Beyond the Privacy Paradox: Objective versus Relative Risk in Privacy Decision Making

Privacy decision making has been examined from various perspectives. A dominant “normative” perspective has focused on rational processes by which consumers with stable preferences for privacy weigh the expected benefits of privacy choices against their potential costs. More recently, an alternate “behavioral” perspective has leveraged theories from behavioral decision research to construe privacy decision making as a process in which cognitive heuristics and biases predictably occur. In a series of experiments, we compare the predictive power of these two perspectives by evaluating the impact of changes in objective risk of disclosure and the impact of changes in relative perceptions of risk of disclosure on both hypothetical and actual consumer privacy choices. We find that both relative and objective risks can, in fact, impact consumer privacy decisions. However, and surprisingly, the impact of objective changes in risk diminishes between hypothetical and actual choice settings. Vice versa, the impact of relative risk is more pronounced going from hypothetical to actual choice settings. Our results suggest a way to integrate diverse streams of IS literature on privacy decision making: consumers may both over-estimate their response to normative factors and under-estimate their response to behavioral factors in hypothetical choice contexts relative to actual choice contexts.