How much risk are people ready to take with their private information?

What is it about?

Many online transactions and digital services depend on consumers’ willingness to take risk with their private information. They take risk when shopping online, joining social networks, using online banking, or interacting with e-health platforms. Information that they submit online may be collected, disseminated, and used without their permissions. In those settings, the decision to disclose information online depend not only on how much they care about keeping their data private, but also on how risk averse they are. Up to now, researchers and practitioner only measured the value of private information, but not how willing people are to take risks with it. In order to remedy this issue, we present a novel method to measure aversion to privacy risk that takes account of both private information value and privacy risk tolerance. Our method can be used to elicit attitudes to a wide range of privacy risks and various types of private information. We empirically tests the validity of this measure in a laboratory experiment with 148 participants. Individuals were asked to make a series of incentivized decisions on whether to incur the risk of revealing private information to other participants or not. Our results confirm that the willingness to incur a privacy risk is driven by a complex array of factors including risk attitudes, self-reported value for private information, and general attitudes to privacy (derived from surveys). We find that attitudes to privacy risk do not depend on whether there is a preexisting threat to privacy. That is, participants are as ready to protect their information from risks if there is already a risk of disclosure as if there is not. This means that they do not get discouraged by the fact there is already a threat to their privacy due to prior decisions they made. We underline that the context in which our measure is collected matters. In particular, presenting privacy choices after asking for aversion to monetary risks leads to less privacy-protective behavior.

Featured Image

Photo by ev on Unsplash

Photo by ev on Unsplash

Why is it important?

Our study advances research on the economics of consumer privacy—one of the most controversial topics in the digital age. There is a proliferation of privacy regulations (including recent EU GDPR, and California Consumer Privacy Act). In this respect, policy-makers need good measures of aversion to privacy risk in order to make informed decisions regarding what tradeoffs consumers consider beneficial and fair, and where to draw the line for violations of consumers’ expectations, preferences and welfare. Measuring aversion to privacy risk is also essential for managers when designing and implementing their privacy policies and also when establishing new markets, such as for example cyber insurances. Our measures of privacy risk aversion is therefore useful for policymakers when surveying public opinion, evaluating existing policies (e.g. whether current regulations address consumers’ concerns) and making decisions about privacy regulations and consumer protection. Surveying privacy risk aversion and the value of privacy under risk can also serve a practical role when computing privacy insurance premiums, deciding what privacy insurance should cover and when doing comparative studies of factors affecting privacy risk tolerance.

Perspectives