For free pizza: giving up personal data?

Free food. For some it’s a reward that makes us willing to do some strange, perhaps even out-of-character, actions. Like wearing something on your head, posing for a silly pic … or giving up your friends’ email addresses to a third party? That might sound far-fetched, but, according to a study from the National Bureau of Economic Research released in June:

MOST PEOPLE WILL CHOOSE FREE PIZZA OVER ONLINE ANONYMITY.

Authored by Susan Athey of the Stanford Institute for Economic Policy Research and Massachusetts Institute of Technology researchers Christian Catalini and Catherine Tucker, the working paper provides strong evidence for the so-called “privacy paradox,” or the extreme difference between how people say they feel about internet privacy and how they actually act online. The majority of the sample group — 3,108 MIT undergraduate students — consistently disclosed friends’ personal information in exchange for free pizza despite their stated privacy preferences.

When MIT launched an initiative in 2014 to encourage undergraduates to experiment with bitcoin, Catalini and Tucker saw an opportunity to study the privacy paradox in action. They found that when participants were presented with four online wallets containing bitcoins, the order that options were presented — and not their privacy levels, which were varied — drove the decision of which wallet to use. Even when offered the added security benefit of encryption, only half the students opted to set it up.

The students also showed little regard for their friends’ internet anonymity. All of the participants were asked to give the email addresses of three of their closest friends. Half of the group were incentivized with a free pizza; the other half were offered nothing. A whopping 98 percent of the free pizza group provided their friends’ emails — and only slightly fewer (94 percent) did in the non-pizza group. What really surprised the researchers was how consistent the effect was across different types of individuals, says Catalini. “Even students who explicitly said in the survey they cared about privacy behaved in the same way as everyone else when offered the incentive.”

So why do people say they want data privacy, but then not take the necessary measures to get it? According to Pekka Jäppinen, senior security adviser at Citrus Solutions, the answer could be lack of understanding. “The challenge is that the ramifications of the privacy selection you make are not clear,” he explains. “Evaluation of the risk for giving your data is very hard.” People need “clear visual cues” to help them understand the risks and benefits of sharing their data, he adds. So people might just be desensitized to the endless fine-printed privacy agreement pop-ups and cookie warnings they see every day.

To be sure, the participants in the study only represent one demographic: young millennials. In 2016, a nationwide study commissioned by Hide My Ass! (a virtual private network service provider) also found the privacy paradox to be true, but saw surprising differences between different generations. Baby boomers, for example, were found to be more likely to consciously limit their personal information online and were the least confident that they were protected from security threats. So it’s possible that these postwar babies wouldn’t fork over their buddies’ info in exchange for a double cheese and pepperoni pie.

Still, overall it seems the old saying “actions speak louder than words” should be remembered when we mindlessly click “agree” to data privacy agreements. Even when free pizza is involved.