Letting Down Our Guard With Web Privacy

Jeff Swensen for The New York Times

Intriguing experiments by Alessandro Acquisti, a behavioral economist, suggest that people often reveal more than they mean to online.

SAY you’ve come across a discount online retailer promising a steal on hand-stitched espadrilles for spring. You start setting up an account by offering your e-mail address â€" but before you can finish, there’s a ping on your phone. A text message. You read it and respond, then return to the Web site, enter your birth date, click “F” for female, agree to the company’s terms of service and carry on browsing.

Shoppers at a mall were offered $10 discount card â€" and an extra $2 discount if they agreed to share their shopping data. Half declined the extra offer.

But wait: What did you just agree to Did you mean to reveal information as vital as your date of birth and e-mail address

Most of us face such decisions daily. We are hurried and distracted and don’t pay close attention to what we are doing. Often, we turn over our data in exchange for a deal we can’t refuse.

Alessandro Acquisti, a behavioral economist at Carnegie Mellon University in Pittsburgh, studies how we make these choices. In a series of provocative experiments, he has shown that despite how much we say we value our privacy â€" and we do, again and again â€" we tend to act inconsistently.

Mr. Acquisti is something of a pioneer in this emerging field of research. His experiments can take time. The last one, revealing how Facebook users had tightened their privacy settings, took seven years. They can also be imaginative: he has been known to dispatch graduate students to a suburban mall in the name of science. And they are often unsettling: A 2011 study showed that it was possible to deduce portions of a person’s Social Security number from nothing but a photograph posted online. He is now studying how online social networks can enable employers to illegally discrimnate in hiring.

Mr. Acquisti, 40, sees himself not as a nag, but as an observer holding up a mirror to the flaws we cannot always see ourselves. “Should people be worried I don’t know,” he said with a shrug in his office at Carnegie Mellon. “My role is not telling people what to do. My role is showing why we do certain things and what may be certain consequences. Everyone will have to decide for themselves.”

Those who follow his work say it has important policy implications as regulators in Washington, Brussels and elsewhere scrutinize the ways that companies leverage the personal data they collect from users. The Federal Trade Commission last year settled with Facebook, resolving charges that it had deceived users with changes to its privacy settings. State regulators recently fined Google for harvesting e-mails and passwords of unsuspecting users during its Street View mapping project. Last year, the White House proposed a privacy bill of rights to give consumers greater control over how their personal data is used.

Mr. Acquisti has been at the forefront, testifying in Congress and conferring with the F.T.C. David C. Vladeck, who until recently headed the agency’s Bureau of Consumer Protection, said Mr. Acquisti’s research on facial recognition spurred the commission to issue a report on the subject last year. “No question it’s been influential,” Mr. Vladeck said of Mr. Acquisti’s work.

Companies, too, are interested; Microsoft Research and Google have offered Mr. Acquisti research fellowships. Over all, his research argues that when it comes to privacy, policy makers should carefully consider how people actually behave. We don’t always act in our own best interest, his research suggests. We can be easily manipulated by how we are asked for information. Even something as simple as a playfully designed site can nudge us to reveal more of ourselves than a serious-looking one.

“His work has gone a long way in trying to help us figure out how irrational we are in privacy related decisions,” says Woodrow Hartzog, an assistant professor of law who studies digital privacy at Samford University in Birmingham, Ala. “We have too much confidence in our ability to make decisions.”

This is perhaps Mr. Acquisti’s most salient contribution to the discussion. Solutions to our leaky privacy system tend to focus on transparency and control â€" that our best hope is knowing what our data is being used for and choosing whether to participate. But a challenge to that conventional wisdom emerges in his research. Giving users control may be an essential step, but it may also be a bit of an illusion.

IF iron ore was the raw material that enriched the steel baron Andrew Carnegie in the Industrial Age, personal data is what fuels the barons of the Internet age. Mr. Acquisti investigates the trade-offs that users make when they give up that data, and who gains and loses in those transactions. Often there are immediate rewards (cheap sandals) and sometimes intangible risks downstream (identity theft). “Privacy is delayed gratification,” he warned.

Mr. Acquisti, lean and loquacious, grew up in Italy. His father, Giancarlo, was a banker by profession and a pianist on the side. Mr. Acquisti inherited his father’s passion for music; last year he helped him write an opera about Margherita Luti, the woman believed to be the painter Raphael’s lover and muse. Mr. Acquisti’s other passion is motorcycle racing â€" he rides a red Ducati â€" though the pursuit of tenure, which he acquired last year, has lately kept him off the racing circuit.

He earned a bachelor’s degree in economics in Rome and master’s degrees in the subject from Trinity College in Dublin and the London School of Economics, and he became interested in the economics of privacy while studying for a doctorate in the interdisciplinary School of Information at the University of California, Berkeley.

A version of this article appeared in print on March 31, 2013, on page BU1 of the New York edition with the headline: Letting Down Our Guard.