Privacy choices explained by uncertainty not conflicting actions
The Privacy Paradox Is a Misnomer: Data Under Structural Uncertainty
Computers and SocietyHuman-Computer Interaction
Summary
People are often said to act against their stated desire for privacy, creating what is called the privacy paradox. This paper by the authors explains that the paradox is actually a misunderstanding. Their experiment shows that people make privacy decisions based on incomplete or uncertain information about risks, not because they are inconsistent or tempted to reveal data. The findings suggest privacy laws should focus on reducing uncertainty by improving transparency and giving people ways to adjust their data sharing as risks change.
What this means in practice
- •For privacy policy makers: Design privacy regulations that reduce uncertainty by requiring clearer data collection disclosures and flexible privacy controls.
- •For consumer protection agencies: Create tools and standards to improve transparency about data risks to help consumers make informed privacy choices.
Authors
Ignacio Cofone
Abstract
The infamous privacy paradox refers to the apparent inconsistency between people's stated concern for privacy and their readiness to disclose personal information. This phenomenon has sparked two largely disconnected literatures: one offering experimental evidence of inconsistent behavior, and another providing qualitative accounts and defending the importance of privacy. The Article presents an online field experiment that bridges those literatures and shows that the so-called paradox arises from a mischaracterization of the underlying behavior. The Article finds that it is structural uncertainty about risk that drives seemingly paradoxical privacy decisions. It does so by isolating discounting mechanisms and empirically testing whether observed privacy choices reflect temptation or rational responses to uncertainty. The results suggest that privacy behavior is not paradoxical but, rather, consistent with choices shaped by incomplete information. The Article then discusses the policy implications of this reframing. As privacy decisions stem from structural uncertainty, which operates as a market failure, regulation should aim to reduce that uncertainty. This supports regulation that prioritizes transparency (for people to assess the risks of data collection) and flexibility mechanisms that accommodate evolving contexts. Such reframing provides a new argument for the right to be forgotten, which allows people to revisit prior disclosures as new risks become apparent. By shifting the focus from individual inconsistency to structural uncertainty, the findings call for privacy law to better reflect the reality of people's decision-making environments.