Disclosure of personal information under risk of privacy shocks

• We study how data-breach notifications affect the disclosure of personal information.
• We run two treatments: with and without data-breach notification messages.
• A breach message induces a sub-group of individuals to disclose less.
• This result contrasts with the theory, where notifications do not have any effect.

Breaches of the security of personal data collected by firms are reported almost daily. Companies are under an increasing political pressure to notify individuals whose privacy as been breached. At the moment, we know virtually nothing about the behavioral impact of data breach notifications. We present the results of an experimental study designed to investigate how breach notifications change the individual's propensity to provide sensitive personal information to firms. In contrast to the theory (where breach notifications have no behavioral effect), our main result shows that notifications induce a sub-group of individuals to disclose less information to a firm, i.e. those with personally sensitive information.