Say you've come across a discount online retailer promising a steal on hand-stitched espadrilles for spring. You start setting up an account by offering your e-mail address — but before you can finish, there's a ping on your phone. A text message. You read it and respond, then return to the Web site, enter your birth date, click "F" for female, agree to the company's terms of service and carry on browsing.
But wait: What did you just agree to? Did you mean to reveal information as vital as your date of birth and e-mail address?
Most of us face such decisions daily. We are hurried and distracted and don't pay close attention to what we are doing. Often, we turn over our data in exchange for a deal we can't refuse.
Alessandro Acquisti, a behavioral economist at Carnegie Mellon University in Pittsburgh, studies how we make these choices. In a series of provocative experiments, he has shown that despite how much we say we value our privacy — and we do, again and again — we tend to act inconsistently.
(Read More: Obama Warns Hacking Against US 'Ramping Up')
Mr. Acquisti is something of a pioneer in this emerging field of research. His experiments can take time. The last one, revealing how Facebook users had tightened their privacy settings, took seven years. They can also be imaginative: he has been known to dispatch graduate students to a suburban mall in the name of science. And they are often unsettling: A 2011 study showed that it was possible to deduce portions of a person's Social Security number from nothing but a photograph posted online. He is now studying how online social networks can enable employers to illegally discriminate in hiring.
Mr. Acquisti, 40, sees himself not as a nag, but as an observer holding up a mirror to the flaws we cannot always see ourselves. "Should people be worried? I don't know," he said with a shrug in his office at Carnegie Mellon. "My role is not telling people what to do. My role is showing why we do certain things and what may be certain consequences. Everyone will have to decide for themselves."
Those who follow his work say it has important policy implications as regulators in Washington, Brussels and elsewhere scrutinize the ways that companies leverage the personal data they collect from users. The Federal Trade Commission last year settled with Facebook, resolving charges that it had deceived users with changes to its privacy settings. State regulators recently fined Google for harvesting e-mails and passwords of unsuspecting users during its Street View mapping project. Last year, the White House proposed a privacy bill of rights to give consumers greater control over how their personal data is used.
(Read More: 10 Ways Companies Get Hacked)
Mr. Acquisti has been at the forefront, testifying in Congress and conferring with the F.T.C. David C. Vladeck, who until recently headed the agency's Bureau of Consumer Protection, said Mr. Acquisti's research on facial recognition spurred the commission to issue a report on the subject last year. "No question it's been influential," Mr. Vladeck said of Mr. Acquisti's work.
Companies, too, are interested; Microsoft Research and Google have offered Mr. Acquisti research fellowships. Over all, his research argues that when it comes to privacy, policy makers should carefully consider how people actually behave. We don't always act in our own best interest, his research suggests. We can be easily manipulated by how we are asked for information. Even something as simple as a playfully designed site can nudge us to reveal more of ourselves than a serious-looking one.
"His work has gone a long way in trying to help us figure out how irrational we are in privacy related decisions," says Woodrow Hartzog, an assistant professor of law who studies digital privacy at Samford University in Birmingham, Ala. "We have too much confidence in our ability to make decisions."
This is perhaps Mr. Acquisti's most salient contribution to the discussion. Solutions to our leaky privacy system tend to focus on transparency and control — that our best hope is knowing what our data is being used for and choosing whether to participate. But a challenge to that conventional wisdom emerges in his research. Giving users control may be an essential step, but it may also be a bit of an illusion.
If iron ore was the raw material that enriched the steel baron Andrew Carnegie in the Industrial Age, personal data is what fuels the barons of the Internet age. Mr. Acquisti investigates the trade-offs that users make when they give up that data, and who gains and loses in those transactions. Often there are immediate rewards (cheap sandals) and sometimes intangible risks downstream (identity theft). "Privacy is delayed gratification," he warned.
Mr. Acquisti, lean and loquacious, grew up in Italy. His father, Giancarlo, was a banker by profession and a pianist on the side. Mr. Acquisti inherited his father's passion for music; last year he helped him write an opera about Margherita Luti, the woman believed to be the painter Raphael's lover and muse. Mr. Acquisti's other passion is motorcycle racing — he rides a red Ducati — though the pursuit of tenure, which he acquired last year, has lately kept him off the racing circuit.
(Read More: Chinese Espionage on the Rise in US, Experts Warn)
He earned a bachelor's degree in economics in Rome and master's degrees in the subject from Trinity College in Dublin and the London School of Economics, and he became interested in the economics of privacy while studying for a doctorate in the interdisciplinary School of Information at the University of California, Berkeley.
He describes himself as an early adopter of technology. He dabbled in programming in his youth and was an early and avid user of Friendster and Second Life. He had planned to study the economics of artificial intelligence.
But as the Web matured and became more commercialized, he grew increasingly concerned about Web services that demanded real names. He questioned why companies should track the online behavior of users in order to tailor their ads.
These concerns led him to his one and only foray into a business enterprise. In 2002, with a pair of fellow graduate students at Berkeley, he made a cryptographic tool that would allow people to make purchases anonymously from e-commerce sites. He quickly realized, however, that even though consumers claimed to want privacy, they didn't want to pay for it. The start-up failed. His interest in privacy economics deepened.
To think about privacy more clearly, he argues, technologists need to understand human behavior better. With that end in mind, he will teach next fall in a new, interdisciplinary one-year master's program at Carnegie Mellon called privacy engineering.
"The technologist in me loves the amazing things the Internet is allowing us to do," he said. "The individual who cares about freedom is concerned about the technology being hijacked, from a technology of freedom into a technology of surveillance."
Early in his sojourn in this country, Mr. Acquisti asked himself a question that would become the guiding force of his career: Do Americans value their privacy?
(Read More: Luring Young Web Warriors Is a Priority--and a Game)
At Carnegie Mellon, where he landed in 2003, he investigated the question with Facebook users. He started tracking a cohort of more than 5,000 people, most of them undergraduates at the time. He noticed that although people revealed more and more of their personal history — responding to Facebook's prompts about whether, say, they had just had a baby or had voted — they were also restricting who could see it. Over time, they were, on the whole, less likely to let "everyone" see their date of birth, for instance, and what high school they had attended.
Experiments like this have their limits and are open to different interpretations. This study, for instance, focused largely on college undergraduates who may have become cautious about who could see information about them as they approached graduation and prepared to enter the job market. But the Facebook study suggested at least that some people valued their privacy enough to seek out the social network's evolving settings and to block strangers from seeing what they had posted.
Aiming to learn how consumers determine the value of their privacy, Mr. Acquisti dispatched a set of graduate students to a suburban mall on the outskirts of Pittsburgh. To some shoppers, the students offered a $10 discount card, plus an extra $2 discount in exchange for their shopping data. Half declined the extra offer — apparently, they weren't willing to reveal the contents of their shopping cart for a mere $2.
To other shoppers, however, the students offered a different choice: a $12 discount card and the option of trading it in for $10 if they wished to keep their shopping record private. Curiously, this time, 90 percent of shoppers chose to keep the higher-value coupon — even if it meant giving away the information about what they had bought.
Why such contradictory responses?