Understanding Privacy Decision- Making Using Social Exchange Theory

Transcription

1 Understanding Privacy Decision- Making Using Social Exchange Theory Jennifer King University of California Berkeley School of Information 102 South Hall Berkeley, CA Abstract Privacy surveys and related research consistently show that a majority of the U.S. public is concerned with information privacy. Despite this demonstrated concern, people often make privacy-related decisions that contradict their professed attitudes and preferences and even undermine their self-interest. This phenomenon, observed by researchers and cited by privacy critics, occurs often enough to garner it a name: the privacy paradox. I argue that Social Exchange Theory offers a framework for understanding this paradox by acknowledging the social aspects of privacy decision-making. Author Keywords Privacy; Social Exchange Theory; Risk; Behavioral Economics; Decision-making. ACM Classification Keywords H.5.m. Information interfaces and presentation (e.g., HCI): Miscellaneous. Copyright is held by the author/owner. CSCW 15, March 14-18, 2015, Vancouver, British Columbia, Canada. Introduction Privacy surveys and related research consistently show that a majority of the U.S. public is concerned with a variety information privacy issues.[6,9] Despite this demonstrated concern, people often make privacyrelated decisions that contradict their professed attitudes and preferences and even undermine their self-interest. This phenomenon, observed by researchers and cited by privacy critics, occurs often enough to garner it a name: the privacy paradox.[2, 12] Critics point to consumers use of technologies such as social media platforms or smartphones as evidence that consumers don t care about the privacy of their personal information. Their argument is that if consumers did care, they would make better choices by refusing to use technologies that pose privacy threats, or by choosing to disclose fewer bits of personal information or using privacy controls where available. In my own research, while I have encountered a small minority of participants who express few or no privacy concerns with their technology choices, most not only express concerns but also employ a range of strategies (some effective, others based on incorrect beliefs, and many highly creative) to address their privacy concerns within the confines of their technology choices.[7] Other researchers have observed users deploying a

2 range of strategies to mitigate privacy concerns, often working around the constraints of platforms or services.[3,11,13] I propose that one reason why the privacy paradox remains enigmatic is that research into privacy decision-making is currently dominated by two theoretical orientations behavioral economics and risk communications that do not consistently weigh the social factors that may influence how people make privacy choices. Privacy, however, is an ambiguous concept. In this paper, I define a privacy decision as one that impacts the disclosure of an individual s personal information. Personal information, in turn, is information that relates either to an identified or identifiable person.[10] Practicing privacy is an inherently social act; privacy is a meaningless concept without the presence of others. By ignoring the social aspects of practicing privacy (in this case, disclosure) we risk miss understanding why people make the choices they do. Every day, people make disclosure decisions with direct or indirect privacy consequences. For example: selecting a new fitness app and seeding it with health data; sharing a personal reflection with friends on a social networking service; clicking a box marked I Agree to this Privacy Policy (without reading the policy) before signing up for a new account for an online service. On the other end of a spectrum, there are disclosure decisions tied to a direct financial consequence, such as buying a product from an unfamiliar merchant, or using a mobile banking application. While the later set of privacy decisions would suggest a strong risk orientation given their connection to financial loss, it seems less clear that individual decision-makers would conceive of the privacy decisions in the first set of examples as risk calculations. If this is correct and they do not, efforts to guide their decision-making based on appealing to their sense of risk is likely askew. Social exchange theory (SET) offers a framework for anchoring this line of analysis. SET is a sociological theory which describes the relationships that develop within structures of mutual dependence between actors. [8] Actors within these relationships engage in reoccurring, mutually contingent exchanges with specific partners over time. [8] More specifically, Emerson argues that SET is a frame of reference that takes the movement of valued things (resources) through a social process as its focus. [5] Humans are wired to respond to reciprocity, a key element of social exchange. When individuals choose to disclose personal information, it is often a reciprocal response to having received something of value, such as the exchange of personal information for access to a free product or service. Even when disclosures are made to companies and organizations rather than to individuals, the disclosures are acts of social exchange primed by expectations of reciprocity and relationship building. SET offers a different lens for examining the interactions between individuals who disclose personal information and those that receive it beyond the current dominant foci of risk calculations or economic trade-offs. Consider a privacy-loving jogger contemplating using a new fitness app: when making the decision to provide the app with her personal information, the jogger is likely not actively calculating the disclosure in terms of benefit versus risk, or exclusively in terms of cost versus benefit, but rather

3 how the app is going to help her achieve her fitness goals. Secondarily, she may have concerns about the use and protection of the information she provides, but her first-order evaluation is focused on how this tool can help her improve her fitness, and the disclosure may seem an appropriate exchange for the service. When the relationship between our jogger and the application provider is examined as an exchange, her decision to use the fitness app despite its potential risk to her personal information looks less paradoxical. Considering the social elements allows us to evaluate the impact of other factors beyond the risk element and the economic value of the exchange: her motivations, the power relationship between the two parties, and the wider social context. According to Irwin Altman, the psychological practice of privacy occurs through boundary regulation, as people choose to whom and when to make selective disclosures of personal information.[1] It is through this process that we both manage access to the self and regulate our emotional needs for privacy. SET captures the social practice of disclosure, where the exchange of personal information enables us to build trust with others and reciprocate in exchange relationships. The practice of social privacy focuses on the dialectic process of regulating proximity and distance towards others. [4] Social exchange, whether comprised of goods and services or personal information, is a core component of human social organization. The exchange of personal information is generally not a unique practice (except, perhaps, for those who deliberately isolate themselves) but rather central to the social experience. Privacy norms reflect the common practices of what we disclose, to whom, and how disclosures are managed (e.g., are they kept confidential? Are they shared? Do they invoke judgment against the discloser?). Viewed through this lens, the act of disclosure, both to individuals as well as to companies and organizations, itself isn t a paradox. In many instances, it is a reasonable reciprocation to an exchange relationship. A key assumption in the privacy paradox is that as actors, we have the facts in hand and yet are inexorably choosing to work against our best interests. We understand how third party browser cookies work, yet we willingly chose to visit websites that deploy them. We understand that applications can access our personal data on our smartphones, but we persist in downloading them regardless. This assumption is short sighted. In fact, many technology users do not understand what is at stake when they download an app or visit a website. But more fundamentally, this argument misses the fact that we act as humans first and technology users second. Disclosure is often a reasonable, and even rational, response to so many of the decisions that we face, even those with detrimental privacy consequences. It s similar to the impulse that has us reaching for our smartphones to check to see who just texted us, despite the fact we are navigating a vehicle down a freeway at seventy miles per hour. The technology has been overlaid upon our existing social structures, but with none of the limitations inherent to our cognitive capacities. What can this approach inform us about privacy decision-making? Examining privacy choices using SET allows us to uncover users motivations, an aspect that both the risk communication and behavioral economics approaches tend to overlook. If users aren t approaching a privacy decision as a risk assessment,

4 then warnings and notices may not resonate with them, especially if they don t address a user s goals and motivations. Many users certainly are subject to the heuristics and cognitive biases exposed by the privacy research within the behavioral economics framework, but focusing on our cognitive limitations doesn t cover the entire spectrum of decision-making. More to the point, this focus may overlook the aspects of privacy decision-making that are socially influenced and that cannot be explained by deficiencies in normative models. One of my goals in outlining this line of analysis is to propose a means to ultimately unify these currently disparate strands of privacy research, especially as it is applicable to CSCW and more broadly, research in human-computer interaction. In many respects they are complementary, and an awareness of all three is References [1] Altman, Irwin. "The Environment and Social Behavior: Privacy, Personal Space, Territory, and Crowding." (1975). [2] BARNES, Susan B. A privacy paradox: Social networking in the United States. First Monday, Sep Available at: /1312. [3] BOYD, danah; HARGITTAI, Eszter. Facebook privacy settings: Who cares?. First Monday, [S.l.], Jul Available at: [4] Dienlin, Tobias; Trepte, Sabine. Is the privacy paradox a relic of the past? An in-depth analysis of privacy attitude3s and privacy behaviors. European Journal of Social Psychology, Eur. J. Soc. Psychol. (2014). likely necessary when confronting the complex reality of privacy choices in the real world. I suspect SET may most obviously be applicable to understanding personto-person disclosures, especially via social media platforms. Where applying SET may be less obvious (and potentially trickier) is in the examination of the relationship individuals have with organizations or companies, whether in a direct exchange (e.g., trading one s personal information for a free service), or indirectly (e.g., using a platform such as Facebook as an intermediary for exchanging information with other individuals). But just as introducing Altman s perspective has added richness to many privacy studies over the past few years, ideally introducing SET to privacy research will yield similar results as well as encourage a clearer division between the psychological and social influences on privacy decision-making. [5] Emerson, Richard M. Social Exchange Theory. Annual Review of Sociology, Vol. 2 (1976), pp [6] C. Hoofnagle, J. King, S. Li, and J. Turow. How Different are Young Adults from Older Adults When it Comes to Information Privacy Attitudes and Policies? April 14, Available at: = [7] J. King. How Come I m Allowing Strangers To Go Through My Phone? Smartphones and Privacy Expectations. Presented at the Workshop on Usable Privacy and Security for Mobile Devices (U-PriSM) at SOUPS, July Washington, D.C., USA. [8] L. Molm and K. Cook. Social Exchange and Exchange Networks. In Sociological Perspectives on

5 Social Psychology. K. Cook, G. Fine, and J. House, eds. Boston: Allyn & Bacon, [9] Pew Internet Research Project. Anonymity, Privacy, and Security Online. Sept. 5, Available at: [10] Paul M. Schwartz & Daniel J. Solove, The PII Problem: Privacy and a New Concept of Personally Identifiable Information, 86 N.Y.U. L. Rev. 1814, (2011). [11] F. Stutzman and J. Kramer-Duffield. Friends only: examining a privacy-enhancing behavior in Facebook. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI '10). ACM, New York, NY, USA, [12] S. Trepte, T. Dienlin, and L. Reinecke. Risky behaviors: How online experiences influence privacy behaviors. Von der Gutenberg-Galaxis zur Google- Galaxis [From the Gutenberg galaxy to the Google galaxy]. UVK, B. Stark, O. Quiring, N. Jackob, eds. Pp [13] Y. Wang, P. Leon, K. Scott, X. Chen, A. Acquisti, and L. Cranor. Privacy nudges for social media: an exploratory Facebook study. In Proceedings of the 22nd international conference on World Wide Web companion (WWW '13 Companion). International World Wide Web Conferences Steering Committee, Geneva, Switzerland,