An experimental method for the elicitation of implicit attitudes to privacy risk

Frik, Alisa and Gaudeul, Alexia (2018): An experimental method for the elicitation of implicit attitudes to privacy risk.

Abstract

We test an experimental method for the elicitation of implicit attitudes to privacy risk. We ask individuals to decide whether to incur the risk of revealing private information to other participants. This type of risk that involves a social component corresponds to privacy threats that individuals may face in the field. We derive a measure of individual attitudes to privacy risk with our method. We empirically test the validity of this measure by running a laboratory experiment with 148 participants. Our results confirm that the willingness to incur a privacy risk is driven by a complex array of factors including risk attitudes, self-reported value for private information, and general attitudes to privacy (derived from survey methods in our study). We also observe that attitudes to privacy risk depend on the order in which measures of risk attitude are elicited, but do not depend on whether there is a preexisting threat to privacy, over which participants have no control. We explain how our method can be simplified and extended for use in eliciting attitudes to a wide range of privacy risks and various types of private information.

• Item Type: MPRA Paper
• Language: English
• Keywords: privacy; attitudes; disclosure; risk; control; personal information; laboratory experiment
• Subjects: C - Mathematical and Quantitative Methods > C9 - Design of Experiments > C91 - Laboratory, Individual Behavior; D - Microeconomics > D1 - Household Behavior and Family Economics > D18 - Consumer Protection; D - Microeconomics > D8 - Information, Knowledge, and Uncertainty > D81 - Criteria for Decision-Making under Risk and Uncertainty; O - Economic Development, Innovation, Technological Change, and Growth > O3 - Innovation ; Research and Development ; Technological Change ; Intellectual Property Rights > O30 - General

References

Acquisti, A., L. K. John, and G. Loewenstein (2013). What is privacy worth? The Journal of Legal Studies 42(2), 249–274.

Acquisti, A., C. R. Taylor, and L. Wagman (2016). The economics of privacy. Journal of Economic Literature 52(2), 442–492.

Adjerid, I., A. Acquisti, L. Brandimarte, and G. Loewenstein (2013). Sleights of privacy: Framing, disclosures, and the limits of transparency. In Proceedings of the Ninth Symposium on Usable Privacy and Security, pp. 9:1–9:11. ACM.

Andersen, S., G. W. Harrison, M. I. Lau, and E. E. Rutström (2006). Elicitation using multiple price list formats. Experimental Economics 9(4), 383–405.

Bardsley, N., R. Cubitt, G. Loomes, P. Moffatt, C. Starmer, and R. Sugden (2010). Experimental economics: Rethinking the rules. Princeton University Press.

Benndorf, V. and H.-T. Normann (2017). The willingness to sell personal data. The Scandinavian Journal of Economics. Online in advance of print.

Beresford, A. R., D. Kübler, and S. Preibusch (2012). Unwillingness to pay for privacy: A field experiment. Economics Letters 117(1), 25–27.

Braunstein, A., L. Granka, and J. Staddon (2011). Indirect content privacy surveys: measuring privacy without asking about it. In Proceedings of the Seventh Symposium on Usable Privacy and Security, pp. 15. ACM.

Broadbent, D. E. (1957). A mechanical model for human attention and immediate memory. Psychological Review 64(3), 205–215.

Broadbent, D. E. (1982). Task combination and selective intake of information. Acta Psychologica 50(3), 253–290.

Carrascal, J. P., C. Riederer, V. Erramilli, M. Cherubini, and R. de Oliveira (2013). Your browsing behavior for a big mac: Economics of personal information online. In Proceedings of the 22nd International Conference on the World Wide Web, pp. 189–200. ACM.

Charness, G., U. Gneezy, and A. Imas (2013). Experimental methods: Eliciting risk preferences. Journal of Economic Behavior & Organization 87, 43–51.

Choi, H., J. Park, and Y. Jung (2018). The role of privacy fatigue in online privacy behavior. Computers in Human Behavior 81, 42–51.

Clemente, M. and T. J. Roulet (2015). Public opinion as a source of deinstitutionalization: A “spiral of silence” approach. Academy of Management Review 40(1), 96–114.

Cofone, I. (2015). The value of privacy: Keeping the money where the mouth is. In 14th Annual Workshop on the Economics of Information Security (WEIS).

Correa, T., A. W. Hinsley, and H. G. De Zuniga (2010). Who interacts on the Web?: The intersection of users’ personality and social media use. Computers in HumanBehavior 26(2), 247–253.

Cubitt, R. P., C. Starmer, and R. Sugden (1998). On the validity of the random lottery incentive system. Experimental Economics 1(2), 115–131.

Dukas, R. (2004). Causes and consequences of limited attention. Brain, Behavior and Evolution 63(4), 197–210.

Egelman, S., A. P. Felt, and D. Wagner (2013). Choice architecture and smartphone privacy: There’s a price for that. In The Economics of Information Security and Privacy, pp. 211–236. Springer.

Feri, F., C. Giannetti, and N. Jentzsch (2016). Disclosure of personal information under risk of privacy shocks. Journal of Economic Behavior & Organization 123, 138–148.

Fogel, J. and E. Nehmad (2009). Internet social network communities: Risk taking, trust, and privacy concerns. Computers in Human Behavior 25(1), 153–160.

Gideon, J., L. Cranor, S. Egelman, and A. Acquisti (2006). Power strips, prophylactics, and privacy, oh my! In Proceedings of the Second Symposium on Usable privacy and security, pp. 133–144. ACM. Graeff, T. R. and S. Harmon (2002). Collecting and using personal data: consumers’ awareness and concerns. Journal of Consumer Marketing 19(4), 302–318.

Griffin, D. W. and C. A. Varey (1996). Towards a consensus on overconfidence. Organizational Behavior and Human Decision Processes 65(3), 227–231.

Grossklags, J. and A. Acquisti (2007). When 25 cents is too much: An experiment on willingness-to-sell and willingness-to-protect personal information. In Proceedings of the Sixth Workshop on the Economics of Information Security (WEIS’07), pp. 7–18.

Hann, I.-H., K.-L. Hui, S.-Y. T. Lee, and I. P. Png (2007). Overcoming online information privacy concerns: An information-processing theory approach. Journal of Management Information Systems 24(2), 13–42.

Harris, P. (1996). Sufficient grounds for optimism?: The relationship between perceived controllability and optimistic bias. Journal of Social and Clinical Psychology 15(1), 9–52.

Harrison, G. W., M. I. Lau, E. E. Rutström, and M. Tarazona-Gómez (2012). Preferences over social risk. Oxford Economic Papers 65(1), 25–46.

Harrison, G. W. and E. E. Rutström (2008). Risk Aversion in the Laboratory, Volume 12, Chapter Risk Aversion in Experiments, pp. 41–196. Emerald Group Publishing Limited.

Hey, J. D. and J. Lee (2005). Do subjects separate (or are they sophisticated)?. Experimental Economics 8(3), 233–265.

Hirschprung, R., E. Toch, F. Bolton, and O. Maimon (2016). A methodology for estimating the value of privacy in information disclosure systems. Computers in Human Behavior 61, 443–453.

Holt, C. A. (1986). Preference reversals and the independence axiom. American Economic Review 76(3), 508–515.

Holt, C. A. and S. K. Laury (2002). Risk aversion and incentive effects. American Economic Review 92(5), 1644–1655.

Hopstaken, J. F., D. Linden, A. B. Bakker, and M. A. Kompier (2015). A multifaceted investigation of the link between mental fatigue and task disengagement. Psychophysiology 52(3), 305–315.

Huberman, B. A., E. Adar, and L. R. Fine (2005). Valuating privacy. IEEE Security & Privacy 3(5), 22–25.

Johnson, C. A., A. Baillon, H. Bleichrodt, Z. Li, D. Van Dolder, and P. P. Wakker (2015). Prince: An improved method for measuring incentivized preferences. SSRN Working Paper 2504745.

Kahneman, D. (1973). Attention and effort. Englewood Cliffs, NJ: Prentice-Hall.

Keith, M. J., S. C. Thompson, J. Hale, P. B. Lowry, and C. Greer (2013). Information disclosure on mobile devices: Re-examining privacy calculus with actual user behavior. International Journal of Human-Computer Studies 71(12), 1163–1173.

Keren, G. (1991). Calibration and probability judgements: Conceptual and methodological issues. Acta Psychologica 77(3), 217–273.

Kim, S.-H. (1999). Opinion expression as a rational behavior. In Annual Meeting of the Association for Education in Journalism and Mass Communication, New Orleans.

Krasnova, H., E. Kolesnikova, and O. Guenther (2009). ”It won’t happen to me!”: Self-disclosure in online social networks. In AMCIS 2009 Proceedings. Paper 343.

Lachter, J., K. I. Forster, and E. Ruthruff (2004). Forty-five years after Broadbent (1958): Still no identification without attention. Psychological Review 111(4), 880–913.

Lewis, K., J. Kaufman, and N. Christakis (2008). The taste for privacy: An analysis of college student privacy settings in an online social network. Journal of ComputerMediated Communication 14(1), 79–100.

Madden, M. and L. Rainie (2015). Americans’ attitudes about privacy, security and surveillance. Report, Pew Research Center.

Maier, J. and M. Rüger (2010). Measuring risk aversion model-independently. Munich Discussion Paper No. 2010-33, Ludwig- Maximilians-Universität München.

Malhotra, N. K., S. S. Kim, and J. Agarwal (2004). Internet users’ information privacy concerns (IUIPC): The construct, the scale, and a causal model. Information systems research 15(4), 336–355. McCallister, E. (2010). Guide to protecting the confidentiality of personally identifiable information. Diane Publishing.

Miller, L., D. E. Meyer, and J. T. Lanzetta (1969). Choice among equal expected value alternatives: Sequential effects of winning probability level on risk preferences. Journal of Experimental Psychology 79(3p1), 419–423.

Motiwalla, L. F. and X.-B. Li (2016). Unveiling consumers’ privacy paradox behaviour in an economic exchange. International Journal Of Business Information Systems 23(3), 307–329.

Noelle-Neumann, E. (1974). The spiral of silence: A theory of public opinion. Journal of Communication 24(2), 43–51.

Norberg, P. A., D. R. Horne, and D. A. Horne (2007). The privacy paradox: Personal information disclosure intentions versus behaviors. Journal of Consumer Affairs 41(1), 100–126.

Nordgren, L. F., J. Van Der Pligt, and F. Van Harreveld (2007). Unpacking perceived control in risk perception: The mediating role of anticipated regret. Journal of Behavioral Decision Making 20(5), 533–544.

Nosek, B. A. and A. G. Greenwald (2009). (Part of) the case for a pragmatic approach to validity: Comment on De Houwer, Teige-Mocigemba, Spruyt, and Moors. Psychological Bulletin 135, 373–376.

Nosek, B. A., C. B. Hawkins, and R. S. Frazier (2011). Implicit social cognition: From measures to mechanisms. Trends in Cognitive Sciences 15(4), 152–159.

Pashler, H. E. and S. Sutherland (1998). The psychology of attention, Volume 15. MIT press Cambridge, MA.

Preibusch, S. (2013). Guide to measuring privacy concern: Review of survey and observational instruments. International Journal of Human-Computer Studies 71(12), 1133–1143.

Rivenbark, D. R. (2012). Valuing the risk from privacy loss: Experimentally elicited beliefs explain privacy behavior. Working Paper, University of Central Florida, Orlando, FL.

Ross, C., E. S. Orr, M. Sisic, J. M. Arseneault, M. G. Simmering, and R. R. Orr (2009). Personality and motivations associated with Facebook use. Computers in Human Behavior 25(2), 578–586.

Schreiner, M. and T. Hess (2013). On the willingness to pay for privacy as a freemium model: First empirical evidence. In Proceedings of the 21st European Conference on Information Systems, pp. 30–36.

Schwarz, N. (1999). Self-reports: how the questions shape the answers. American Psychologist 54(2), 93–105.

Shafir, E. and A. Tversky (1992). Thinking through uncertainty: Nonconsequential reasoning and choice. Cognitive Psychology 24(4), 449–474.

Slovic, P. E. (2000). The perception of risk. Earthscan publications, London.

Sutanto, J., E. Palme, C.-H. Tan, and C. W. Phang (2013). Addressing the personalization-privacy paradox: An empirical assessment from a field experiment on smartphone users. MIS Quarterly 37(4), 1141–1164.

Taddicken, M. (2014). The ‘privacy paradox’ in the social web: The impact of privacy concerns, individual characteristics, and the perceived social relevance on different forms of self-disclosure. Journal of Computer-Mediated Communication 19(2), 248–273.

Tsai, J. Y., S. Egelman, L. Cranor, and A. Acquisti (2011). The effect of online privacy information on purchasing behavior: An experimental study. Information Systems Research 22(2), 254–268.

Turow, J., M. Hennessy, and N. Draper (2015). The tradeoff fallacy: How marketers are misrepresenting American consumers and opening them up to exploitation. Working Paper, The Annenberg School for Communication, University of Pennsylvania.

Tversky, A. and D. Kahneman (1992). Advances in prospect theory: Cumulative representation of uncertainty. Journal of Risk and Uncertainty 5(4), 297–323.

Wallsten, T. S. (1996). An analysis of judgment research analyses. Organizational Behavior and Human Decision Processes 65(3), 220–226.

Wathieu, L. and A. Friedman (2009). An empirical approach to understanding privacy concerns. Technical report, ESMT Working Paper No. 09-001.

Weinstein, N. D. (1984). Why it won’t happen to me: Perceptions of risk factors and susceptibility. Health Psychology 3(5), 431–457.

Westin, A. F. (1968). Privacy and freedom. Atheneum, New York.

Wilson, T. D. and N. Brekke (1994). Mental contamination and mental correction: Unwanted influences on judgments and evaluations. Psychological Bulletin 116(1), 117–142.

Zywica, J. and J. Danowski (2008). The faces of Facebookers: Investigating social enhancement and social compensation hypotheses; predicting Facebook and offline popularity from sociability and self-esteem, and mapping the meanings of popularity with semantic networks. Journal of Computer-Mediated Communication 14(1), 1–34.