Why Uncertainty Can Make Personalization Less Attractive
The subject here is how people respond when an AI-personalization service may expose them to a later personalized price. The question is whether a clearly measured chance of a data leak has the same effect as an uncertain range of possible chances; the answer helps us read adoption, trust, and bargaining as different responses to the same data-to-price mechanism.
The distinction comes from an online experiment with 610 participants. The researchers did not change the basic need to share data in the personalized condition. Instead, they changed the information environment around a possible leak and compared a privacy threat with an economically equivalent but privacy-neutral surcharge. That design lets us ask a more precise question than whether people “care about privacy.”
Risk Is a Number; Ambiguity Is a Range
In the experiment’s Risk condition, participants were told that the probability of a data leak was 30%. They knew the chance, even though they could not know whether a leak would happen to them. In the Ambiguity condition, they knew only that the probability lay somewhere between 10% and 50%. The outcome was still a possible leak, but its likelihood was not pinned to one number.
That difference changes the decision a participant has to make. With a known probability, someone can compare a defined expected loss with the benefit of personalization. They may dislike the risk, but the calculation has a visible input. With an interval, they must also decide where inside the interval to place their belief. A cautious person may act as if the upper end is more plausible; another person may assume the lower end. The uncertainty is not only about what will happen. It is about how to interpret the chance that it will happen.
The study added a Neutral condition to separate the monetary consequence from the privacy meaning. Participants in this condition shared the same demographic information used in the sensitive-data treatment, but there was no data leak. Instead, using the personalized service entered them into a lottery that imposed a 30-Coin surcharge with the same probability structure. In the privacy conditions, a leak gave a later pricing algorithm access to personal information and caused the price increase. In the neutral condition, the increase came from a random draw.
This is a useful comparison because an identical amount of money can represent different relationships. A random surcharge says that the participant was unlucky. A leak says that information about the participant became available to another pricing system and was used against them. The experiment holds the monetary stakes as comparable while changing what caused the loss.
The third dimension concerned the kind of data shared. In the Preference Data condition, participants provided information about time, risk, and social preferences. In the Sensitive Data condition, they provided demographic information such as gender, age, and income range. The distinction made it possible to see whether the threat mattered only when the data looked identity-related, or whether the broader fact of personal information being exposed was enough.
The setup was deliberately concrete. Participants first considered a standard product basket or a more valuable basket personalized by an AI system. The standard basket paid 20 Coins; the personalized basket paid 35. To use the AI option, participants had to submit the specified personal information. They then faced a bargaining stage in which an algorithm could make a more aggressive price offer after a leak. Later, they could bid for a perfectly trusted privacy label that would remove the leak risk in a second round.
The experiment therefore connected four decisions without treating them as one outcome: whether to use personalization, how to bargain with a pricing algorithm, how much to pay for certainty, and how to react after learning whether a leak occurred. The design does not reproduce every real privacy incident. It creates a controlled test of how the information and meaning of the downside shape behavior.
The diagram should be read as a conditional result, not a ranking of data types. The experiment found a clear information-environment contrast, but the descriptive difference between Preference Data and Sensitive Data was not statistically significant. The most stable lesson is the difference between a known probability and an ambiguous one.
The Adoption Result Is Conditional, and the Other Outcomes Do Not Follow It Automatically
The direct adoption result is striking because it includes a null effect. When participants knew the leak probability was 30%, about half chose AI personalization across the neutral and privacy conditions. The researchers found no measurable difference in use caused by the privacy threat. The expected monetary benefit of the personalized basket was positive in the setup, but the privacy framing did not produce a detectable additional reduction relative to the neutral lottery.
That does not mean the participants were indifferent to privacy. It means that, under this particular known-risk presentation, the threat did not change the observed adoption decision. The authors interpret the stable use rate as consistent with people responding to the defined risk differently from an ambiguous one, rather than treating every privacy concern as a reason to avoid the service.
The Ambiguity conditions produced a different pattern. Fifty-six percent of participants in the neutral condition chose personalization, compared with 42% in the Preference Data condition and 34% in the Sensitive Data condition. The privacy threat reduced adoption when the probability was not clearly quantifiable. The lower percentage for sensitive data is descriptively suggestive, but the reported difference between the two privacy data types was not statistically significant (χ² = 1.36, p = 0.24). It would be too strong to conclude that demographic data reliably deter personalization more than preference data.
The direct observation is therefore narrower and more useful: uncertainty about the probability of a leak can make a data-dependent service less attractive, while a known probability did not do so in this experiment. That finding changes how we interpret a warning. A disclosure that says “your data may be used in pricing” leaves the participant to supply a probability and a consequence. A disclosure that gives a credible, understandable probability supplies more of the information needed for a decision. Whether a real disclosure can achieve that clarity is a separate question.
The experiment also measured what the leak meant to participants. After a leak—or the neutral lottery draw—participants reported feelings such as violated trust, betrayal, and having made a mistake. People in the privacy conditions reported substantially stronger betrayal concerns than people facing the neutral lottery. Participants who used AI personalization tended to report lower betrayal than non-users, while stronger privacy concerns were associated with stronger betrayal feelings.
These measures add an important layer, but they need careful interpretation. The neutral condition helps separate the economic loss from the meaning of a privacy violation, and the difference is consistent with a non-monetary privacy-related disutility. Yet the researchers did not manipulate one specific emotional, reputational, or social harm. The leak was artificial and was routed to a pricing algorithm, not to a hostile human who could use the information in many unpredictable ways. The result supports the claim that privacy meaning mattered in this design; it does not quantify the full harm of a real breach.
The willingness-to-pay result shows a different response to the same uncertainty. Participants could bid for a privacy label that was assumed to be perfectly informative and fully trusted. The label would reduce the leak probability to zero in a second round. The theoretical benchmark for the bid was 15 Coins. Average bids were close to that benchmark, but AI users bid 17.7 on average while non-users bid 13.6. In other words, people who preferred personalization were willing to pay more for an assurance that made personalization safe.
The result is counterintuitive only if adoption and assurance are assumed to be opposites. Someone may choose a personalized service because its benefit is valuable and still pay for a reliable way to remove the downside. A person who avoids the service may value the label less because they are not planning to use the service. The label can therefore be an information good: its value comes from resolving uncertainty that affects a later choice.
Actual experience also mattered. After learning that a leak had occurred, participants increased their bids for the label in the privacy conditions: the average increase was 3.65 Coins for Preference Data and 2.86 for Sensitive Data. The neutral lottery produced a much smaller change, a decrease of 0.23 Coins. This pattern suggests that a concrete privacy event can update assurance demand more strongly than an abstract, economically equivalent possibility.
But the label result is an upper-bound case, not a guarantee about real certification. In the experiment, the label was perfectly trusted, perfectly informative, and connected to an immediate, simple consequence. Real disclosures can be incomplete, delayed, difficult to compare, or disconnected from actual practice. A badge that merely signals safety without making its verification credible may not buy the same reduction in uncertainty.
Bargaining provides yet another outcome. In the experiment, a leak allowed the pricing algorithm to use personal information and make a more aggressive offer. Participants did not, however, reject algorithmic offers more often simply because a privacy leak was possible. Rejection rates were broadly comparable across the conditions. The privacy threat did not create clear social retaliation against the algorithm.
Ambiguity still shaped bargaining posture. Under ambiguous information, participants who had used AI personalization bargained less aggressively and were willing to accept higher algorithmic prices, or a lower share of the surplus, than they were under the clearer-risk setting. The paper interprets this as uncertainty affecting negotiation strategy rather than the leak threat alone changing rejection behavior. Adoption and bargaining can thus diverge: a person may be less likely to enter a personalized interaction, yet a person who enters may accept a worse downstream offer when the situation is hard to evaluate.
The study’s limitations define how far these findings travel. The sample consisted of English-speaking participants recruited through an online crowdsourcing platform, not a representative cross-section of all consumers. Participants always shared the required data in the personalized condition, so the study isolates reactions to a possible leak rather than the independent discomfort of initial disclosure. The consequences were immediate and deliberately simple, while real leaks can occur later and expose people to many kinds of misuse. Some interaction effects, including differences between the two data types, may also have been underpowered.
The experiment is therefore evidence about a mechanism, not a universal behavioral law. It shows that information precision can change the attractiveness of a data-dependent service, that privacy meaning can matter beyond an equivalent monetary lottery, that credible assurance can be valuable, and that uncertainty can influence bargaining without producing simple retaliation. It does not tell us that every user will avoid ambiguous personalization, that every label will work, or that a privacy threat always changes the price a buyer ultimately pays.
The practical interpretation is to keep the outcomes separate. Ask first whether the buyer adopts the service. Ask next whether the buyer understands the chance and consequence of a changed offer. Then ask whether they can obtain credible assurance or protect their bargaining position. These questions describe different points in the same relationship. Bringing them together—benefit, exposure, and the precision of what is known—gives us a better way to judge a personalization choice than a single privacy-attitude score.