Information Problems, Rational Ignorance, and Online Privacy Warnings:

    Most of us use the internet every day, usually from a single browser, and we have all come across privacy warnings on the various websites we visit. The US has less stringent requirements than some other countries, so we get fewer legally required pop-ups, but we are all at least vaguely familiar with the concept of “cookies” and warnings like this:

We value your privacy

We use cookies to enhance your browsing experience, serve personalized ads or content, and analyze our traffic. By clicking "Accept All", you consent to our use of cookies. Read More

This message is most often accompanied by three options: Accept All Cookies, Reject All Cookies, and Customize. As far as I understand it, some cookies are used to improve the functionality of the website and others are used for marketing and analytics. The site will save your login information so that you don’t have to type it out every time, or it will save your progress on some aspect of the site. Very useful. We want these. At the same time, some cookies contain personal information that can be used in a more manipulative way. For example, Google will track your spending habits across websites in order to serve you ads that you are more likely to engage with, potentially manipulating you into spending money you would otherwise have saved. (I don’t actually know if Google uses cookies or some other user-tracking mechanism, but the result is the same). 

The fact that some cookies might benefit the user and some might work against them makes the Customize Cookies option appear enticing, but it poses an interesting informational problem for those utility maximizers among us. Basically, it would take a large amount of time and effort to parse out which cookies are beneficial to the user and which are not for every website, not to mention the time spent physically customizing the cookie options on each of those websites. For many, it is rational to forgo learning about cookies and how they are used in favor of one of the more extreme, but less involved, options of Accept or Reject, even if it results in a sub-optimal “consumption” of cookies. Just like voters who have a low marginal utility of learning a lot about the candidates they vote for, internet users have a low marginal utility of making an informed decision about which cookie option to select, especially since the costs of poor cookie allocation are so abstract and difficult to identify.

All of this shows that the laws around internet cookie disclosure do a poor job of taking into account people’s incentives. The idea behind requiring cookie notifications is to give consumers more control over the information they give away to the websites they visit. While it’s better than nothing, the default for most browsers is still to accept all cookies. So, a user who rationally chooses not to engage with the privacy warnings will end up with a poor allocation of cookies more often than not. In this case, a libertarian-paternalist approach might be more appropriate. That is to say, if the default cookie allocation were set by law to only accept cookies that improve web functionality but reject other kinds while still giving consumers the option to customize their cookies, we could better approach an equilibrium cookie allocation without increasing the informational costs of cookie selection.