Power strips, prophylactics, and privacy, oh my!

ABSTRACT

While Internet users claim to be concerned about online privacy, their behavior rarely reflects those concerns. In this paper we investigate whether the availability of comparison information about the privacy practices of online merchants affects users' behavior. We conducted our study using Privacy Finder, a "privacy-enhanced search engine" that displays search results annotated with the privacy policy information of each site. The privacy information is garnered from computer-readable privacy policies found at the respective sites. We asked users to purchase one non-privacy-sensitive item and then one privacy-sensitive item using Privacy Finder, and observed whether the privacy information provided by our search engine impacted users' purchasing decisions (participants' costs were reimbursed, in order to separate the effect of privacy policies from that of price). A control group was asked to make the same purchases using a search engine that produced the same results as Privacy Finder, but did not display privacy information. We found that while Privacy Finder had some influence on non-privacy-sensitive purchase decisions, it had a more significant impact on privacy-sensitive purchases. The results suggest that when privacy policy comparison information is readily available, individuals may be willing to seek out more privacy friendly web sites and perhaps even pay a premium for privacy depending on the nature of the items to be purchased.

REFERENCES

• 1: Alessandro Acquisti, Privacy in electronic commerce and the economics of immediate gratification, Proceedings of the 5th ACM conference on Electronic commerce, May 17-20, 2004, New York, NY, USA [doi>10.1145/988772.988777]
• 2: A. Acquisti and J. Grossklags. Losses, gains, and hyperbolic discounting: An experimental approach to information security attitudes and behavior. In Proceedings of The 2nd Annual Workshop on Economics and Information Security (WEIS '03), 2003.
• 3: D. Allen. The great online privacy debate, 2000. http://www.ebusinessforum.com/index.asp? doc_id=1785&layout=rich_story.
• 4: L. Cranor, M. Langheinrich, M. Marchiori, M. Presler-Marshall, and J. Reagle. The Platform for Privacy Preferences 1.0 (P3P1.0) Specification, April 2002. http://www.w3.org/TR/P3P/.
• 5: L. F. Cranor, J. Reagle, and M. S. Ackerman. Beyond concern: Understanding net users' attitudes about online privacy. AT&T Labs-Research Technical Report TR 99.4.3, 14 April 1999. http://www.research.att.com/resources/trs/TRs/99/99.4/99.4.3/report.htm.
• 6: M. J. Culnan. How privacy notices promote informed consumer choice, 2002. http://www.cdt.org/privacy/ccp/notice1.pdf.
• 7: M. J. Culnan and G. R. Milne. The culnan-milne survey on consumers and online privacy notices, 2001. http://intra.som.umass.edu/georgemilne/pdf_files/culnan-milne.pdf.
• 8: B. J. Fogg , Jonathan Marshall , Othman Laraki , Alex Osipovich , Chris Varma , Nicholas Fang , Jyoti Paul , Akshay Rangnekar , John Shon , Preeti Swani , Marissa Treinen, What makes Web sites credible?: a report on a large quantitative study, Proceedings of the SIGCHI conference on Human factors in computing systems, p.61-68, March 2001, Seattle, Washington, United States [doi>10.1145/365024.365037]
• 9: S. Fox, L. Rainie, J. Horrigan, A. Lenhart, T. Spooner, and C. Carter. Trust and privacy online: Why Americans want to rewrite the rules. August 20, 2000. http://www.pewinternet.org/pdfs/PIP_Trust_Privacy_Report.pdf.
• 10: Harris Interactive. First major post-9/11 privacy survey finds consumers demanding companies do more to protect privacy: public wants company privacy policies to be independently verified, 2002. http://www.harrisinteractive.com/news/allnewsbydate.asp?NewsID=429.
• 11: Harris Interactive. Identity Theft: New Survey & Trend Report, August 2003.
• 12: B. Huberman, E. Adar, and L. Fine. Valuating privacy. In Proceedings of the Workshop on The Economics of Information Security, Boston, MA, June 1--3, 2005.
• 13: Carlos Jensen , Colin Potts, Privacy policies as decision-making tools: an evaluation of online privacy notices, Proceedings of the SIGCHI conference on Human factors in computing systems, p.471-478, April 24-29, 2004, Vienna, Austria [doi>10.1145/985692.985752]
• 14: Jupiter Research. Seventy percent of us consumers worry about online privacy, but few take protective action, 2002. http://www.jmm.com/xp/jmm/press/2002/pr_060302.xml.
• 15: Trevor Moores, Do consumers understand the role of privacy seals in e-commerce?, Communications of the ACM, v.48 n.3, p.86-91, March 2005 [doi>10.1145/1047671.1047674]
• 16: R. F. Murphy. Social distance and veil. American Anthropologist, 66(6):1257--1274, 1964.
• 17: E. Rose, Data Users versus Data Subjects: Are Consumers Willing to Pay for Property Rights to Personal Information?, Proceedings of the Proceedings of the 38th Annual Hawaii International Conference on System Sciences (HICSS'05) - Track 7, p.180.3, January 03-06, 2005 [doi>10.1109/HICSS.2005.184]
• 18: A. Shostack. Paying for privacy: Consumers and infrastructures. In Proceedings of The 2nd Annual Workshop on Economics and Infomation Security (WEIS '03), 2003.
• 19: M. D. Smith and E. Brynjolfsson. Consumer Decision-Making at an Internet Shopbot. Technical Report 4206-01, MIT Sloan School of Management, October 2001. http://ssrn.com/abstract=290334.
• 20: Sarah Spiekermann , Jens Grossklags , Bettina Berendt, E-privacy in 2nd generation E-commerce: privacy preferences versus actual behavior, Proceedings of the 3rd ACM conference on Electronic Commerce, p.38-47, October 14-17, 2001, Tampa, Florida, USA [doi>10.1145/501158.501163]
• 21: P. Syverson. The paradoxical value of privacy. In Proceedings of The 2nd Annual Workshop on Economics and Information Security (WEIS '03), 2003.
• 22: H. Taylor. Most People are "Privacy Pragmatists" Who, While Concerned about Privacy, Will Sometimes Trade It Off for Other Benefits, 17, 2003. http://www.harrisinteractive.com/harris_poll/index.asp?PID=365.
• 23: B. Tedeschi. Everybody talks about online privacy, but few do anything about it. The New York Times, page C6, June 3, 2002.
• 24: J. Turow. Americans and online privacy: The system is broken, 2003. http://www.asc.upenn.edu/usr/jturow/internet-privacy-report/36-page-turow-version-9.pdf.
• 25: C. Varney. You Call This Self-Regulation? Wired News, June 9, 1998.
• 26: A. F. Westin. Harris-equifax consumer privacy survey (1991). Technical report, Equifax, Inc., Atlanta, GA, 1991.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.1 Public Policy Issues
          Subjects: Privacy

Additional Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.2 User Interfaces (D.2.2, H.1.2, I.3.6)
          Subjects: Evaluation/methodology

  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.4 Electronic Commerce

Keywords:
P3P, e-commerce, privacy policies, search engines, user studies