An interesting study was published at the 2024 PET Symposium and it aims to examine how individuals understand and perceive the data being that is being collected and linked to their identity. One such example that offers users this ability is Google’s “My Activity” dashboard which collates all of your activity across Google services.
The researchers know that most people are aware that, in a general sense, when you search for “lawnmower” on Google, there is some sort of record on your account for “searched for lawnmower.” But do people understand that Google and others could make inferences based on that information, i.e. “searched for a lawnmower, must own a house” etc.
This is what the researchers call the Generic Paradox. What is this means is that people are commonly unconcerned with the interest labels applied to them because they think they’re so broad, they could be applies to everyone. This discounts the ability to infer from data as previously mentioned.
Further, people may not be aware of what the researchers call the data food chain - or, what people think is evidence of their phone listening to them. An example of this is searching for a new lawnmower on Google then later seeing an advertisement on YouTube for home loan interest rates. The further an individual interacts and engages with these advertisements can act as confirmation or denial for how accurate the interest labels are.
The interesting thing about this image is that it shoes that even after being showed the evidence, the majority of people still believe that Google only has a broad understanding of their interests. This helps the users feel like the data being collected is not of concern, or not invasive.
Some more interesting data that shows that for this group of participants, they are generally not concerned with Google and see data collection as mostly benign or even beneficial. Only 9 participants were “extremely concerned” about the sensitive nature of their searches.
Privacy fatigue
Perhaps something we can all relate to, 18 of the participants confessed they had pretty much given up on trying to maintain their privacy. For example, P55 (not at all concerned) noted: “Not much I can do to stop it, so why worry?” Participant P88 (slightly concerned) added: “I believe that data gathering and analytics is occurring in all aspects of life from the television that you watch to the groceries that you buy so I’m really not that concerned and there is little I can do to block the collecting of information.”
Another 15 participants considered Google’s data collection as a reasonable trade-off for free applications and services. For instance, P62 (not at all concerned) noted: “They aren’t collecting any more from me than from anyone else and it is the cost of using their free services.” Participant P60 (slightly concerned) articulated that the conveniences of Google services made them willing to accept the data collection, explaining: “Google provides many conveniences to me as an internet user. It’s not ideal that so much information is gathered about me, but I’m not prepared to give up these conveniences.”
And course, 4 participants were convinced they had nothing to hide, so they were not concerned at all with data collection.
Lack of alternatives
While perhaps not indicative of the general population, 168 of the 170 study participants used Google Chrome as their browser. The researchers noted that this is slightly biased because having a Google account was a prerequisite for participating in the study. If they asked 170 Firefox users the same questions they would be sure to get drastically different results.
As one participant summarized, “I still value some Google products over their competition so I compromise on the collection of my activity information.”
Concluding thoughts
While reading through this study, I am reminded of the old proverb “You can lead a horse to water, but you can’t make him drink.” It’s a reminder that privacy is a personal journey and not everyone’s journey will be identical. Just because you get the heebie jeebie’s from personalized ads doesn’t mean everyone will. And that’s ok.
What we argue is needed is the ability for users to make informed decisions about what is collected and how it’s used. If an individual wants to sacrifice a small bit of privacy for a free product, that’s their choice to make. But what we need more than obnoxious cookie banners is a real understanding of what data is being collected and how it’s being used, even if there is a “I don’t care” selection.