Commercial Privacy on the Internet and Diffusion Characteristics

We have little privacy on the Internet. Commercial companies collect our personal information. Their goal is to tailor advertising that will suit our individual tastes. My study showed that despite public awareness of the privacy threat, we now have more cookies and spyware than ever before. At the same time, the diffusion of Internet technology is unaffected. Can diffusion characteristics help resolve this privacy-diffusion paradox, where a privacy threat increases, yet people who claim to care about their privacy keep using a technology?

I believe two diffusion characteristics made the Internet vulnerable to this paradox and may make other technologies that share these qualities susceptible to the same paradox. First, the Internet is characterized by a critical mass point quality. This characteristic is prevalent among interactive technologies. A critical mass of people needs to adopt them before they are of value. For example, the telephone was far less useful before there were many people to call. Once the critical mass point is reached the rate of diffusion accelerates. At that point a technology is less likely to be affected by a privacy threat. It is less likely to be abandoned because of the threat. When the critical mass point is reached and diffusion accelerates, social norms become quickly entrenched.

The Internet reached its critical mass point in 1990 with 4 million users worldwide. The privacy threats appeared around the mid-1990s at a time of rapid diffusion, and non-privacy norms became quickly entrenched.

The second relevant diffusion characteristic is decentralization. The entrenchment of non-privacy norms is also enhanced where a technology is decentralized. Where a technology is decentrally diffused all users can re-invent it. In the case of the Internet, many users could act to develop privacy threatening tools, such as cookies. This exacerbated the entrenchment of non-privacy norms.

I suggest that where a technology is characterized by a critical mass point and decentralized diffusion the window of opportunity for intervention is much narrower. Privacy protection, whether through technological design or legal rules, is likely to be effective earlier before social norms are entrenched.

My week is over, and I ran out of time to explore the last point regarding the timing for privacy protection. For readers interested in the full argument - it can be found here.