DATA PRIVACY IN THE UNITED STATES By ANDREW DAILEY A THESIS Presented to the Lundquist College of Business And the Robert D. Clark Honors College In partial fulfillment of the requirements for the degree of Bachelor of Science May 2024 An Abstract of the Thesis of Andrew Dailey for the degree of Bachelor of Science in the Department of Business to be taken June 2024 Title: Data Privacy in the United States Approved: Utsav Shenava, Ph.D. Primary Thesis Advisor The aim of this thesis is to analyze how public opinion in the United States regarding data privacy and certain companies’ privacy policies have changed in recent years. Since the field of data privacy is constantly changing year by year, a current analysis will be able to provide new information and insights. The findings in this thesis can serve as useful information to anyone who uses digital products or services, which in today’s digital world is a majority of Americans. Part of the thesis is centered around two yearly surveys conducted by Deloitte and the Pew Research Center. By analyzing and comparing results from each year, this paper will directly address the posed research questions. This paper also focuses on the privacy policies of companies that have a large customer base within the United States. By comparing the policies before and after data privacy legislation went into effect, conclusions will be drawn about how companies have been forced to adapt to the changing digital environment. 2 Acknowledgements I would like to thank my primary thesis advisor Utsav Shenava, and my Clark Honors College advisor Ellen Fitzpatrick for their continual support throughout the entire thesis process. I’d also like to thank the CHC academic and thesis programs manager Miriam Alexis Castellón Jordan for all her assistance during the process. 3 Table of Contents Abstract 2 Acknoledgements 3 Introduction 6 Research Questions 7 Hypotheses 7 Literature Review 8 Consumer Privacy 8 Litigation and Laws 9 Public Opinion Error! Bookmark not defined. Methods 12 Surveys 12 Privacy Policies 13 Findings 14 Surveys 14 Privacy Policies 15 Discussion 19 Conclusion 21 Bibliography 22 4 List of Figures Figure 1: Graphic from Pew Research Survey 2023 15 Figure 2: Pew Research privacy policy study 2023 17 5 Introduction Privacy can be defined simply as the quality or state of being apart from company or observation (Merriam Webster, 2023). Some people view privacy as a basic human right, yet they give their information freely to companies every day. Some assume their information is secure yet are subject to practices such as tracking and targeted ads (Miller, Terri, et al, 2023). Most people in the academic and legal fields can’t even agree on a universal definition. With the rise of technology, user privacy has seen a rise in relevance, but this isn’t a topic that’s only existed in the past few years. As far back as the Cold War, there was mass hysteria in the U.S. that there were spies from another government operating within our borders, aptly named the Red Scare (History.com, 2023). Even in 1999, Scott McNealy, at the time the CEO of Sun Microsystems, told reporters that consumer privacy issues were a “red herring” as they have “zero privacy anyway” (Sprenger, 1999). As technology has advanced and companies have found new ways to collect and use information, the topic of consumer privacy has only become more relevant as the use of smartphones and computers has become commonplace. As consumer privacy grows in importance, the public’s knowledge of how their data is collected needs to grow with it. With this knowledge users can better protect their information and fight back against any unethical data breaches. Lawsuits totaling hundreds of millions of dollars have been filed and won against major companies like Facebook and Google, signaling that users are against their data being misused. Google has even agreed to start disabling third party cookies in order to stop the tracking of users, showcasing the effectiveness of public pressure (Southern, Matt G, 2023). Even outside of the tech field, data collection is prevalent for marketing companies like Acxiom and data analytics companies like Experian. Companies are being pressured to change with the 6 times, resulting in major shifts in the field. Because of the changing landscape, it’s never been more important for users to educate themselves on the topic of consumer privacy in order to protect themselves. Research Questions • How has public opinion on data privacy changed in recent years in the United States? • How has recently passed legislation forced companies to change their privacy policies? Hypotheses • Data privacy is an important issue to most people. • People are aware that data is being collected, but not how and why it is. • Users care more about privacy when using search engines than when using apps on their phones. 7 Literature Review Consumer Privacy Analyzing consumer privacy can be a challenge because different groups of people have different definitions for the word privacy. Many cultures believe not being disturbed is the most important part of privacy and this can be applied to consumer privacy (Newell, 1988). Trying to be left alone while browsing the web and social media seems to be impossible, which has led the idea of privacy being dead to become popularized. 81% of survey respondents believed that they had little to no control over the data that companies collect, with that number jumping to 84% with regards to the government collecting information (Auxier, Brooke, et al, 2019). The amount of data being collected is increasing at an alarming rate with some predicting that the amount of data being collected increased 300 times between 2005 and 2020 (D. S. Terzi, R. Terzi and S. Sagiroglu, 2015). Prominent companies that are used by millions of Americans even make is a business to collect and sell information to advertisers (C. Dwyer, 2011). Collecting data to increase profits and overall productivity is a common practice. For example, companies will use user information like location and past searches to produce targeted ads, made specifically for each user. The more specific an ad is to a user, the higher likelihood they will make a purchase. The companies are then incentivized to collect information so they can more accurately match the advertising space to advertisers. Using a more digitized approach to marketing has also helped cut costs in areas such as data parsing and data storage. The field of consumer privacy has been greatly affected by the amount of companies that are collecting data and will continue to change as companies are incentivized to increase their data collection. The rise in technology has also enabled more data to be collected. As more devices are being used by 8 the public and more information must be given up using them, companies’ data collections will grow. And as more data is being collected the possible negative consequences for users grow as there would be greater probabilities of data breaches. The combination of the growth of data collection and the emergence of negative outcomes for consumers makes consumer privacy an extremely relevant topic. Litigation and Laws As the field of consumer privacy and public opinion on the topic changes, laws and government regulation have been forced to change along with it. Some scholars have stated that legislators respond to their best sense of the public’s mood or the “broad climate of opinion” (Gandy, O.H., Jr. 2003). There have been many cases of legislation being passed in the privacy sector in regard to growing public pressure. As the internet was becoming increasingly more popular at the start of the 21st century, the Children’s Online Privacy Protection Act was passed after growing concerns about child safety. This restricted businesses from collecting identifiable data from kids under 13 (Ambrose, S., & Gelb, J. W. 2002). As soon as 2020 we’ve seen legislation that has changed the way businesses collect and use information. The California Consumer Privacy Act has given users the ability to access and delete any personal information of theirs that is held by a company and to deny the company the right to sell their information to third parties (de la Torre, Lydia, 2018). Privacy laws in other governing bodies like the European Union are much stricter than those of the United States. The General Data Protection Regulation in the EU says that companies can’t collect, store, or use personal data without consent from the data subject. The EU classifies location information, IP addresses, and cookie data as personal information, while the U.S. doesn’t. Similar laws in the U.S. limit personal data to just financial and health information (Singlemann, 2023). 9 Along with new laws, companies are being forced to change through class action lawsuits. In 2010, Google was hit with a class action lawsuit regarding their collection of email information. They eventually admitted wrongdoing and changed their processes, but only in reaction to class action lawsuits, not governmental action (C. Dwyer, 2011). As mentioned in the section above, the field of consumer privacy is growing quickly as companies are incentivized to collect as much user information as possible. But with this growth has come greater regulation by the government and a swarm of class action lawsuits, forcing companies to change their practices. As companies continue to innovate, it will be the governments and the public’s responsibility to innovate along with them. Public Opinion Gauging public opinion on controversial topics is a necessary but often daunting task. Strong opinions exist on each side of every argument and trying to figure out what the majority of people feel can be challenging, even for people who are experts within each field. The topic of consumer privacy elicits these strong opinions as people take their privacy very seriously. In a culture that is strongly centered around online forums, people have felt the need to better protect themselves. As far back as the early 2000s, surveys taken by Alan Westin showed that a majority of Americans were troubled by potential misuses of their information (Acquisti, A., Brandimarte, L., & Loewenstein, G., 2020). In a survey taken in 2013, 86% of users took steps in order to mask or get rid of their digital footprint, even though 59% of users felt it was impossible to be completely anonymous online (Raine, Lee, et al, 2013). Many people feel helpless when fighting to protect their privacy online as 62% of users felt there was no way for them to stop companies from collecting their data and 59% of users said they have little to no understanding of what the companies do with the data (Auxier, Brooke, et al, 2019). With users feeling helpless against data 10 collection, it has caused consumer privacy to become a hot topic in today’s political and social environment. Surveys are showing a majority of users feel uncomfortable with their own privacy which signals that change must take place at both the governmental level and the business level. 11 Methods The methodology of this thesis is separated into two parts. First, I analyzed the Deloitte and Pew surveys. And secondly, I analyzed privacy policies of major companies before and after the General Data Protection Regulation went into effect in the European Union. While the legislation is centered in the EU, it had a significant affect on privacy policies in the U.S., so it serves as a relevant part of this thesis. Surveys The Pew Research Center conducted surveys about data privacy through the American Trends Panel. The ATP has been taking almost yearly surveys regarding data privacy since as early as 2013 while making an effort to keep active participants constant throughout the years. Pew created the panel which consists of randomly selected U.S. adults. The 2019 survey was conducted between June 3 and June 17 and included 4,272 respondents. The 2023 survey was conducted between May 15 and May 21 and consisted of 5,101 respondents. In both studies, panelists participated using self-administered web surveys, and if they didn’t have internet access at home, they were provided a tablet and wireless internet connection. Participants were given varying financial incentives to participate in the survey, with payments ranging from five to twenty dollars. The target population of the surveys are people over 18 years old and living in the United States at the time of the survey. The panelists were sampled in a way that made sure the survey population demographics were proportional to U.S. adult demographics (McClain, Colleen, et al, 2023). The Deloitte Center for Technology, Media, and Telecommunications conducted a similar survey in Q2 of 2023 by surveying 2,018 U.S. consumers in order to understand customer’s 12 attitudes towards digital life. This was their fourth annual addition of the survey. Like with the Pew Research Center, Deloitte conducts yearly surveys on this topic, which allows for further analysis. All the data collected was weighted against the most recent U.S. census in order to arrive at a representative view of U.S. consumer’s opinions and behaviors. They also segmented respondents into generational groups based on their birth year. These groups include Gen Z, Millennials, Gen X, Boomers, and Matures (Arbanas, Jana, et al, 2023). While these surveys produce comprehensive results, there are some limitations that exist. The surveys sampled a diverse range of people, but there could still be biases with the respondents. Also, People who respond to an online survey might have more technological savvy than the normal population, which would skew results. Applying any skewed findings to make assumptions about the public could be cause inaccuracy. Comparing results between surveys could be difficult as the Pew study has an intricate weighting system for their results while the Deloitte is strictly weighted against the U.S. census. Privacy Policies Research dealing with privacy polices focused on ten major companies that conduct business within the United States. These companies were chosen because of their prominence within the country and the availability of past and current privacy policies. The ten companies are Google, Facebook, Reddit, Amazon, Wikipedia, Yahoo, Twitter, eBay, Instagram, and Netflix. Conclusions were drawn by analyzing the word count, reading time, and reading level of the policies, along with the identification of common trends within the policies. 13 Findings Surveys The first hypothesis, that consumer privacy is an important issue to a majority of users, was supported by the findings of the Pew and Deloitte studies of U.S. consumers. Pew found that the percentage of U.S. adults that feel very or somewhat concerned with how the government uses their data rose from 64 to 71 percent between 2019 and 2023. The percentage of adults who were concerned about companies using their data rose at a slower rate, from 79 to 81 percent over the four-year period (McClain, Colleen, et al, 2023). Both findings support the idea that a majority of Americans are worried about their data privacy. Deloitte found that 67% of smart phone users worry about data security and privacy on their phones. This is a 13% increase from data taken in 2022 that asked the same question. The 2023 Deloitte study also found that almost 60% of users worry that their devices are vulnerable to a security breach and that other people or organizations could track them through their devices (Arbanas, Jana, et al, 2023). Findings in the Pew and Deloitte surveys also support the second hypothesis that users are aware of their data being collected, not how and why it is being collected. Deloitte found that in 2023 only 34% of users felt that companies were clear about how they used the data they collected. In a 2021 study, 48% of users felt that way, signaling a worrying trend (Arbanas, Jana, et al, 2023). The Pew studies found similar trends as in 2019 59% of users lacked understanding of companies’ data use, but in 2023 it was 67% of users who felt that (McClain, Colleen, et al, 2023). 14 Figure 1: Graphic from Pew Research Survey 2023 The Pew studies in 2019 and 2023 went against the hypothesis that users care more about privacy on social media apps than on search engines. The 2019 survey found that respondents felt they have less control over who can access their information during social media activity than activity through traditional websites. A significantly higher percentage of respondents were concerned over social media posts than with websites they visited or search terms they used while online. The 2023 survey also supports the hypothesis, as it found that users were more likely to change their social media privacy settings than to change websites browsers or turn off cookies and website tracking (McClain, Colleen, et al, 2023). Privacy Policies Since the implementation of the General Data Protection Regulation in the European union, many companies have been forced to update their privacy policies for customers in the 15 United States. The GDPR was enacted in May 2018 and serves as a comprehensive data privacy law with the goal of giving users greater control over their personal data while standardizing privacy laws across Europe. The regulation applies to all companies who process personal data of people living in the EU, meaning that companies founded in the U.S. must adhere to the law if they have a customer base in the EU. One of the major points of the regulation is the requirement of consent from the individual before data is collected and processed. Users are also granted the ability to access and erase any data that a company has collected from them. When companies are found to have violated the regulations, fines will be levied with some going as high as 20 million euros (Wolford, Ben, 2023). This regulation is considered to be one of the strictest data privacy laws in the world and it has forced companies to expand their privacy policies in the U.S. to ensure that the privacy of consumers remains unviolated. When analyzing the changing privacy policies, one trend that stands out is the incorporation of videos that serve to explain how a company collects and uses information (“Privacy & Terms.” Google, 2024). Previous privacy policies were just written text but with the use of different formats shows that companies are trying to make their message more digestible, especially since younger users might be more inclined to take in information in a video format. It is a common trope that most users don’t actually read a privacy policy before accepting the terms and conditions, so changing the presentation of information is one way a company can rectify that. The Pew Research study conducted in 2023 found that a majority of users felt that current privacy policies were ineffective in conveying information, so further exploration of new themes and formats within privacy policies will be warranted (McClain, Colleen, et al, 2023). 16 Figure 2: Pew Research privacy policy study 2023 Another trend within newer privacy policies is that companies have made it easier for users to manage their data and privacy setting directly from the privacy policy (“Privacy & Terms.” Google, 2024). Google’s policy that went into effect in March of 2024 includes links to privacy settings as well as links that enable users to export and delete data that the company has from them. This feature aligns with the GDPR’s rules and was not featured in previous policies that were in affect before the implementation of the GDPR. As stated in the methods section, privacy polices from ten companies were analyzed in order to draw conclusions about how new regulations have affected company policies. Along with the incorporation of new formats and links, the lengths and reading levels of the policies also increased. On average, the word count from the privacy polices of the ten companies rose of 25 percent after the implementation of the GDPR and the average change of reading level was an increase of over three levels (Sobers, 2022). Increasing the length and reading levels of the polices can be viewed as companies trying to protect themselves from harmful litigation by making sure that all practices are openly stated before individuals are able to use their service. 17 This desire for legal protection might come at the expense of user understanding. Some changes, like the use of videos, will help users understand the policies, but the extra length and intricacy of the written portions might offset any new benefits. It is reasonable to assume that companies will further lengthen their policies in the future as they are forced to adhere to new regulations, so the further exploration of new formats will be needed if user understanding of the polices is to be increased. 18 Discussion After analyzing surveys conducted by the Pew research center and Deloitte in order to answer the first research question, it can concluded that the first two hypotheses were correct while the third one wasn’t. The data showed that data privacy is a relevant issue to a majority of respondents and that the percentage of people who are worried about certain issues is increasing. The second research question is focused on companies’ response to this increasingly relevant issue as well as new litigation that was established. An interesting dichotomy arose in the findings as companies tried to make information more accessible through video explanations while also increasing the length and reading level of the privacy policies. The effects of these changes on user comprehension over the next few years would be an interesting topic and would require further surveys and analysis. When researching privacy laws in the United States, it was evident how lackluster U.S. laws are compared to the ones in the European Union. Currently in the U.S. there isn’t an overreaching federal data privacy law as recently proposed acts such as the American Data Privacy and Protection Act is still stuck in the U.S. House of Representatives (Congress.gov, 2022). It is expected that disagreements between political parties will hinder the country’s ability to pass a comprehensive federal law. Traditionally, right wing politicians have been against stricter restrictions for businesses as they feel that it could hinder profitability and job opportunities in their state. Without the existence of a federal law, it is up to the states to pass their own data privacy laws. The California Consumer Privacy Act is currently the most comprehensive data privacy law in the United States as it gives consumers the ability to opt out of the sale of their personal data and have any personal data a company holds on them deleted after a request is filed (de la Torre, Lydia, 2018). 19 The field of data privacy will change drastically in the next few years as new legislation is passed and companies are forced to update their policies. It is likely that the trend of traditionally liberal states passing comprehensive data privacy laws will continue until over half the states in the U.S. have such laws. This will put more pressure on the federal government to pass federal law that is comparable to the existing state law, ensuring that all U.S. citizens are protected against wrongful business practices. It doesn’t seem realistic to expect the United States to pass legislation that is on the same level as the GDPR, as disagreements between parties will force concessions to be made which will result in less strict laws. 20 Conclusion The intention of this thesis is to provide a general audience with information about how the field of data privacy has changed in recent years, with the hope that readers can use information to better shape their opinions and practices in the future. With the field constantly changing, further research can be conducted to see if the trends highlighted in this paper continue in the future, or to see if new trends emerge in the field. Analyzing public opinion and the changing privacy policies is just a small part in the process of understanding data privacy in the United States, and I expect this topic be increasingly relevant in years to come. 21 Bibliography Acquisti, A., Brandimarte, L., & Loewenstein, G. (2020). Secrets and Likes: The Drive for Privacy and the Difficulty of Achieving It in the Digital Age. Journal of Consumer Psychology, 30(4), 736-758. Ambrose, S., & Gelb, J. W. (2002). Consumer privacy regulation and litigation. Business Lawyer (ABA), 57(3), 1231-1256. Arbanas, Jana, et al. Balancing Act: Seeking just the right amount of digital for a happy, healthy, connected life, Deloitte, https://www2.deloitte.com/us/en/insights/industry/telecommunications/connectivity- mobile-trends-survey.html#print-the-report Auxier, Brooke, et al. Americans and Privacy: Concerned, Confused and feeling a lack of control over their personal information, Pew Research Center, https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy-concerned- confused-and-feeling-lack-of-control-over-their-personal-information/ C. Dwyer, "Privacy in the Age of Google and Facebook," in IEEE Technology and Society Magazine, vol. 30, no. 3, pp. 58-63, Fall 2011, doi: 10.1109/MTS.2011.942309. Congress.Gov, H.R.8152 - 117th Congress (2021-2022): American Data Privacy and Protection Act | Library of Congress, Congress.Gov, www.congress.gov/bill/117th-congress/house- bill/8152. Accessed 14 May 2024. de la Torre, Lydia, A Guide to the California Consumer Privacy Act of 2018 (November 2018). D. S. Terzi, R. Terzi and S. Sagiroglu, "A survey on security and privacy issues in big data," 2015 10th International Conference for Internet Technology and Secured Transactions (ICITST), London, UK, 2015, pp. 202-207, doi: 10.1109/ICITST.2015.7412089. Gandy, O.H., Jr. (2003), Public Opinion Surveys and the Formation of Privacy Policy. Journal of Social Issues, 59: 283-299. https://doi.org/10.1111/1540-4560.00065. McClain, Colleen, et al. How Americans View Data Privacy, Pew Research Center, www.pewresearch.org/internet/2023/10/18/how-americans-view-data-privacy/. Miller, Terri, et al. “How Websites and Apps Collect and Use Your Information.” Consumer Advice, Federal Trade Commission, 22 Sep. 2023, Newell, Patricia, A CROSS-CULTURAL COMPARISON OF PRIVACY DEFINITIONS AND FUNCTIONS: A SYSTEMS APPROACH, Journal of Environmental Psychology, Volume 18, Issue 4, 1998. 22 “Privacy Definition & Meaning.” Merriam-Webster, Merriam-Webster, Accessed 19 Nov. 2023. “Privacy & Terms.” Google, Google, policies.google.com/. Accessed 14 May 2024. Raine, Lee, et al. Anonymity, Privacy, and Security Online, Pew Research Center, https://www.pewresearch.org/internet/2013/09/05/anonymity-privacy-and-security- online/ “Red Scare: Cold War, McCarthyism & Facts.” History.Com, A&E Television Networks, 1 June 2010. Singlemann, Chris. “GDPR US Equivalent: How the US and EU Compare on Data Privacy Laws.” Thoropass, 5 July 2023. Sobers, Rob. “How Privacy Policies Have Changed since GDPR.” Varonis, Varonis, 14 Oct. 2022, www.varonis.com/blog/gdpr-privacy-policy. Southern, Matt G. “Google to Disable Third-Party Cookies for 1% of Chrome Users.” Search Engine Journal, 15 Oct. 2023, Sprenger, P. (1999, January 26). Sun on privacy: “Get over it.” Wired. Wolford, Ben. “What Is GDPR, the EU’s New Data Protection Law?” GDPR.Eu, 14 Sept. 2023, gdpr.eu/what-is-gdpr/. 23