New study challenges assumptions about our attitudes to data privacy online

A new article by Professor Ignacio Cofone challenges the concept of the 'privacy paradox' – the claim that people say they value privacy but then act inconsistently by willingly sharing personal data on the internet.

Published in the Georgetown Law Technology Review, the study centres on an original experiment designed to mirror familiar online choices. In the experiment, participants were offered a small financial benefit in exchange for sharing personal information. The experiment varied the terms of the offer: in some cases, participants had to decide in the moment whether to share their data, while in others, they could decide later after receiving more information.

The results show that participants value the ability to revisit their data-sharing decisions. This helps explain why our behaviour in relation to data privacy can appear paradoxical. People's choices are largely responses to uncertainty about the risks of data practices, rather than a lack of concern about them.

The article's finding has regulatory implications. Instead of trying to correct people's choices with paternalistic 'nudges' (similar to setting a spending limit on a gambling website), privacy law and policy should focus on reducing uncertainty – particularly through more meaningful forms of transparency and through legal mechanisms, such as the right to be forgotten, that allow individuals to reassess earlier decisions as circumstances and risks change.

Professor Cofone says: "When people are unsure about what practices their information is subjected to, and the consequences of those data practices, they may disclose information while still valuing privacy because the perceived risk at the time of data collection is too uncertain to act upon decisively. The so-called privacy paradox, as a result, is not a paradox at all, but behaviour that reflects adaptation to structural informational constraints. Showing that privacy behaviour is not paradoxical matters both conceptually and practically. If people are not reversing their preferences or acting irrationally, but instead responding to structural uncertainty, their behaviour should not be seen as a failure of decision-making but as a failure of the information environment."