We find that there is no relationship between the self-stated privacy concerns of a sample of Alipay users and their number of data-sharing authorizations with third-party mini-programs on Alipay. We explain this data privacy paradox by a curious finding that users with stronger privacy concerns tend to benefit more from using mini-programs, which further suggests that consumers may develop data privacy concerns as a by-product of the process of using digital applications, not because such concerns are innate.

Data sharing is crucial in the development of the digital economy. As illustrated by the recent report of the Luohan Academy (2021), data sharing fosters connectivity, decision-making, and trust. At the same time, privacy concerns have attracted growing attention; privacy is important for maintaining the sustainable development of the digital economy, as reflected by the enactment of the General Data Privacy Regulation (GDPR) by the European Union in 2018 and the California Consumer Privacy Act (CCPA) by the state of California in 2020. A less understood phenomenon is the “data privacy paradox,” which refers to a general disconnect between consumers’ self-stated privacy preferences and their actual privacy-seeking behavior, specifically, consumers in a wide range of survey and experimental studies often say they care about privacy but at same time choose to share their personal data either freely or for small rewards. The presence of this disconnect is often used as evidence to argue either that consumers’ privacy concerns are not credible or that privacy is no longer achievable in the age of a data economy. Does the privacy paradox exist in realistic settings when consumers are faced with choices to share personal data with digital service providers? If so, what causes consumers to ignore their privacy concerns in data sharing?

The privacy literature has suggested a number of psychological and behavioral factors to explain the data privacy paradox, including consumers’ ignorance about the consequences of data sharing (Pew, 2019); present bias, which causes consumers to overweight immediate convenience from using digital applications and underweight future cost of sharing personal data (Acquisti, 2004); and illusion of control, which causes consumers to feel more in control when making data-sharing choices (Brandimarte, Acquisti and Loewenstein, 2013). Although these behavioral biases are clearly relevant, it remains unclear how consumers’ data-sharing choices are related to their demands for digital services.

Our recent study—Chen, Huang, Ouyang, and Xiong (2021)—addresses these issues by conducting a survey of Alipay users about their data privacy preferences and then matching their survey responses with rich administrative data about their data-sharing choices on the Alipay platform to analyze how their data-sharing choices are related to their stated privacy preferences. Alipay is a highly popular payment and lifestyle platform with more than 900 million active users in China. In addition to its widely used payment system, it also hosts over two million third-party mini-programs, which are lightweight apps that run inside Alipay to offer a variety of digital services to Alipay users. To use a mini-program, a user must first authorize sharing of certain personal data with the mini-program. The requested data sharing varies across mini-programs from innocuous information, such as nickname, to highly sensitive information, such as the user’s national ID number and credit score.

In policy discussions, a widely held view is that the privacy paradox exists because users simply cannot afford not to use popular digital applications. Because the mini-programs on Alipay vary substantially in the importance of the provided services and the sensitivity of the requested information, this setting provides an ideal opportunity to study how different users, when given the options, balance their privacy preferences with their demand for digital services.

In July 2020, we worked with Alipay to conduct a survey of Alipay users, which included 12 questions about their preferences and concerns regarding data sharing with Alipay’s mini-programs. We received survey responses from 14,250 Alipay users. In response to a question that explicitly asked whether users are concerned about their data privacy when sharing personal data with mini-programs, 46% said they are very concerned, 39% are concerned, and only 15% are not concerned. As shown by Figure 1, during the one-year period from July 2019 to July 2020, the “unconcerned” users on average initially visited 14.3 mini-programs and authorized data sharing with 11.2 of them, the “concerned” users initially visited 15.5 mini-programs and authorized 11.5, and the “very concerned” users initially visited 16.3 mini-programs and authorized 11.3. To the extent that the last group  rejected nearly 25% of data-sharing requests, these “very concerned” users did not resign from active protection of their data privacy by blindly authorizing all requests.

Figure 1. The Data Privacy Paradox

Source: Chen et al. (2021).

Even though one would expect users with stronger privacy concerns to be more reluctant to share personal data, these three groups of users with different levels of privacy concerns, on average, authorize data sharing with almost the same number of mini-programs, even after controlling for user characteristics such as digital experience, age, gender, and city, as well as mini-program fixed effects. This lack of difference in data-sharing authorizations is puzzling and confirms the data privacy paradox in a setting that is highly relevant to the digital economy.

It is tempting to attribute the data privacy paradox to noisiness and the unreliability of survey responses. While survey responses are indeed noisy at the individual level, we find that at the group level, the privacy concerns stated in survey responses are positively associated with the respondents’ propensity to take two privacy-seeking actions in Alipay: one is canceling previously authorized data sharing with mini-programs and the other is changing Alipay’s default privacy settings, which tend to make a user’s information visible to other Alipay users. These findings thus validate the survey-based measure of privacy concerns.

What causes the privacy paradox? Our analysis uncovers a curious, positive correlation between Alipay users’ data privacy concerns and digital demands—that is, users with stronger privacy concerns also tend to open their authorized mini-programs more frequently and view more pages in the programs, reflecting their greater demand for digital services. As the greater digital demands of privacy-concerned users offset their privacy concerns about sharing personal data with the mini-programs, this correlation helps to explain the data privacy paradox.

The positive correlation between privacy concerns and digital demands is a new finding to the literature and connects privacy preferences directly to demands for digital services, albeit in an unexpected way. If privacy concerns are an innate preference like risk aversion, they would deter users from extensively using digital services that usually require sharing of personal data, leading to a negative correlation between privacy concerns and digital demands. Instead, our finding suggests that privacy concerns are possibly a preference developed through the process of using digital services. That is, as some users gradually develop enjoyment from using the powerful and convenient services offered by mini-programs, they may also develop more concerns about the potential risks from their extensive data sharing with those programs. Under this notion of privacy as a developed preference, it is reasonable to conjecture that privacy concerns grow with the personal data accumulated with mini-programs.

To further explore this notion, we examine a hypothesis that more-active users of mini-programs are more likely to cancel their data-sharing authorizations with mini-programs. Although this hypothesis is a direct implication of privacy concerns increasing with digital demands, it counters our usual intuition that more-active users incur greater costs from canceling a mini-program. By using two different measures of user activeness and after controlling for various user characteristics and mini-program fixed effects, we find that more-active users of mini-programs in our sample are more likely to cancel their data-sharing authorizations with mini-programs. It is again difficult to explain this pattern without recognizing that privacy concerns are positively correlated with user activeness.

Our study adds to the literature on the data privacy paradox, including, Gross and Acquisti (2005), Goldfarb and Tucker (2012), and Athey, Catalini, and Tucker (2017). These studies have designed creative surveys and experiments to measure individuals’ privacy preferences. See Acquisti, Brandimarte, and Loewenstein (2020) for a recent review of this literature. By combining survey data with extensive administrative data, our study not only confirms the paradox in a highly relevant setting but also uses the paradox as an entry to analyze the nature of data privacy concerns. We uncover data privacy concerns as a preference developed through the use of digital applications, which, to our knowledge, is a new dimension not previously explored by the literature. This nature further implies that data privacy concerns may increase over time with the deepening of the data economy, making consumers more restrictive with their data sharing. This effect may in turn prevent the economy from realizing the full promise of data sharing implied by nonrivalry and increasing returns to scale, two fundamental features of data sharing, see for example, Jones and Tonetti (2020), Farboodi and Veldkamp (2020), and Cong, Xie, and Zhang (2020).

Our findings bring insightful implications for today’s discussion on data governance. Consumers may develop more privacy concerns in the process of adopting digital applications to meet their digital demands, and the best way to protect privacy may not be to restrict data sharing, as it will hurt consumer welfare (Liu, Sockin, and Xiong, 2020). Instead, promoting better privacy protections, such as requiring appropriate data-sharing authorizations and developing convenient data-sharing management tools, would be a more promising way to both harness digital dividends for consumers and promote sustainable development of the digital economy.

(Long Chen, Luohan Academy; Yadong Huang, Luohan Academy; Shumiao Ouyang, Ph.D. Candidate, Department of Economics, Princeton University; Wei Xiong, Department of Economics, Princeton University.)

References

Acquisti, A. (2004). Privacy in Electronic Commerce and the Economics of Immediate Gratification. Proceedings of the 5th ACM Conference on Electronic Commerce, 21–29.

Acquisti, A., Brandimarte, L., & Loewenstein, G. (2020). Secrets and Likes: The Drive for Privacy and the Difficulty of Achieving It in the Digital Age. Journal of Consumer Psychology, 30(4), 736–758.

Athey, S., Catalini, C., & Tucker, C. (2017). The Digital Privacy Paradox: Small Money, Small Costs, Small Talk (Working Paper No. 23488). National Bureau of Economic Research.

Brandimarte, L., Acquisti, A. & Loewenstein, G., (2013). Misplaced Confidences: Privacy and the Control Paradox. Social Psychological and Personality Science, 4(3), 340–347.

Chen, L., Huang, Y., Ouyang, S., & Xiong, W. (2021). The Data Privacy Paradox and Digital Demand (Working Paper No. 28854). National Bureau of Economic Research.

Cong, W., Xie, D., & Zhang, L. (2020). Knowledge Accumulation, Privacy, and Growth in a Data Economy. Management Science, forthcoming.

Farboodi, M., & Veldkamp, L. (2020). Long-Run Growth of Financial Data Technology. American Economic Review, 110(8), 2485–2523.

Goldfarb, A., & Tucker, C. (2012). Shifts in Privacy Concerns. American Economic Review, 102(3), 349–53.

Gross, R., & Acquisti, A. (2005). Information Revelation and Privacy in Online Social Networks. Proceedings of the 2005 ACM Workshop on Privacy in the Electronic Society, 71–80.

Jones, C. I., & Tonetti, C. (2020). Nonrivalry and the Economics of Data. American Economic Review, 110(9), 2819–2858.

Liu, Z., Sockin, M., & Xiong, W. (2020). Data Privacy and Temptation. Working Paper, Princeton University.

Luohan Academy. (2021). Understanding Big Data: Data Calculus in the Digital Era.

Pew Research Center (2019). Americans and Privacy: Concerned, Confused and Feeling Lack of Control Over Their Personal Information. Pew Research Center.