The notion of the privacy paradox is weaving its way through society, finding adherents left and right. Although it initially referred to the paradoxical situation that to protect people with certain private characteristics you need to register them,* most people know the privacy paradox as a label for the discrepancy between people claiming to want privacy and the supposed negligence with which they give private information away. For instance, the privacy paradox is used to describe how people who say they would not like to share personal data with just anyone freely, nevertheless maintain Instagram or TikTok accounts on which they publish a lot of their everyday behaviour, from their morning coffee to intimate late-night musings.
There are a good number of reasons why there is actually not much of a paradox in that latter situation. For instance, people do not actually get an opportunity to express their real data-sharing preferences when using social media: they have to make do with the restricted options in settings that social media platforms allow them. Another reason is that people do curate what they put on social media and what not, so their behaviour is not entirely out of line with their preferences. A third reason is that social media companies try their utmost best to keep it unclear to users what is really done with the personal data they gather: which data exactly they collect, with whom exactly they share information about their users, how exactly they use those data themselves, and for what exact purposes, and so on. As a user, you do not truly know what you are getting into when you put information about yourself on social media. In brief, this is not a paradox, but a conundrum.
If we are going to reinterpret the notion of the privacy paradox anyway, let’s look at another paradox: companies that claim to “value your privacy” but in actual practice do not care at all, or if they do value your privacy, it is because they can put a price tag on it.
A well-known large technology company that has made a marketing strategy out of privacy promises is Apple. The company’s ads carry the slogan: “Privacy. That’s iPhone.” Paradoxically, Apple’s practices speak an entirely different language. For example, it introduced an App Tracking Transparency framework for the operating system of the iPhone in 2021 that allows users to refuse data processing and sharing by apps in its App Store – but refusing Apple’s own user tracking is not on the table. In the years following the introduction of the ATT framework, while iPhone users massively refused tracking by apps, Apple more than tripled its share in advertising profits on the iPhone. After all, they were now the number one source of data on their users. Apple made billions in advertising income this way.
In my latest paper for the Privacy Studies Journal, I have detailed a method to analyse such practices. I argue in the paper that we should consider these practices as a form of discourse. Beyond the words that a company like Apple uses to convince us of its intentions, we need to study its actions, because a technology platform’s practices also communicate something and it may be something else than its words. Just like the social media settings that restrict how users can express their privacy preferences, the technological infrastructure of a large digital platform restricts the meaning of privacy for its users. In that respect, we need to remember that the users of the operating system for iPhones are not just consumers who have bought a smartphone, but also digital service providers, app developers, advertising companies, and others. All these users have to deal with the restrictions that Apple imposes on how privacy can be understood in practice within its environment. While Apple’s environment has been called a digital “walled garden”, when it comes to privacy I call it a “framed garden”, because it frames the meaning of privacy in a way that serves Apple best.
Apple’s competitors filed complaints with competition authorities, of course. Meta, the company that owns WhatsApp, Instagram and Facebook, was particularly unhappy, because already in the first year after the introduction of the ATT framework it lost around 10 billion dollars in advertising income. Not many iPhone users agreed to let Meta have their personal data. Meta does not run ads proclaiming it cares about your privacy, its CEO famously once claimed privacy is not a social norm anymore, and we have all heard about the various privacy scandals that Facebook has been embroiled in. Apparently, users do care as much about their privacy as they claim, when they get a choice and when they are informed about what happens.
In March 2025, the complaints against Apple’s ATT framework even led to a fine from the French Competition Authority of 150 million euros. The Authority took into account that although the intention to protect iPhone users’ privacy was in itself laudable, the ATT framework did not comply with European laws on the protection of personal data. The Authority did not go so far as to conclude that Apple probably never truly had the intention to protect users’ privacy but it does conclude that since this protection was not aligned with the law, it must have mainly served anti-competitive purposes.
The fine for Apple made news headlines, but not front pages. Apple denies the charges and continues to claim it is a privacy champion. Everything is relative, of course: as smartphone users we have the choice between iPhones, phones that have Google’s Android as an operating system, or no smartphone at all. Not great choices if you value your privacy but also still want to live in a society that is increasingly digitalizing and appifying. Even if you are informed, you do not get to express your real privacy preferences.
And so, the interpretation of the privacy paradox in which we, as users, are painted as inconsistent fools, persists. It is about time we turn the tables and address the real paradox.
* I have Prof. Irina Shklovski to thank for reminding me of this historical background of the privacy paradox.
Works consulted:
Bacchi, Carol, and Jennifer Bonham. “Reclaiming Discursive Practices as an Analytic Focus: Political Implications.” Foucault Studies, (April 30, 2014): 179–92, https://doi.org/10.22439/fs.v0i17.4298.
Greene, Daniel, and Katie Shilton. “Platform Privacies: Governance, Collaboration, and the Different Meanings of ‘Privacy’ in iOS and Android Development.” New Media & Society 20, no. 4 (2018): 1640–57.
Hadar, Irit, Tomer Hasson, Oshrat Ayalon, Eran Toch, Michael Birnhack, Sofia Sherman, and Arod Balissa. “Privacy by Designers: Software Developers’ Privacy Mindset.” Empirical Software Engineering 23, no. 1 (February 2018): 259–89. https://doi.org/10.1007/s10664-017-9517-1.
Hardy, Cynthia, and Robyn Thomas. “Discourse in a Material World.” Journal of Management Studies 52, no. 5 (2015): 680–96. https://doi.org/10.1111/joms.12113.
Kollnig, Konrad, Reuben Binns, Pierre Dewitte, Max Van Kleek, Ge Wang, Daniel Omeiza, Helena Webb, and Nigel Shadbolt. “A Fait Accompli? An Empirical Study into the Absence of Consent to Third-Party Tracking in Android Apps.” In Proceedings of the Seventeenth Symposium on Usable Privacy and Security (SOUPS 21), 181–96, 2021.
Kollnig, Konrad, Anastasia Shuba, Max Van Kleek, Reuben Binns, and Nigel Shadbolt. “Goodbye Tracking? Impact of iOS App Tracking Transparency and Privacy Labels.” In 2022 ACM Conference on Fairness, Accountability, and Transparency, 508–20.FAccT ’22. New York, NY, USA: Association for Computing Machinery, 2022, https://doi.org/10.1145/3531146.3533116.
McGuigan, Lee, Sarah Myers West, Ido Sivan-Sevilla, and Patrick Parham. “The after Party: Cynical Resignation in Adtech’s Pivot to Privacy.” Big Data & Society 10, no. 2 (July 1, 2023): 20539517231203665. https://doi.org/10.1177/20539517231203665.
Orlikowski, Wanda J., and Susan V. Scott. “Exploring Material-Discursive Practices.” Journal of Management Studies 52, no. 5 (2015): 697–705. https://doi.org/10.1111/joms.12114.
Pierson, Jo. “Digital Platforms as Entangled Infrastructures: Addressing Public Values and Trust in Messaging Apps.” European Journal of Communication 36, no. 4 (August 2021): 349–61. https://doi.org/10.1177/02673231211028374.
Plantin, Jean-Christophe, Carl Lagoze, Paul N Edwards, and Christian Sandvig. “Infrastructure Studies Meet Platform Studies in the Age of Google and Facebook.” New Media & Society 20, no. 1 (January 2018): 293–310. https://doi.org/10.1177/1461444816661553.