Evaluating Behavioral Interventions for Privacy Decisions

Behavioral interventions have been developed to help users overcome structural and cognitive hurdles in privacy decisions by modifying them to add new information or change how a decision is presented. In the hands of practitioners and policy-makers, behavioral interventions are a tool which can be used to potentially reduce the complexity of privacy decisions for users, leading to better outcomes. This dissertation explores the application of different behavioral interventions to contexts currently unexplored in the literature and examines whether they can be made more effective. In addition, this dissertation contributes to policy discussions regarding behavioral interventions for privacy decisions by examining how data protection regulation has impacted the presence and strength of behavioral interventions on websites. 

In Chapter 2 of this dissertation, I present the results of three online experiments aimed at investigating whether nudges (a type of behavioral intervention) tailored to various psychometric scales can influence participants’ disclosure choices. Across each of these experiments, we do not find significant effects robustly linking any of the measured psychometric variables to differences in disclosure rates. In Chapter 3, I examine whether providing explanations (a different type of behavioral intervention) for recommendations about hypothetical privacy decisions impacts the rate at which participants adopt the recommendations. The results do not find strong evidence linking the tested explanations to hypothetical adoption intent. Across both chapters, I describe the study designs and contextualize the null results, drawing lessons about the robustness of behavioral interventions in the context of real user behaviors. 

In Chapter 4, I leverage longitudinal data from a large panel of websites to investigate the dynamics of privacy notice design over time in order to comment on the potential impacts of the EU’s General Data Protection Regulation on the presence and strength of behavioral interventions within privacy notices. The results identify geographic disparities in the prevalence of privacy notices in the US compared to the EU. I additionally identify a shift away from more coercive responses on US websites and a shift towards consent responses on EU websites. I discuss the implications of these results, limitations, and possible directions for future research. 

Finally, in Chapter 5, I conclude this dissertation by discussing considerations practitioners should take into account when considering behavioral interventions for privacy decisions and lessons for policy-makers regarding the use of behavioral interventions in public policy.