The Privacy Paradox

The Privacy Paradox

The privacy paradox is the gap between what people say about protecting their personal data and what they do. Patricia Norberg and colleagues named it in 2007. Research since then disagrees about whether it is a real contradiction, a measurement problem or a product of how data choices are designed.

What it is

Norberg and colleagues, in the Journal of Consumer Affairs, started from consumers complaining about losing control of their personal information while handing it over freely. They called the relationship between intended and actual disclosure the privacy paradox.

In 2015 Alessandro Acquisti and colleagues reviewed the field in Science. In one study they describe, 48 per cent of those most concerned about strangers learning their sexual orientation had revealed it publicly on a social network. In a gift card experiment, 52.1 per cent of shoppers who started with an anonymous 10 dollar card kept it, while only 9.7 per cent of those who started with a trackable 12 dollar card switched to the anonymous one. The review's reading: "people value privacy more when they have it than when they do not."

Susan Athey, Christian Catalini and Catherine Tucker found in 2017 that a free pizza halved the share of MIT students who protected their friends' email addresses, from 5 to 2.5 per cent, whatever they had said about their preferences. In Mindmasters (2025), Sandra Matz reports an unpublished experiment in which 75 per cent of more than 1,500 participants said they were concerned about privacy and 85 per cent sold their data anyway. She concludes that transparency and control are not enough.

In effect

For a consumer, concern is easy to state and gives way when a small, immediate reward is on offer and the cost is out of sight. Our view is that the design of the choice deserves as much attention as the person making it.

What it does not say

It does not say concern is meaningless. Lemi Baruh and colleagues pooled 166 studies from 34 countries with 75,269 participants in 2017: concern did not predict social network use, but it did predict less use of online services, less sharing and more protective measures.

Daniel Solove argued in 2021 that the paradox is "a myth created by faulty logic", because behaviour involves specific risk decisions while attitudes are general. The 2015 review had weighed a version of this argument and found it incomplete. Matz's experiment has no citation in the book, so its design cannot be inspected.

Sources

  1. Norberg, P. A., Horne, D. R., & Horne, D. A. (2007). "The privacy paradox: personal information disclosure intentions versus behaviors." Journal of Consumer Affairs, 41(1), 100-126. doi:10.1111/j.1745-6606.2006.00070.x.
  2. Acquisti, A., Brandimarte, L., & Loewenstein, G. (2015). "Privacy and human behavior in the age of information." Science, 347(6221), 509-514. doi:10.1126/science.aaa1465.
  3. Athey, S., Catalini, C., & Tucker, C. (2017). "The digital privacy paradox: small money, small costs, small talk." NBER Working Paper 23488. doi:10.3386/w23488.
  4. Matz, S. (2025). Mindmasters: The Data-Driven Science of Predicting and Changing Human Behavior. Harvard Business Review Press, ch. 8, pp. 159 to 160, and ch. 9.
  5. Baruh, L., Seçinti, E., & Cemalcılar, Z. (2017). "Online privacy concerns and privacy management: a meta-analytical review." Journal of Communication, 67(1), 26-53. doi:10.1111/jcom.12276.
  6. Solove, D. J. (2021). "The myth of the privacy paradox." George Washington Law Review, 89(1), 1-51.