The Market for Data Privacy

We find considerable and systematic variation in privacy policies along multiple dimensions including ease of access, length, readability, and clarity, both within and between industries. Surprisingly, firms' data extraction is strongly and positively related to the length and complexity of their privacy policies.

Firms with intermediate levels of technical sophistication have longer, more complex policies. A simple signalling model of firms engaging in data extraction in an economy with both myopic and sophisticated consumers helps to rationalize these findings.