The Privacy Paradox: How well do respondent attitudes and concerns about privacy predict privacy-related behaviors?

Casey Eggleston, Aleia Clark Fobia, Jennifer Hunter Childs

U.S. Census Bureau

FCSM Research and Policy Conference 2021

1

Any opinions and conclusions expressed herein are those of the author and do not represent the views of the U.S. Census Bureau. The U.S. Census Bureau reviewed this data product for unauthorized disclosure of confidential information and approved the disclosure avoidance practices applied to this release (CBDRB-FY22-CBSM002-001).

Background: The Privacy Paradox

Social scientists have long recognized that attitudes, beliefs, and intentions are not always strong predictors of behavior (Ajzen & Fishbein, 1974)

Privacy Paradox = Term coined to describe attitude-behavior gap for privacy concerns (Norberg, Horne, & Horne, 2007).

Individuals with greater privacy concerns do not necessarily behave in ways that are protective of privacy, even when knowledge and resources are not a barrier (e.g., Barth et al, 2019).

Studies supporting the privacy paradox typically examine whether individuals engage in a specific privacy-seeking behavior or set of behaviors in a specific situation.

However, other research has found that privacy-concerned individuals DO engage in a variety of privacy protective strategies, though perhaps not strategies that privacy experts would consider effective or optimal (Kokolakis, 2015).

.

2

Research Questions

How are privacy-seeking behaviors related to each other?

What attitudes or characteristics predict which individuals engage in specific privacy-seeking behaviors or engage in a greater number of such behaviors?

Can behaviors be combined into a meaningful privacy-seeking behavioral scale?

How well are privacy-seeking behaviors predicted by respondent privacy concerns?

.

3

Methods: Privacy Concerns Survey

Data collected June 2020

10,000 responses collected via Qualtrics; nationally-representative sample recruited from Ipsos KnowledgePanel

Survey to measure individuals’ privacy risk tolerance with the goal of informing the privacy-loss budgets allowed in mathematical privacy models for decennial data releases

Collected information about privacy concerns for decennial information and other types of personal information, also asked about privacy-related attitudes and behaviors

4

Items: Privacy Attitudes
| Item           | Text                                                                                                                                                                              |
|----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Hacking        | “How worried are you about information you give to the Census Bureau being stolen through hacking or a data breach?”                                                              |
| Census Concern | “If someone was able to find out ALL OF THE INFORMATION included in the Census Bureau questionnaire, how concerned would you be?”                                                 |
| Income Concern | “If someone was able to find out your INCOME, how concerned would you be?”                                                                                                        |
| Tradeoff       | “In general, how willing are you to risk your confidentiality so the government can produce useful data and statistics for policy makers, businesses and researchers to use?”     |

5

Items: Privacy-Seeking Behaviors
| Avoidance Strategies               |                     | Settings/ Permissions Strategies     | Proactive Strategies                                        |
|------------------------------------|---------------------|--------------------------------------|-------------------------------------------------------------|
| Avoid Personalized Recommendations | Avoid Social Media  | Block App Permissions                | Sign Up for Do Not Call Registry                            |
| Avoid Location Services            | Avoid Loyalty Cards | Change Social Media Privacy Settings | Use Secure Communication Methods (Encrypted)                |
| Avoid Search Engines               | Nonreport Income    | Change Default Browser Settings      | Request Removal of Personal Information from Public Records |
| Avoid Reviewing Products           |                     |                                      | Request Review of Personal Information from Public Records  |

Nine of these behaviors (shown in black) were asked together in a privacy-specific question.  The others were asked in the context of use of technological services (search engines, personalized recommendations, location services, reviewing products), or were directly observed behavior (nonreport of income).

6

Exploratory Analysis Approach

Correlation – Observe strength of association between individual behaviors, attitudes, and respondent characteristics

Factor Analysis – Attempt to identify several coherent “factors” among the various privacy-seeking behaviors

Regression – Predict privacy attitudes from behaviors and respondent characteristics

7

Correlations

Privacy attitudes moderately correlated with each other (e.g., Hacking concern correlated with Census Concern r = .38, Income Concern r = .39, Tradeoff r = .22)

Most privacy behaviors only slightly correlated with each other, with nonreport of income (our only direct behavioral measure) being one of the least correlated.  

Avoidance of web browsing was also minimally correlated, or sometimes negatively correlated, with other behaviors.  Because the question about web browsing did not ask specifically about privacy, this behavior is likely confounded with other reasons for non-internet use.

An exception was the 3 items related to settings/permissions strategies which were moderately correlated (correlations r > .40)

8

Correlations

Education and income positively correlated with engaging in a variety of individual privacy-seeking behaviors as well as a greater number of behaviors engaged in cumulatively (several other demographics also significantly correlated with smaller r values)

Privacy attitudes showed small correlations with privacy behaviors, with greater concern being associated with a greater number of behaviors engaged in (r values ranging from .05 to .23 across attitude items)

9

Factor Analysis

Generous exploration did not reveal a clear set of factors to describe the available list of behaviors

After trying several different exploratory analyses with different possible numbers of factors, only one slightly promising factor (Eigenvalue > 1) emerged comprised of the 3 permissions/settings strategy items

Social Media Privacy Settings, Browser Settings, App Permissions

10

Regression

Hacking =  Strongest predictors were self-reported race of White and nonreport of income, both associated with increased concern (variance explained by model = 9%)

Census Concern = Strongest predictors were nonreport of income and avoidance or adjustment of social media, all associated with increased concern (variance explained by model = 8%)

Income Concern = Strongest predictor was nonreport of income in survey (associated with increased concern), showing consistency between attitude and observed behavior (variance explained by model = 7%)

# Privacy-Seeking Behaviors = Strongest predictors were education and Census Concern, with more educated and more concern for census information predicting a greater number of privacy-seeking behaviors (variance explained by model = 12%)

11

Summary

The privacy-seeking behaviors measured in this survey were only loosely correlated, with the exception of a subset of behaviors related to adjusting settings/permissions in digital environments

Education level and concern for census information were the strongest predictors of the number of privacy-seeking behaviors reported (but still explaining only about 12% of variance in the number of behaviors)

Low correlations between behaviors and a lack of identification of clear factors suggests that the privacy-seeking items we measured were not appropriate for creating a meaningful behavioral scale or set of scales

Privacy-seeking behaviors were predictive of privacy attitudes, BUT the amount of variance explained was small.  

It is notable that a strong predictor across models was nonreport of income (our one directly observed, rather than self-reported, behavior).  

12

Research questions:

How are privacy-seeking behaviors related to each other?

What attitudes or characteristics predict which individuals engage in specific privacy-seeking behaviors or engage in a greater number of such behaviors?

Can behaviors be combined into a meaningful privacy-seeking behavioral scale?

How well are privacy-seeking behaviors predicted by respondent privacy concerns?

12

Conclusion and Future Directions

Our findings overall support the existence of a Privacy Paradox – we observe some coherence between privacy attitudes and behavior, but also a substantial amount of variance that is unexplained

Limitations: Based mostly on correlations and self-reported behavior

Just as has been found in other domains, attitudes probably best predict behaviors when the two are closely related (as in the case of attitudes about income and the decision to nonreport on an income question) 

Results from our factor analysis suggest that it may be possible to compose meaningful privacy-seeking behavioral scales related to specific privacy strategies, but not with the items we included 

13

Thank you!

Casey Eggleston

casey.m.eggleston@census.gov

14

# image2.jpeg

# image3.png

# image1.png