Behavioral data cannot establish indifference to privacy
Aliases: constrained choice · behavior-as-preference · preference identification
What it is
The revealed preference fallacy in privacy is the direct inference that continued use, acceptance, or unchanged settings mean a person does not care about privacy. Behavior is evidence of a choice, but it reveals what someone did under available options, costs, knowledge, and power—not a unique value weight. Endorsement, missing alternatives, misunderstanding, fatigue, and different beliefs about harm can generate the same action.
Why it happens
Inferring preference from action is underdetermined because multiple latent motives yield one observation. Product logs record only branches the system offers and omit unavailable alternatives, unknown facts, and dissatisfaction after selection. Defaults turn silence into state. When organizations use those states to justify more collection, constrained action is recursively treated as authorization and opportunities to express objection shrink.
Studying it
Preference identification requires varying constraints—for example, reducing refusal cost, providing an equivalent alternative, explaining consequences, or changing the default—and observing whether action changes. Randomization can estimate interface effects, choice models can represent attribute trade-offs, and interviews can explain residual heterogeneity. Log correlation does not identify motive. Willingness to pay for privacy is also shaped by income and market alternatives, so it is not a pure preference scale.
Where it stops holding
Behavioral data are not worthless. Stable action under clear, symmetric, inexpensive, repeatable choice is stronger evidence, though it still concerns a particular exchange rather than privacy in general. Self-report has social-desirability and hypothetical biases and cannot simply replace behavior. Conclusions should remain at the level identified by the design and should not assign a group average to an individual.
Applying it
- Name the metric as a choice under specified interface conditions, not as privacy preference or trust.
- Retain the alternatives, default, steps, information, and functional consequences present at decision time.
- Stress-test interpretation by lowering refusal friction, offering alternatives, and showing concrete consequences; changed behavior defeats the stable-preference claim.
- Report actions beside stated reasons, withdrawal, and complaints, explicitly listing motives the data cannot distinguish; do not use uptake alone to authorize broader purpose.