On My Mind: The Privacy Hoax

Eric Goldman

10.14.02

What's the point of regulating Internet privacy? Consumers sure don't care.

Dozens of bills are pending in Congress to regulate Internet privacy, often based on the assumption that privacy fears are stifling the growth of the Internet. Proponents like to trot out surveys in which consumers overwhelmingly express concern about Internet privacy. In a June report by Jupiter Research, 70% of online consumers said they were worried about online privacy. In another survey 93% of e-commerce users said it was very important that sites disclose their privacy practices.

But what do these surveys really prove? Consumers may tell survey takers they fear for their privacy, but their behavior belies it. People don't read privacy policies, for example. In a survey taken last year by the Privacy Leadership Initiative, a group of corporate and trade association executives, only 3% of consumers read privacy policies carefully, and 64% only glanced at--or never read--privacy policies.

Even these figures may overstate the attention people pay to privacy policies. For example, only 0.3% of users read Yahoo's privacy policy during a one-month period this past spring, according to the New York Times.

Another indication privacy is a false concern: Relatively few consumers have bought privacy management tools, such as software to browse anonymously and manage Internet cookies and e-mail. Many vendors are now migrating away from consumer-centric business models. So, although consumers can take technological control over their own situation, few consumers do.

Plus, as most online marketers know, people will "sell" their personal data incredibly cheaply. As Internet pundit Esther Dyson has said: "You do a survey, and consumers say they are very concerned about their privacy. Then you offer them a discount on a book, and they'll tell you everything." Indeed, a recent Jupiter report said that 82% of respondents would give personal information to new shopping sites to enter a $100 sweepstakes.

Clearly consumers' stated privacy concerns diverge from what consumers do. Two theories might explain the divergence.

First, asking consumers what they care about reveals only whether they value privacy. That's half the equation. Of more interest is how much consumers will pay--in time or money--for the corresponding benefits. For now the cost-benefit ratio is tilted too high for consumers to spend much time or money on privacy.

Second, consumers don't have uniform interests. Regarding online privacy, consumers can be segmented into two groups: activists, who actively protect their online privacy, and apathetics, who do little or nothing to protect themselves. The activists are very vocal but appear to be a tiny market segment.

Using consumer segmentation, the analytical defect of broad-based online privacy regulations becomes apparent. The activists, by definition, take care of themselves. They demand privacy protections from businesses and, if they don't get it, use technology to protect themselves or take their business elsewhere.

In contrast, mainstream consumers don't change their behavior based on online privacy concerns. If these people won't take even minimal steps to protect themselves, why should government regulation do it for them?

Further, online businesses will invest in privacy when it's profitable. In counseling several dozen companies about privacy practices over the past eight years, I found that companies scaled their investments in privacy to their assessments of how they thought consumers would react. When companies thought a lot of consumers would jump ship unless they got better privacy, those companies spent more money on privacy. When companies believed that few consumers would change their behavior if they were offered greater privacy, those companies did nothing or put into place privacy policies that disabused consumers of privacy expectations. Of course, if companies later discovered that they were losing business because customers wanted more privacy, they would increase their privacy initiatives.

Consumer behavior will tell companies what level of privacy to provide. Let the market continue unimpeded rather than chase phantom consumer fears through unnecessary regulation.

Eric Goldman assistant professor, Marquette University Law School; former general counsel, Epinions.com.