Consumers Welcome Strong, Opt-In Privacy Policies

Tomorrow [May 25, 2018; the day after the post was written...] is the implementation day for the GDPR regulation, the General Data Protection Law of the EU that focuses on data protection and privacy for all citizens within the European Union and the European Economic Area. This post is not one more post about GDPR per se (so much has been written already about it...). Instead, it takes a consumer perspective and asks the question of whether consumers really want to have control over their data... and some preliminary research by three of my master students here at Erasmus School of Economics in the past four years seems to indicate that the answer is yes, an increasing number of consumers want stronger privacy policies. In their theses, there are also some specific guidelines on how firms can strengthen their privacy policies. Let's take a look at their results.

Result 1: Consumers are increasingly conscientious about privacy, and the more conscientious they become, the less they are willing to trade-off privacy for ad personalization... (Larisse Mercera, 2014)

In 2014, Larisse Mercera examined a new consumer trait called consumer privacy conscientiousness – which she defined as how concerned an individual consumer typically is about her or his privacy. Using survey data among 291 respondents, Larisse showed that (1) there are quite some differences in the level of consumer privacy conscientiousness (CPC) over the population, (2) these differences are not related to traditional sociodemographics (in fact, her sample was basically all college students), and (3) consumers with high CPC perceive the value of privacy as higher and the value of ad personalization as lower than consumers with low CPC. Thus, understanding if a consumer falls in a “highly concerned with privacy” or “not concerned with privacy” bucket is important as it determines how much privacy she or he is willing to trade-off in order to be able to capture more value from firms’ offerings (e.g., through personalized ads).

Result 2: Consumers trust websites with strong privacy policies significantly more than websites with weak privacy policies. To develop strong privacy policies, companies can follow the five principles proposed in the Federal Trade Commission's fair information practice principles (FIPPs): (1) notice/awareness, (2) choice/consent, (3) access/participation, (4) security and (5) enforcement (Ran Chen 2017).

In 2017, Ran Chen conducted an experiment to compare consumers’ reactions to websites with a strong vs. weak privacy policy (see pictures below for the definitions synthesized by Ran Chen). In her online experiment (N = 250), Ran Chen showed that, when compared with consumers assigned to a website with a weak privacy policy, consumers assigned to a website with a strong privacy policy are significantly more likely to be satisfied with the website, more willingly share data and more willingly make purchases within the website. The reason? They simply trust websites with a strong privacy policy more than websites with a weak privacy policy… 

And in the experiment this is how Ran manipulated the strength of the privacy policy across these five principles:

Source: Ran Chen (2017)

Result 3: Consumers are more willing to share private data if they face an opt-in privacy policy than an opt-out privacy policy. However, consumers are also vulnerable to monetary incentives - a 10% discount on a product led to a significant up-lift in consumers' willingness to share private data (Elif Gamze Karadag 2017).

Also in 2017, Elif Karadag used an online experiment (N = 146) to show that simple opt-in privacy policies are more effective than opt-out policies. A possible explanation for the finding, according to Elif, is that an opt-out policy triggers what psychologists call "psychological reactance" leading consumers to antagonize the website. Yet, she also finds that companies can convince customers to share their data if they offer them monetary incentives for such data sharing… 

#DataPrivacy #ConsumerPrivacy #ResponsibleMarketing

Cautionary Note: Obviously all studies have limitations, and master theses more so than peer-reviewed papers published in academic journals. Yet, if we keep in mind that further research should validate and replicate these insights, I think the insights from these three theses are simple but quite pragmatic also and thus worth sharing.