It's Creepy, But it Doesn't Bother Me

Undergraduates interviewed about privacy concerns related to online data collection made apparently contradictory statements. The same issue could evoke concern or not in the span of an interview, sometimes even a single sentence. Drawing on dual-process theories from psychology, we argue that some of the apparent contradictions can be resolved if privacy concern is divided into two components we call intuitive concern, a "gut feeling," and considered concern, produced by a weighing of risks and benefits. Consistent with previous explanations of the so-called privacy paradox, we argue that people may express high considered concern when prompted, but in practice act on low intuitive concern without a considered assessment. We also suggest a new explanation: a considered assessment can override an intuitive assessment of high concern without eliminating it. Here, people may choose rationally to accept a privacy risk but still express intuitive concern when prompted.