The Privacy Paradox

3.2. The Privacy Paradox

3.2.1. Inconsistencies in privacy valuations

Part of the experimental literature on the topic addresses the question of how much data subjects really value their privacy in view of the mentioned paradox.

The earliest studies in the topic show the inconsistency between data subjects’ declared concern for privacy and their actual behavior online.²⁷⁹ The study grouped participants according to their own declared privacy concern and discovered that, when participating in an online shopping simulation, there was no significant difference between the groups regarding the amount of personal information revealed.²⁸⁰

The same finding can be found in other experiments, which show that privacy concerns announced by subjects prior to the experiment are inconsistent with shopping behavior during the experiment.²⁸¹ It was also shown that privacy concerns of experimental subjects are a weak predictor of membership and of the amount of information disclosed through social networks.²⁸² In an experiment where almost 90% of respondents of a survey declared that they have a high concern about their own privacy,

279 See Sarah Spiekermann, Jens Grossklags, and Bettina Berendt, “E-Privacy in 2nd Generation E-Commerce: Privacy Preferences versus Actual Behavior,” in Proceedings of the Third Association for Computing Machinery Conference on Electronic Commerce, ed. Michael Wellman and Yoav Shoham (New York:

Association for Computing Machinery Press, 2001), 38.

280 This included information such as: in which occasions the subject takes photos, what he does with his pictures, what are his motivations for taking pictures, how photogenic he is, and how conceited he is. See Ibid.

281 See Bettina Berendt, Oliver Günther, and Sarah Spiekermann, “Privacy in E-Commerce,” Communications of the Association for Computing Machinery 48, no.

4 (2005): 101.

282 See Alessandro Acquisti and Ralph Gross, “Imagined Communities: Awareness, Information Sharing, and Privacy on the Facebook,” in Proceedings of the Sixth Workshop on Privacy Enhancing Technologies (Cambridge: Robinson College of Cambridge University, 2006), 1.

again almost 90% of these respondents accepted to put full name and home address under risk of disclosure in exchange for a loyalty card.²⁸³

Still, data subjects have been shown to respond to monetary incentives regarding privacy, and particularly regarding the avoidance of secondary use, improper access, and error, even if the willingness to pay was low.²⁸⁴ In addition to their willingness to pay, data subjects have been shown to respond to privacy concerns by avoiding behaviors that deviate from social norms, which have been shown to be more privacy-sensitive.²⁸⁵

In more recent studies, data subjects’ valuations also display a gap between willingness to pay to protect information and willingness to accept a certain proposal to sell information.²⁸⁶ In a survey, most participants under a first treatment were not willing to pay one dollar to prevent behavioral advertising, while under a second treatment most participants were not willing to accept one dollar to allow for behavioral advertising.²⁸⁷ In an experiment, subjects were either asked how much money they were willing to pay to protect their otherwise public personal information, or how much they would be willing to accept to allow that information to become public. The average willingness to accept was five times higher

283 See Alessandro Acquisti and Jens Grossklags, “Privacy and Rationality in Individual Decision Making,” Institute of Electrical and Electronics Engineers Security and Privacy Magazine 3, no. 1 (2005): 26.

284 See Il-Horn Hann et al., “Overcoming Online Information Privacy Concerns: An Information-Processing Theory Approach,” Journal of Management Information Systems 24, no. 2 (2007): 13. Willingness to pay was shown to vary between $30.49 and $44.62 for US subjects.

285 See Yoan Hermstruwer and Stephan Dickert, “Tearing the Veil of Privacy Law:

An Experiment on Chilling Effects and the Right to Be Forgotten,” Preprints of the Max Planck Institute for Collective Goods (Bonn, 2013).

286 Some studies suggest that, counter intuitively, the offer of a reward for the information actually reduces self-disclosure, intensifying concern against rational-choice based predictions. See Eduardo Andrade, Velitchka Kaltcheva, and Barton Weitz, “Self-Disclosure on the Web: The Impact of Privacy Policy, Reward, and Company Reputation,” Advances in Consumer Research 29 (2002): 350. Other research, however, contradicts those findings. See Kai-Lung Hui, Hock Hai Teo, and Sang-Yong Lee, “The Value of Privacy Assurance: An Exploratory Field Experiment,” Management Information Systems Quarterly 31, no. 1 (2007): 19.

287 See Aleecia McDonald and Lorrie Faith Cranor, “Beliefs and Behaviors:

Internet Users’ Understanding of Behavioral Advertising,” in Proceedings of the 38th Research Conference on Communication, Information and Internet Policy (Arlington, 2010).

than the willingness to pay (WTA:WTP ratio of 5.47) which almost doubles average ratio for other goods (2.92).²⁸⁸

Other related research has explored the impact —or lack thereof—

of privacy policies in websites,²⁸⁹ together with other elements such as the mention of a protecting regulation,²⁹⁰ privacy seals,²⁹¹ the way in which information requests are presented,²⁹² how much other data subjects disclose,²⁹³ and promises of data breach notifications.²⁹⁴

3

3.2.2. Differing valuations

Other research focuses on whether these valuations vary and whether certain types of personal information are valued more or less than others.

Data subjects value their offline information, which is composed by facts related directly to their person that enters the online domain such as their birth date or health status, differently than their online information, composed by their browsing patterns. In average, they seem to value offline information three times as much as their browsing behavior.²⁹⁵

288 See Alessandro Acquisti, Leslie John, and George Loewenstein, “What Is Privacy Worth?,” Journal of Legal Studies 42, no. 2 (2013): 249.

289 See Eduardo Andrade, Velitchka Kaltcheva, and Barton Weitz, “Self-Disclosure on the Web: The Impact of Privacy Policy, Reward, and Company Reputation,”

Advances in Consumer Research 29 (2002): 350; Kai-Lung Hui, Hock Hai Teo, and Sang-Yong Lee, “The Value of Privacy Assurance: An Exploratory Field Experiment,” Management Information Systems Quarterly 31, no. 1 (2007): 19.

290 See Sarah Spiekermann, Jens Grossklags, and Bettina Berendt, “E-Privacy in 2nd Generation E-Commerce: Privacy Preferences versus Actual Behavior,” in Proceedings of the Third Association for Computing Machinery Conference on Electronic Commerce, ed. Michael Wellman and Yoav Shoham (New York:

Association for Computing Machinery Press, 2001), 38.

291 See Kai-Lung Hui, Hock Hai Teo, and Sang-Yong Lee, “The Value of Privacy Assurance: An Exploratory Field Experiment,” Management Information Systems Quarterly 31, no. 1 (2007): 19.

292 See Alessandro Acquisti, Leslie John, and George Loewenstein, “The Impact of Relative Standards on the Propensity to Disclose,” Journal of Marketing Research 49 (2012): 160.

293 See Ibid.

294 See Francesco Feri, Caterina Giannetti, and Nicola Jentzsch, “Disclosure of Personal Information Under Risk of Privacy Shocks,” University of Bologna School of Economics Working Paper 875 (Bologna, 2013).

295 See Juan Pablo Carrascal et al., “Your Browsing Behavior for a Big Mac:

Economics of Personal Information Online,” in Proceedings of the 22nd International Conference on World Wide Web (Geneva, 2013).

Regarding offline information in particular, it has been shown that—as it is intuitive—data subjects do not value all of its types in the same way. An inverse linear relationship has been shown between the desirability of their personal traits and the value they place on them;

people ask for more money in order to reveal their undesirable traits with no direct financial or identity-theft repercussions, such as weight and age.²⁹⁶

More specifically, some research has indicated that data subjects place different values over different types of offline personal information.

For instance, they seem to place a high value on information related to their medical and financial status and information about their families, and to have less trouble disclosing information about product consumption and brand consumption, as well as media usage.²⁹⁷

This line of research suggests that there are relevant differences between the types of information data subjects choose to disclose—offline and online, sensitive and non-sensitive—, and if personal information is treated as fungible units then experimental results might not be entirely accurate. Since not all types of personal information impact data subjects’

utility in the same way, it is questionable to treat personal information as fungible units when analyzing transactions.²⁹⁸

3

3.2.3. Context and accessibility

Other papers explore the importance of context and accessibility of information at the moment of disclosure, which data subjects seem to respond to. They suggest that consumer behavior is less random than one might think based on the findings reviewed above.

296 See Bernardo Huberman, Eytan Adar, and Leslie Fine, “Valuating Privacy,”

Institute of Electrical and Electronics Engineers Security and Privacy Magazine 3 (2005): 22.

297 See Daniel Horne and David Horne, “Domains of Privacy: Toward an Understanding of Underlying Factors,” in Direct Marketing Educators’ Conference (San Francisco, 1998).

298 See Luc Wathieu and Allan Friedman, “An Empirical Approach to Understanding Privacy Valuation,” Harvard Business School Working Paper 07-75 (Boston, 2007).

When taking the context of disclosure into account, there is some evidence in favor of agents that behave rationally when facing simple privacy issues.²⁹⁹ Data subjects’ privacy concerns seem to be sensitive not only to direct harms—defined as an immediate perceived harm provoked by an information release such as fear of fraud or spam—but also to the indirect consequences of the transmission of information—such as fear of ending up being the object of price discrimination. Data subjects seem mainly concerned about the use that is given to their information—even more than about its transfer.³⁰⁰ An increment in control over the publication of data subjects’ personal data decreases their concerns over their privacy and hence increases their willingness to disclose sensitive information.³⁰¹

Data subject’s ability to act in their own self-interest when dealing with privacy issues changes when these issues become complex—there does not seem to be a generalized inability to deal with them.³⁰²

Other studies have shown that when information about security is made visible, for instance available on browsers themselves, data subjects respond to it.³⁰³ One of them shows that, when information about privacy is available directly on search engines, data subjects do prefer websites that offer a higher protection for their privacy, in particular regarding purchases that involve the disclosure of sensitive information.³⁰⁴ Another,

299 See Ibid.

300 See Ibid.

301 See Leslie John, Alessandro Acquisti, and George Loewenstein, “Strangers on a Plane: Context-Dependent Willingness to Divulge Sensitive Information,” Journal of Consumer Research 37, no. 5 (2011): 858.

302 See Ibid.

303 See Julia Gideon et al., “Power Strips, Prophylactics , and Privacy, Oh My!,” in Proceedings of the Second Symposium on Usable Privacy and Security (New York, 2006), 133; Janice Tsai et al., “The Effect of Online Privacy Information on Purchasing Behavior: An Experimental Study,” Information Systems Research 22, no. 2 (2011): 254; Nicola Jentzsch, Sören Preibusch, and Andreas Harasser, “Study on Monetising Privacy: An Economic Model for Pricing Personal Information.

Report for the European Network and Information Security Agency” (Heraklion, 2012).

304 See Julia Gideon et al., “Power Strips, Prophylactics , and Privacy, Oh My!,” in Proceedings of the Second Symposium on Usable Privacy and Security (New York, 2006), 133.

explores whether a different display of privacy policies induces data subjects to incorporate better privacy considerations. It shows that when information is available and salient, data subjects prefer to purchase from retailers that protect their privacy better and are even willing to pay a premium to do so.³⁰⁵

Conversely, it has been shown that when information about privacy is not salient, data subjects display a low willingness to pay for their personal information. Participants were shown two otherwise identical stores that differed only in the requested information; one store asked for sensitive information and the other for non-sensitive information. When prices between the stores differed, subjects chose to buy from the cheapest store—even if it required more disclosure—and when the prices of the stores were equal, they were indifferent between the stores.³⁰⁶

Finally, while the level of comprehension of privacy policies is very low, and while an accessible link to the privacy policy in websites does not significantly affect levels of disclosure, other more “visceral” notices—such as anthropomorphic elements, self-focused attention mechanisms and a high level of formality in web design—do achieve higher levels of comprehension on data subjects and have an effect on their levels of disclosure.³⁰⁷

305 See Janice Tsai et al., “The Effect of Online Privacy Information on Purchasing Behavior: An Experimental Study,” Information Systems Research 22, no. 2 (2011): 254.

306 See Alastair Beresford, Dorothea Kübler, and Sören Preibusch, “Unwillingness to Pay for Privacy: A Field Experiment,” Economics Letters 117, no. 1 (2012): 25.

For an extension of this experiment to an unraveling market, and showing that to some extent data subjects react to privacy costs, see Volker Benndorf, Dorothea Kuebler, and Hans-Theo Normann, “Privacy Concerns, Voluntary Disclosure of Information, and Unraveling: An Experiment,” Forthcoming in European Economic Review, 2015.

307 See Victoria Groom and Ryan Calo, “Reversing the Privacy Paradox: An Experimental Study,” in Proceedings of the 39th Telecommunications Policy Research Conference (Schertz, 2011).