The Notice-and-Choice Privacy Gamble: Game Theory, Consumer Agency, and Implications for GDPR

Abstract

This article provides a theoretical basis for why the notice-and-choice model for protecting consumer information privacy might still be considered a viable policy approach despite evidence that privacy notices are often ignored, difficult to read, and misunderstood by consumers. Drawing from several well-known game-theoretic models that map closely to an online consumer’s notice-and-choice context, we outline a rational choice model for consumer online privacy and discuss its relevance for the EU’s General Data Protection Regulations [GDPR]. We argue that an online consumer’s notice-and-choice privacy gamble is a reasonable bet when constrained by competition and the presence of meaningful regulation.