The Bulletproof Glass Effect: Unintended Consequences of Privacy Notices

Journal of Marketing Research Scholarly Insights are produced in partnership with the AMA Doctoral Students SIG – a shared interest network for Marketing PhD students across the world.

Consumer data is of great value to businesses. Better insights about consumers’ preferences allow them to target advertisements, identify growth opportunities and personalize services. An exponential increase in the rate and extent of consumer data collection has made privacy a top concern for all consumers. A 2019 report by Pew Research Center found that about 79% of Americans are concerned about how their data was used by companies.

Firms display privacy notices to safeguard from legal liabilities and to assuage doubts in consumers’ minds that their personal data might be misused. Even though the intent is to make consumers feel secure, could these privacy notices increase feelings of vulnerability? In a recent Journal of Marketing Research article, Aaron R. Brough, David A. Norton, Shannon L. Sciarappa, and Leslie K. John show that privacy notices can have unintended consequences in the form of reduced trust, leading to lower purchase intent. They call this the “bulletproof glass effect” — just as bulletproof glass in a home makes a visitor concerned about the safety of the home’s location, privacy notices can have a similar effect.

The authors show that although most managers expect privacy notices to make consumers feel secure, they can actually increase consumers’ feelings of vulnerability. In a field experiment, the authors manipulate the visibility of a privacy notice. Contrary to expectations, they find that prominently displaying detailed privacy protections can drive consumers away. This happens even when the privacy notices emphasize objective protection or omit mentions of potentially concerning data practices. In contrast, such notices were found to be helpful when consumers already had a reason to be distrustful. Interestingly, firms that add benevolence cues, such as “We care about protecting your privacy!” to their privacy notices benefit from a decrease in the bulletproof glass effect.

The authors show that although most managers expect privacy notices to make consumers feel secure, they can actually increase consumers’ feelings of vulnerability.

These findings have important implications for marketers. They demonstrate a miscalibration between manager expectations and consumer responses. By shedding light on the mechanism behind the bulletproof glass effect, this research also provides insights on how to overcome the negative consequences of privacy notices.

We were able to ask several questions to these authors, who kindly provided interesting insights into this article:

Q: You show that consumers may respond to the mere concept of a formal contract. Do you think this somehow makes the actual content within the privacy notice less impactful, or does the text still have an impact? For example, does a firm versus consumer-oriented tone of the notice matter? Does a lengthy notice shrouded in legalese have a different impact compared to a small, vague notice with limited information about the privacy protection policy?

A: Content still matters. In fact, we show that purchase interest is lower after exposure to a privacy notice that omits (vs. includes) statements we refer to as benevolence cues, which communicate that the company cares about consumer privacy. We did not systematically test other characteristics of privacy notices (e.g., length, accessibility, and orientation), but to the extent that such characteristics foster feelings of perceived benevolence [or detract from those feelings], we would expect that consumers would be more [less] interested in purchase.

Q: Have you thought of looking at the effect of differences in text within the privacy notice in future research?

A: Actually, we already do that in the published manuscript. We argue that “…one potential solution may lie in modifying the written content of the privacy notice to build greater trust” (p. 743). We then go on to describe how including benevolence cues in the text of a privacy notice may increase trust. We predict in Hypothesis 5 that the effect will be attenuated when a privacy notice incorporates (vs. omits) these cues. We find support for this hypothesis in Study 5, where we show that adding benevolence cues to the text of a privacy notice attenuates its negative effect on purchase interest.

Q: Apart from the differences between what consumers say and do in the context of privacy-related information, there are many instances of a disconnect between what consumers say and do. Do you think this partly because consumers tend to conform with expectations, either by giving answers that others in the situation would give or the researcher would expect? Also, is it possible that these survey responses might actually be different from consumers’ actual perceptions about privacy notices?

A: An attitude–behavior gap has been well-documented in a variety of domains. However, since we observe the same pattern in both self-reported attitudes and consequential behavior, this cannot explain our findings. In fact, as far as I know, we are the first researchers to conduct a field study examining how a privacy notice affects the actual behavior of real customers, and we find a similar pattern in that study as we do across our other survey-based studies.

Q: Although you rule out the possibility of privacy notices interrupting consumers primary goal as a reason for reduced willingness to transact, do you think there could be differences in the negative effect of privacy notices, depending on the stage in which consumers are shown privacy notices?

A: While there is always a possibility that information could be more or less impactful when introduced at different stages of the purchase process, we have found no evidence that the timing of presenting the privacy notice moderates the effect. In an unpublished study, we varied whether the privacy notice was displayed before or after a description of product features. Results indicated no significant difference in purchase interest across these conditions; the results were similar regardless of when consumers were exposed to the privacy notice.

Q: Would you expect an attenuation of the negative bulletproof glass effect as on-site popups (i.e., cookie use policy notices) become increasingly common? For example, if consumers see more privacy related notices at the bottom of websites, will they dismiss them with little cognitive process and thus also respond less negatively to more salient privacy policies?

A: Yes. Our findings suggest that reducing the salience of a privacy notice should attenuate the bulletproof glass effect, and I would expect privacy notices to become less salient as they become increasingly common. Some support for this intuition comes from an article published in 2001 in Marketing Science by Eric Anderson and Duncan Simester—they found that when sales signs are common in a retail store, they become less effective. Similarly, I would expect consumers who encounter privacy notices more frequently to pay less attention to them. On the flip side, we note in the General Discussion that, “as transparency becomes increasingly required, the absence of a privacy notice may become even more conspicuous.”

Q: What is the balance that practitioners should strike with privacy notices? Should they incorporate less salient notices or more salient ones that also include benevolence statements?

A: I would be cautious about overgeneralizing here, but the results of Study 5 in our manuscript showed that the presence of a privacy notice with a benevolence cue led to higher purchase interest than the absence of a privacy notice. Based on these results, practitioners may be better off including salient privacy notices with benevolence cues rather than less salient notices that lack benevolence cues. Managers should also consider that some customers may naturally be more distrustful than others and benevolence cues may not have the same effect on all customers.

Q: In the example you provide in Figure 4, the full notice is 22 words in length. How often do you expect firms are using similarly long privacy notices?

A: The length of the privacy notices in our stimuli is typical of real privacy notices. The privacy notice in Figure 4 included a six-word benevolence cue, so it was slightly longer than the standard notice used in the control condition of the same study. However, I do not believe a 22-word privacy notice is uncommon, and many standard privacy notices are much longer.

Read the full article:

Aaron R. Brough, David A. Norton, Shannon Sciarappa, and Leslie K. John (2022), “The Bulletproof Glass Effect: Unintended Consequences of Privacy Notices,” Journal of Marketing Research, 59 (4), 739–54. doi:10.1177/00222437211069093

Go to the Journal of Marketing Research