The Privacy Paradox

While most people express an interest in privacy when asked, their online habits do not reflect their stated interests. People willingly overshare information on social media, routinely use “free” services that are paid in personal information, and do not take adequate privacy precautions when online. In this lesson, we’re going to consider some of the literature that has explored this paradox between a stated desire for privacy and behaviors that disregard it.

“Free” Services

“If you are not paying for it, you’re not the customer; you’re the product being sold.”¹

On the Internet, we all make use of “free” services on a daily basis. Search engines, websites, email services, instant messaging services, and a variety of other services are available without direct monetary cost to the user. However, there are real costs in producing content, developing applications, and hosting websites. Content creators, software developers, hosting companies, Internet service providers, and power companies all expect to be paid in money. Thus, how can a site or service be free of charge for an extended period of time?

While there are certainly paid services available online, where access is restricted without first providing some kind of payment, the majority of sites and services are supported indirectly. For example, this page that you’re reading is hosted by a university, which receives income from tuition, state appropriations, federal appropriations, grants, donations, and so forth. I am a state employee, paid a salary by the same university from many of the same funding sources. Neither the university nor I have any real need to know who you are or to track you while you read this page. If you’re interested in our educational services, we assume you can navigate to Admissions on your own. (Note that the main Coastal Carolina University website does have some tracking code in it, since my colleagues in marketing feel it is somehow necessary, but I digress.)

A different story exists in the private sector. Websites for companies that actually produce useful things, like tractors or food, can be subsidized by the sale of the thing the company actually produces. However, an entire segment of the online economy produces nothing that is both useful and tangible. Instead, it produces online content and services that exist only within the confines of a network of computer systems. This segment of the economy depends on revenue from advertisers to pay the bills. These advertisers would like to know that their money spent on ads is producing results, so they expect the websites to collect data about their users to see if the ads are effective. To make the ads more effective, the advertisers want websites to target their users to show the most “relevant” ads possible.² The result is an economic sector dependent upon surveillance capitalism, which aims to profit from the collection and sale of individuals’ private information.³

Paradoxical Expectations

Survey data indicate that 90% of people care about their privacy to at least some degree.⁴ Based on these data, it would seem logical than only 10% of people would use “free” sites and services on the Internet, given the way that these services are funded. However, we all know the reality to be different. Roughly half the United States population used TikTok at the beginning of 2025, and even both chambers of Congress and the conservative majority on the Supreme Court ruled this application to be a major privacy and national security threat.⁵

The observation that so many people care about their privacy and yet are readily willing to compromise it online has been deemed “the privacy paradox”.⁶ Ordinarily, the decision to use a “free” service and give up one’s personal information would be made after a rational risk-benefit analysis, in which the user consciously decides that the benefit they gain from the service outweighs the loss of privacy incurred by using it. However, a considerable amount of research suggests that people are optimistically biased when assessing the risk, if they assess the risk at all. Even when they aren’t optimistic about what a company will do with their data, people may not want to take the time to evaluate a service, they might become overwhelmed by the options, or they might succumb to peer pressure or desire instant gratification.⁶

When people do assess the privacy risks of online services, they frequently underestimate those risks and/or overestimate the benefits. The desire for social connections and interest in other people can lead to difficult-to-break habits that effectively condition people toward using social media and similar platforms. People also tend to assess risk using heuristics, or mental shortcuts that are based on a person’s lived experiences. It is difficult for a person – especially for a teenager or young adult – to perform a rationale evaluation of hypothetical future risks.⁶

Corporations hire psychologists who can read the same literature and advise the design of products and services so as to minimize the appearance of risk and lull the user into a false sense of privacy. These same companies lobby against a requirement for informed consent, where the user is given a rational explanation of the risks and benefits of using the service prior to signing up for an account.⁷ As we will see in later lessons, these problems extend to services where the user doesn’t have to create an account or log in, as well as to paid applications.

Notes and References