Saying You're Afraid Is Not Being Protected

Is the privacy paradox a myth? On the fissure between what we declare and the architecture we live in People say they place a high value on privacy, yet in their behaviour they hand over their personal data for small rewards, sometimes for nothing at all. This mismatch is known as the "privacy paradox." Two opposing camps have formed in the literature: on one side, those who argue that behaviour reveals the true preference, that privacy is therefore of little value, and that regulation should be loosened; on the other, those who argue that behaviour is distorted by cognitive biases, manipulation and ignorance, and that the distortion must therefore be corrected. Daniel Solove (2021) takes a third and radical position: the paradox is a myth, because behaviour is a *risk decision* in a particular context while an attitude is a *general value judgment*; the two are different things, and their divergence is not a contradiction. This essay begins where Solove is right, but does not stop where he stops. First we bring into focus a distinction the literature has largely overlooked: **privacy and security are not the same thing.** Privacy is the question of *who* sees information, and in what context; security is the question of whether information is protected against unauthorised seizure. The privacy-paradox literature frames the phenomenon mainly along the *privacy* axis. Yet a particular type of case, the user who voices security concerns at high volume but keeps a sensitive document in a large commercial cloud and conducts communication through a platform that, even when the content is encrypted, commercially processes the whole map of the relationship, speaks the language of *security* and does not fit neatly into Solove's frame of "contextual rational risk." Here the contradiction is not between attitude and behaviour; the contradiction is between the **declared threat model and the actual threat architecture.** Moreover, the person conflates two axes: they mistake a large brand's *security* reputation for a *privacy* guarantee. In the end, the discourse "security is everything to me" turns into a performative ritual and **takes the place of the actual experience of being protected**: the person *feels* protected because they have declared it. We feed this reading with Acquisti and colleagues' (2015) findings on the control paradox and on malleability, and try to show that the behaviour is not a character flaw but a predictable output of normal cognition inside a broken information architecture. ---