The so-called privacy paradox was a big topic of discussion at the Federal Trade Commission’s first PrivacyCon.
The event, held Thursday in Washington, DC, brought together around 20 privacy and data researchers who presented their work on consumer privacy and security issues in the commercial sector to an audience of technologists, policymakers and regulators.
“There is no question that, among other issues, we need to better understand the consumer perception of data practices, along with what is actually happening in the marketplace,” said FTC Chairwoman Edith Ramirez.
One of the main takeaways from PrivacyCon: the disconnect between policy, what people say they want and what people actually do.
“There is a conflict behind the kind of rhetoric one hears in Washington around users being in control and being able to make choices about how they’re being tracked online and the technical reality,” said Chris Jay Hoofnagle, a professor at the University of California, Berkeley School of Information.
The FTC’s regulatory model around privacy has centered on the concept of notice and choice. In other words, asking companies to provide consumers with privacy policies that clearly explain their information practices, including what is being collected and how that data is being shared and used.
But there’s a disconnect between the theory that underpins that model – that consumers have the time, the wherewithal and the know-how to evaluate each of the privacy policies associated with the many products and services that touch their daily lives – and how consumers actually operate in the marketplace.
Many consumers are “simply uninformed” and “people are laboring under substantial misconceptions about their rights,” said Hoofnagle. He noted surveys conducted by Joseph Turow, a privacy researcher and professor of communication at the University of Pennsylvania, which found that roughly half of American Internet users don’t know what a privacy policy actually is.
According to Turow’s research, most consumers believe that the mere presence of a privacy policy means that a website can’t sell their information to third parties. Another misguided but widely held belief is that the government protects citizens against price discrimination.
“Even when Americans do weigh [the options], they do so on incorrect information,” Turow said.
Which is why the notion of a trade-off – consumers knowingly and willingly sharing their information with marketers as part of a value exchange – is a little wonky.
Although a Pew study released Thursday found that the majority of Americans are, in certain circumstances, willing to share their information if they get some sort of value in return, Pew also noted that “consumers are often cautious about disclosing their information and frequently unhappy about what happens to that information once it’s been collected.”
“In the real world, people who exchange data for benefits are more likely to do it when they’re resigned, rather than as the result of a cost-benefit analysis,” Turow said. “[But] most Americans don’t have sufficient knowledge to make that cost-benefit analysis.”
Turow acknowledged that his view of the world “may sound really dark,” but that it’s important to confront these issues when we see them play out in everyday life.
“People do these things online, in stores and in apps not because they’re thinking rationally, but because they feel they have no other choice if they want to live in the world,” Turow said.
But is there actually a second fallacy at play – that of consumer as victim, powerless to control the technology that’s taking over their lives?
Rather than feeling downtrodden and helpless, many consumers are “thrilled or even delirious” about new technology, said Omer Tene, VP of research and education at the International Association of Privacy Professionals.
Look at Uber, the newest iPhone, Fitbit – people love their tech.
“There seems to something more complex at play here and I think we see it in other contexts like, ‘I care about my health, but I still eat a cheeseburger,’ or ‘I care about the environment, but I still drive a four-wheel drive,’” Tene said. “Yes, consumers are ignorant and they just don’t know, but I think [Turow’s] surveys and research show that the more informed people are, the more resigned they become. Maybe it’s better to just be blissfully ignorant.”
Perhaps, but the best-case scenario would be to find some middle ground. It’s a “false dilemma that privacy means we can’t have spectacular convenience in our life,” Hoofnagle said.
“One can look at our work and say it’s anti-technology, but I would argue strongly that it’s not,” said Hoofnagle, who described himself as an early adopter. “Much of what we call innovation does not depend on personal information. It’s a straw man that we have to recognize and deal with. You don’t need personal information for Uber, but if you do need personal information, you can have rules around it.”
One might not need PII to power Uber, but major players like Google, Facebook and The New York Times all rely on data to power their businesses.
That said, FTC commissioner Julie Brill echoed Hoofnagle’s sentiment with an analogy.
“Outside of the privacy sphere, companies have excelled at helping consumers use and manage complex systems,” Brill said. “Cars are now computers on wheels, but we can all drive them because companies have kept the complexity behind interfaces that are easy to use. Companies can do the same for privacy by building the right tools and understanding what is important to individuals.”
