There are many answers to the so-called privacy paradox but the simplest is the analogy to the environment. Why do people say they care but then not do much? Because they understand what many experts don't: individual action feels overwhelming and collective action is needed.
When given the opportunity for collective action on privacy, people are eager to take it. The latest example is the California Privacy Rights Act. https://www.brookings.edu/blog/techtank/2020/11/17/by-passing-proposition-24-california-voters-up-the-ante-on-federal-privacy-law/
How long would it take to make informed privacy decisions about all the apps we use? More time than we spend using those apps. This has been well known for a long time, yet some scholars insist that people's refusal to waste their time is a "paradox". https://www.npr.org/sections/alltechconsidered/2012/04/19/150905465/to-read-all-those-web-privacy-policies-just-take-a-month-off-work
For a detailed model of privacy regulation inspired by environmental regulation, see "Regulating Mass Surveillance as Privacy Pollution: Learning from Environmental Impact Statements" by @mfroomkin. https://repository.law.miami.edu/cgi/viewcontent.cgi?article=1062
I call for a study the privacy paradox paradox, which is the tendency of researchers to assert that there is a privacy paradox in spite of all the evidence to the contrary.
Sorry for the broken link to the privacy regulation paper. Here's the correct one: https://repository.law.miami.edu/cgi/viewcontent.cgi?article=1062&context=fac_articles
(Link was broken because I've gotten into the habit of reflexively stripping URL parameters before sharing links to prevent tracking. Usually a good thing to do!)
(Link was broken because I've gotten into the habit of reflexively stripping URL parameters before sharing links to prevent tracking. Usually a good thing to do!)