Where to now with privacy? a systematic literature review with human–artificial intelligence synthesis (SLR-HAIS)

Consumers are becoming increasingly concerned about data privacy and security. A recent study by Deloitte (2024) showed that approximately 60% of consumers grapple with the uncertainty of their technological devices being susceptible to unauthorized access to personal information and being monitored by organizations or individuals via their devices. The Marketing Science Institute highlighted consumer privacy as one of the top research priorities for marketers and researchers in 2022–2024 (MSI, 2022, p. 3). Although Viot et al. (2024) conducted a critical review of privacy issues for smartphone users, these matters in this area must be systematically examined to a broader extent, given public importance and the interest of scholars (Cooper et al., 2023; Craciun and Zhou, 2025; Graeff and Harmon, 2002; Singh and Hill, 2003).

Significant gaps persist in the literature, where studies are often fragmented, focusing on isolated aspects such as the privacy paradox (Scarpi et al., 2022) or ethical artificial intelligence (AI), without integrating these across product-, consumer-, market- and society-level perspectives. Additionally, limited attention has been paid to emerging environments, such as social commerce, payment touchpoints, hedonic platforms and not-for-profit organizations, in shaping privacy perceptions. Finally, there is a lack of comprehensive frameworks and AI-driven analytical methods that simultaneously map out challenges, opportunities and stakeholder responses.

To this end, we develop a more detailed systematic literature review (SLR) and add AI-driven analysis incorporating a sensemaking approach Lim and Kumar (2024) to suggest areas for future research from the corpus of work in this area. This novel approach provides an independent recommendation for future research directions, that is, an objective assessment of key research gaps and identification of key future research questions for scholars to be guided by:

This study makes the following contributions:

• What is the state of play in privacy research? The key themes, trends and research areas in the extant literature have been addressed.

• How well has this research been conducted?

• What future research needs to be conducted on consumer privacy?

The remainder of this paper unfolds as follows: Section 2 details the methodological framework guiding our investigation. Section 3 synthesizes the study’s key results, paving the way for Section 4, which explores an agenda for future research. Building on this, Section 5 introduces an AI-driven Leximancer analysis to formulate a targeted research agenda for scholars in consumer privacy. Section 6 examines the practical implications of our findings for both policymakers and marketers. The study’s limitations are evaluated in Section 7, and the paper’s conclusion in Section 8 provides a concise synthesis of our study.

This SLR examines privacy research using a framework-based review guided by the theory, characteristics, context and methods (TCCM) approach (Paul and Rosado-Serrano, 2019) and scientometric analysis Lim and Kumar (2024) to unpack trends in privacy research. Next, the study used a sensemaking approach (Weick, 1969) through Leximancer to identify themes and clusters (Lim, 2024). A sensemaking approach is described as a “process by which individuals develop cognitive maps of their environment” (Ring and Rands, 1989, p. 342) to bring clarity and meaning to an obscure phenomenon (Weick et al., 2005) and enable informed action (Zhang and Soergel, 2014). The 3Ss of sensemaking – scanning, sensing and substantiating – offer a robust framework for navigating and uncovering actionable and meaningful insights (Lim, 2024) in the evolving field of consumer privacy. This analysis is suitable for identifying trends (Donthu et al., 2021) of major themes in scientific research (Lim et al., 2022; Rathore et al., 2023). This study adopted the PRISMA framework (Figure 1) to systematically scan, search and extract relevant articles while ensuring that the process is transparent and comprehensive (Moher et al., 2009; Basu et al., 2023). This yielded a corpus of 149 articles. Next, using the sensemaking approach (Lim and Kumar, 2024), an AI-driven program, Leximancer, which is underpinned by natural language processing (NLP), enabling thematic analysis of the data via text mining, topic modeling and data visualization, was used to analyze the theoretical implications of sections of papers within the data set using a sensemaking approach (Lim and Kumar, 2024). Leximancer’s Bayesian algebra-based algorithm automatically identifies frequently co-occurring concepts and their associations using this substantiating approach. Fourth, using the substantiating approach, the program formed clusters of concepts and identified themes with minimal researcher involvement (Leximancer, 2024; Wilk et al., 2019, 2021; Lim and Kumar, 2024) to identify future research directions (Mukherjee et al., 2022). Sensemaking (Weick, 1969) provides a foundational framework for navigating and interpreting data that may appear intricate, disordered or overwhelming (Namvar et al., 2018). Applying sensemaking to the analysis facilitates a more comprehensive understanding of the present state, developmental trajectory and future possibilities of a field. It addresses common critiques, notably regarding the risks of under-interpretation or misinterpretation, and enables more sophisticated, insightful data analysis (Lim and Kumar, 2024).

Following the Leximancer-driven data visualization process via the generation of a concept map illustrating the emergent themes, concepts and conceptual associations, a sensitivity analysis was performed to ensure that the thematic analysis was robust and stable, and therefore, can be relied upon – we refer to this process as “Leximancer thematic analysis concept map stability testing process” (Figure 2). The principles set out in extant studies that used Leximancer for thematic analysis were consulted and provided guidance for this process (Angus, 2022; Byun et al., 2023), as well as the Leximancer user guide (Leximancer, 2024). Theme stability was tested by engaging in the following during the concept mapping stage: (1) In the concept map view, the “Recluster Map” function was used to assess whether the themes (clusters) were cohesive; as the themes did not change during the re-cluster process, they were kept; (2) In the concept cloud view, the “Concept Map Rotation” function was used to assess whether the concepts presented a cohesive path (formed cohesive themes) in the way they were displayed; as the themes did not change their path, they were kept; (3) In the concept map view, the “Theme Size” function was used to determine the adequacy of the theme size for meaningful interpretation in light of the research aim and research questions. This last stage required the research team to determine whether the default 33% theme size adequately captured the essence of the emergent themes, or whether a higher/lower theme size adjustment was required to meaningfully interpret the emergent concept clusters. In this case, the research team assessed various theme size combinations and determined that the default 33% themes size was the most stable and most suitable in presenting the required insights to answer the set research questions. The process is presented in Figure 2.

Academic research methodologies are evolving, and in the field of literature review, AI offers techniques for representing and inferring knowledge, efficiently processing text and learning from large data sets (de la Torre-López et al., 2023). In their seminal work, Bolanos et al. (2024) presented a thorough overview of the opportunities and challenges that AI presents in the context of literature reviews, specifically, where AI assists and partially automates the process of a SLR. Their view is that “the increasing role of AI in this field shows great potential in providing more effective support for researchers, moving toward the semi-automatic creation of literature reviews” (Bolanos et al., 2024, p. 259). This is the view that we adopt in the present study.

Therefore, to present a more robust and objective view of the research gaps in current research into consumer privacy, an AI-driven software, Leximancer, was chosen. This machine-learning text-mining program uses a Bayesian algebra algorithm to identify key themes via concept clusters and associations within the conceptual network of meaning (Wilk et al., 2019). Prolific researchers using this methodology (e.g. Wilk et al., 2019; Tunca et al., 2023) suggest that Leximancer offers a more objective and efficient means of analyzing large text-based data sets, as it can uncover unexpected, unknown and hidden themes with minimal involvement from researchers. Despite this, researchers have pointed out that an inductive approach reliant on AI analysis is insufficient for robust qualitative analysis, and that a human lens is required to make sense of the data and the outputs produced by AI-enabled programs such as Leximancer (Wilk et al., 2021). In this sense, the researcher plays a crucial role in meaning attribution in the AI-enabled literature synthesis. Researchers agree that AI-driven analysis adds a new dimension to SLRs. For example, Zaveri and Wilk (2024) conducted a literature review that uncovered research gaps and questions regarding Facebook consumer research. In contrast, Goh and Wilk (2022) used Leximancer to uncover key research themes in tourism and hospitality literature. Indeed, researchers agree that Leximancer is a suitable program for conducting literature reviews; however, no robust process has been proposed for HAIS as an extension of SLRs.

The HAIS introduced in this SLR includes a dual Leximancer analysis and researcher sensemaking to attribute meaning to the findings. This process included the following steps: HAIS incorporating Leximancer (AI) analysis and human researcher sensemaking, including:

• data visualization of themes, concepts and their associations (qualitative analysis via Leximancer-produced concept map);

• prominence scores analysis of concept and compound concept associations (quantitative analysis via Leximancer-produced Insight Dashboard); and

• human sensemaking, rekindling and refinement via manual inspection and interpretation of findings and validation via cross-checking with the dataset and refinement of insights and conclusions based on the researcher’s epistemological understanding.

Figure 3 shows a gradual increase in the number of publications since 1997. Yearly analysis shows a significant rise, highlighting growing scholarly interest and reflecting consumer privacy concerns on digital platforms, with 76% of the studies published post-2016 (see Table 1 in the online Supplementary data for journals publishing consumer privacy research).

The rise in privacy research since 2009 stems from several factors. Technological advances have led to widespread use of smart devices, Internet of Things (IoT) systems and cloud computing, all of which process extensive personal data. This increased data processing has raised privacy concerns, driving further research in the field ^[1]. Regulatory changes such as the General Data Protection Regulation (GDPR) have required firms to meet stricter privacy standards, spurring research in privacy-enhancing technologies and data anonymization. Research investigating the impact of privacy breaches is also on the rise, owing to the major data breaches of companies such as Google, Apple and LinkedIn, which have compromised the private data of millions of consumers (BreachSense, 2025).

Our research shows that 63 theories have been used to enhance the understanding of consumer privacy concerns (see Table 2 of the online Supplementary data). However, one widely accepted theoretical approach has yet to be used. This is also indicative of a scientific field of inquiry that has yet to develop a consensus on a mechanism for examining privacy in psychology and marketing research.

In our data set of 149 articles, 102 studies used at least one formal theory. Among these, social exchange theory (SET; 7%), privacy calculus theory (PCT; 6%) and power–responsibility equilibrium theory (PRE; 6%) emerged as the most frequently used. Although the numerical differences in their applications appear modest, the theoretical landscape remains highly fragmented, with no single theory dominating the field. The selection of these three theories is informed not only by their relatively higher frequency but also by their conceptual relevance and increasing influence in recent studies. These theories encapsulate the foundational and evolving perspectives of consumer privacy research. SET provides a classical perspective on cost-benefit analysis in information disclosure, PCT refines this with privacy-specific trade-offs, and PRE introduces a novel framework that considers the asymmetric power dynamics between consumers and firms. Collectively, they represent both the historical foundations and emerging directions of theoretical inquiry in this domain.

SET (Blau, 2017) posits that individuals engage in relationships based on expected benefits and costs, striving to maximize rewards and minimize losses. In the consumer privacy literature, SET provides a foundational lens to understand why consumers choose to disclose personal information despite perceived risks. For instance, Cloarec et al. (2022) investigated the personalization–privacy paradox, analyzing how consumers balance the advantages of personalized advertising against privacy risks. SET was used to explain how consumers perform a cost-benefit analysis, opting to exchange personal data when perceived value surpasses privacy concerns. These findings indicate that perceived personalization enhances perceived value, thereby promoting information disclosure as a form of reciprocal exchange. Nonetheless, excessive personalization heightens privacy risks, thereby diminishing disclosure. Similarly, Gutierrez et al. (2023) employed SET to explain the influence of consumer-brand interactions on social media on purchase intention. The findings indicate that high-quality interactions with brands significantly enhance purchase intention, as consumers are inclined to exchange their time, data and attention for valuable content and engagement. SET facilitates conceptualizing consumer-brand interaction as a reciprocal, trust-based relationship shaped by perceived benefits. Pallant et al. (2022) studied how different consumer segments respond to exchanging data in a retail context with US consumers. They applied SET to understand segment differences as outcomes of a cost-benefit evaluation, where data sharing is viewed as a reciprocal act in exchange for perceived benefits such as personalization, convenience or rewards. All three studies concur on SET’s fundamental premise that reciprocal value drives consumer willingness to engage or share data, but not all consumers evaluate exchanges in the same way.

PCT, an extension of SET, incorporates a risk-benefit analysis specific to online contexts (Culnan and Bies, 2003). The theory posits that consumers engage in rational decision-making by evaluating the perceived advantages of data disclosure, such as personalization and social capital, against perceived privacy risks, including data misuse and surveillance. It has been applied in marketing research to predict user behavior on social media, e-commerce and mobile applications (Li, 2011; Xu et al., 2011). Fernandes and Costa (2023) found that consumers’ willingness to adopt and disclose personal data through COVID-19 contact-tracing applications is influenced by a rational trade-off between perceived benefits and privacy risks. The study identified a privacy paradox: despite elevated privacy concerns, consumers were inclined to disclose data when the benefits were deemed substantial. Notably, the research expanded the traditional self-focused privacy calculus to an other-focused perspective, demonstrating that social benefits are also pivotal. Similarly, Schade et al. (2018) found that a trade-off between perceived benefits and perceived risks shapes consumers’ intention to use location-based advertising. The theory was applied by modeling how advertising value positively influences usage intention, whereas privacy concerns negatively impact it. These studies reinforce the idea that perceived benefits often outweigh privacy risks, but also highlight different consumer strategies for increasing adoption. Although PCT offers a more nuanced framework for understanding consumer privacy choices, it remains constrained by its predominantly cognitive focus (Adjerid et al., 2018).

PRE (Morey et al., 2015; Pavlou and Gefen, 2005) is a relatively recent addition to the privacy literature that introduces a normative dimension. This posits that when firms have greater power over consumer data, they also bear a greater responsibility to protect it. Equilibrium is disrupted when firms collect excessive data without providing adequate safeguards or transparency, leading to consumer resistance and regulatory backlash.

Krishen et al. (2017) found that consumers’ perceptions of fairness in location-based services are shaped by their internal locus of control, attitudes toward marketing communications and privacy concerns. They applied this theory by conceptualizing the relationship between power holders (e.g. governments or firms) and consumers, where fairness is achieved when those in power act responsibly with consumer data. They extended PRE by examining implicit privacy risks, such as those arising from government policies that use location data for toll collection, rather than explicit privacy policies. Their study highlights the importance of balancing power and responsibility to foster trust and fairness in digital interactions involving personal data. Bandara et al. (2021) showed how consumers’ privacy concerns and defensive behaviors within the digital marketplace are influenced by the equilibrium, or lack thereof, between the power held by firms and regulators and their responsibility in managing consumer data. The theory was operationalized by modeling the impact of corporate privacy responsibility and regulatory protection on consumer trust, privacy empowerment and ultimately, privacy concerns and defensive actions. Collectively, these studies underscore the significance of responsible data practices and transparent communication in asymmetric power balance dynamics.

All three theories aim to explain consumer privacy behavior but differ in scope and emphasis. SET and PCT are rooted in rational choice models, with PCT providing privacy-specific refinement. In contrast, PRE shifts the focus from individual rationality to the structural dynamics of power and accountability between consumers and firms. While SET and PCT emphasize consumer agency, PRE introduces the concepts of corporate responsibility and systemic trust. There are also areas of overlap: all three theories acknowledge that trust and perceived fairness influence consumer behavior. However, gaps persist, particularly in accounting for the emotional, social and cultural influences that transcend economic rationality. Integrating these theories or extending them with contemporary constructs, such as algorithmic fairness or digital autonomy, could enhance explanatory power and guide future research in this evolving domain.

A geographical investigation suggests that consumer privacy has primarily been explored in the West (Bhattacharya et al., 2023). The USA (7) is the most researched geography on privacy issues, whereas Canada appears in two studies. Within Europe, research is dominated by the UK (5), followed by Germany (3), France (1), Norway (1) and Sweden (1). Among Asian countries, China contributes the most, with two studies, but it remains comparatively less than that of Western countries. India and Taiwan each contributed one study. Finally, South Africa features in three studies, Australia in two and New Zealand and Spain in one each. Furthermore, e-commerce (8) is the most frequently occurring context in terms of trust deficiency and privacy concerns, as trusting online retailers remains a significant challenge. This is followed by mobile banking and financial services (6) and a range of platforms, including social media (4) and smartphone usage (2), to access web services, emphasizing the necessity for more industry-specific empirical studies to obtain a more nuanced sector-wise perspective.

To examine these characteristics, we employed an antecedents-consequences approach with moderation–mediation (Vrontis et al., 2021) using a science mapping technique (Mukherjee et al., 2022). Science mapping offers organized visual and non-visual representations of the characteristics (e.g. occurrences) (Mukherjee et al., 2022) and yields insights into the characteristics, their relations and their development (Donthu et al., 2021). The first author conducted a comprehensive review of the articles, identifying and categorizing the variables studied (Vrontis et al., 2021), with mediators and moderators also accounted for. The literature has predominantly focused on a few primary variables, such as privacy concerns, consumer risk and trust, while areas such as consumer vulnerability (Aiello et al., 2020) and data management practices (Martin et al., 2017) have received limited attention.

Acknowledging this imbalance, we propose an integrative framework that centers on topics of prominent scholarly interest rather than on the entire literature. Such frameworks are highly regarded by both practitioners and academics (Vrontis et al., 2021). Our framework details the influence of consumer characteristics on intentions, willingness and behavioral outcomes, enabling readers to comprehend the relationships between various categories of variables in the literature. This discipline-specific integrative framework addresses the gap in existing research that our model seeks to fill (see Table 4 of the online Supplementary data for studies that investigated all the variables included in the integrative framework). Figure 4 presents this framework, structured around an antecedents-and-consequences model, incorporating moderators, mediators and contextual factors, consistent with the approach of Vrontis et al. (2021).

Despite the diverse theories employed, few antecedent variables have been studied in the past. Privacy concerns are the most frequently researched antecedent in consumer privacy literature (17% of studies, see Table 3 in the online Supplementary data). One of the leading research streams on privacy concerns focuses on the consumer privacy paradox, which refers to the discrepancy between consumers’ professed privacy concerns and their actual online behavior when divulging personal information (Massara et al., 2021). On the one hand, consumers express grave concerns about their privacy and data security. However, they frequently engage in actions that undermine their privacy, such as disclosing personal information on social media platforms or using services to collect and monetize their data (Bright et al., 2021; Okazaki et al., 2020). Consumer risk (14%) is the second most frequently researched antecedent, and studies investigating this construct have examined ways to reduce privacy risk and its impact on the adoption of electronic services and consumers’ willingness to take privacy risks when engaging with technology (Featherman et al., 2010). Consumer trust (11%), the third most frequently researched construct, influences consumers’ purchasing behavior on social media (Alzaidi and Agag, 2022). Consumer control over data and technology broadly focuses on how consumers perceive control over their personal information and the role of technology. Finally, consumer vulnerability is investigated as the concern that consumers must disclose information to firms (Aiello et al., 2020) and their data management practices (Martin et al., 2017). This is expected to be an area of interest for future research.

Only 9% of the studies considered mediation, which is interesting given the time this phenomenon has been studied. Technology usefulness is a highly relevant mediator of consumer privacy (Cowan et al., 2021), whereby consumers’ willingness to disclose personal information when adopting a new technology or social media is mediated by the usefulness of the technology (Massara et al., 2021) but has been rarely studied (3% of papers). Interaction and engagement with technology and perceived control of personal information and risk are also frequently researched variables in the consumer privacy literature (Lambillotte et al., 2022). Trust and risk perception serve as the mediating factors in this relationship. Mpinganjira and Maduku (2019) found that perceived privacy control, desire for privacy and privacy concerns significantly influence brand equity. Perceived information control and trust in the organization mediate the relationship between perceived organizational privacy, ethical care and the accuracy of information consumers are willing to share with the organization (Mattison Thompson and Siamagka, 2022), but likewise, has been rarely studied (3% of papers).

Even fewer papers (6%) included moderating variables such as demographics, especially age, gender and income. Trust has been identified as the most critical moderator in consumer privacy research (4%). Consumers with high trust in social media platforms have increased engagement with the platform despite privacy concerns (Bright et al., 2021). Grosso et al. (2020) found a multilevel trusting mechanism in an extensive study conducted across seven product categories and 14 countries with more than 22,000 survey respondents. Micro-level trust (i.e. retailer and staff) positively affects consumers’ willingness to disclose information, whereas it attenuates privacy concerns and negatively influences their willingness. The effects of different policies and regulations have also rarely been studied (2% of papers). This finding points to a significant gap in the literature on consumer privacy when firms and governments make changes.

Intentions are the most studied outcome variable (17%) in the consumer privacy literature (Alzaidi and Agag, 2022; Bhattacharya et al., 2023; Cheah et al., 2022). This includes purchase intention, booking intention, word-of-mouth intentions, opt-in intentions, patronage intention, intention to use, intention to adopt, brand usage intention, repurchase intention and intention to opt-in. This was followed by willingness (10%) (e.g. Carlsson Hauff and Nilsson, 2023; Cheng et al., 2023; Cloarec et al., 2022), which includes willingness to clickthrough, use, disclose personal information, exchange data, sell consumers’ data, disclose consent, share and register online. Notably, actual behavior is even less studied in 9% of the papers. This indicates the need for research to move beyond what is stated and what happens with consumer privacy.

The consumer privacy field is dominated by a quantitative research orientation (see Table 5 of the online Supplementary data). The most preferred design was a survey (60 studies), followed by experiments (33 studies) and secondary data (i.e. database, archival or content analysis, 15 studies). Qualitative studies (14 studies) were predominantly conducted through interviews. Only a few studies have adopted ethnography, grounded theory or a case study approach. Mixed-methods research on consumer privacy (11 studies) was relatively less than that of the other studies discussed above. Conceptual and non-empirical research (17 studies) is the second-highest type of research published in the consumer privacy literature.

Various data collection approaches are evident in the consumer privacy literature (Table 5 of the online Supplementary data). The primary data for surveys were predominantly collected online (30%) through researchers’ social and professional networks (e.g. Facebook, LinkedIn or e-mail) via panel companies (e.g. Qualtrics, Research Now) or crowdsourced survey platforms (e.g. Amazon’s MTurk). Field data collection (i.e. mall intercepts and e-mail; 7%) was undertaken relatively infrequently. Mixed methods (combining online and field) are fewer, but not as few as data collection via telephone. Similarly, most experiments were conducted online (15%), followed by universities or research laboratories (6%) and rarely in real-life settings (1%). Studies (10%) using multiple data points originating from archival, databases and online media content primarily collected online data. Qualitative research involving interviews typically employs methods that include online (1%), in-person (2%) or a combination of both (2%).

Structural equation modeling is the most widely used data analysis technique in surveys and experimental research (45 studies). This was followed by partial least squares (19 studies) and Analysis of Variance (ANOVA)/multivariate ANOVA (19 studies), which were primarily used in experimental and survey research. Multivariate, logistic, hierarchical and linear regressions were commonly used in the data analysis (18 studies) (Table 6 in the online Supplementary data). The reliance on cross-sectional research may explain the use of these methods. As noted, the lack of behavioral research or field studies in this area may partly explain the analysis methods used.

Qualitative studies have primarily used thematic analysis to investigate data. Other less frequently used data analysis techniques include linguistic inquiry and word count, polynomial analysis, Least Absolute Shrinkage and Selection Operator and Latent Dirichlet Allocation.

Figure 4 offers a comprehensive synthesis of the current state of research, delineating key theoretical frameworks, constructs and thematic areas that have influenced existing consumer privacy scholarship. This framework not only captures the topics that have been explored but also underscores areas of theoretical and methodological focus. In the subsequent sections, we expand on this foundation to identify research gaps and propose a future research agenda. By juxtaposing the emphasis of past studies with emerging needs and underexplored areas, we suggest targeted directions for future inquiry, as summarized in Table 1.

Following the conventions of using AI for thematic content analysis outlined in their literature review by Zaveri and Wilk (2024) and using a sensemaking approach (Lim and Kumar, 2024), this study identified several key themes using thematic content analysis with AI-powered software, namely Leximancer, to provide an objective and thorough understanding of research on this subject. Leximancer’s analysis of large-scale qualitative data sets is underpinned by NLP, enabling thematic analysis through text mining, topic modeling and data visualization (Zaveri and Wilk, 2024). Leximancer’s Bayesian algebra-based algorithm automatically identifies frequently co-occurring concepts and their associations using this substantiating approach (Wilk et al., 2022). Based on this analysis, the program forms clusters of concepts named themes with minimal researcher involvement (Wilk et al., 2019). This AI software was deemed suitable for the purpose of thematic, content analysis of theoretical implications sections of the academic papers in our data set as the objective was to identify themes aligned with the words “future research,” “future studies,” “research gap” and similar, to identify future research directions for consumer privacy research (Mukherjee et al., 2022; Zaveri and Wilk, 2024). Thus, compound concepts, such as “future research,” “future studies,” “research gap,” and similar, were seeded within Leximancer to identify single and compound concepts and themes aligned with these and to ultimately identify the directions and gaps for future researchers to answer.

In addition, in line with similar extant studies, such as Zaveri and Wilk (2024) and Goh and Wilk (2022), at the outset of the Leximancer analysis, the Stop Words List was inspected and words such as “great,” “good,” “excellent,” “poor,” “apply,” which are typically automatically withdrawn by Leximancer deemed as trivial, were removed from the stopped words and added back into the analysis by the researchers, as there were deemed necessary for the attribution of meaning, and this is in line with prior studies’ conventions (e.g. Biroscak et al., 2017; Khan et al., 2022; Wilk et al., 2025, 2024, 2023, 2022, 2021, 2019, 2018). Also in line with prior conventions, all key concepts in the Mapped Concepts setting were scrutinized and assessed for their attribution of meaning, and those presented in the data visualization within this paper, met the required criteria or prominence score (PS) of 1 for a single concept and PS of 3 for a compound concept, within the Leximancer-identified theme clusters (Wilk et al., 2025, 2024).

This analysis helped objectively identify the themes in the extant papers’ theoretical implications sections and the research gaps highlighted in the extant literature, not from the authors’ perspectives. Notably, this AI-driven analysis in Leximancer extended the typical PRISMA TCCM literature review methodology to incorporate human and AI lenses into the findings reported above. To this end, this study applied an SLR, which was extended by the human–AI lens. We propose this methodology as a SLR-HAIS based on the steps outlined in Figure 1.

At this point in the analysis, the HAIS focused on the Theoretical Implications sections (Figure 5) of the papers in the data set and identified key themes that highlighted the academic contributions of past research on this topic, thereby uncovering extant research gaps. These themes are visualized in Figure 5 (Leximancer Concept Map 1). Figure 6 presents a synopsis of these themes from the most prominent (highest number of hits) to the least prominent within the data set. Thus, the top five most prominent themes in the Theoretical Implications sections of the data set are consumers (861 hits), privacy (834), research (777), information (614) and literature (573).

To make sense of the key themes that emerged in the data visualization reported in the concept map (Figure 5) and the theme synopsis (Figure 6), an AI-driven quantitative analysis in Leximancer using the Insight Dashboard reported for the compound concepts of “future research,” “future studies” and “research gaps” revealed key compound concepts (pairs of words) associated with these compound concepts. This process followed the conventions set by Zaveri and Wilk (2024) and allowed for the discovery of ten critical gaps that emerged (see Table 1) by mapping the critical compound concepts to 1. the data visualization represented in the concept map and 2. to the data set of the papers. For each of the ten compound concepts, data visualization (concept map) and the data set were inspected to determine which papers featured these compound concepts. A research-driven assessment was conducted via a keyword search within the data set to identify research questions that remain unanswered in future studies, thereby forming the proposed future research agenda. Additionally, the research directions proposed in Table 1 are directly informed by the conceptual mapping presented in Figure 4. While Figure 4 encapsulates the current state of consumer privacy research, Table 1 presents a logical extension of this analysis, identifying gaps, contradictions and underdeveloped areas that warrant further investigation. This approach ensures that our proposed agenda is grounded in a comprehensive understanding of existing scholarship while offering a forward-looking contribution to the literature.

Consumer privacy is a multidimensional construct, and prior research has drawn upon SET, PCT, PRE and the theory of reasoned action. Prospective theoretical frameworks for future investigation include psychological ownership theory, which delves into consumers’ sense of ownership and control over their data (Morewedge et al., 2021). This perspective can be valuable for investigating how feelings of ownership influence privacy-related behaviors and attitudes. Furthermore, identity management theory provides insights into how consumers manage and portray their identities in diverse situations (Imahori and Cupach, 2005). Investigations rooted in this theory can clarify the interplay between consumers’ privacy concerns and identity management mechanisms within and across various online environments.

These emerging theoretical perspectives hold great promise for understanding decision-making in privacy research, building on the existing theory of planned behavior approaches. Psychological ownership theory, for example, considers the issue of possession of personal data and how this needs to be protected and controlled by third parties. SET offers valuable insights into the social contract and license between data owners and marketers, as well as how consumers perceive this relationship as advantageous or harmful. For marketers, PCT provides valuable insights into the extent to which consumers are willing to trade off privacy risks with benefits. This theory may explain how many consumers today accept a complete loss of privacy for free and convenient benefits (Google Maps, Facebook and TikTok). Another area of interest for future researchers is cross-cultural research.

While cross-cultural research has emerged in consumer privacy literature in recent years (e.g. Liyanaarachchi, 2021; Schumacher et al., 2023; Shaw et al., 2022; Swani and Milne, 2022), it is still in its early stages. However, an agreed-upon theoretical approach has yet to emerge to study this phenomenon, as shown by the use of 63 different theoretical approaches in the review. There is, however, as shown by the characteristics and a lack of cross-cultural approach in privacy research. Cultural dimension theory can be employed to further investigate the impact of cultural values and norms on consumer attitudes and behavior (Hofstede, 1983). Research may explore how cultural factors, such as individualism versus collectivism, power distance and uncertainty avoidance, shape privacy norms and customs (Schumacher et al., 2023). The identified research gaps (Table 1) indicate that scholars must address an increasingly AI-oriented context. It is imperative to focus on AI-related presence and practices within a rapidly evolving digital environment, shifting consumer attitudes, developing digital platforms and enhancing AI knowledge and ethics. These areas should constitute a future research agenda for academic and industry scholars and researchers.

Our review found a lack of research on moderating and mediating variables, indicating that the boundary conditions for privacy concerns are poorly understood. No responses to firm or government policy changes have been widely studied, indicating an important area for future research. The methodologies used are mainly quantitative and survey-based, with little experimental research or qualitative research to uncover underlying causes, which can provide greater insight into the lived experiences of consumers in this area. The lack of mixed-method research is also of concern, as it may well explain why there is no accepted theory of privacy research being used, as the focus on research has been on theory confirmation rather than rigorous theory development.

Research on consumer privacy has improved our understanding of various privacy practices and drivers. However, to advance the field, further research in various contexts and settings is required. These are broadly categorized as technological and consumer characteristics, which align with the theoretical model. The introduction of new technology in the online environment is constantly increasing, and consumers are frequently presented with decisions regarding adopting these innovations. To date, research has expanded our understanding of consumer privacy in social and e-commerce settings and, to some extent, of biometrics (Clodfelter, 2010; Pizzi et al., 2022), IoT (Jaspers and Pearson, 2022), avatars (Cowan et al., 2021), chatbots (Fan et al., 2023; Rajaobelina et al., 2021; Rese et al., 2020), AI (Du and Xie, 2021; Querci et al., 2022), intelligent wearables (Gerhart and Ogbanufe, 2022) and the metaverse. However, research on these emerging technologies and their applications in customer interaction in the context of consumer privacy is scarce, and further investigation is required to advance the field of study. Identity management theory can be beneficial for exploring how consumers manage their identities across different technological environments, such as avatars, wearables and metaverse. Our review demonstrates that most research has been conducted in developed Western countries, whereas developing economies still need to be represented. Therefore, ample opportunities remain in Asia, with large economies such as China and India, and rapidly emerging economies including Vietnam, Bangladesh and Malaysia. African, Middle Eastern, Central and Eastern European and Latin American countries have provided promising avenues for future research. The potential for cross-national studies to better understand consumer norms and practices in diverse cultural settings is exciting. This can be explored using cultural dimension theory by deploying underrepresented studies across countries and regions.

Future research agendas for consumer privacy are likely to be shaped by AI in several ways. First, as AI models become more sophisticated, there is likely to be a growing need for enhanced privacy-preserving techniques, such as federated learning, differential privacy and homomorphic encryption (Khalid et al., 2023). These methods can help train AI models while ensuring that sensitive data remains secure and private. This will be of particular importance in industries such as healthcare and education. Second, data anonymization and de-identification will be more prominent in consumer privacy (Chevrier et al., 2019). AI can aid in the development of advanced data anonymization and de-identification techniques, making it easier to anonymize large data sets without compromising the quality of the data for analysis and modelling. Third, AI can be used to automatically detect and prevent privacy violations. For example, AI can identify potential risks in data sharing, recommend safer data usage practices or detect unauthorized access to private data. Therefore, AI-driven privacy protection is likely to be of interest to future researchers in the consumer privacy context (Yang et al., 2024). Fourth, AI and privacy policy compliance present an area for future research. AI systems can assist organizations in ensuring compliance with privacy laws and regulations such as the GDPR, and the California Consumer Privacy Act by automating data audits, assessing risks, and ensuring that data handling practices align with legal requirements (Folorunso et al., 2024). Fifth, ethical considerations and bias remain under-researched in the context of consumer privacy. As AI technologies are deployed in privacy-sensitive contexts, research should focus on ethical AI practices, such as reducing bias in algorithms and ensuring the fair treatment of individuals’ personal information. Some work in this area has already commenced, but researchers call for further inquiry (Islam, 2024). Consequently, with the rise of AI-powered surveillance and data harvesting, privacy research will need to increasingly focus on developing countermeasures against new forms of AI-driven threats, such as adversarial attacks or the misuse of personal data in deep learning systems. Again, early research has delved into this issue; however, much remains unanswered and requires further investigation (Emara et al., 2025) (Awad and Mahmoud, 2025).

As shown in Table 1, there are several implications for policymakers and marketers that future research should address. These suggestions come from the HAIS analysis of recommendations for future research in the reviewed papers. For policymakers, the first consideration is the acceptable and ethical norm for privacy in society (see research gap 3) and how laws and practices align with this standard. This becomes more important with the increasing adoption of AI by firms and consumers (see gaps 5 and 9 in Table 1). Consumers may also take a non-rational view of privacy and be guided by conspiracy theories (research gap 10), or at least they become cynical of policymakers and marketers, which may increase or lower their privacy concerns (see research gap 7, RQ19). Thus, policymakers and marketers should establish clear guidelines on data usage and consent to prevent exploitative practices to lower privacy concerns. An important consideration for marketers is how, with the use of AI, privacy concerns could more easily spill over to CSR activities (research gap 8, RQ22 and RQ23) and the use of payment platforms (research gap 6, RQ17). It is quite possible that these spillover effects could be positive or negative. This highlights the need to better understand the theories that explain consumer privacy concerns in an AI world (research gap 1, RQ2 and RQ3). The design of how data are stored and shared with consumers is also an important area for marketers to consider. Furthermore, policymakers should encourage industry-wide standards for ethical AI, ensuring that CSR efforts are not merely symbolic but substantively address societal concerns. Another critical area of research is the extent to which these design features are perceived as beneficial for consumers. How consumers find information about what is now accepted by them with AI use is also another important consideration for policymakers and marketers (see research gap 9). Firms implementing AI must integrate privacy-by-design principles into product development and marketing strategies. This includes robust encryption, anonymization and opt-in mechanisms. Finally, social media platforms should not take consumer privacy for granted and should therefore consider how these privacy concerns may affect sharing information socially from consumers (research gap 8). This is because sharing such information by consumers is the bedrock of their businesses. Thus, marketers should design experiences that respect consumer boundaries while fostering engagement and policymakers should consider guidelines for AI-mediated interactions to prevent manipulative practices.

This study has several limitations. First, the inherent complexity of privacy was not fully addressed using a processual framework, highlighting the need for a more dynamic perspective (Mariani et al., 2023). Adopting such an approach could advance theoretical development in an increasingly globalized context (Homer and Lim, 2024). Second, as with most literature reviews, the scope of this study was constrained by its methodological design, particularly by the keywords used to retrieve data. This limitation resulted in a relatively narrow identification of themes. Future research could expand search strategies to uncover additional themes (Kinias et al., 2023). Third, the study was limited by the choice of databases, search terms, analytical tools and data collection methods. Incorporating alternative databases, such as Google Scholar (Mariani et al., 2023) and Web of Science (WOS), could enhance the breadth and depth of future research. Furthermore, while Leximancer proved effective for textual analysis, integrating other bibliometric tools, such as VOSviewer, could triangulate and strengthen the findings (Mariani et al., 2023). Additionally, this review excluded policy documents, reports and conference proceedings (D’Alessandro et al., 2023), which future research may consider including to develop a more comprehensive understanding. Finally, interdisciplinary and multidisciplinary research that incorporates constructs and methodologies from fields such as information systems (Mariani et al., 2023) is essential for generating a holistic, integrated understanding of privacy.

This study contributes to the literature in several ways. First, through PRISMA TCCM, our review demonstrates that privacy research has yet to progress to a mature, well-understood field, as it is still fragmented and underdeveloped, with vastly competing theories, limited contexts and a minute range of methods. Second, we propose a new, expanded process for conducting SLRs using HAIS, which we term SLR-HAIS. We urge researchers to implement this methodology for a more robust and objective analysis of the literature. Third, we uncover ten research gaps and 30 research questions that underpin the future research agenda for academic researchers to address and to better inform and empower the industry and governments globally with new insights into the consumer privacy phenomenon.

The supplementary material for this article can be found online.