Beyond The Privacy Paradox: Objective Versus Relative Risk in Privacy Decision Making1

Privacy decision making has been examined in the literature from alternative perspectives. A dominant “normative” perspective has focused on rational processes by which consumers with stable preferences for privacy weigh the expected benefits of privacy choices against their potential costs. More recently, a behavioral perspective has leveraged theories from decision research to construe privacy decision making as a process in which cognitive heuristics and biases predictably occur. In a series of experiments, we compare the predictive power of these two perspectives by evaluating the impact of changes in the objective risk of disclosure and the impact of changes in the relative perceptions of risk of disclosure on both hypothetical and actual consumer privacy choices. We find that both relative and objective risks can, in fact, influence consumer privacy decisions. However, and surprisingly, the impact of objective changes in risk diminishes between hypothetical and actual choice settings. Vice versa, the impact of relative risk becomes more pronounced going from hypothetical to actual choice settings. Our results suggest a way to integrate diverse streams of the information systems literature on privacy decision making: in hypothetical choice contexts, relative to actual choice contexts, consumers may both overestimate their response to normative factors and underestimate their response to behavioral factors.