The Implications of Privacy-Aware Choice

Abstract

Privacy concerns are becoming a major obstacle to using data in the way that we want. It's often unclear how current regulations should translate into technology, and the changing legal landscape surrounding privacy can cause valuable data to go unused. In addition, when people know that their current choices may have future consequences, they might modify their behavior to ensure that their data reveal less---or perhaps, more favorable---information about themselves. Given these concerns, how can we continue to make use of potentially sensitive data, while providing satisfactory privacy guarantees to the people whose data we are using? Answering this question requires an understanding of how people reason about their privacy and how privacy concerns affect behavior. In this thesis, we study how strategic and human aspects of privacy interact with existing tools for data collection and analysis. We begin by adapting the standard model of consumer choice theory to a setting where consumers are aware of, and have preferences over, the information revealed by their choices. In this model of privacy-aware choice, we show that little can be inferred about a consumer's preferences once we introduce the possibility that she has concerns about privacy, even when her preferences are assumed to satisfy relatively strong structural properties. Next, we analyze how privacy technologies affect behavior in a simple economic model of data-driven decision making. Intuition suggests that strengthening privacy protections will both increase utility for the individuals providing data and decrease usefulness of the computation. However, we demonstrate that this intuition can fail when strategic concerns affect consumer behavior. Finally, we study the problem an analyst faces when purchasing and aggregating data from strategic individuals with complex incentives and privacy concerns. For this problem, we provide both mechanisms for eliciting data that satisfy the necessary desiderata, and impossibility results showing the limitations of privacy-preserving data collection.