The Cost of Reading Privacy Policies

Companies collect personally identifiable information that website visitors are not always comfortable sharing. One proposed remedy is to use economics rather than legislation to address privacy risks by creating a marketplace for privacy where website visitors would choose to accept or reject offers for small payments in exchange for loss of privacy. The notion of micropayments for privacy has not been realized in practice, perhaps because advertisers might be willing to pay a penny per name and IP address, yet few people would sell their contact information for only a penny. 1 In this paper we contend that the time to read privacy policies is, in and of itself, a form of payment. Instead of receiving payments to reveal information, website visitors must pay with their time to research policies in order to retain their privacy. We pose the question: if website users were to read the privacy policy for each site they visit just once a year, what would their time be worth? Aleecia M. McDonald is a Ph.D. candidate in Engineering and Public Policy at Carnegie Mellon University. Lorrie Faith Cranor is an Associate Professor of Computer Science and of Engineering and Public Policy at Carnegie Mellon University where she is director of the CyLab Usable Privacy and Security Laboratory (CUPS). We gratefully acknowledge Janice Tsai, Ponnurangam Kumaraguru, and Pitikorn Tengtakul for support, feedback, and helpful comments on preliminary drafts of this work. This paper benefited from insightful conversations with H. Scott Matthews, Jon M. Peha, Alessandro Acquisti, and Chriss Swaney. The authors thank Robert McGuire for his assistance with analysis. Many thanks to Michelle McGiboney and Suzy Bausch of The Nielsen Company. This research was funded in part by U.S. Army Research Office contract no. DAAD19-o2-1-0389 ("Perpetually Available and Secure Information Systems") to Carnegie Mellon University's CyLab. 'Simson Garfinkel, Database Nation: The Death of Privacy in the 21st Century (Sebastopol, CA: O'Reilly & Associates, 2001), 183. I/S: A JOURNAL OF LAW AND POLICY Studies show privacy policies are hard to read, read infrequently, and do not support rational decision making. We calculated the average time to read privacy policies in two ways. First, we used a list of the 75 most popular websites and assumed an average reading rate of 250 words per minute to find an average reading time of lo minutes per policy. Second, we conducted an online study of 212 participants to measure time to skim online privacy policies and respond to simple comprehension questions. We used data from Nielsen/Net Ratings to estimate the number of unique websites the average Internet user visits annually with a lower bound of 119 sites. We estimated the total number of Americans online based on Pew Internet & American Life data and Census data. Finally, we estimated the value of time as 25% of average hourly salary for leisure and twice wages for time at work. We present a range of values, and found the national opportunity cost for just the time to read policies is on the order of $781 billion. Additional time for comparing policies between multiple sites in order to make informed decisions about privacy brings the social cost well above the market for online advertising. Given that web users also have some value for their privacy on top of the time it takes to read policies, this suggests that under the current self-regulation framework, targeted online advertising may have negative social utility. [Vol. 4:3