Abstract

Breaches of the security of personal data collected by firms are reported almost daily. Companies are under an increasing political pressure to notify individuals whose privacy as been breached. At the moment, we know virtually nothing about the behavioral impact of data breach notifications. We present the results of an experimental study designed to investigate how breach notifications change the individual’s propensity to provide sensitive personal information to firms. In contrast to the theory (where breach notifications have no behavioral effect), our main result shows that notifications induce a sub-group of individuals to disclose less information to a firm, i.e. those with personally sensitive information.