Search

For consumers, managing privacy online requires navigating a complex process of interrelated choices. This process may be conceived of as 'cascaded,' in that a combination of upstream choices (e.g., of privacy settings on a social network site) and downstream choices (e.g., of what to reveal on the site) together determine ultimate privacy outcomes. In a series of experiments, we examine the potential impact of choice architecture in cascaded privacy choice settings. We investigate how changes in choice frames implemented by service providers can influence consumers' upstream disclosure settings, often in ways that they are unaware of and that may be destructive to them. Whether the effects of choice frames upstream are ultimately detrimental to individuals' privacy, however, depends on whether they are offset by more or less protective downstream choices. Thus, we also examine whether such upstream effects of choice architecture are 'mitigated' through changes in downstream self-disclosure. We find, first, that various manipulations of decision frames, common in privacy contexts, significantly impact participants' upstream choice of disclosure settings. Second, we do not find evidence that the impact of choice architecture upstream is mitigated downstream: participants' self-disclosure rates do not adjust or change in response to choice architecture-induced changes in upstream choices. These findings call into question both policy makers' and industry advocates' reliance on choice-based privacy protection mechanisms, contribute to an emerging behavioral perspective on privacy decision making, and highlight the importance of accounting for the cascaded nature of privacy decision making in both policy and managerial settings. History: Accepted by Uri Gneezy, behavioral economics. Funding: The authors gratefully acknowledge research support from the National Science Foundation [Awards CNS-1012763 and SES-1514192]. In addition, Acquisti gratefully acknowledges support from the Alfred P. Sloan Foundation and from the Carnegie Corporation of New York via an Andrew Carnegie Fellowship. A list of Acquisti's additional funding sources can be found at www.heinz.cmu.edu/~acquisti/cv.htm. Keywords: choice architecture * privacy decision making * framing * behavior and behavioral decision making, 1. Introduction Consumer privacy decision making is often cascaded: a combination of early 'upstream' and subsequent 'downstream' choices together determine some ultimate privacy outcome and its associated benefits and costs. [...]

When asked to mentally simulate coin tosses, people generate sequences that differ systematically from those generated by fair coins. It has been rarely noted that this divergence is apparent already in the very 1st mental toss. Analysis of several existing data sets reveals that about 80% of respondents start their sequence with Heads. We attributed this to the linguistic convention describing coin toss outcomes as "Heads or Tails," not vice versa. However, our subsequent experiments found the "first-toss" bias reversible under minor changes in the experimental setup, such as mentioning Tails before Heads in the instructions. We offer a comprehensive account in terms of a novel response bias, which we call reachability. It is more general than the 1st-toss bias, and it reflects the relative ease of reaching 1 option compared to its alternative in any binary choice context. When faced with a choice between 2 options (e.g., Heads and Tails, when "tossing" mental coins), whichever of the 2 is presented first by the choice architecture (hence, is more reachable) will be favored. This bias has far-reaching implications extending well beyond the context of randomness cognition; in particular, to binary surveys (e.g., accept vs. reject) and tests (e.g., True--False). In binary choice, there is an advantage to what presents first.

In the United States, identity theft resulted in corporate and consumer losses of $56 billion dollars in 2005, with up to 35 percent of known identity thefts caused by corporate data breaches. Many states have responded by adopting data breach disclosure laws that require firms to notify consumers if their personal information has been lost or stolen. Although the laws are expected to reduce identity theft, their effect has yet to be empirically measured. We use panel data from the U.S. Federal Trade Commission to estimate the impact of data breach disclosure laws on identity theft from 2002 to 2009. We find that adoption of data breach disclosure laws reduce identity theft caused by data breaches, on average, by 6.1 percent. (Contains 6 tables, 7 figures and 20 footnotes.)