderson and Agarwal, 2011) and tend not to share information publicly (Fox and McEwan, 2017). Additionally, ESNs users are more likely to share high-richness information publicly, just as MRT suggests that high-richness information reduces uncertainty and equivocality (Daft and Lengel, 1986) and helps avoid misuse, misunderstandings and conflicts (Xu et al., 2011; Karwatzki et al., 2017).

Second, the model performs well in terms of interaction effects. Results show that both work-relatedness and information richness weaken the negative relationship between the disposition to value information and public sharing (H4 and H5), validating that information control should be adapted to contexts. The relationship between the disposition to value information and public sharing differs significantly for work-related and non-work-related information. Specifically, the negative effect of disposition to value information on public sharing is more pronounced for non-work-related information, where users' disposition to value information matters more. Importantly, there is a clear substitution between the disposition to value information and work-relatedness in influencing public sharing. Similarly, the role of disposition to value information varies significantly across information richness levels. The negative effect of disposition to value information on public sharing is more pronounced at the low-richness level of information and mitigates as information richness increases. This suggests that the disposition to value information may also be important for low-richness information.

Finally, the desire for public benefits is found to stimulate public information sharing (Barth and de Jong, 2017; Ellison et al., 2011), thus H6 is supported. Public risk has no significant influence, thus H7 does not hold. This outcome may be due to users' information privacy decisions that tend to ignore or underestimate risks, a phenomenon explained by the privacy paradox (Acquisti and Grossklags, 2004; Barth and de Jong, 2017). Under this premise, the impact of public risks on public sharing behaviors may be limited, an issue that warrants further investigation.

In this study, the initial model (2) is a simple random intercept model containing only a user-level random effect $ui$⁠, which can be extended by the addition of the variable $Work$ to the random effects, per equation (3):

The new model thus contains a random intercept and a random coefficient for $Work$ and allows for no correlation between the user-level random effects. The results are shown in model (3) in Table 3, where the fixed effects remain largely stable. Model (3) is an improvement over the random intercept model (2), as confirmed by the results of the likelihood-ratio test, the goodness of fit and the Akaike Information Criterion (AIC) and Bayesian Information Criterion (BIC) tests. To further optimize the model, this study relaxes the assumption of independence between random effects and assumes a correlation between $ui$ and $vi$ by specifying the covariance (unstructured) in the model, with the results of model (4) in Table 3 being consistently robust.

This study fits the data again using the generalized structural equation model (GSEM). Similar to meqrlogit, GSEM can fit a binary response mixed-effects model that includes both fixed and random effects and partially addresses the problem of omitted variables. The model output is shown in model (5) in Table 3 and the results remain robust. The study also re-runs the original model using 93,281 information data from 125 employees, both of which yield more consistent results.

ESN users often neglect the use of the continuous information-control settings employed during information sharing, although information-control studies on the information disclosure intentions of users' profile pages found that they often express privacy concerns. This is especially the case in work-oriented ESNs, where users are more concerned with information control in broadcasting channels like wall posts and may consider all information as information privacy. This study highlights information privacy control as a crucial topic in ESNs (Keith et al., 2014; Wang and Fussell, 2020), focusing on the wall posts and adapting CPM theory to elucidate information-control behaviors and their key antecedents. The findings of actual behavioral data analysis show the direct effects of the individual-specific factor, context-specific factors and risk-benefit ratio on employees' public sharing behaviors, emphasizing the interaction of individual motivational and contextual factors.

This study has three key theoretical contributions. First, it extracts the core maxim from the complex CPM framework: shared privacy boundaries. This provides a basis for normalizing CPM research by examining information boundaries in the ESN context and observing the consistency of information control and the shared privacy boundary of CPM theory. It also highlights the potential of information control as a new pathway to explain CPM theory and enhance its applicability. Importantly, information control should be more adaptive to context changes, where context-specific factors can act as moderators and interact with an individual-specific factor. This result not only confirms the interdependence of boundary rules in CPM theory and encourages researchers to re-conceptualize the relationships among boundary rules, but also creates a connection between CPM and MRT, providing insights for developing a more comprehensive theory of information control.

Second, this study focuses on information privacy in work scenarios and examines employees' continuous information-control behaviors in adapting to specific contexts, which expands the research boundary of information-control behavior. Analysis of the moderating role of context-specific factors in ESNs reveals that information privacy constantly changes when adapting to specific contexts, as supported by the exclusive and positive role that information richness plays. The study thus fills the research gap in information-control behavior in ESNs and lays the foundation for extending information-control research into new areas, thus developing unique understandings of information sharing.

Third, this study emphasizes the importance of incorporating actual information-control behaviors data rather than reported sharing intentions, which exemplifies an objective way to validate users' true preferences and helps avoid the privacy paradox. User perception of the insignificance of public risk may corroborate this argument. That is, despite the strong relationship between weak information-control attitudes and public risk, in actual information-control behaviors, users tend to ignore or underestimate information risks.

The study also has three practical implications. First, the disposition to value information emphasizes the information disposal practices of ESN users, which are closely related to their familiarity with the ESN modules. The study, therefore, guides managers and developers to revisit ESNs' system tools, expand the information management functions of channels such as wall posts, rationalize information disposal modules and strengthen training on the application of channels and modules so that employees can better adapt to and manage information-control settings. Second, the findings can inspire employees to pay attention to contextual changes when dealing with information privacy in work scenarios. They also prompt managers to reasonably assign tasks, guide employees to manage information sharing in terms of work-relatedness and information richness and help employees achieve effective business information control. Third, this study instructs managers to regulate employees' information privacy practices using actual behavioral data, without being subject to misinformation related to nebulous intentions or reported attitudes.

This study has some limitations. Users' information-control behaviors change over time, and studies should explore more dynamic models of user behavior. This implies that researchers could continue to explore how often users update their information-control settings and continuously assess information-control behaviors longitudinally. Finally, studies can incorporate information-control intentions into the model to further distinguish information-control intentions and behaviors and to enrich privacy paradox research.

This research is supported by National Social Science Foundation of China (Grant NO. 20BGL287) and Research and Innovation Fund of Shanghai University of Finance and Economics (CXJJ-2019-393).