You open a website to read one news story. A banner slides up from the bottom: a bright "Accept all" button and a pale "Settings" link. You press the bright one without finishing the text. Yet only yesterday you told a survey, quite honestly, that you worry a lot about who knows what about you online.
This gap between words and actions has a name: the privacy paradox. The usual conclusion is simple: people don't really care, they just say they do. But the more closely researchers look, the less certain it becomes that the paradox exists at all.
What the privacy paradox is
The term spread in the 2000s, when researchers noticed that people who expressed strong concern about their data in questionnaires behaved online much like people who didn't care. They signed up for social networks, shared photos and agreed to terms they hadn't read.
Over time the idea became almost a cliché. It is often used as an argument: if people share anyway, perhaps privacy isn't something they value much.
But to speak of a paradox, you have to show that concern has no connection to behaviour. And that is a question for the data.
What the data show
In 2017, Lemi Baruh and colleagues at Koç University in Istanbul published a meta-analysis combining 166 studies from 34 countries, with more than 75,000 participants in total. The result was mixed.
On the one hand, privacy concern really did not predict whether someone used social networks. On the other, people who worried more shared less information, used fewer online services and took more protective steps. These findings held regardless of gender, culture and a country's legal system.
The link between concern and sharing is weak, but it is not zero. A weak link is not the same as no link.
A study by Tobias Dienlin, Philipp Masur and Sabine Trepte (2021) is even more telling. They surveyed the same representative sample of 1,403 people in Germany three times, six months apart. That made it possible to look not only at differences between people but at changes within each person over time.
People who worried about privacy more than others shared slightly less. And when a particular person worried more than usual, they also shared slightly less than usual. The researchers found no long-term effect six months later. The authors described their results as further evidence against the privacy paradox.
The dispute over a meta-analysis
Not everyone reached that conclusion. In 2020 another research group published a meta-analysis that, in their view, confirmed the paradox.
The following year Dienlin and Ye Sun criticised that work in the journal Meta-Psychology. Among other problems, they pointed to flawed logic of hypothesis testing (a test that fails to find an effect does not prove there is none) and to erroneous and implausible results. Their conclusion: that meta-analysis does not offer evidence in support of the privacy paradox.
So the honest summary is this: words and actions are linked, but weakly. And the more interesting question is not "are people hypocrites?" but "why is the link so weak?"
Why words and actions drift apart
In 2015, Alessandro Acquisti, Laura Brandimarte and George Loewenstein reviewed privacy research in the journal Science. They identified three reasons that explain the gap without accusing anyone of hypocrisy.
Uncertainty. We rarely know what data is collected about us or how it will be used. We are not always sure what we want ourselves. In one experiment people were given a gift card that was either anonymous or tracked their purchases. Among those holding the anonymous card, 52% refused to swap it for the tracked one, even though it was worth more. Among those holding the tracked card, only about 10% switched to the anonymous one. How much people valued privacy depended on what they already had.
Context. The same person can be cautious in one situation and open in another. Participants in experiments were more willing to admit questionable behaviour on a casual-looking website than on a formal one, even though outsiders rated the formal site as safer.
Malleability. Those who benefit from our data can easily influence us, not least through default settings. Even a sense of control can backfire: in one study, people given more control over the publication of their data shared more sensitive information with a wider audience.
There is also a simpler explanation, which echoes research on patience. The benefit of agreeing is felt immediately: the article opens, the app works. The risk is abstract, delayed and may never happen. That is our interpretation, but in such choices "now" almost always beats "some day".
The button that decides for us
Cookie banners show this most clearly. In 2020, Midas Nouwens and colleagues, including researchers from the Massachusetts Institute of Technology, analysed the consent pop-ups of 680 of the UK's 10,000 most popular websites. Only 11.8% met the minimum requirements of European law as the authors defined them.
The researchers then tested how design affects the choice. When the reject option was removed from the first screen, consent rose by 22–23 percentage points. When more detailed settings appeared on the first screen, the share of people consenting fell by 8–20 points.
The experiment was small, with 40 participants, so the exact figures should be treated with caution. But the direction is clear: much of the apparent indifference to privacy is created by the way the choice is built.
Where this explanation falls short
These studies have limits. Concern is usually measured with questionnaires, while "sharing information" means different things in different studies, from filling in a profile to the number of posts. Most studies are one-off surveys rather than experiments, so they speak cautiously about cause and effect.
People also differ a great deal. Some genuinely don't mind about their data, some mind but don't know what to do, and some are simply tired of deciding every time. A weak average link can hide very different stories.
Finally, the "paradox" depends on what we consider rational. If a service you need won't open without consent, or all your friends are on one social network, agreeing is not necessarily a contradiction. It may be a forced compromise.
What to do with this
None of this promises that you will suddenly control all your data. But a few observations follow from the research.
- Don't accuse yourself of hypocrisy. The gap between words and actions is largely created by uncertainty and design, not a lack of principles.
- Look for equal buttons. If "Accept all" is a single click and refusing is buried deeper, that already tells you whose interest came first.
- Decide once, not every time. Default settings are enormously powerful. A few minutes reviewing the privacy settings of the apps you use every day may count for more than hundreds of decisions on banners. Our article on Google's AI assistant and Gmail shows why this matters.
- Ask yourself: what would I choose if both buttons looked the same?
A small experiment: for one day, every time you see a cookie banner, notice which button is highlighted and how many clicks it takes to refuse. You don't have to change anything; just count.
Questions for discussion
- When did you last consciously decline to share your data? What influenced that decision?
- Do you see the gap between words and actions on privacy as hypocrisy, or rather as a forced compromise?
- What would need to change in the design of websites and apps for your decisions about data to better match your beliefs?
Log in or Sign up to join the discussion.