Technology Data & Privacy Data and Privacy

What to do about ‘privacy paradox’ now that CCPA has launched

By Martin Kihn | Senior vice president, marketing cloud

July 9, 2020 | 9 min read

With the California Consumer Privacy Act (CCPA) kicking off this month, marketers are faced not only with concerns around compliance, but also with the issue of how they can make customers feel comfortable about sharing their data. Here, the senior vice-president of strategy of Salesforce’s Marketing Cloud, Martin Kihn, shares four tactics to try based on troves of research.

Salesforce SVP Martin Kihn

Salesforce SVP Martin Kihn says people 'are not good at making decisions about privacy trade-offs'

It’s already been a long, hot summer for advertisers. In addition to everything else, the CCPA was unleashed on a bewildered public. Plus, Apple announced a major change to its Identifier for Advertisers (IDFA), forcing users to opt-in to ad tracking in apps starting this fall and raising the specter of a flurry of GDPR-like consent screens tripping gamers on their way into Animal Crossing.

At the heart of this orgy of opt-ins lies a dark secret: people are not good at making decisions about privacy trade-offs. We just aren’t. Why? Because of a strange phenomenon called the ‘privacy paradox’.

What exactly is the privacy paradox?

Here’s the pickle: when we’re asked if we value our personal data, almost all of us say ’yes’. Yet our behaviors show otherwise. For example, in 2018, Facebook confronted a flush of bad PR after a public data scandal, yet its revenue grew 30%. We regularly surrender intimate information to platforms such as Google (searches), Facebook (party photos), Amazon (purchases), Stitch Fix (waist sizes) and so on, all without a squeak.

There is ample evidence that we appreciate relevant content: Amazon and Netflix both built a business on trenchant recommendations. After GDPR appeared in Europe, the cost of advertising to consumers who had opted in to targeting actually rose. And anecdotal evidence suggests that prices for comparable ads are about 50-60% lower on Apple’s Safari (which blocks most user-level targeting) than on Google’s Chrome browser (which does not, for now).

What’s a marketer to do? It turns out, there are a lot of theories about the privacy paradox – including one that it doesn’t exist. A detailed overview of the academic literature found 35 explanations packed into 32 studies. These and other briefs can help to point the way.

How do you solve the paradox?

Imagine the following: you arrive on a website or download an app and a pop-up appears saying something like, ’We’d like to track you so we can make your experience better – yes or no?’ In that moment, you haven’t experienced anything; you just got there. You can’t value a ’good experience’ because you haven’t had any experience yet.

So the trouble with ’rational choice theory,’ as it’s called, is that we’re usually forced to make decisions without enough information. Our ability to do continual ’privacy calculus’ is constrained. Common biases that plague privacy decisions include time constraints, lack of information or interest, immediate gratification and a tendency to think we’re ’giving up’ more data than we are.

Four tactics to try

Marketers and advertisers are going to have to master the art of gaining consumer trust. How? Some general guidelines from the research include:

1. Don’t talk about people behind their backs

It turns out that we don’t like this behavior online any more than we do at work or school. Our attitudes toward information sharing depend both on the type of information and the way it’s shared, what social scientist call the ’information flows’.

One study found we are much more comfortable with open, direct so-called ’first-person sharing’ than we are with covert ’third-party sharing’. The latter, when disclosed, actually drove down purchase interest by 24%. Conversely, using ’overt data collection’ can restore interest and rebuild trust.

Bottom line: tell people directly how you are gathering their data.

2. Give a sense of control

Like Janet Jackson, we really want ’control’. An alarming 81% of respondents to a Pew Research survey confessed they felt they had almost ’no control’ over companies collecting their data. This feeling is rife in the US. When consumers in the US and the EU were asked if they would opt out of data collection in future, US consumers were 1.5 times more likely to say ‘yes’.

Why? One likely explanation is that, for all its fits and starts, GDPR provides a sense of control. In America, our hodgepodge of legislation and tools does not. People have been shown to share data much more willingly when they believe they can control what they share, even if that control is an illusion.

Bottom line: make customers believe they control the data.

3. Explain the benefits in concrete, positive terms

It’s up to the marketer to describe the privacy value exchange as concretely and positively as they can. The insight here is that concrete benefits might often dominate abstract risks – and that privacy ’threats’ are usually abstract. But stay positive and benefit-focused, since there’s evidence that mentioning risks makes people nervous.

The idea is to give the consumer a sense of the awesomeness of your personalized experience, either in words or pictures. In one study, for example, an ad for a rental company using a person’s physical location performed better when it was explained that location data was used specifically to mention services not available elsewhere.

Bottom line: paint a happy picture of tangible benefits for sharing data.

4. Remember, people are different

It is often assumed that attitudes to online privacy and ad targeting are demographically determined. Millennials and Gen Z are the cultural paranoids, while Boomers and Gen X are more relaxed. It turns out these attitudes are more a function of our personalities than our demos: they’re a state of mind.

A few years ago, the Advertising Research Foundation released a report on ’ad receptivity’ that concluded that the anti-ad crowd were more likely to be ’suspicious’ and ’headstrong’. And a different study, published earlier this year, identified about one-third of the online population as ’privacy actives,’ more informed and aware. Rather than retreating from data sharing, these ’actives’ were two time more likely to share their purchase history in exchange for better recommendations.

So, the privacy conversation will be different with different groups, and these groups are likely not segmented by age, gender or income. The ’actives’ just need more information, and the more the better. The ’rejecters’ need their suspicions allayed. It’s up to the marketer to figure out which psychographic segment each consumer inhabits.

Bottom line: throw your customer insights and data science teams at the problem.

And remember, you can always try something new. Ask people to share data after you’ve given them something of value. Be explicit. Ask them how they feel. Give them the remote. The human rules still apply: trust is something that is earned, not just given.

Martin Kihn is senior vice-president of strategy of Salesforce’s Marketing Cloud

To keep up with all our dedicated US coverage, sign up for the free daily briefing newsletter.

Technology Data & Privacy Data and Privacy

More from Technology

View all


Industry insights

View all
Add your own content +