Shopping for Privacy on the Internet

Privacy is a concern for all major stakeholders in modern society, and technology to erode privacy continually emerges. Studies show that individuals are concerned about database privacy; yet, they seldom make privacy a salient attribute when deciding among competing alternatives. Although privacy policies are present on many Web sites, Web users rarely bother to read them. Professor Nehf explores why this is so, identifying rational reasons why Web users do not shop for privacy and discussing the implications for the expanding market for consumer information. Unless privacy becomes a salient attribute influencing consumer choice, Web site operators will continue to obtain and use more personal information than Web users would choose to provide in a more transparent exchange. In a responding commentary, Professors Pitt and Watson use an ecosystem approach that explores the multiple dimensions of privacy. Investigating the interactions between the three major players--citizen/consumer/investor, government, and corporation--they identify reasons for the failure of market mechanisms to arise to protect privacy. ********** Protecting consumer privacy in the United States is largely the responsibility of individuals who are expected to guard their personal information and take steps to minimize the risk that it will be used in an unauthorized way. Although federal (and a few state) laws restrict sharing some kinds of personal information--in health-related fields (Health Insurance Portability and Accountability Act (1996 (1)), the financial services industry (Gramm-Leach-Bliley Act (2)), and a handful of other economic sectors such as video rentals, children's Web sites, and telecom industries (3)--the restrictions are riddled with exceptions. In most aspects of daily life, individuals are expected to take steps to protect their own privacy interests (Solove 2001). This is particularly true for consumer transactions on the Internet, most of which are not subject to state or federal privacy laws. The self-policing model would be more effective if a market for information privacy were conducive to individuals shopping their privacy preferences online. This paper summarizes many of the reasons privacy shopping seldom occurs. On the surface, market incentives seem to be present. Many online businesses purport to collect only a minimum of customer data and to keep it secure. On the consumer side, many individuals are concerned about identity theft or the embarrassing release of private facts about them (Hoar 2001; Norberg, Home, and Home 2007; Saunders and Zucker 1999) and they give as little personal information as possible in online transactions (Sheehan and Hoy 1999). For most consumers and businesses, however, privacy-enhancing market incentives are weak, and the conditions for market failure are strong. Consumers do not shop for privacy, and there are several reasons why. AGGREGATION AND EASY TRANSFER OF DATA A system that relies on individuals to police their privacy rights presumes that individuals can value privacy rights meaningfully. If people do not know what information is being collected, how it could be used, and what harm might result from its collection and use, they have no way to judge how much it is worth to them (in time, money, or other trade-offs). To make an informed choice about whether and how to share personal information, and whether to make an effort to protect it, people need to know what is at stake. Most people have no idea what information a Web site collects and how it will be used. In rare instances, a user will take time to read a Web site's privacy policy, but even then the information is only marginally helpful. Most privacy policies are obtuse and noncommittal (LaRose and Rifon 2007; Milne, Culnan, and Greene 2006), but even a straightforward policy can be deceiving. For example, many privacy policies state that the site uses cookies and other means to obtain customer information and that it shares customer data only with affiliated companies and firms that have entered into joint marketing agreements with the site host. …