The oft-cited privacy paradox is the perceived disconnect between individuals’ stated privacy expectations, as captured in surveys, and consumer market behavior in going online: individuals purport to value privacy yet still disclose information to firms. The goal of this paper is to...

Privacy policies are essential to the notice-and-choice approach to online privacy in the United States. And yet these policies are unreadable, inconspicuous, and hard to understand. And, as I discuss in other scholarship, privacy notices are designed in ways that make their substance even...

A growing chorus of scholars, privacy professionals, and policymakers think that individual rights of control—rights to access, correct, and delete data, as well as rights to opt out of tracking and to humans in the loop of automated decision-making—are effective means of regulating the...

Scholars and commentators often argue that individuals do not care about their privacy, and that users routinely trade privacy for convenience. This ignores the cognitive biases and design tactics platforms use to manipulate users into disclosing information. This essay highlights some of those...

Design configures our relationship with a space, whether offline or online. In particular, the design of built online environments can constrain our ability to understand and respond to websites' data use practices or it can enhance agency by giving us control over information. Design,...

Privacy by design is about making privacy part of the conception and development of new data collection tools. But how should we interpret “privacy by design” as a legal mandate? As it transitions from an academic buzzword into binding law, privacy by design will, for the first time, impose...