Online shoppers will pay extra to protect privacy, study shows

June 6, 2007

People are willing to pay extra to buy items from online retailers when they can easily ascertain how retailers’ policies will protect their privacy, a new Carnegie Mellon University study shows.

Participants in the laboratory study used a Carnegie Mellon shopping search engine called Privacy Finder, http://www.privacyfinder.org , which can automatically evaluate a Web site’s privacy policies and display the results on the search results page. The study, led by Lorrie Cranor, director of the Carnegie Mellon Usable Privacy and Security (CUPS) Lab, found that people were more likely to buy from online merchants with good privacy policies, which were identified by Privacy Finder. They were also willing to pay about 60 cents extra on a $15 purchase when buying from a site with a privacy policy they liked.

Findings from the study, the first to suggest that people will pay a premium to protect their privacy when shopping online, will be presented Friday, June 8, at the Workshop on the Economics of Information Security, an international meeting hosted by Carnegie Mellon that begins Thursday, June 7. In addition to Cranor, the research team included Alessandro Acquisti, assistant professor of information technology and public policy, and graduate students Janice Tsai and Serge Egelman.

Many people express concerns that unscrupulous online merchants might misuse credit information, target spam to their email addresses or otherwise violate their privacy. But a number of previous studies have found that many people still fail to act to protect their privacy online. Some have shown that people willingly give up private information in return for lower prices or even the mere chance of a monetary reward.

“Our suspicion was that people care about their privacy, but that it’s often difficult for them to get information about a Web site’s privacy policies,” said Cranor, an associate research professor of computer science and of engineering and public policy. A Web site’s policies may not be readily accessible, can be hard to interpret and sometimes are nonexistent, Cranor said. “People can’t act on information that they don’t have or can’t understand,” she added.

Privacy Finder is a search engine developed by Cranor and her students to address this issue. The engine makes use of the Platform for Privacy Preferences (P3P), a technical standard for creating machine-readable privacy policies. About 10 percent of Web sites overall and more than 20 percent of e-commerce sites now employ P3P, Cranor said, and of the top 100 most-visited Web sites, about a third use P3P. The search engine can automatically read and evaluate the policies of Web sites that employ P3P, and it displays this information as a series of colored squares that indicate to the user whether the site’s privacy policy complies with his or her privacy preferences.

In the new study, Cranor and her colleagues recruited 72 people to make online purchases. Some used Privacy Finder while others did not. They were given $45 and asked to buy two items — a package of batteries and a vibrating sex toy — each of which cost about $15. Participants were allowed to keep the items and any surplus money, so they had a financial incentive to buy from the cheapest online retailers. Those who used Privacy Finder made purchases from sites with “high privacy” ratings for 50 percent of the battery purchases and 33 percent of the sex toy purchases.

Cranor said they had expected people to be more sensitive about privacy in purchases of the sex toy, but the findings proved inconclusive on that point. Additional research is necessary to resolve that issue and to better determine how much of a premium purchasers are willing to pay. This study focused on whether people would pay a premium, not on how much they would pay.

Source: Carnegie Mellon University