Carnegie Mellon University
November 28, 2012

Press Release: Increasing Control Over Release of Information Leads People To Divulge More Online, Carnegie Mellon Researchers Find

Greater Control Can Mean Greater Vulnerability

Contact: Ken Walters / 412-268-1151 / walters1@andrew.cmu.edu
Shilo Rea / 412-268-6094 / shilo@cmu.edu

PITTSBURGH-When perceiving they have more control over their personal information, people increase their willingness to disclose sensitive information that allows them to be personally identified, according to a study done by researchers at Carnegie Mellon University.

The study investigated how people respond when given control over their personal information, allowing them to choose how much to reveal about themselves. CMU researchers Laura Brandimarte, Alessandro Acquisti and George Loewenstein found that users given more privacy controls share more sensitive information with larger, and possibly riskier, audiences.

"We found there was a paradox of control. People who felt more in control of their information took more privacy risks more often," said Acquisti, associate professor of information technology and public policy at CMU's H. John Heinz III College. "They felt more empowered and more in control of their personal information. But once the information is online, users can't control what people do with it."

Published in Social Psychological and Personality Science magazine, the findings have important public policy implications. Some privacy experts have called for providing users with more controls as a way to protect their information, but this research suggests that such policies could backfire.

"Our research shows that such self-regulation may still leave users vulnerable to privacy risks," said Brandimarte, a doctoral candidate at Heinz College.

As part of the research, three studies were conducted with a total of 600 participants across several populations. Two studies examined the impact of increasing or decreasing control over the release of information, while the third study manipulated control over access (but not usage) of information. All three studies showed that increasing perceived control over release or access of personal information can cause people to experience an illusory sense of security, and as a result, release more information.

"The conventional wisdom is that control over personal information implies protection," said Loewenstein, the Herbert A. Simon University Professor of Psychology and Economics at CMU's Dietrich College of Humanities and Social Sciences. "Our results provide evidence that control over personal information may be a necessary but not sufficient condition for privacy protection, and can even produce perverse effects."

###