Introduction

The online experience of billions of people is shaped by machine-learning algorithms and other types of artificial intelligence (AI) technologies. These self-learning programs include a variety of algorithmic tools that harvest and process people’s personal data in order to customize and mediate information online, in, for example, personalized social media feeds, targeted advertising, recommender systems, and algorithmic filtering in search engines (for more examples see Table B1 in Appendix B). Although many personalized services might be innocuous (e.g., music or movie suggestions), others challenge the existence of a transparent and open democratic marketplace of ideas and, ultimately, a collectively shared reality (Mazarr et al., 2019). For instance, there is substantial concern that personalized political messages containing false claims influenced both the Brexit referendum and the U.S. presidential election in 2016 (Digital, Culture, Media and Sport Committee, 2019; Persily, 2017). Furthermore, algorithms can amplify conspiracy theories, false or misleading information, and extremist content, which in turn may contribute to radicalization, the rise of political extremism (Baumann et al., 2020; Horwitz and Seetharaman, 2020; Kaiser and Rauchfleisch, 2018; Rauchfleisch and Kaiser, 2017), and increasing distrust in the media (Newman et al., 2020). Most recently, there have been growing concerns that the combination of algorithmic filtering and opinion dynamics on social media networks have fostered the spread of false information about the COVID-19 pandemic and governments’ responses to it, thereby reinforcing dangerous beliefs and conspiracy narratives (Cinelli et al., 2020; Thompson and Warzel, 2021; Zarocostas, 2020) and potentially hampering an efficient public response.

Data privacy and transparency are also causes for concern. People’s data are at the heart of the online ecosystem, where service providers monetize behavioral traces collected directly or by third-party trackers (Zuboff, 2019). This widespread collection of behavioral data enables AI algorithms to infer more information than people intend to share (e.g., information on sexual orientation, personality traits, and political views; Hinds and Joinson, 2019, 2018; Kosinski et al., 2016; Matz et al., 2017; Youyou et al., 2015). Using demographic and behavioral data in targeted advertising may also result in discrimination—for instance, by preferentially targeting (i.e., including or excluding) users belonging to disadvantaged social groups (e.g., according to race, religion, or sexual orientation; Speicher et al., 2018; see also Ali et al., 2019; Datta et al., 2018). For example, the 2016 Trump presidential election campaign has been accused of attempting to deter 3.5 million Black Americans from voting by deliberately targeting them on Facebook with negative Hillary Clinton ads (Sabbagh, 2020). Similarly, the Russian Internet Research Agency ran ads featuring socially divisive topics (e.g., immigration, race-based policing) on Facebook with the goal of creating social discord prior to the 2016 U.S. presidential elections; these ads were targeted at people based on their ethnicity (Ribeiro et al., 2019).

But how aware are people of the influence that algorithms exert on their online experience? And how acceptable do people find the use of their information for personalization?

Investigating these questions has become particularly urgent with the growing number of Internet users who rely on social media or search engines to find and access political news (Newman et al., 2020). Social media news feeds (e.g., on Facebook), video suggestions (e.g., on YouTube), and online advertising (on most platforms) have become highly personalized environments governed by nontransparent algorithms, and users have little control over how the information they see is curated.

There have been multiple calls to regulate online political advertising (e.g., Jaursch, 2020; Zuiderveen Borgesius et al., 2018) and align it with existing strict rules for offline political campaigning (for a discussion see Lewandowsky et al., 2020). To some extent, these calls have been heeded. At the end of 2020, the European Commission launched the Digital Services Act, which aims to upgrade the rules governing digital services in the European Union (European Commission, 2020a). This act complements the European Democracy Action Plan, which proposes legislation on, among other things, transparency of sponsored political content (European Commission, 2020b). Yet for now, platforms pursue their own, often divergent, approaches to targeting and personalization. For instance, Twitter now prohibits the promotion of political content (Twitter, 2021b), and Facebook recently tightened its advertising policies to, among other things, allow it to restrict certain electoral or political ads (e.g., in the lead-up to an election; Facebook, 2021)—its precise targeting mechanisms, however, remain nontransparent. Recent research has shown that Facebook’s ad delivery algorithms favor relevance (alignment with user interests) when it comes to pricing of ads and thereby indirectly incentivize political ads that align with users’ political preferences, thus potentially amplifying polarization dynamics (Ali et al., 2021). The significant power that digital platforms exercise over political discourse—whether through algorithms or human judgment (e.g., unilaterally banning Trump; Twitter, 2021a)—despite a lack of public accountability or scrutiny highlights the urgent need for public-centered social media regulation. Any approach to regulating the digital sphere should take into account people’s attitudes towards these key issues of data privacy and personalization of online content in order to secure public support and capture public ethical concerns. It is therefore puzzling that there has been little public involvement in monitoring and shaping the design of algorithms and the collection of data used for personalization.

We aimed to address this dearth of knowledge by focusing on people’s attitudes towards personalized online services and towards the use of their personal data and information in order to offer those services. Our goal is to contribute to a better understanding of people’s attitudes towards various aspects of online personalization.

Previous studies in the US and the UK have shown that attitudes towards personalization are context dependent: Attitudes are generally more positive towards commercial applications than towards personalized political information (Ipsos Mori, 2020; Smith, 2018). People in the US and Europe feel they have little control over their personal data and have general concerns about their digital privacy (Auxier et al., 2019; Directorate-General for Communication, 2019). Yet although people profess to care a great deal about their data privacy, their actual behavior does not necessarily reflect this concern. The inconsistency between people’s privacy attitudes and privacy behaviors has been coined the “privacy paradox” (e.g., Acquisti et al., 2015; Barth and de Jong, 2017; Kokolakis, 2017; Norberg et al., 2007; but see Dienlin and Trepte, 2015 and meta-analysis by Baruh et al., 2017). For example, even people with high privacy concerns do not display adequate privacy-protecting behavior (e.g., limiting profile visibility on social networks or controlling privacy settings on online platforms), although there is a modest positive relation between high privacy concerns and behavior (Baruh et al., 2017).

Attitudes towards privacy are not homogeneous: they may vary across different types of personalized services and across different types of personal data and information that make personalized services possible. Most studies have looked separately at either attitudes towards personalized services or attitudes towards data privacy. However, personal data is essential for personalized services, and so attitudes on data collection have implications for personalization, and possibly vice versa.

We therefore contrasted people’s attitudes towards different aspects of personalization, including services and collection of data and information, in order to draw a more comprehensive picture of people’s attitudes and the extent to which they cohere or conflict with each other. We included questions about the acceptability of personalization in various kinds of digital services and of collecting and processing people’s data for the purpose of personalization (see Hinds and Joinson, 2018 for a systematic review of demographic characteristics that can be inferred from people’s digital footprints). An awareness of these heterogeneous and fine-grained attitudes is crucial for regulatory interventions or guidelines, as well as for platforms’ efforts to self-regulate in a way that respects people’s preferences, concerns, and values.

In an online survey (using representative quota sampling) in Germany (N = 1065), Great Britain (N = 1092), and the United States (N = 1059), we inquired into three main aspects of public attitudes and behavior: (1) people’s awareness of the use of AI algorithms in online environments; (2) people’s attitudes towards three key components of algorithmic personalization online: personalized services (e.g., recommendations for music and movies, political campaigning), personal data collected online and used for personalization (e.g., location history, likes and shares on social media), and personal information that can be provided by users directly or inferred from data (e.g., age, gender, political leaning, sexual orientation); and (3) people’s concerns about the use of their personal data and how they protect their own personal information. We also investigated the extent to which people’s attitudes and concerns are moderated by political leaning and demographic characteristics.

Our findings (for details see the Results section) show that although people were willing to accept some personalized services (e.g., for shopping and entertainment), they objected to personalization in political campaigning and, in Germany and Great Britain, to the personalization of news and news sources. For instance, most respondents in Germany (61%) and Great Britain (61%) and approximately half in the US (51%) said personalized political advertising was unacceptable. In all three countries (but more so in Germany and Great Britain), people also objected to the use of most personal data and sensitive information that could be collected for personalization, including data related to their online interactions, such as with whom and how often they communicate (GER: 77%; GB: 66%; US: 60%); their location history (GER: 69%; GB: 57%; US: 55%); and their browsing and search history (GER: 63%; GB: 58%; US: 53%). Moreover, a large majority of respondents rated, on average, personalized services as more acceptable than the collection of personal information or data for the purposes of personalization. This acceptability gap between personalized services and the collection and use of data they require can be observed at both the aggregate and the individual level. Across countries, between 64% and 75% of respondents showed an acceptability gap. Furthermore, respondents in all three countries reported high levels of concern about data privacy, with 82% of participants in Germany, 81% in Great Britain, and 82% in the US saying they were somewhat or very concerned. Despite this widespread concern, respondents reported taking few steps to protect their privacy online—although those who were more concerned about privacy were more likely to change privacy settings and use privacy tools. Privacy concerns and attitudes are similar across the political spectrum, indicating that regulation related to data privacy protection and political advertising will likely be met with approval from voters regardless of their political leaning.

Methods

Sample and data collection

Dalia Research conducted the survey for the Max Planck Institute of Human Development in September (Germany) and November (Great Britain and US) 2019. Online samples were obtained in Germany (N = 1065), Great Britain (N = 1092), and the United States (N = 1059), using quota sampling and applying post-stratification weights to account for current population distributions with regard to age (18–65 years), gender, and education. The Institutional Review Board of the Max Planck Institute for Human Development approved the surveys. See Table 1 for demographic information about the three samples (weighted based on post-stratification survey weights; for both weighted and unweighted demographic information see Table B2 in Appendix B). Some preliminary results for the German sample, not including the acceptability gap, were made available in a technical report in English (Kozyreva et al., 2020a) and in German (Kozyreva et al., 2020b).

Table 1 Demographic information.
Full size table

Study design

The survey was conducted online in German and English. The survey questions covered three topics: Public awareness of the use of AI and personalization algorithms on the Internet, public attitudes towards algorithmic personalization, and public attitudes and behavior regarding online privacy. We also collected information about participants’ demographics and political leanings. In Fig. 1 and in the following we provide an overview of the study design and summarize the gist of the survey questions; for the full questionnaire in English and in German, see Appendix C.

  1. (1)

    Public awareness of the use of AI and personalization algorithms on the Internet. We defined “artificial intelligence (AI) technologies” as self-learning computer programs (“machine learning”) that analyze people’s personal data in order to customize their online experience. We asked people whether they thought that AI technologies are used in a variety of online situations, including news feeds, advertising on social media, and product recommendations in online shops (see Fig. A1 and Study questionnaire in Appendix C for full list).

  2. (2)

    Attitudes towards algorithmic personalization. In order to gain a more complete understanding of how acceptable people find algorithmic personalization online, we asked about three key components of personalization: services, information, and data. All three are necessary for a full picture of attitudinal heterogeneity, both within individuals and across individuals. The set of questions for all three dimensions (services, information, and data) represents common personalization practices. To elicit attitudes towards personalizing services, we asked respondents “How acceptable do you think it is for social media and other websites to collect and use data about you and your past online activities to [personalize different online services, e.g., search results or friend suggestions]?” (see Fig. 2 and Study questionnaire in Appendix C for full list). To elicit attitudes towards information we asked respondents “How acceptable do you think it is for online web platforms to use any of the following information about you to create personalized advertising?” (e.g., gender, age, political views, sexual orientation; see Fig. 2 and Study questionnaire in Appendix C for full list). To elicit attitudes towards data collection, we asked respondents “How acceptable do you think it is for web services and applications to record and use the following types of information that they collect about you on their platform?” (e.g., browsing and search history, location history, content of emails and online messages; see Fig. 2 and Study questionnaire in Appendix C for full list). Respondents could answer “not acceptable at all”, “not very acceptable”, “somewhat acceptable”, or “very acceptable”.

  3. (3)

    Public attitudes and behavior regarding online privacy: To elicit respondents’ concerns about their data privacy online, we asked “How concerned are you about your data privacy when using the Internet?” Respondents could answer “not concerned at all”, “not very concerned”, “somewhat concerned”, or “very concerned”. To elicit people’s self-reported privacy-protecting behavior online, we asked “Which of the following [privacy settings] have you used in the last year to check and/or adjust what kind of data on you can be used by Internet companies?” (e.g., activity controls on Google) and “Which of the following measures and tools do you currently use to protect your data privacy online?” (e.g., ad blockers, VPN; see Fig. 4 and study questionnaire in Appendix C for full lists of settings and tools).

  4. (4)

    Demographics and political leanings: We collected respondents’ demographics (age, gender, education level, and location: urban/rural) and political leaning (on a scale ranging from “1 (left-wing)” to “7 (right-wing)”; see Figs. A2 and A3 in Appendix A and Table B2 in Appendix B for demographic information).

Fig. 1
figure 1

Study design for online survey “Artificial intelligence in online environments’’.

Full size image

Data analysis

Anonymized data and reproducible R code are available at Open Science Framework: https://osf.io/7nj8h. Unless explicitly noted, all numbers and figures reported incorporate post-stratification survey weights provided by Dalia Research (based on age, gender, and education level) to increase the representativeness of the reported results.

For binary responses (or binary categorizations of rating-scale responses), the worst-case margin of error (i.e., the 95% confidence interval of a true proportion of 50%) is ≈ ±3 percentage points for a sample size of N = 1000 and ≈ ±10 percentage points for a sample size of N = 100.

Results

Public awareness of AI technologies online

Respondents were partially familiar with AI-related concepts and key entities: They knew that algorithms are employed online, and that algorithms are used to curate social media feeds (see Fig. A1 in Appendix A). For example, in all three countries, the majority of participants were familiar with the term “artificial intelligence” (GER: 86%; GB: 74%; US: 67%) and, more specifically, with targeted/personalized advertising (GER: 70%; GB: 58%; US: 50%). However, significantly fewer participants were familiar with recommender systems (GER: 34%; GB: 12%; US: 12%) and machine learning (GER: 42%; GB: 31%; US: 33%). Respondents were also aware that AI algorithms are employed in smart assistants (e.g., Siri or Alexa; GER: 70%; GB: 66%; US: 63%), search engine results ranking (GER: 59%; GB: 52%; US: 48%), and advertising on social media (GER: 57%; GB: 56%; US: 55%). They were less aware of AI used to recommend partners on dating websites (GER: 38%; GB: 41%; US: 40%) or curate social media news feeds (GER: 44%; GB: 43%; US: 44%). A clear majority of respondents correctly identified environments with little or no personalization (e.g., Wikipedia or a local restaurant’s website).

Public attitudes towards personalization and the collection and use of information and data

We found heterogeneity in respondents’ attitudes towards three key components of algorithmic personalization online (Fig. 2).

Fig. 2: Public attitudes towards algorithmic personalization online in Germany, Great Britain, and the United States.
figure 2

Percentage of respondents indicating levels of acceptability for (a) personalizing services, (b) using information for personalization, and (c) collecting and using data in online services in general. White numbers show percentages per rating category; black numbers show total percentages for the two sides of the rating scale. Within panels, items are ordered by their average rating pooled across all three countries (in ascending order of acceptability).

Full size image

Personalized services

Most respondents in Germany (61%) and Great Britain (61%) and approximately half in the US (51%) said personalized political advertising was unacceptable. Approximately half of respondents in Germany and Great Britain opposed personalized news, including on front pages of online newspapers (GER: 52%; GB: 54%) and in news feeds on social media (GER: 57%; GB: 51%). In contrast, 60% of respondents in the US found personalized online newspapers acceptable and 62% approved of personalized social media news feeds. At the same time, a majority in all three countries approved of personalized recommendations for entertainment (movies or music: GER: 77%; GB: 84%; US: 88%), shopping (GER: 77%; GB: 82%; US: 89%), and search results (GER: 63%; GB: 60%; US: 71%).

Information

A majority of respondents found the collection and use of their personal information unacceptable. They clearly opposed personalization based on sensitive information (e.g., tragic and personal events, household income, sexual orientation, religious or political views). This opposition was highest in Germany and Great Britain; for instance, 71% and 59%, respectively, found it unacceptable to use political views for personalization. Respondents in Germany (71%) and Great Britain (62%) also found the use of information about their sexual orientation unacceptable. In the US, approximately half of respondents objected to the use of information about their political views (49%) and sexual orientation (51%), while a majority opposed the use of information about their household income or personal tragedies. Only age and gender were considered acceptable for personalization in all three countries by the majority of respondents. Respondents in the US were more accepting of information such as personal events (55%), their ethnicity (57%), their marital status (62%), and their personality traits (68%) being used for personalization online.

Personal data

In all three countries, most people objected to the collection and use of their personal data, including data related to their online interactions (e.g., with whom and how often they communicate; GER: 77%; GB: 66%; US: 60%); their location history (GER: 69%; GB: 57%; US: 55%); and their browsing and search history (GER: 63%; GB: 58%; US: 53%). Among the types of data that approximately half of respondents found acceptable were purchasing history (GER: 44%; GB: 47%; US: 51%), videos watched (GER: 44%; GB: 52%; US: 62%), and likes and shares on social media (GER: 43%; GB: 54%; US: 65%).

Acceptability gap in attitudes towards personalization

In all three countries a seemingly paradoxical result emerged: Respondents found personalized services (e.g., customized search results, online advertising, entertainment recommendations) more acceptable than the use of personal information and data (e.g., personal interests or location history), even though this information is currently used in personalized services. This constitutes what we call an “acceptability gap”, which we define as the difference between how acceptable people find personalized online services (e.g., social media news feeds, video suggestions) and how acceptable they find the collection and use of their personal data and information for such personalization. The gap exists on both the aggregate and the individual level (see Fig. 3).

Fig. 3: Acceptability gap between personalized services and information and data used for personalization in Germany, Great Britain, and the United States.
figure 3

A respondent’s acceptance level is defined as the arithmetic mean of their ratings (mapped into the [0, 1] range), ranging from 0 (not acceptable at all) to 1 (very acceptable). a Country subpanels show kernel-smoothed densities of the population distributions of acceptance levels for services, information, and data, respectively. Vertical dashed lines show the median values for each distribution; decimal values indicate how much lower the median value for information and data is compared to the median value for services. b Respondent-level differences between the acceptability level for services versus information (x-axis) and services versus data (y-axis). Positive values indicate that a respondent rated services as, on average, more acceptable than collecting information (upper half of each subpanel) or data (right half of each subpanel). Bold values show percentages of respondents falling into each of the four quadrants. Respondents in upper-right quadrants (blue) reported higher acceptability levels for both information and data; respondents in lower-left quadrants (gray) reported lower acceptability levels for both. Respondents in upper-left and lower-right quadrants showed an acceptability gap for only data (green) or only information (brown), respectively.

Full size image

At the aggregate-level, the acceptability gap refers to the finding that the population medians of respondents’ average acceptability rating for services are greater than those for collecting information or data (Fig. 3a). Across comparisons and countries, the size of this gap ranges between one-sixth and one quarter of the full range of the response scale (“not acceptable at all”, “not very acceptable”, “somewhat acceptable”, “very acceptable”). That is, the size of the gap equalled as much as one step on the four-step rating scale. The gap was most pronounced in Germany (one quarter of the rating scale), and somewhat less pronounced, but still notable, for Great Britain (one-fifth of the rating scale) and the US (one-sixth of the rating scale for information and one-fifth for data).

At the individual level, the acceptability gap refers to the finding that a large majority of respondents rated, on average, personalized services as more acceptable than the collection of personal information or data (Fig. 3b). Across countries, 84%–89% of respondents showed at least one acceptability gap (for information and/or data). Between 64% and 75% of respondents showed an acceptability gap for both information and data. Only 13–16% showed no gap. Mirroring the aggregate-level results, the individual level acceptability gap is somewhat more pronounced in Germany than in Great Britain and the US.

In summary, for all three dimensions of online personalization (services, information, and data), we found that preferences were heterogeneous: Some services and data types were judged acceptable, others were not. On average, services were judged more acceptable than information and data.

Data privacy concerns and behavior

People in all three countries reported high levels of concern about their data privacy (Fig. 4 top panel): 82% of participants in Germany, 81% in Great Britain, and 82% in the US said they were somewhat or very concerned. Only a small fraction of respondents were not at all concerned (GER: 4%; GB: 4%; US: 6%), indicating that lower levels of concern do not explain the more pronounced laissez-faire attitudes to algorithmic personalization found in the US (see Figs. 2 and 3).

Fig. 4: Privacy concerns and behavior in Germany, Great Britain, and the United States.
figure 4

a Answers to the question “How concerned are you about your data privacy when using the Internet?” White numbers show percentages per rating category; black numbers show total percentages for the two sides of the rating scale. b Percentage of respondents indicating that they currently use a privacy tool, separately for respondents who indicated that they were not or not very (black), somewhat (orange), or very (red) concerned about their privacy online. The size of the points indicates the number of respondents contributing to a percentage value (see legend at the bottom of the figure); because only very few respondents said they were not concerned at all (see top panel), these respondents and those who said they were not very concerned were pooled into one category. Bold values show the percentage of respondents using a tool, irrespective of their level of concern. Items are ordered by this overall percentage of use, pooled across all three countries (in descending order except for “None of the above”, which is always last). c Percentage of respondents who indicated that they had checked or adjusted privacy settings within the last year (only considering respondents who indicated having used the respective service within the last year).

Full size image

Despite the high levels of concern, respondents reported taking few steps to protect their privacy online (Fig. 4, panels b and c). Popular measures included changing privacy settings on Facebook (GER: 59%; GB: 60%; US: 63%) and Google (GER: 47%; GB: 44%; US: 53%) and using ad blockers (GER: 38%; GB: 34%; US: 36%). About 20% of respondents in Germany, 24% in Great Britain, and 17% in the US indicated that they did not use any privacy-protecting tools; results were similar for privacy-protecting settings (GER: 20%; GB: 24%; US: 19%). Respondents who were more concerned about privacy were more likely to change privacy settings and use privacy tools (see Fig. 4, panels b and c).

Role of demographics and political attitudes

With the exception of male respondents in the US, there was a general decline in acceptability for all three aspects of personalization (services, information, data) across age (Fig. A2 in Appendix A). For men in the US, there was an indication of a slight inverted U-shape, where acceptance increased slightly up to age 40 then declined; men in the US were thus overall slightly more accepting of all three aspects of personalization. No noteworthy gender effects emerged for Germany and Great Britain. Age and gender did not moderate our finding of a lower acceptance of information and data compared to services (see panel a in Fig. A2, Appendix A). In general, older respondents were more concerned about data privacy than were younger respondents and male respondents were slightly less concerned than were female respondents (see panel b in Fig. A2, Appendix A). We found no noteworthy associations between personalization attitudes and privacy concerns on the one hand and education or location (urban/rural) on the other hand (see Fig. A3 in Appendix A).

Importantly for public policy makers, we found no political polarization in attitudes towards personalization and privacy in all three countries (Fig. 5). Respondents across the political spectrum agreed on the acceptability of personalized services, the use of people’s information and data for personalized services, and the collection and use of sensitive information. They were also equally concerned about data privacy.

Fig. 5: Political leaning and attitudes towards personalization and data privacy concerns in Germany, Great Britain, and the United States.
figure 5

a Boxplots of respondents’ acceptance level towards services, information, and data (panel columns) broken down by political leaning (x-axis in subpanels) and country (panel rows). A respondent’s acceptance level is defined as the arithmetic mean of their ratings (mapped into the [0, 1] range), ranging from 0 (not acceptable at all) to 1 (very acceptable). The width of the boxplots is proportional to the square root of the weighted number of respondents per distribution; these rounded weighted counts are also shown as gray numbers below the x-axis. b Answers to the question “How concerned are you about your data privacy when using the Internet?’’ broken down by political leaning (x-axis in subpanels) and country (panel rows). White numbers show percentages per rating category; black numbers show total percentages for the two sides of the rating scale. The width of the stacked bars is proportional to the square root of the weighted number of respondents per distribution; these rounded weighted counts are also shown as gray numbers above the stacked bars.

Full size image

Discussion and conclusion

The public perceives clear ethical boundaries in the use of algorithmic personalization online. Although people accept personalized commercial services (e.g., shopping and entertainment), they object to the use of the personal data and sensitive information that is currently collected for personalization. They consistently oppose advertising that is customized based on sensitive information, and find personalization in commercial services more acceptable than personalization in political and informational (e.g., news) content: People in all three countries oppose personalization in political campaigning, and people in Germany and Great Britain also oppose personalized news sources and social media feeds. This is an important finding with potentially far-reaching implications, given that social media feeds and political advertisement, like entertainment recommendations, can be highly personalized. People across the political spectrum are equally concerned about their data privacy and the effects of personalization on news and politics. This consensus, unusual in the current polarized political environment (especially in the US), raises the hope that policies for protecting online privacy and regulating the personalization of political news and advertising would receive broad support.

A clear tendency towards higher acceptability rates for all three categories—services, information, and data—can be observed in the US. Germany lies on the other side of the spectrum, with the lowest acceptability rating. Yet in all three countries we observed an acceptability gap: Even though most people accept personalized services, they generally oppose the collection and use of the personal, and specifically sensitive, information that personalized services collect. The reasons behind this gap are unclear. One possibility is that people have incommensurable values—that is, they value their data privacy but they also value the use of personalized services. Thus, people cannot help but to act as if they had found an acceptable trade-off between the immediate advantages of personalized services and future risks to their data privacy. When asked about their attitudes, however, they can acknowledge that data privacy and personalized services are to some extent in conflict, thus leading to the emergence of the acceptability gap. Trade-off processes also appear to play a role in the privacy paradox (Acquisti et al., 2015; Barth and de Jong, 2017). Another possible explanation for the acceptability gap is that it results from a lack of transparency in online services. Users might not be aware that companies such as Facebook or Google Maps need to collect information about their online behavior in order to customize news feeds or optimize suggestions. If this were the case, the trade-off people make between convenient personalized services and maintaining privacy online might not accurately reflect their preferences, since they may underestimate the extent to which the efficiency of personalized services hinges on data collection. This lack-of-awareness hypothesis is supported by the finding that 74% of Americans did not know that Facebook maintained a list of their interests and traits (Hitlin and Rainie, 2019).

Unlike the disconnect between people’s concerns about privacy and their approval of personalized services, people’s concerns about data privacy were moderately related to their privacy-protection behavior. This is consistent with the findings of a meta-analysis by Baruh et al. (2017), which demonstrated that privacy concerns are associated with the extent to which individuals engage in privacy management, although the magnitude of the association was modest. The positive relation between concerns and behavior could be another indication that the observed acceptability gap and privacy paradox are rooted in the current online environment, which does not offer users simple tools to keep their data safe and, consequently, does not support attitude-consistent privacy behavior. If this explanation is correct, then in order for privacy concerns and behavior to match more closely, the data privacy functions of online services should be more accessible, explained in simpler terms, and easy to use. Behavioral interventions (e.g., digital nudging and boosting; see Kozyreva et al., 2020c; Lorenz-Spreen et al., 2020) can also be employed to empower users to align their privacy protective measures to their level of privacy concern. New transparency measures could enable people to exercise their preferences in a more nuanced way, which would constitute an important next step towards regaining autonomy in the online world.

Finally, our results highlight the importance of personalization that respects people’s preferences for data privacy and their preference, shared across the political spectrum, that personalization not be used in political campaigning, and, at least in Europe, in news sources. To respect user preferences and concerns, platforms should shift towards using less personal data (e.g., the data minimization principle in Article 5 of the European Union’s General Data Protection Regulation; European Parliament, 2016). Collecting less data for personalization has been shown to be feasible without loss of quality in the recommendations based on minimized data (Biega et al., 2020; Wen et al., 2018). Furthermore, it is important to conceptualize data privacy and its protection in AI-assisted information environments as a public, as well as an individual, right and good (Fairfield and Engel, 2015). As algorithmic inferences from data collected from users can be harnessed to predict personal information of non-users (“shadow profiles”; Garcia, 2017), an individual’s privacy may be at risk through no fault of their own. Instead, the risk may arise from other users who are unconcerned about their data or were “nudged” by online choice architectures towards privacy-threatening options (Utz et al., 2019). Protecting user privacy must, therefore, encompass the privacy protection of citizens as a whole in what is known as a “networked privacy” model (Garcia, 2019)—a challenging but urgent task both for future research and policy making.

Understanding people’s general attitudes is crucial for defining the goals and values that inform regulations on networked data privacy and algorithmic personalization online. While our study contributed to this discussion and uncovered important links between people’s attitudes to online services and pertinent personal data, they do not shed light on what drives these attitudes. Further research is required to better understand the reasons behind both the acceptability gap and the privacy paradox. This should be complemented by research that investigates how people represent, understand, and resolve the trade-offs between using specific services and revealing the data that are needed to personalize those services, using people’s self reports and, crucially, their actual behavior.