How have consumers’ attitudes and behaviours towards data protection changed since 2018?
Last year Which? undertook consumer research as part of our policy project ‘Control, Alt or Delete’ which explored consumer understanding of, and attitudes towards, the collection and use of data. It found that consumers, on the whole, do not understand the data ecosystem and are unpleasantly surprised when they discover the range of inferences that can be made from the data they share online. Despite this, they often feel powerless to protect their data and do not necessarily show behaviours which are congruent with their attitudes - for example failing to employ good data protection practices to reflect the concern that they feel about the issue.
One year on, data is just as much a priority topic for organisations - from Government and regulators to policy-makers and commercial organisations. In the last year, the Government has set up its advisory body called the Centre for Data Ethics and Innovation (CDEI) to investigate and advise on how the benefits of data-enabled technology are maximised. The General Data Protection Regulation (GDPR) was introduced on 25th May 2018 and Facebook has rolled out a global advertising campaign telling consumers that “From now on, Facebook will do more to keep you safe and protect your privacy”. But have the percentage of consumers who are ‘concerned’ or ‘anxious’ about data collection and use changed? Have more people become ‘tolerant’ or ‘liberal’ in their attitudes towards their data?
The “Data Dozen”
In our 2018 research, we identified 12 distinct groups of consumers, typified by their attitudes and behaviours regarding the collection and use of their data. The segmentation highlighted that attitudes and behaviours are not always consistent with one another. For example, one group ("Concerned Maximisers") express worry about data collection and use, but also take potentially risky shortcuts to increase convenience when sharing their data online.
The four attitudinal groups ranged from those who were more relaxed about their data - the “Tolerant” and “Liberal” groups - to those who were more wary of the way their data was collected and used - the “Anxious” and “Concerned” groups. Nested within these four attitudinal groups are five different behavioural groups. For example, “Maximisers”spend a lot of time online and look for ways to make sharing their data more convenient, and “Activists”actively seek out ways to protect their data, perhaps by checking and changing privacy settings.
In 2019, we completed a follow-up survey in order to explore whether the proportion of people fitting into these different groups has changed since 2018.
Populus, on behalf of Which?, interviewed 2067 UK adults by phone between 11th and 23rd April 2019. Data were weighted to be demographically representative of the UK population.
How has the population changed over the last year?
The proportion of people in the “Tolerant” attitudinal group has fallen significantly, with the “Anxious” and “Concerned” groups now accounting for much larger shares of the population
The “Tolerant” group had previously been the largest of all 4 groups, at 35% of the sample, but now it makes up just 21%, a smaller proportion than both the “Concerned” (38%) and “Anxious” (33%) groups.
These latter two are the groups of people who are typically more worried than the other segments about how their data is collected and used. These two groups now collectively account for 71% of the population, compared to 52% in 2018.
The “Tolerant” and “Liberal” groups, characterised as being fairly comfortable with their data being collected and used, now collectively make up 29% of the population, a decrease from 2018 (48%).
This shift indicates a significant rise in concern around issues related to personal data protection. Although it is difficult to determine what has lead to this increase, it follows high-profile news stories regarding these issues since the original survey in early 2018. These include the Cambridge Analytica scandal in March 2018 and the introduction of GDPR in May 2018.
Looking at changes in classification by behaviour group, the greatest proportion of people now fall into the “Maximiser” group
We also looked at any shifts that had taken place in the behavioural groups that are nested within these attitudes. There has been an increase in the proportion within all segments who fit into the “Maximiser” group. These are people who are using shortcuts afforded to them online, for example saving bank details and logging in using social media, both arguably actions that could put their data at more risk.
However, we have also seen a decline in the proportion of people falling into the “Casual” group, which is now the smallest of all the behavioural groups. These are people who are online fairly often and are not particularly protective of their data when doing so. In addition, there has been a fall in the proportion of people in the “Browser” behavioural group, which are characterised as those with low online use, but unrestrictive in their data activities. Both of these may be linked to the general shift in the population towards more cautious data attitudes observed in the groups above.
Attitudes and behaviour towards data privacy remain inconsistent for some consumers.
An important finding of the 2018 segmentation was that attitudes and behaviours are not always aligned. This is evident in the 2019 findings too: for example, despite an increase in the proportion of people in the “Anxious” group, within this group there has also been an increase in people who are demonstrating potentially risky data behaviour, by using online shortcuts, such as saving passwords and bank details (“Maximisers”).
Similarly, whilst we have seen an increase in the size of both the “Concerned” and "Anxious" groups, there is not always a corresponding increase in people who are taking action to protect their data ("Protector" and "Activist" groups). For example, looking at those who have the most cautious attitude towards data privacy (the "Anxious" group), the proportion taking action to restrict what data is collected from them (the “Activist” group) has remained about the same.
Overall, this data suggests a significant shift in consumer attitudes towards data collection and use since our previous survey at the beginning of 2018. It appears that more consumers are worried about the way their data is used, with a lower proportion portraying a “Liberal” or “Tolerant” attitude. However, how this translates to behaviour presents a less clear picture. As consumers become more reliant on the use of online services, it appears that they are looking for ways to maximise convenience, even if this may sometimes mean engaging in practices that could compromise their data security.