Privacy in electronic commerce and the economics of immediate gratification

ABSTRACT

Dichotomies between privacy attitudes and behavior have been noted in the literature but not yet fully explained. We apply lessons from the research on behavioral economics to understand the individual decision making process with respect to privacy in electronic commerce. We show that it is unrealistic to expectindividual rationality in this context. Models of self-control problems and immediate gratification offer more realistic descriptions of the decision process and are more consistent with currently available data. In particular, we show why individuals who may genuinely want to protect their privacy might not do so because of psychological distortions well documented in the behavioral literature; we show that these distortions may affect not only 'naive' individuals but also 'sophisticated' ones; and we prove that this may occur also when individuals perceive the risks from not protecting their privacy as significant.

REFERENCES

• 1: A. Acquisti, R. Dingledine, and P. Syverson. On the economics of anonymity. In Financial Cryptography -FC '03, pages 84--102. Springer Verlag, LNCS 2742, 2003.
• 2: A. Acquisti and J. Grossklags. Losses, gains, and hyperbolic discounting: An experimental approach to information security attitudes and behavior. In 2nd Annual Workshop on Economics and Information Security - WEIS '03, 2003.
• 3: A. Acquisti and H. R. Varian. Conditioning prices on purchase history. Technical report, University of California, Berkeley, 2001. Presented at the European Economic Association Conference, Venice, IT, August 2002. http://www.heinz.cmu.edu/acquisti/papers/privacy.pdf.
• 4: G. A. Akerlof. The market for 'lemons:' quality uncertainty and the market mechanism. Quarterly Journal of Economics, 84:488--500, 1970.
• 5: G. S. Becker and K. M. Murphy. A theory of rational addiction. Journal of Political Economy, 96:675--700, 1988.
• 6: B. D. Brunk. Understanding the privacy space. First Monday, 7, 2002. http://firstmonday.org/issues/issue7_10/brunk/index.html.
• 7: G. Calzolari and A. Pavan. Optimal design of privacy policies. Technical report, Gremaq, University of Toulouse, 2001.
• 8: David L. Chaum, Untraceable electronic mail, return addresses, and digital pseudonyms, Communications of the ACM, v.24 n.2, p.84-90, Feb. 1981 [doi>10.1145/358549.358563]
• 9: D. Chaum. Blind signatures for untraceable payments. In Advances in Cryptology - Crypto '82, pages 199---203. Plenum Press, 1983.
• 10: R. K. Chellappa and R. Sin. Personalization versus privacy: An empirical examination of the online consumer's dilemma. In 2002 Informs Meeting, 2002.
• 11: F. T. Commission. Privacy online: Fair information practices in the electronic marketplace, 2000. http://www.ftc.gov/reports/privacy2000/ privacy2000.pdf.
• 12: Community Banker Association of Indiana. Identity fraud expected to triple by 2005, 2001. http://www.cbai.org/Newsletter/December2001/identity_fraud_de2001.htm.
• 13: S. Corey. Professional attitudes and actual behavior. Journal of Educational Psychology, 28(1):271--280, 1937.
• 14: C. Diaz, S. Seys, J. Claessens, and B. Preneel. Towards measuring anonymity. In P. Syverson and R. Dingledine, editors, Privacy Enhancing Technologies - PET '02. Springer Verlag, 2482, 2002.
• 15: ebusinessforum.com. eMarketer: The great online privacy debate, 2000. http://www.ebusinessforum.com/index.asp?doc_id=1785&layout=rich_story.
• 16: Federal Trade Commission. Identity theft heads the ftc's top 10 consumer fraud complaints of 2001, 2002. http://www.ftc.gov/opa/2002/01/idtheft.htm.
• 17: R. Gellman. Privacy, consumers, and costs - How the lack of privacy costs consumers and why business studies of privacy costs are biased and incomplete, 2002. http://www.epic.org/reports/dmfprivacy.html.
• 18: I.-H. Harn, K.-L. Hui, T. S. Lee, and I. P. L. Png. Online information privacy: Measuring the cost-benefit trade-off. In 23rd International Conference on Information Systems, 2002.
• 19: Harris Interactive. First major post-9.11 privacy survey finds consumers demanding companies do more to protect privacy; public wants company privacy policies to be independently verified, 2002. http://www.harrisinteractive.com/news/allnewsbydate.asp?NewsID=429.
• 20: P. Jehiel and A. Lilico. Smoking today and stopping tomorrow: A limited foresight perspective. Technical report, Department of Economics, UCLA, 2002.
• 21: Jupiter Research. Seventy percent of US consumers worry about online privacy, but few take protective action, 2002. http://www.jmm.com/xp/jmm/press/2002/pr_060302.xml.
• 22: H. Kunreuther. Causes of underinsurance against natural disasters. Geneva Papers on Risk and Insurance, 1984.
• 23: D. Laibson. Essays on hyperbolic discounting. MIT, Department of Economics, Ph.D. Dissertation, 1994.
• 24: R. LaPiere. Attitudes versus actions. Social Forces, 13:230--237, 1934.
• 25: G. Lowenstein, T. O'Donoghue, and M. Rabin. Projection bias in predicting future utility. Technical report, Carnegie Mellon University, Cornell University, and University of California, Berkeley, 2003.
• 26: Andrew Odlyzko, Privacy, economics, and price discrimination on the Internet, Proceedings of the 5th international conference on Electronic commerce, p.355-366, September 30-October 03, 2003, Pittsburgh, Pennsylvania [doi>10.1145/948005.948051]
• 27: T. O'Donoghue and M. Rabin. Choice and procrastination. Quartely Journal of Economics, 116:121---160, 2001. The page referenced in the text refers to the 2000 working paper version.
• 28: R. A. Posner. An economic theory of privacy. Regulation, pages 19--26, 1978.
• 29: R. A. Posner. The economics of privacy. American Economic Review, 71(2):405--409, 1981.
• 30: Privacy Rights Clearinghouse. Nowhere to turn: Victims speak out on identity theft, 2000. http://www.privacyrights.org/ar/idtheft2000.htm.
• 31: M. Rabin and T. O'Donoghue. The economics of immediate gratification. Journal of Behavioral Decision Making, 13:233--250, 2000.
• 32: A. Serjantov and G. Danezis. Towards an information theoretic metric for anonymity. In P. Syverson and R. Dingledine, editors, Privacy Enhancing Technologies - PET '02. Springer Verlag, LNCS 2482, 2002.
• 33: A. Shostack. Paying for privacy: Consumers and infrastructures. In 2nd Annual Workshop on Economics and Information Security - WEIS '03, 2003.
• 34: H. A. Simon. Models of bounded rationality. The MIT Press, Cambridge, MA, 1982.
• 35: P. Slovic. What does it mean to know a cumulative risk? Adolescents' perceptions of short-term and long-term consequences of smoking. Journal of Behavioral Decision Making, 13:259--266, 2000.
• 36: Sarah Spiekermann , Jens Grossklags , Bettina Berendt, E-privacy in 2nd generation E-commerce: privacy preferences versus actual behavior, Proceedings of the 3rd ACM conference on Electronic Commerce, p.38-47, October 14-17, 2001, Tampa, Florida, USA [doi>10.1145/501158.501163]
• 37: G. J. Stigler. An introduction to privacy in economics and politics. Journal of Legal Studies, 9:623--644, 1980.
• 38: P. Syverson. The paradoxical value of privacy. In 2nd Annual Workshop on Economics and Information Security - WEIS '03, 2003.
• 39: C. R. Taylor. Private demands and demands for privacy: Dynamic pricing and the market for customer information. Department of Economics, Duke University, Duke Economics Working Paper 02-02, 2002.
• 40: T. Vila, R. Greenstadt, and D. Molnar. Why we can't be bothered to read privacy policies: Models of privacy economics as a lemons market. In 2nd Annual Workshop on Economics and Information Security -WEIS '03, 2003.
• 41: S. Warren and L. Brandeis. The right to privacy. Harvard Law Review, 4:193--220, 1890.
• 42: N. D. Weinstein. Optimistic biases about personal risks. Science, 24:1232--1233, 1989.
• 43: A. Whitten and J. D. Tygar. Why Johnny can't encrypt: A usability evaluation of PGP 5.0. In 8th USENIX Security Symposium, 1999.

INDEX TERMS

Primary Classification:
  J. Computer Applications
  J.4 SOCIAL AND BEHAVIORAL SCIENCES
      Subjects: Economics

Additional Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.1 Public Policy Issues
          Subjects: Privacy

General Terms:
Economics, Human Factors, Security

Keywords:
electronic commerce, hyperbolic discounting, immediate gratification, privacy, self-control problems