Privacy intuitions evolved in an environment that was radically different from the one found online; this evolved privacy psychology leaves people disconnected from the consequence of online privacy threats

The Privacy Mismatch: Evolved Intuitions in a Digital World. Azim Shariff, Joe Green, William Jettinghoff. Current Directions in Psychological Science, April 14, 2021. https://doi.org/10.1177/0963721421990355

Abstract: Although people report grave concern over their data privacy, they take little care to protect it. We suggest that this privacy paradox can be understood in part as the consequence of an evolutionary mismatch: Privacy intuitions evolved in an environment that was radically different from the one found online. This evolved privacy psychology leaves people disconnected from the consequence of online privacy threats.

Keywords: emotion, evolution, Internet, privacy, technology

“You have zero privacy anyway,” declared Scott McNealy, CEO of Sun Microsystems in 1999. “Get over it” (quoted in Sprenger, 1999, paras. 1–2). Two decades later, the amount of public data vacuumed up by social networks, geolocalized cell phones, and other smart devices makes those early days seem quaint. Yet polling indicates that people remain strongly—indeed, increasingly—concerned about online privacy (Pew Research Center, 2019). They have not “gotten over it.” Or at least, they say they have not. Though people express serious concerns about their privacy, these same people do little to protect it (Gerber et al., 2018). This inconsistency—now extensively documented (Kokolakis, 2017)—is known as the privacy paradox.

As more of people’s lives moves online and falls under increasingly sophisticated surveillance technologies, these gaps between the public’s professed desire for privacy and their behavior will become more consequential. We argue here that understanding privacy psychology in modern online environments requires looking back to the evolutionary roots of privacy concern. The privacy paradox, we submit, is the consequence of an evolutionary mismatch (Li et al., 2018). Human privacy intuitions emerged in an ancestral environment that differed radically from the digital environment in which those intuitions are now being tested.

A Future

For privacy psychology, the past three decades have seen an environmental change that is arguably larger than even the Neolithic revolution 12,000 years ago. In this current environment, online interfaces befuddle intuitions that have otherwise allowed people to adaptively decide what to share, how much, and with whom. The mass, permanent record of online behavior leaves access to people’s information—and thus control over their reputations and decisions—to the whims of online power brokers. This leaves users vulnerable to coercive persecution by dissent-averse governments, commercial manipulation by profit-seeking corporations, and criminal exploitation by tech-savvy ne’er-do-wells (Zuboff, 2019).

Examples of the consequences of privacy erosion are accumulating. Data breaches have taken a substantial psychological and human toll (the leaking of account information from adulterous match-making site Ashley Madison provoked divorces, resignations, and suicides). The easily accessed digital footprints people leave online can often return to sabotage other aspects of their life (e.g., Sherman, 2013, found that one in ten 16- to 34-year-olds reported being rejected from a job because of something they had posted online). Surreptitiously acquired personal data on Facebook can be used to sway an electorate (as happened in the 2016 U.S. election with the political consulting firm Cambridge Analytica and the Trump campaign). Perhaps the most large-scale example is the broad use of online data that powers China’s Social Credit System, which has already been used to regulate millions of citizens’ travel options, apartment rents, medical wait times, and even education quality.

However, people’s reactions to privacy violations are tied not to these grave consequences, but to their evolved intuitions. This disconnect between reaction and consequence exposes how privacy psychology can be exploited for power and profit. For instance, even though technology companies soberly and technically explain their privacy policies, they can nonetheless easily coax data from people by burying the cues that would trigger evolved privacy concerns. In exchange, companies offer returns—for example, the connection of social networks or the titillation of online pornography—that powerfully appeal to evolved desires. Both corporations and governments often appease citizens’ civil-liberty concerns by removing the triggers of, rather than the actual intrusions behind, privacy concern. These types of solutions exploit humans’ mismatched psychology, quelling immediate emotional reactions while leaving the deeper, more rational concerns unaddressed.

Evolutionary mismatches tend to resolve via subsequent evolution, environmental change, or behavioral adaptation (Lloyd et al., 2014. The glacial pace of genetic evolution precludes subsequent evolution from being a reasonable solution for this issue. Environmental change, in this context, would entail changing how people experience the Internet. Europe’s General Data Protection Regulation was aimed at such user-level changes, but its contractual legalese bloodlessly appealed only to abstract concerns, failing to ignite emotional privacy intuitions. Privacy alerts could be reimagined to more viscerally trigger people’s social intuitions (Calo, 2012), and researchers should measure the effectiveness of such changes for aligning preferences and behavior. However, we are pessimistic.

The sheer scale of privacy management online makes putting the behavioral onus on individual users—even with the help of alerts and pop-ups on websites—unrealistic. The problems are similar, if even more formidable, for bottom-up behavioral adaptations that require individual users to simply edit their privacy settings themselves. Even scholars who are themselves skeptical of the existence of a privacy paradox (e.g., Solove, 2020) recognize that when it comes to privacy, the online environment is too vast to be individually managed given humans’ psychological limitations. People were not built for it.

Given the privacy mismatch, efforts to align users’ preferences and behavior may prove futile. A more tractable solution could focus on mitigating the negative consequences of people’s loose privacy behavior, but data-protection efforts face resistance from powerful government and corporate interests. Challenging those interests would require rousing public interest in, and changing social norms about, data privacy. Psychologically, one strategy for lifting an issue to sociopolitical importance is via “moral piggybacking”—tying privacy to other areas of existing moral concern (Feinberg et al., 2019). Privacy could be piggybacked on fairness concerns, by highlighting the injustice of corporations extracting personal data for profit, or onto liberty concerns, by reminding people that their data fuel mass manipulation through personalization algorithms. Moralizing privacy via piggybacking may rally greater political will to support privacy rights.

Obviously, the online environment is vast and diverse. Not all domains will lead to poorly calibrated oversharing. In fact, certain technologies may provoke mismatches that err in the other direction, affording novel but self-defeating motivations for social withdrawal. For instance, videoconferencing enables asymmetric visibility whereby students, patients, or audience members can unilaterally disable their webcams—rendering themselves seeing, but unseen. This protects privacy, but may undermine other goals by degrading a traditional social experience.

In either case, for something so morally complex, culturally ubiquitous, and increasingly topical, privacy somehow remains understudied in psychology. We hope that the functionalist approach we have outlined here can help close the gap between the paucity of psychological research on privacy and the important, pervasive, and ever-widening public discussion of it. There are few topics for which the gap is so large.