Online Shoppers are Willing to Pay More for Privacy

Caroline Matische writes "People are willing to pay more to buy items from online retailers who make their privacy policies clear, a new Carnegie Mellon University study showed. People were more likely to buy from online merchants with good privacy policies and were also willing to pay about 60 cents extra on a $15 purchase when buying from a site with a privacy policy they liked."

Why privacy matters...

[by Anonymous Coward]

Privacy is central to our dignity and our basic human rights. Privacy ensures and protects our rights to free assembly and free speech, especially in areas where the governments would seek to curtail these rights. The right to privacy ensures our autonomy in the world and in our affairs. Think of your information as a gift you give to agencies and people you trust. How do you feel when any gift you give is "regifted." How do you feel when something you say in confidence is repeated and spread through your community, whether that is your office of group of friends. How would you feel if a friend gave your phone number out to every person who asked them. How would you feel if a friend revealed an embarrassing medical condition you had or a financial problem you were struggling with. Thinking of privacy in these terms helps you to see why your privacy is an important part of your life.

Re:

[BadERA (107121)]

And in other news, water is wet, ice is cold, violets are blue, bears are Catholic and the Pope poops in the woods.

Re:Why privacy matters...

[WrongSizeGlass (838941)]

Mod parent up for reinforcing his point by posting anonymously.

Why copyright matters:

[by Anonymous Coward]

http://www.cpsr.org/issues/privacy/whyPrivacy [cpsr.org]

Re:Why privacy matters...

[Original Replica (908688)]

"At what point does the intrinsic need for privacy override the need to prevent societal decay? "

Privacy has a lot of grey area to it, and I think different places in that grey area are appropriate in different circumstances. Sexual predators might need to be known to the local police and school officials, but not the media. Politicians' campaign donations need to be known to the media, but are not of special concern to local police. The trick is who gets to decide, what info is databased and shared. If someone goes to the doctor for an STD medication, should that info be attached to their online dating profile? If someone is in Alcoholics Anonymous, should their children's teacher be informed?
There is a difference between allowing someone's reputation to follow them, and having institutionalzed gossip. But it's a tough call as to exactly where that difference lies. http://yro.slashdot.org/comments.pl?sid=237213&cid =19375351 [slashdot.org]

Re:

[mpe (36238)]

A line must be drawn, however, when it comes to fighting and eliminating crime. Individuals who rape children deserve no privacy. Individuals who sell drugs deserve no privacy. Disgusting politicians who accept dirty money for their campaigns deserve no privacy.

Why should pharmacists (or bar tenders) have no privacy? Exactly what money is "dirty"...

Ridiculuous

[Rinisari (521266)]

That's ridiculous. Users should expect, no, demand privacy, not have to pay for it. Privacy should already be there, because the user has to trust the company to handle their data correctly.

I won't trust a company that makes people pay for "extra privacy." That screams distrust to me.

Re:

[BadERA (107121)]

You know, that was my initial reaction too. However, I don't think that's the notion that's conveyed by the study -- I'd like to think that it means merchants who protect privacy to begin with are rewarded for it. Unfortunately, I do suspect that this will translate into "how much more can I charge because I post a rigid and thorough privacy policy?"

Re:

[mrbooze (49713)]

Or, to come at it from another angle, how much can I discount my prices in exchange for selling customer's information with their consent? Customers want to pay less for things, so how much are they willing to trade to pay less for a gallon of milk? How much is their demographic information worth to them?

Re:

[mr_stinky_britches (926212)]

In a perfect world, you are right, all online retailers should protect our privacy.

However, in the real world..there are a lot of shady outlets which either haven't bothered to make their privacy policy clear or don't respect the privacy of their customers.

Re:

[mpe (36238)]

However, in the real world..there are a lot of shady outlets which either haven't bothered to make their privacy policy clear or don't respect the privacy of their customers.

It really dosn't matter if the policy is clear or not. If someone is a crook they will simply lie anyway. As well as it being trivial to write a policy full of loopholes.
The only really meaningful policy would be one along the lines of "If you supply any customers' details to a third party without explicit authority (either from the c

Re:

[DragonWriter (970822)]

That's ridiculous. Users should expect, no, demand privacy, not have to pay for it. Privacy should already be there, because the user has to trust the company to handle their data correctly.

You mean, people should be more willing to buy at all from a company with a good privacy policy? Isn't that one of the things the summary says that the study found?

What, exactly, of what is actually in the summary/article, do you find ridiculous?

Re:

[owlstead (636356)]

I'm sorry, but personal data is worth money. So, inherently, the bad companies make more money, even if they sell a little less. This can keep their price down. Of course, I won't buy from them, and I find that good quality service is more or less linear with good privacy. Other buyers fortunately think so as well. So the good companies still have a business case, but they are somewhat more expensive most of the time.

Just compare it with television. The ones with the most (annoying) commercials make the mos

Re:Ridiculuous

[Bongo Bill (853669)]

It's not that good companies charge more. It's that bad companies charge less, because they have no obligation not to use that information to turn an additional profit.

Re:

[RJ11 (17321)]

Welcome to the real world. Most of the companies that provide "free" services to you online only do so because they're getting your personal information which can be resold. Few people are aware of this. For instance, American Express is rated as one of the most trusted companies, yet they have one of the most egregious privacy policies. Providing people with clear information on how their personal details are used allows them to make better decisions, as opposed to just their perceptions of the company

Re:

[AusIV (950840)]

I won't trust a company that makes people pay for "extra privacy." That screams distrust to me.

Did you read anything other than the headline? The summary even mentions that people are more willing to buy from a company that makes their privacy policy clear. Scenario:

Retailer X sells widget A for $10, and makes it clear that they protect your privacy
Retailer Y sells widget A for $9, and is ambiguous about their use of personal information.

More people are choosing retailer X than retailer Y.

I know this

Advantages of B&M retailers

[mbstone (457308)]

I just say, I'm going to use my Ben Franklin Card today. If the store clerk then asks for my phone number or email address, I just remind them of the airtight Ben Franklin Card privacy policy.

Re:

[zCyl (14362)]

I just say, I'm going to use my Ben Franklin Card today. If the store clerk then asks for my phone number or email address, I just remind them of the airtight Ben Franklin Card privacy policy.

While this is true, I bet if you walk up to the counter wearing a ski mask, people are going to get the wrong idea. :)

Newsflash:

[Richard McBeef (1092673)]

People look for the "shipped in plain brown packages" when buying porn related items.

Privacy is temporary, no?

[citrusburst (1112479)]

Isn't the notion of a "company respecting user privacy" illusory? In other words, when you give your private information away, you're not giving it to another person. You're giving it to a corporation. If the management changes, if the shareholders demand a greater quarterly return, the same company can alter their "privacy policies" and sell all the information they like. Sure, a random user can sue, but can they afford the same kind of attorneys as the company? There's an old proverb about "what you

Privacy is not always temporary

[feepcreature (623518)]

It varies, depending on to whom you give your information.

In most of Europe, companies are bound by laws implementing the EU's Data Protection Directive, which makes it clear that your data is not just another asset of the company which collects it, and that companies can only process it for the purposes for which you gave them the data.

In the US, companies howl with outrage at the prospect that they should treat their customers with similar fairness. You could argue that resisting even the smallest extra expense is in the short term interests of their shareholders. Of course that ignore the possibility that ethical policies may increase customer loyalty, and better serve their shareholders' longer term interests - as well as being "The Right Thing".

There is a lot of nonsense spoken about "impersonal corporations". Folk forget that it's actual human beings who make the "decisions of the corporation". Some of those people do good and some do evil.

Maybe they should be held to account?

Re:

[Jah-Wren Ryel (80510)]

There is a lot of nonsense spoken about "impersonal corporations". Folk forget that it's actual human beings who make the "decisions of the corporation". Some of those people do good and some do evil.

Maybe they should be held to account?

That's a laugh. The whole point of incorporation is to shield the owners and the management from legal liability. Add in the factor of diffusion of responsibility - the bigger the company, the less direct personal responsibility any one employee has for any one policy - and the end result is practically guaranteed to be "impersonal."

In most of Europe, companies are bound by laws implementing the EU's Data Protection Directive, which makes it clear that your data is not just another asset of the company which collects it, and that companies can only process it for the purposes for which you gave them the data.

This is really the only way to make it work. As long as the legal framework is such that customer's do not own the information associated with a business transaction, busin

Re:

[mpe (36238)]

The whole point of incorporation is to shield the owners and the management from legal liability.

Actually the original idea behind a Limited Liability Corporation was only to shield the owners from creditors if the business failed. Their liability being limited to the amount they had invested, worst case senario being that they ended up with a worthless piece of paper.
The idea of this protecting the executive is rather more recent.

Re:

[feepness (543479)]

In the US, companies howl with outrage at the prospect that they should treat their customers with similar fairness. You could argue that resisting even the smallest extra expense is in the short term interests of their shareholders. Of course that ignore the possibility that ethical policies may increase customer loyalty, and better serve their shareholders' longer term interests - as well as being "The Right Thing".

Great! Then the companies that do "The Right Thing" will survive and out-prosper the o

Re:

[Oktober Sunset (838224)]

The Data Protection directive does not take away your right to flush your privacy down the crapper. It simply means that a company cannot go back on it's word, it can only use your data in the way it originally tells you. So if they are going to sell it to the highest bidder, they have to tell you that when you give it to them. If they say they will use it only internally, they must stick to that.

Re:

[mpe (36238)]

In most of Europe, companies are bound by laws implementing the EU's Data Protection Directive, which makes it clear that your data is not just another asset of the company which collects it, and that companies can only process it for the purposes for which you gave them the data.

The point is that the data "belongs" to the customer.

In the US, companies howl with outrage at the prospect that they should treat their customers with similar fairness.

The US Government is doing more than "howling" when it c

Depends on where you are

[Moraelin (679338)]

It depends on where you are. Here in Europe we have pretty damn clear privacy laws, and a habit of slapping corporations with massive fines for breaking the laws. Plus the usual legal concept that you can't let someone make a profit from breaking the laws, i.e., the punishment has to at the very least be bigger than the illicit gains.

Plus, we don't depend on random users suing, but have government and EU agencies for enforcing the consumer rights. They _can_ afford good lawyers.

So shareholders can't really

Privacy?

[Brad1138 (590148)]

If I can order a TUTU in my underwear, I'm good.

Where do you get *real* privacy ratings?

[schwaang (667808)]

I usually read an online shop's privacy policy before buying (along with their other policies). And it's usually legalistic gunk, with a truste logo slapped on, which is worthless given that most policies say "we can change this anytime without prior notification".

So how do you rate what they _do_ instead of what they _say_?

You should not have to know.

[twitter (104583)]

So how do you rate what they _do_ instead of what they _say_?

All that can really be done is to pass laws that make inappropriate data sharing unprofitable. This is the only way to make good, privacy respecting service competitive and fix those places where market forces or bad laws have eliminated choice.

meanwhile, in the real world, ...

[schwaang (667808)]

Google just paid 3 *billion* dollars for doubleclick.

And ChoicePoint, which supposedly paid ~$5 million after their little data Valdez incident, seems to be chugging along quite nicely thank you.

Yeah, toothful privacy laws in this country would be great. But for now, I want useful independent information about bad actors so I can avoid them when possible.

I always check resellerratings.com to see what other people think about an online vendor before using them. It would be nice to have independent informat

Error: Subject Conformation

[DynaSoar (714234)]

Fatal flaw: the study told the subjects how to act. They were confronted explicitly with the privacy "device" developed by the researcher. They knew what was being measured and allowed to behave freely. In such circumstances subjects consciously or otherwise will attempt to conform to the implied expectations of the researcher.

MSNBC has an article on the same subject (http://redtape.msnbc.com/2007/06/price_of_privac. html#posts). Their poll is flawed for the same reason (it ends up measuring what people say

And the conversation went

[Evets (629327)]

Researcher: Would you be willing to help us out today by answering a few questions and buying something online? We're researching consumer buying decisions as they correlate to privacy policies of internet merchants.
Woman in Mall: Sure, what do I have to buy?
Researcher: Just batteries. Oh and a... um... vibrator.
Woman in Mall: <turns around and walks away looking for security>
Researcher: But you get to keep it!
Woman in Mall: Well, I guess if it's for scientific research...

What this means

[obeythefist (719316)]

Is that now every shoddy internet business is going to have a big serious looking "we care about your privacy" notice stuck somewhere prominent (but not prominent enough to displace advertising).

They won't change their actual privacy policies or anything, and they'll still leak credit card details etc. to the highest bidders.

Think I'm being cynical? Maybe. But think about it, this is bound to happen.

Isn't privacy a right?

[wikinerd (809585)]

Customers pay for service. If they are willing to pay more for privacy, this means that privacy is equated with a service that can be bought. Since then is privacy something you buy? Isn't privacy a right? Should we pay to enjoy our rights? I am afraid that the blatant lack of privacy has made even the customers to abandon the idea that they have this right as an unrealistic romantic ideal and accept the harsh reality that in today's corporate jungle there are no rights and everything can be sold and bought.

Re:

[Vegeta99 (219501)]

You go to a party. You introduce yourself to a few people.

Eventually, someone you DIDN'T introduce yourself to comes up and already knows your name.

No, you don't have a right to privacy when you talk to someone else.

What are you paying for?

[emjoi_gently (812227)]

Really, what are you paying extra for?
So that the store wont stick you on a Spam list?
Wont use your Credit Card drain your bank account?
What is the actual cost involved in limiting your supplied information to the transaction at hand?

If the store even hints that my info is going to be used beyond what it is supplied for, I wouldn't touch the place with a 10 foot pole.

The study's methodology seems flawed to me

[Infonaut (96956)]

From TFA: Participants in the laboratory study...

I've seen over and over again that when you place Internet users in an environment where they are being watched, and know they're being watched, their behavior changes. If you were participating in a study conducted by the Carnegie Mellon Usable Privacy and Security Lab, using their own "Privacy Finder" search engine, don't you think your behavior would be a bit skewed?

I'm all for privacy, and for giving consumers a choice about whether they want to let

Checking out BankRate and Wachovia

[Animats (122034)]

The idea here is that they're looking for sites that have a privacy policy expressed in XML, something that's been working since 2002 but never really caught on.

Even the few sites that use that have problems. Check out Bankrate.com [bankrate.com]. According to PrivacyFinder, their policy, from the XML, can be summarized as "BankRate.com may share your information with: Companies that help this site fulfill your requests (for example, shipping a product to you), but these companies must not use your information for an

Better Surveys: 15% value privacy

[giafly (926567)]

A better measure of how you value you privacy is whether you use a store card/loyalty card. Most people are willing to sell their privacy for a small discount, but it seems up to 15% value it enough to reject these cards. Reference is from 2005 but I doubt the figures have changed much.

According to a 2004 poll conducted by Boston University's College of Communication, 86 percent of American shoppers use some form of store card or discount card, "and the majority of them say the benefits of the card are wort

Re:Oh, please

[WrongSizeGlass (838941)]

This study is BS. Purchase a sex toy? How can this study even be valid. How about trying books or something like that?

How about buying a book about how to use the sex toy you purchased on the other site?

Re:

[Esteanil (710082)]

Yeah. Summary of the article: A test group using a special "privacy finder" search engine to shop for sex toys and batteries will pay extra for privacy.

This clearly leads to the conclusion that all online shoppers care deeply about privacy and will happily pay web shops with good privacy policies much more for the same products.
Anyone got some statistics from a web shop with a privacy policy? I'd sure like to see how many % of visitors and buyers actually read this policy.
This should give some indicat

Re:

[moderatorrater (1095745)]

My biggest concern is that they were forced to review the privacy policy first, which isn't realistic at all. Claiming real-world relevance requires the study be similar to real world circumstances.

Re:

[yali (209015)]

Here's a link to the researchers' actual report [econinfosec.org]. (Never trust a press account of any study of anything. Or a slashdot summary, for that matter.)

This was a controlled experiment, and I agree with your point about real-world relevance. It appears to me that the researchers are claiming that if privacy information was made more prominent and easily digestible (as it was in their experiment), people would pay more for privacy. I don't think they are claiming that privacy policies influence people in the curren

Re:

[mpe (36238)]

It appears to me that the researchers are claiming that if privacy information was made more prominent and easily digestible (as it was in their experiment), people would pay more for privacy.

Rather they might pay more for some text on a website saying or not saying certain things... You'd need to carry out more research to see what a company's actual policy on privacy was.

Re:

[RJ11 (17321)]

Actually, if you bothered to read the paper, you'd find that that's not the case. Privacy information was provided in the margins. No one was actually forced to read any privacy policies before purchasing.

But thanks for playing!

Re:

[mpe (36238)]

The cynical side of me envisions some PHB calculating the maximum they can get from selling customer data, and whether this exceeds 4%.

If you were really cynical you'd consider that they could both charge and extra 4% and sell the data...

Re:

[dgatwood (11270)]

You forgot:

Shipping: $6.75

I buy locally if the local store carries something and it's only a couple of dollars difference. Usually when I buy online, it is either because local stores don't have it or because it would save 30% or more of the purchase price. If you aren't saving me a significant chunk of change off of the local price, your online store isn't worth my time. If your site is buggy and rejects payments and/or has significant navigation problems, your store isn't worth my time. If your po

Does not always work

[gr8dude (832945)]

What if the company is supposed to send you some data via email, and the message was handled as spam and rejected by your server?

You'll miss the message, thinking the company is a bad one. On their end - they attempt to get in touch with you because they have received the failed delivery report; but they fail to contact you because all the data you provided were bogus.

Sometimes the customer may figure out something like this has happened and contact the company. Other times the customer sends a nastygram to

Re:

[mpe (36238)]

By the way : Funny. A company can demand all sorts of rights when they sell you a product, but a customer can do no such thing when he buys it.
"You cannot guarantee that this product is fit to actually do what you advertised it for ? Well, I can't guarantee that that money you got from me is actually fit to be used either" :-)

Depends where you are in the world. There are plenty of places where goods must be "as described". With an advertisment (even a salesman's comment, if documented/witnessed) being l