The Effect of Consumers’ Perceived Power and Risk in Digital Information Privacy: The Example of Cookie Notices

Recent regulation in the European Union (i.e., the General Data Protection Regulation) affects websites’ information privacy practices. This regulation addresses two dimensions: websites must (1) provide visible notice regarding private information they collect through cookies and (2) give consumers the choice to disagree to such tracking. Policy makers must understand their regulation’s degree of implementation, as well as its effect on consumers. The authors develop a typology of website cookie notices along the dimensions of notice visibility and choice. A field study shows that most websites only offer low notice visibility and limited choice over private information collection. In addition, four experimental studies in the EU and United States explore the effects of information privacy practices. They find that offering choice over whether or which data are collected increases consumer power, whereas visibility of the notice (vs. no notice) only affects risk perceptions. The authors establish the novel suggestion that perceived risk is mitigated if consumers have more choice over their data (indirectly through greater power). Power and risk influence consumers’ affect and purchase intent.