“I don't get it, but I accept it” Exploring uninformed consent to privacy policies: A neutralization perspective

Abstract

While registering or logging onto an online platform, users are required to carefully read a privacy statement and decide whether they give consent. Accepting privacy policies without reading them is common yet detrimental to data privacy. Theorizing it as a type of deviant behavior, this study leverages neutralization theory to understand users’ uninformed consent decisions. Through a review of neutralization theory, we identified and contextualized four relevant neutralization techniques: denial of responsibility, denial of injury, claim of normality, and claim of necessity. We focused on how these neutralization techniques could individually and collectively lead to uninformed consent to privacy policies. We conducted a cross-sectional survey with 985 Internet users. A multi-method approach combining structural equation modelling (CB-SEM) with fuzzy-set qualitative comparative analysis (Fs/QCA) confirmed the proposed individual and configurational effects, thereby answering how these neutralization techniques could individually and collectively influence uninformed consent decisions. These insights provide an important theoretical angle to understand why users accept privacy policies without reading the content. Practitioners can leverage these insights to design user-friendly privacy policies.