Privacy policies influence consumer behavior online, new study finds

Newswise — CHICAGO — Deciding how much personal information to share online has become an everyday choice for consumers. However, whose responsibility is it to keep private information safe — companies or consumers? New research from James A. Mourey at DePaul University and Ari Ezra Waldman at New York Law School finds that consumers share less private information when companies empower them to be in charge. However, when companies communicate that they actively manage users’ privacy, consumers become even more willing to share private, personal information online.

The study, “Past the Privacy Paradox: The Importance of Privacy changes as a Function of Control & Complexity,” is scheduled to appear in the April issue of the Journal for the Association of Consumer Research, and is now available online at https://www.journals.uchicago.edu/doi/10.1086/708034.

“After looking at the issue of privacy from numerous angles, we began asking the question, ‘what happens when you, as a consumer, perceive yourself as being in control of your privacy,” said Mourey, an assistant professor of marketing in DePaul’s Driehaus College of Business. “It turns out that the way companies frame their approach to privacy management can affect whether or not users disclose very private information, like their home address or even intimate photos.”

The research examines whether consumers perceive themselves or the company as being in charge of managing privacy, and second, how difficult consumers perceive privacy management to be. When managing privacy is perceived to be difficult, people share less information when they believe they are actively managing their privacy and share more information when they believe a tech company is actively managing their privacy, explained Mourey.

The study offers an alternative explanation to the privacy paradox, which posits that consumers want privacy online but act in ways that are opposite of maintaining their privacy in a cost-benefit tradeoff. The researchers found that the very importance of online privacy changes for consumers based on the context of how privacy is viewed. The relationship between privacy management, its perceived level of difficulty to maintain, and the perception about who is in charge of their privacy online predicts the propensity to share private personal information.

The researchers conducted three experiments, with each experiment sampling 200 or more participants. The first two experiments had participants read news releases or company privacy policies that offered different perspectives of the party responsible for actively managing privacy control (the participant or his/her selected tech company), and how easy/difficult managing privacy was to do. Both experiments showed that, when managing privacy was perceived to be difficult, who was in charge of actively managing privacy affected willingness to share private, personal information. Even participants’ perception of how important privacy was changed as a function of who was said to be actively managing privacy.

The third experiment measured participants’ tolerance for risk-benefit tradeoff, their trust perceptions for themselves and online companies, and their sense of self-efficacy to highlight the work’s unique contribution to understanding privacy: privacy’s very importance can change as a function of who is thought to be managing privacy and how easy/difficult managing privacy is. This dynamic importance of privacy then affects whether individuals share private, personal information or not.

Among the findings:

• Consumers who perceive that managing their privacy online is difficult, but that it’s their own responsibility, place a higher level of importance on privacy. These consumers are less likely to share private personal information.
  
  
• However, when consumers perceive privacy and the management of it online as difficult to do and a tech company is actively managing privacy, privacy is viewed as less important and therefore it is more likely that individuals will share private personal information.
  
  
• There is an unintended consequence for companies that inform consumers of updated privacy policies, as these may signal to the consumer that their privacy is being taken care of, leading consumers to reveal more private personal information. This consequence is due to consumers viewing the responsibility to manage privacy as in the hands of the company, making it seem easier to maintain and manage.
  
  
• In order to avoid creating a false sense of protection, consumers are better off feeling in control of maintaining their privacy and should be wary of companies that say that they will do it for them.
  
  
• Tech companies need to understand and consider the consequences of informing consumers of updated privacy policies since more personal information may be indirectly shared as a result.

“The lesson that privacy’s importance to consumers can vary based on how hard they perceive maintaining privacy to be or who is perceived as in control of managing privacy is an important lesson to take from this research,” said Mourey. “Our hope is that consumers become more aware of privacy issues and do a double take the next time a company says that they are effectively managing your privacy.”

The findings from this research have implications from both consumer protection and legislative standpoints, the authors noted. Educating consumers and helping them feel greater urgency about managing their own privacy is critical, said Mourey. This is especially important when new privacy policies are released, which research shows lead consumers to reveal more private personal information, he added.

The researchers acknowledge the findings as a stepping-stone for future work, which might include looking into what happens to online privacy and consumer perceptions as the sharing of private personal information becomes normalized.

Public policy needs to be reviewed and updated as technology evolves, noted Waldman, a professor of law at New York Law School.

“Our findings suggest that the law needs to be far more robust in limiting how technology companies can influence, coerce and manipulate us,” Waldman said. “It’s not enough to say that ‘individuals need more control over their data.’ Companies can use design tricks to manipulate what control means and how that translates into our disclosure behavior online. We need specific, affirmative obligations on companies that will stop certain uses of our data.

“Individuals should think twice when a company says it is giving them more ‘control’ over their data. What they’re really doing is lulling us into a false sense of power just as they manipulate our behavior to suit their own ends,” he added.

###

Source:
James Mourey
[email protected]
321-362-7663