<figure><img src="image_1.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Valuation of Differential Privacy Budget in Data Trade: A Conjoint Analysis

Michael Khavkin(✉) and Eran Toch

Department of Industrial Engineering, Tel Aviv University, Tel Aviv 6997801, Israel
khavkin1@mail.tau.ac.il, erant@tauex.tau.ac.il

**Abstract.** Differential privacy has been proposed as a rigorous privacy guarantee for computation mechanisms. However, it is still unclear how data collectors can correctly and intuitively configure the value of the privacy budget parameter $\varepsilon$ for differential privacy, such that the privacy of involved individuals is protected. In this work, we seek to investigate the trade-offs between differential privacy valuation, scenario properties, and preferred differential privacy level of individuals in a data trade. Using a choice-based conjoint analysis ($N = 139$), we mimic the decision-making process of individuals under different data-sharing scenarios. We found that, as hypothesized, individuals required lower payments from a data collector for sharing their data, as more substantial perturbation was applied as part of a differentially private data analysis. Furthermore, respondents selected scenarios with lower $\varepsilon$ values (requiring more privacy) for indefinitely-retained data for profit generation than for temporarily-retained data with a non-commercial purpose. Our findings may help data processors better tune the differential privacy budget for their data analysis based on individual privacy valuation and contextual properties.

**Keywords:** Differential Privacy · Privacy Budget · User Preferences · Willingness-to-Accept · Conjoint Analysis

## 1 Introduction

Anonymization has become the fundamental step in privacy protection and data minimization, acting as one of the critical principles in compliance with privacy-related laws. Privacy-related laws and regulations, such as the European General Data Protection Regulation (GDPR) [20] and its American equivalents California Consumer Privacy Act (CCPA) and the Health Insurance Portability and Accountability Act (HIPAA), have raised data collectors' awareness to privacy and contributed to the empowerment of individuals through increased transparency of data handling processes. Anonymization is often used as a Privacy-Enhancing Technique (PET) to deal with the risk of releasing Personally identifiable Information (PII), i.e., any information that is linkable to an individual's identity or to her personal attributes, by either direct or indirect means. This has made privacy-preserving data analysis more relevant, especially in providing business insights in many real-world applications, such as census surveys
[7], healthcare [12], and so forth. However, as previously demonstrated [23], anonymization does not always act as a silver bullet, primarily when statistical analyses are performed.

Rigorous privacy constraints, such as differential privacy [13], have been proposed to prevent adversarial re-identification of sensitive information from data analysis outcomes. Under differential privacy, individual-level values cannot be inferred from aggregate data, even in the presence of an adversary with background knowledge. A privacy parameter typically controls the level of differential privacy, denoted by the parameter $\epsilon$ and referred to as privacy budget [15]. The privacy budget limits the privacy loss incurred by an individual when her personal data is used in an analysis. In the context of differentially private mechanisms for data analysis, the privacy budget is translated to the amount of noise that is added to the analysis output to guarantee privacy. In general, setting an appropriate value of $\epsilon$ is an unsolved problem open to interpretations and heuristics, as there is no upper bound on the value of $\epsilon$, and no gold standard for its selection exists [14, 19]. For example, reported privacy budget values in previous works range from 0.1 to $\ln(3)$ [15] and as high as 14 in Apple's implementation [29]. Moreover, the relativeness of $\epsilon$ to the data domain and analysis type adds another dimension of complexity to its selection process since it may require a high degree of domain expertise from the data processor.

User-Centered-Design (UCD) principles have been developed to extend the initiative of *Privacy-by-Design* development [6], which encourages involving end-users in the design process of privacy in information systems. Although these principles help increase the cooperation of individuals in contributing their data for an analysis [17], they posed an additional challenge due to a possibly significant deviation in privacy preferences and varying privacy valuations among individuals. This has raised the need for personalized differential privacy [17], according to which personal privacy levels are set individually at a user-level and then aggregated to a general privacy budget. However, we cannot expect individuals to provide the data processor with their preferred value of $\epsilon$ directly, as this task is non-trivial, even for domain experts.

The challenge of privacy budget selection has been intensified in data markets [27], where individuals trade their personal data by selling it to data collectors (e.g., organizations), who in turn present them with monetary compensation for their privacy loss (also referred to as Transactional Privacy [26,27]). User interaction with privacy, particularly Transactional Privacy, is strongly connected to human behavior and personal valuation. The decision-making process of users (also referred to as *privacy-calculus* [10]) involves weighting the privacy risks of disclosing personal information, on the one hand, and the personal benefits from this act, on the other hand. Accordingly, if the benefits outweigh the privacy risks, users are expected to disclose sensitive information. Hence, the decision-making process of individuals in data trade is represented, often unconsciously, by the evaluation of multiple trade-offs between multiple factors. Previous evaluation of privacy-utility trade-offs in the health recommender systems [30] and e-commerce [31] domains has emphasized the importance of studying human-
related factors to increase acceptance of privacy mechanisms and understand their impact on individuals' willingness to share personal data. Nevertheless, most previous works investigated the impact of privacy valuation on decision-making processes without establishing specific research questions that relate to differential privacy, in particular.

Extending the existing literature on decision-making processes under differential privacy, we investigated the influence of behavioral and contextual factors on the willingness to share data in data trade under differential privacy. These factors reflect the privacy preferences of individuals participating in a data-sharing scenario. In particular, we examined these trade-offs' influence on the value of $\varepsilon$, which the data processor can later use to apply a differential privacy mechanism to data analysis. To that end, we performed a choice-based conjoint analysis, where we asked 139 participants to select their most preferred scenario, described by a set of attributes, in the context of three data-sharing use cases involving medical, financial, and behavioral data.

*Contribution.* In this paper, we considered the human-related aspects of selecting $\varepsilon$ for differential privacy. We compared the potential impact of varying privacy preferences and scenario properties on the selected privacy budget $\varepsilon$. In addition, we investigated whether individuals' differential privacy valuation is aligned with the expected theoretical payment scheme for data trade under differential privacy.

The remainder of this paper is structured as follows. In Sect. 2, we review related work concerning privacy valuation and provide a brief overview of differential privacy. In Sect. 3, we describe our experimental design and present our findings in Sects. 4 and 5. Finally, we conclude this paper in Sect. 6.

# 2 Background and Related Work

## 2.1 Anonymization and Differential Privacy

Statistical Disclosure Limitation techniques [3] have been proposed as a type of anonymization that generates an anonymized dataset with a specific format designed to reduce disclosure risk. Such methods implemented the idea of *"hiding in a crowd"*, reducing the uniqueness of a record among all other records in a dataset. Such protection methods achieved anonymization by performing generalization, suppression, or both. However, these methods have been found [23] to be vulnerable to cases where the adversary has broader background knowledge about individuals in a dataset than one would anticipate.

Differential privacy (DP) [13] has been proposed as a mathematically rigorous privacy guarantee that provides plausible deniability. According to differential privacy, the maximal change in a randomized algorithm's output on two neighboring datasets is bounded by the privacy budget parameter $\varepsilon$. This parameter controls the maximum amount of information that can be learned about any individual's data through the analysis of a dataset. In other words,
the outcome of any analysis is equally likely, up to a multiplicative factor, independent of whether any individual's data is present in the analyzed dataset. Formally, a randomized mechanism $\mathcal{A}$ satisfies $\varepsilon$-differential privacy concerning two neighboring datasets $D$ and $D'$, differing in precisely one record, and for every subset of possible outputs $S$, if and only if

$$ \Pr[\mathcal{A}[D] \in S] \leq \exp(\varepsilon) \Pr[\mathcal{A}[D'] \in S] \quad (1) $$

Differential privacy is commonly achieved through noise-addition mechanisms, such as Laplace mechanism [15], Gaussian mechanism [15], or exponential mechanism [24]. For example, for an analysis function and Laplace mechanism, noise is sampled randomly from the Laplace distribution and added to the function's output. The amount of added noise is directly and inversely controlled by the privacy budget $\varepsilon$, i.e., the lower $\varepsilon$, the noisier the output is (but more private), and vice versa. In the context of personalized differential privacy [17] for computations between a data collector and multiple individuals, each individual selects a personal privacy specification, which is then aggregated to a single general privacy budget.

Previous works argued that although the privacy budget parameter $\varepsilon$ of differential privacy is theoretically well-defined, there is a challenge in configuring it in practice [14, 16, 19]. Reported privacy budget values in previous works ranged from 0.1 to $\ln(3)$ [15] and as high as 14 in Apple's implementation [29], but these may serve as a rough estimation and may not be suitable for any use case. Moreover, the change in the risk of learning anything about a non-participating individual, as opposed to a participating individual whose data is used for a data analysis, is bounded by a multiplicative exponential factor of $e^{\varepsilon}$. Hence, even small changes in $\varepsilon$ are translated to large deviations in that risk.

From a practical point of view, the selection of $\varepsilon$ in real-world applications [14] was also accompanied by the challenge of relativeness to the data domain and analysis type. This has presented organizations with the requirement of hiring a dedicated domain expert with knowledge of differential privacy to circumvent the challenges in the selection process, which ultimately can hinder the deployment of differential privacy into information systems. Furthermore, the difficulty in comprehending differential privacy and its implications among laypeople has been extensively studied [11, 31] to improve the general acceptance of differentially private methods. Other criticized challenges relate to increased computational resources and the need for suitable computing environments [4].

## 2.2 Privacy Valuation Under Differentially Private Data Trade

Personal privacy valuation and segmentation of privacy attitudes [21] have been used to explain the rationality behind privacy calculus [10]. Acquisti et al. [2] stated that the value of privacy depends on how private the data is, i.e., the less private the information is, the lower it is valued, and vice versa. Privacy valuation is commonly measured in monetary units by the individual Willingness-to-Accept (WTA) [2], i.e., the lowest price that individuals are willing to accept for
sharing their personal information. Alternatively, valuation has been considered as the Willingness-to-Pay (WTP) for the protection of personal sensitive information [2]. However, deeper examination using common experience and surveys [1] showed a paradox between privacy attitudes and user behavior, which has later been referred to as the privacy paradox [5]. Namely, the privacy preferences that individuals declare are not always the ones they reveal (i.e., “users do share data but value not sharing data” [30]). Several cognitive and behavioral factors have been researched to explain the rational behind the privacy paradox and extend it, including privacy attitudes and sharing attitudes [9]. These have been found to be almost decoupled in the context of data sharing experiences with positive sentiment (i.e., people forget about privacy when they perceive sharing data as beneficial or pleasurable).

In the context of differentially private data trade, this observation was used for devising a payment scheme that is both fair for the individual who shares personal data and profitable enough for the data processor. For example, Jung et al. [18] proposed a fair negotiation technique which leverages the concept of social welfare, i.e., the participant's benefit from a transaction in a negotiation. Following that negotiation, the connection between $ε$ and the price individuals were willing to sell their personal data for was controlled by an exchange rate (dollar value per $ε$ value).

However, since differentially private data analysis is more accurate with large datasets, including data from many individuals can be expensive for the data collector. To reduce query costs for the data collector, Nget et al. [25] proposed a balanced query-based pricing mechanism that finds a sample of data owners to be included in a differentially private data analysis, using a price menu, derived from individuals' privacy preferences. Alternatively, in cases where data owners struggle to valuate their privacy, several pre-calculated payment schemes have been generated for data owners to choose from [2, 22].

Although several user studies [2, 28] have been conducted to understand attitudes towards data trade in general, and data protection within a data trade environment in particular, no extensive empirical investigation with users has been conducted to investigate the alignment of theoretical pricing mechanisms with real-world behavior under differentially private data trade. Furthermore, in spite of the comprehensive literature on privacy valuation, it still lacks sufficient research on how to help individuals correctly valuate their differential privacy, based not only on their subjective assessment, but also on data and setting properties (e.g., data type, collection purpose and etc.).

# 3 Research Method

Inspired by the methodology of Valdez et al. [30], a conjoint analysis was performed to investigate the decision-making process of individuals under a differentially private data sharing scenario. A conjoint analysis [8] is a common research method typically employed for product and pricing research and frequently used across different industries. We consider hereafter a use case of a two-sided data
market where individuals trade their personal data with a data collector, who in turn aggregates the data to perform a statistical data analysis that satisfies differential privacy. This use case corresponds to an “interactive use” of differential privacy, where aggregate data is used to calculate statistics, rather than masking the individual data records themselves in an offline manner. The total cost of the data analysis for the data collector is the sum of compensations to all participating individuals for their incurred privacy loss.

For simplicity, in our case we defined analysis of personal data as a histogram query, computed on the collected data of individuals who had agreed to share their data. This selection was based on reviewing recent real-world use cases, where differential privacy has been successfully implemented [7]. Furthermore, such analysis type allows us to analyze differential privacy in terms of added noise scale, with a global sensitivity [15] of 1. This property leads to an inverse relationship between the privacy budget $\varepsilon$ and the added noise scale, namely the scale of the noise is $1/\varepsilon$, and its value is sampled from Laplace distribution with parameters $(0, 1/\varepsilon)$ (i.e., Laplace mechanism [15]).

## 3.1 Experimental Design

For the experimental design, a standard setting of conjoint analysis was used. In our experiments, participants were asked to perform several choice-based tasks, where they select their most preferred scenario, described by a set of attributes, in the context of data sharing scenarios across three domains: (1) medical sensitive data (e.g., relating to the existence of diabetes); (2) financial data (e.g., income); and (3) behavioral data (e.g., Internet browsing history). To that end, we collected the responses of 139 participants to choice-based tasks, each answering 10 rounds of random decision tasks of three choices, representing three settings of sharing scenarios.

Three data-related and two user-related categorical attributes were used in the conjoint choice tasks. For the data-related attributes, we included the disclosed information type, its retention period and sharing purpose, to define the scenario for a single choice in the task.

As a proxy to the differential privacy budget, we included a noise scale attribute, representing the minimum perturbation that an individual would prefer to be added to the output of an underlying data analysis, to protect her shared personal data. Accordingly, the privacy budget was logarithmically split to five ranges between 0.05 and 2 (maximal assumed privacy budget), corresponding to noise scales, i.e., lower noise scales correspond to higher range of $\varepsilon$ values (and vice versa). The noise scale was used instead of directly presenting a privacy budget, since it is inversely tied to the value of $\varepsilon$ [15], and it would be difficult for people to interpret a continuously distributed value.

A monetary privacy valuation factor was presented as a value in the range of 1$ – 100$ (split to five sub-ranges), representing different WTA valuations. In total, the decision tasks have been randomly sampled from a set of 450 (3 × 2 × 3 × 5 × 5) factor value combinations. Table 1 summarizes the considered attributes in the study.
<table><caption>**Table 1.** Considered attributes in the choice-based conjoint analysis. Each combination of attribute levels (i.e., values) describes a setting of a data sharing scenario under differential privacy.</caption><thead><tr><th>Attribute</th><th>Description</th><th>Attribute levels</th></tr></thead><tbody><tr><td>Sensitive disclosed data</td><td>Type of collected data</td><td>(Medical) Existence of Diabetes;<br>(Financial) Income; (Behavioral)<br>Browsing History</td></tr><tr><td>Retention period</td><td>Retention period of data</td><td>Indefinite; Temporary</td></tr><tr><td>Sharing purpose</td><td>The purpose for which the<br>personal data is collected</td><td>Research; Revenue generation;<br>Improvement of services</td></tr><tr><td>Data sharing<br>compensation price<br>(Willingness-to-Accept)</td><td>Lowest price that individuals<br>are willing to accept for<br>sharing their personal<br>information</td><td>1$ – 100$</td></tr><tr><td>Differential Privacy Level<br>(prop. to noise scale, lower<br>noise scales correspond to<br>higher ε ranges)</td><td>Expected differential privacy<br>level to be satisfied by the<br>data processor</td><td>1 (1.0 ≤ ε ≤ 2.0);<br>2 (0.5 ≤ ε ≤ 1.0);<br>3 (0.2 ≤ ε ≤ 0.5);<br>4 (0.1 ≤ ε ≤ 0.2);<br>5 (0.05 ≤ ε ≤ 0.1)</td></tr></tbody></table>

As an introductory explanation to the questionnaire, all participants were provided with a short description of the study and differential privacy. We adapted the general description of differential privacy from Xiong et al. [31], which has been studied to best enhance comprehension among laypeople and increase their willingness to share information. In total, 1390 choice selections were considered, ignoring incomplete responses and click-through completions (1% of responses)<fnref n="1" />. Figure 1 illustrates a screenshot of a single decision task presented to a participant.

**Participant Statistics.** The participants were recruited via MTurk platform, with restriction to people from the U.S. with at least 90% approval rate and at least 1,000 approved assignments. Each respondent was paid 0.6$ for an estimated 7 min work. The participants consisted of $N = 77 (55\%)$ male and $N = 62 (45\%)$ female participants. Participants varied in age, spanning across all age groups: $N = 48 (34\%)$ in 18–34, $N = 67 (48\%)$ in 35–54, and $N = 24 (18\%)$ were 55 and above. Reported highest level of education has also spanned across all categories: $N = 19 (14\%)$ indicated a high-school education or less, $N = 100 (73\%)$ indicated high education degree, and $N = 20 (13\%)$ reported other non-degree education.

<footnote n="1">¹ Full survey protocol and evaluation code are available at https://github.com/iWitLab/valuating_differential_privacyBudget.</footnote>
## Question 1

Please carefully review the choice options detailed below, then choose your most preferred scenario.

Which of these choices do you prefer?

<table><thead><tr><th></th><th>Choice 1</th><th>Choice 2</th><th>Choice 3</th></tr></thead><tbody><tr><td>Retention period<br>(Retention period of collected personal data by the data processor)</td><td>Indefinitely</td><td>Temporary</td><td>Temporary</td></tr><tr><td>Differential privacy level: 1<br>(lowest) - 5 (highest)<br>(Expected differential privacy level to be satisfied by the data processor)</td><td>1</td><td>3</td><td>4</td></tr><tr><td>Data sharing compensation price<br>(Lowest price that individuals are willing to accept for sharing their personal information)</td><td>1$</td><td>50$</td><td>10$</td></tr><tr><td>Sharing purpose<br>(The purpose for which personal data is collected)</td><td>Research</td><td>Research</td><td>Research</td></tr><tr><td>Sensitive disclosed data<br>(Type of collected data)</td><td>(Medical)<br>Existence of<br>Diabetes</td><td>(Financial)<br>Income</td><td>(Behavioral)<br>Browsing<br>History</td></tr></tbody></table>

Choice 1

Choice 2

Choice 3

<caption>**Fig. 1.** Screenshot of one decision choice task in the distributed questionnaire. Each column refers to a different setting of a differentially private data sharing scenario. Participants were asked to choose their preferable scenario setting out of the presented options. Order of attributes was randomized for each participant to prevent any biased selection according to the appearance order.</caption>
## 3.2 Comparison to Theoretical Behavior

Prior to carrying out the study, we examined the theoretical relationship between the amount of added noise for satisfying differential privacy and the value of WTA, to compare it with that induced from the survey's collected answers. Following our methodology (in Sect. 3.1 above), we considered the scale of the added noise and not the privacy budget $\varepsilon$ explicitly, to be consistent with the attributes in the conjoint analysis survey.

As has been demonstrated in previous differential privacy studies dealing with balanced data trade pricing [22], increasing the noise scale of perturbation can lower the data processor's price. Hence, we would expect to see a logarithmic decrease in the payment that individuals will receive from a data collector, when the amount of added noise increases. This can be explained by the low utility of a perturbed analysis output when a large amount of noise is added to it, up to an extent where it might become useless for the purposes of the data collector. Thus, we can overall assume a similar pricing scheme for contributing individuals, according to which a noisier analysis output leads to a lower disclosure risk for contributing individuals, allowing them to compromise on a lower payment.

<figure><img src="image_2.png" /><figcaption>**Fig. 2.** Theoretical expected WTA (Willingness-to-Accept) payment as a function of added noise scale. Noise scale is derived from the privacy budget $\varepsilon$ for a differentially private analysis, with Laplace noise scale of $(1/\varepsilon)$. Payment distribution is shown for three schemes - linear, sub-linear and logarithmic.</figcaption></figure>

We adopted the definitions of Nget et al. [25] for a theoretical payment scheme in a data market setting. Figure 2 shows the expected relationship between added noise scale and the WTA values for three types of payment schemes. For a
linear payment function $(c \cdot \varepsilon)$, the data subject can set any value for some
linear constant $c$ to increase his profit, resulting in highly untruthful privacy
valuation. Alternatively, for logarithmic and sub-linear schemes, the decay in the
WTA payment is slower but is different between the two functions. Logarithmic
payment schemes represent conservative risk-averse individuals, whose $\varepsilon$ is small,
whereas sub-linear schemes are more suitable for liberal risk-seeking individuals,
whose $\varepsilon$ is large (i.e., tend to compromise on privacy for reward).

# 4 Results

The analysis of the trade-offs in the selection of a differentially private data shar-
ing scenario was performed twofold. First, we computed the relative importance
of each included attribute in the conjoint analysis, with respect to its levels.
Then, we compared the distributions of WTA and $\varepsilon$ values for varying scenario
properties.

## 4.1 Trade-Offs in Individual Decision-Making

Similarly to Valdez et al. [30], we calculated the importance of each attribute to determine which attributes are the most influential in the decision-making process of an individual who is requested to share her personal data. In addition, preferences across attribute levels (i.e., attribute values) were measured using part-worth utility analysis [8]. We computed the standardized relative importance of each attribute and its levels, to understand how individuals’ privacy perception varies across attributes and their levels. As shown in Fig. 3, it was more acceptable for participants to disclose data concerning browsing history (1.2), rather than financial or medical data (–1.25 and 0.05, respectively). In terms of retention period of collected data, a neutral preference trend was found, with a positive perception for temporarily-retained data (1.0), and a negative perception for indefinitely-retained data (–1.0). Moreover, data sharing for the purpose of revenue generation was negatively utilized (–1.4), in comparison with the purposes of research or improvement of service, which were perceived positively. As expected, high levels of noise (i.e., guaranteeing higher differential privacy levels, corresponding to setting $\varepsilon \le 0.2$), were more acceptable than low noise levels (corresponding to setting $0.5 \le \varepsilon \le 2$). Similarly, higher payments (50$ and above) were more acceptable (1.38) among individuals than low payments (–1.33), which may cause individuals to decline sharing their data, even when shared for a benevolent purpose.

The relative importance of attributes (at a granularity of an attribute) for a
preference decision is shown in Fig. 3 by color and descending order of importance
(top to bottom). Overall, the most dominant factor among participants when
choosing a preferred sharing scenario was their Willingness-to-Accept, i.e., the
amount of money they are willing to receive for sharing their personal data. This
was an expected outcome of a trade market, where both sides wish to maximize
their profits. The second most relevant factor was the differential privacy level
<figure><img src="image_3.png" /><figcaption>Fig. 3. Relative importance of attribute levels (standardized part-worth utilities)</figcaption></figure>

(offered by the privacy budget $\varepsilon$ and its corresponding incurred noise). The purpose for which the data is requested was considered more relevant than its retention period. Relatively to other attributes, the data type (i.e., sensitive disclosed attribute) received the lowest weight in the decision making process of participants.

We computed the mean WTA values for the combination of two attributes: the sensitive disclosed data type and its sharing purpose. The mean WTA values were normalized to a [0, 1] scale for easier comparison. We conducted a statistical Kruskal-Wallis test, with a significance level of $\alpha = .05$, to find differences in the values of WTA and $\varepsilon$ with respect to different sharing properties, with additional pairwise Dunn's post-hoc testing (with Bonferroni correction).

Overall, as seen in Fig. 4, the mean WTA value is statistically significantly higher in scenarios where the data is retained indefinitely, in comparison with a temporary retention ($\chi^2(1) = 241.156, p < .001$). Similarly, we found statistically significant differences with respect to the shared sensitive attribute ($\chi^2(2) = 7.634, p = .02$). Disclosure of medical sensitive data (e.g., the existence of diabetes) was considered more “expensive” for data owners to disclose, than financial income data ($p = .02$), and when data is retained indefinitely rather than temporarily by the data recipient (Fig. 4a). However, there were no significant differences in WTA between scenarios involving financial and behavioral browsing data, or between medical and behavioral browsing data ($p = .64$ and $p = .39$, respectively).

Furthermore, statistically significant differences in WTA values were observed with respect to different sharing purposes, depicted in Fig. 4b ($\chi^2(2) = 272.478, p < .001$). The mean WTA value was statistically significantly higher when data is shared for the purpose of revenue generation than when it is used for research or improvement purposes ($p < .001$), but no significant differences were found between the two non-revenue-related purposes ($p = .90$). This implies
<figure><img src="image_4.png" /><figcaption>**Fig. 4.** Effect of scenario properties on mean normalized Willingness-to-Accept (WTA) and mean ε values</figcaption></figure>

that individuals may be more concerned about scenarios involving sensitive data, which may be used by the data collector for unknown periods of time and ultimately for commercial purposes. In turn, the raised concerns may be translated to higher compensation demands, which are expressed by higher WTA values.

The same analysis was performed with respect to the mean ε value that corresponds to the desired differential privacy level of individuals (Fig. 4c). As previously noted, due to the inverse relationship between ε and the differential privacy level, we expected to see lower ε values for more privacy-demanding data types. The mean ε value in selected scenario choices was not found to be lower for scenarios involving medical data (e.g., existence of diabetes) than for scenarios analyzing financial data (χ²(2) = 1.019, *p* = .6). This can be explained by the low relative importance that respondents assigned to the sensitive disclosed data attribute (Fig. 3).

Moreover, the ε values were higher for scenarios where data is retained temporarily than indefinitely, implying that participants considered such retention periods less risky, in comparison with indefinite retention, which was associated with more demanding privacy guarantees (translated to lower ε values). In addition, differences in mean ε values were found between scenarios where data is shared for the purpose of revenue generation and research (*p* = .04), with higher ε values for the latter (Fig. 4d).
## 4.2 Distribution of WTA Payments Under Differential Privacy

<figure><img src="image_5.png" /><figcaption>**Fig. 5.** Normalized mean Willingness-to-Accept (WTA) payment value as a function of differential privacy level (determined by the value of $\varepsilon$).</figcaption></figure>

In Fig. 5, for each type of sensitive disclosed data, we plotted the relationship between the normalized mean WTA values and the selected privacy budget, translated to the amount of added noise. A polynomial regression line was fitted for each type of sensitive disclosed data, based on the combinations of analyzed attributes from the conjoint analysis. Comparing the shown fitted curves with the theoretical relationship of Nget et al. [25] in Sect. 3.2, we can see a similarity. To confirm our hypothesis about this similarity, we conducted a Mann-Whitney non-parametric statistical test with a significance level of $\alpha = .05$, according to a null hypothesis that both the theoretical and the surveyed WTA values correspond to the same distribution. We found that the distributions were similar for the scenario of sharing browsing data ($U = 4204.0, p = .052$) and medical sensitive data ($U = 5001.0, p = .051$), confirming our null hypothesis, but not for financial income data ($U = 8867.0, p < .001$). Furthermore, overall, the mean WTA values for the medical scenario were higher than those for other data types across all differential privacy noise scales.

# 5 Discussion

In terms of differential privacy valuation, we saw that individuals presented a pragmatic view of the trade setting, focusing on their personal *profit* and the *way* their data is processed. Moreover, this pragmatic attitude was also reflected in the selection of the differential privacy levels, considering temporary retention periods less risky than indefinite retention. This was associated with less demanding privacy guarantees, translated to the setting of higher $\varepsilon$ values.
Furthermore, differences in mean $ε$ values across scenarios with different sharing purposes can imply that participants considered research-purposed analysis as safer than an analysis for the purpose of revenue generation, and thus assigned lower privacy expectations for such scenarios.

In fact, we can use the above results for the benefit of both the individuals and the data collector, who often have contradicting interests, i.e., individuals wish to maximize their payment, while the data collector aims at minimizing compensation expenses. It implies that when data collectors have a limited monetary budget for the collection of data, they can offer individuals a lower payment, by injecting more noise to the outputs of the differentially private computation. On the other hand, if individuals wish to increase profit, they may want to compromise on their privacy, by allowing data processors to use a less perturbed version of their information (closer to their original data). Hence, we can expect individuals to demand higher compensation for either more sensitive data, or less noisy outputs of a differentially private analysis (and vice versa). However, although this observation partially supports the theoretical pricing model of Nget et al. [25], it varies across different data types and can be accurate for only some data types, such as medical data.

A large-scale conjoint analysis with higher coverage of data types and scenarios is required to make conclusive conclusions for broader audiences of data processors. In addition, closer examination of correlations between demographics, such as age of data owners, and privacy valuation with respect to sensitive data types is also of interest, and is left as future work. Nevertheless, our findings can be taken into account by data processors when designing and applying differential privacy mechanisms on individual-related data, and in particular, when selecting a privacy budget for a data analysis.

# 6 Conclusions

Through a choice-based conjoint analysis ($N = 139$) of a data trade scenario under differential privacy, we investigated the trade-offs between differential privacy valuation, scenario properties and the preferred differential privacy level, which can later be used by a data processor to set a privacy budget $ε$. We concluded that the differential privacy valuation, measured by individual Willingness-to-Accept (WTA), is similar to the theoretical payment schemes for differential privacy in a data trade environment. Furthermore, we found that respondents preferred scenarios with a lower privacy budget $ε$ (requiring a higher degree of privacy) for data that is retained indefinitely for the purpose of profit generation, than temporarily for a non-commercial purpose. From the data collectors' perspective, our conclusions can be employed to better tune the differential privacy budget for an individual-related data analysis, in a way that will optimize the expenses of data collectors, on one hand, and protect the privacy of individuals, on the other hand.

**Acknowledgments.** This work was partially supported by a grant from the Tel Aviv University Center for AI and Data Science (TAD).
References

1. Acquisti, A.: The economics of personal data and the economics of privacy (2010)

2. Acquisti, A., John, L.K., Loewenstein, G.: What is privacy worth? J. Leg. Stud. **42**(2), 249–274 (2013). https://doi.org/10.1086/671754

3. Adam, N.R., Worthmann, J.C.: Security-control methods for statistical databases: a comparative study. ACM Comput. Surv. (CSUR) **21**(4), 515–556 (1989). https://doi.org/10.1145/76894.76895

4. Agrawal, N., Binns, R., Van Kleek, M., Laine, K., Shadbolt, N.: Exploring design and governance challenges in the development of privacy-preserving computation. In: Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems, pp. 1–13 (2021). https://doi.org/10.1145/3411764.3445677

5. Barth, S., De Jong, M.D.: The privacy paradox-investigating discrepancies between expressed privacy concerns and actual online behavior-a systematic literature review. Telematics Inform. **34**(7), 1038–1058 (2017). https://doi.org/10.1016/j.tele.2017.04.013

6. Birnhack, M., Toch, E., Hadar, I.: Privacy mindset, technological mindset. Jurimetrics **55**, 55 (2014). https://doi.org/10.2139/ssrn.2471415

7. Bureau, U.C.: The modernization of statistical disclosure limitation at the U.S. census bureau (2021). https://www2.census.gov/cac/sac/meetings/2017-09/statistical-disclosure-limitation.pdf

8. Cattin, P., Wittink, D.R.: Commercial use of conjoint analysis: a survey. J. Mark. **46**(3), 44–53 (1982). https://doi.org/10.1177/002224298204600308

9. Coopamootoo, K.P., Groß, T.: Why privacy is all but forgotten. Proc. Priv. Enhancing Technol. **2017**(4), 97–118 (2017). https://doi.org/10.1515/popets-2017-0040

10. Culnan, M.J., Armstrong, P.K.: Information privacy concerns, procedural fairness, and impersonal trust: an empirical investigation. Organ. Sci. **10**(1), 104–115 (1999). https://doi.org/10.1287/orsc.10.1.104

11. Cummings, R., Kaptchuk, G., Redmiles, E.M.: I need a better description: an investigation into user expectations for differential privacy. In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 3037–3052 (2021). https://doi.org/10.1145/3460120.3485252

12. Dankar, F.K., El Emam, K.: Practicing differential privacy in health care: a review. Trans. Data Priv. **6**(1), 35–67 (2013)

13. Dwork, Cynthia: Differential privacy. In: Bugliesi, Michele, Preneel, Bart, Sassone, Vladimiro, Wegener, Ingo (eds.) ICALP 2006. LNCS, vol. 4052, pp. 1–12. Springer, Heidelberg (2006). https://doi.org/10.1007/11787006_1

14. Dwork, C., Kohli, N., Mulligan, D.: Differential privacy in practice: expose your epsilons! J. Priv. Confident. **9**(2), 689 (2019). https://doi.org/10.29012/jpc.689

15. Dwork, C., Roth, A., et al.: The algorithmic foundations of differential privacy. Found. Trends Theor. Comput. Sci. **9**(3–4), 211–407 (2014). https://doi.org/10.1561/9781601988195

16. Garfinkel, S.L., Abowd, J.M., Powazek, S.: Issues encountered deploying differential privacy. In: Proceedings of the 2018 Workshop on Privacy in the Electronic Society, pp. 133–137 (2018). https://doi.org/10.1145/3267323.3268949

17. Jorgensen, Z., Yu, T., Cormode, G.: Conservative or liberal? personalized differential privacy. In: 2015 IEEE 31St International Conference on Data Engineering, pp. 1023–1034. IEEE (2015). https://doi.org/10.1109/ICDE.2015.7113353
18. Jung, K., Park, S.: Privacy bargaining with fairness: privacy-price negotiation system for applying differential privacy in data market environments. In: 2019 IEEE International Conference on Big Data (Big Data), pp. 1389–1394. IEEE (2019). https://doi.org/10.1109/BigData47090.2019.9006101

19. Kohli, N., Laskowski, P.: Epsilon voting: Mechanism design for parameter selection in differential privacy. In: 2018 IEEE Symposium on Privacy-Aware Computing (PAC), pp. 19–30. IEEE (2018). https://doi.org/10.1109/PAC.2018.00009

20. Koops, B.: Directive 95/46/EC general data protection regulation. Tech. rep., European parliament and council (2016). https://ec.europa.eu/info/law/law-topic/data-protection_en

21. Kumaraguru, P., Cranor, L.F.: Privacy indexes: a survey of Westin's studies. Carnegie Mellon University, School of Computer Science, Institute for Software Research International (2005)

22. Li, C., Li, D.Y., Miklau, G., Suciu, D.: A theory of pricing private data. ACM Trans. Database Syst. (TODS) 39(4), 1–28 (2014). https://doi.org/10.1145/2691190.2691191

23. Machanavajjhala, A., Kifer, D., Gehrke, J., Venkitasubramaniam, M.: l-diversity: Privacy beyond k-anonymity. ACM Trans. Knowl. Discov. Data (TKDD) 1(1), 3 (2007). https://doi.org/10.1145/1217299.1217302

24. McSherry, F., Talwar, K.: Mechanism design via differential privacy. In: 48th Annual IEEE Symposium on Foundations of Computer Science (FOCS2007), pp. 94–103. IEEE (2007). https://doi.org/10.1109/FOCS.2007.66

25. Nget, R., Cao, Y., Yoshikawa, M.: How to balance privacy and money through pricing mechanism in personal data market. arXiv preprint arXiv:1705.02982. https://arxiv.org/abs/1705.02982

26. Poikela, M., Toch, E.: Understanding the valuation of location privacy: a crowdsourcing-based approach. In: Proceedings of the 50th Hawaii International Conference on System Sciences (2017). https://doi.org/10.24251/hicss.2017.241

27. Riederer, C., Erramilli, V., Chaintreau, A., Krishnamurthy, B., Rodriguez, P.: For sale: your data: by: you. In: Proceedings of the 10th ACM Workshop on Hot Topics in Networks, pp. 1–6 (2011). https://doi.org/10.1145/2070562.2070575

28. Staiano, J., Oliver, N., Lepri, B., de Oliveira, R., Caraviello, M., Sebe, N.: Money walks: a human-centric study on the economics of personal mobile data. In: Proceedings of the 2014 ACM International Joint Conference on Pervasive and Ubiquitous Computing, pp. 583–594 (2014). https://doi.org/10.1145/2632048.2632074

29. Tang, J., Korolova, A., Bai, X., Wang, X., Wang, X.: Privacy loss in apple's implementation of differential privacy on MacOS 10.12. arXiv preprint arXiv:1709.02753 (2017). https://arxiv.org/abs/1709.02753

30. Valdez, A.C., Ziefle, M.: The users' perspective on the privacy-utility trade-offs in health recommender systems. Int. J. Hum Comput. Stud. 121, 108–121 (2019). https://doi.org/10.1016/j.ijhcs.2018.04.003

31. Xiong, A., Wang, T., Li, N., Jha, S.: Towards effective differential privacy communication for users' data sharing decision and comprehension. In: 2020 IEEE Symposium on Security and Privacy (SP), pp. 392–410. IEEE (2020). https://doi.org/10.1109/SP40000.2020.00088