DUP: To Share Or Not To Share

To share or not to share What consumers really think about sharing their personal information By Gina Pingitore, Vikram Rao, Kristin Cavallaro, and Kruttika Dwivedi How willing are consumers we surveyed more than 8,500 consumers in six different to share their data? countries1 on how they feel about sharing personal infor- mation with businesses, comparing their answers with 2 It’s no secret that many companies rely heavily on con- equivalent data collected in 2012 and 2014. Here are sumer-generated data to inform many activities, from the highlights of what we found. product development and strategic planning to targeted marketing campaigns. When the information is used Have consumer privacy effectively, however, it is the consumer who may ulti- concerns changed over the mately benefit, as it can enable companies to enhance the customer experience and provide innovative prod- last decade? ucts and services. But how willing are consumers to pro- vide their information, and what concerns do they have Data security remains a hot-button issue, with a variety about sharing and protecting it? In partnership with of well-known and respected companies reporting that SSI, a global provider of data solutions and technology the data of more than 250 million of their consumers were stolen or compromised in 2014 alone.3 for consumer and business-to-business survey research, As connected 1

To share or not to share What consumers really think about sharing their personal information products become more common, many industry observ- some people’s level of concern can decrease instead of ers expect consumer concerns over data security to rise only going up—providing companies with an opportu- further. For example, emerging cyber risks—such as a nity to build consumer trust. hacker being able to control a heart monitor—continue to rattle the health care industry and make headlines.4 WHAT CAN COMPANIES DO TO Given the ever-present threat that their information may REASSURE CONSUMERS? fall into the wrong hands, it’s not surprising that 81 per- Our study finds that while consumers state that they cent of our US respondents feel they have lost control want more protection and security, the reality is that over the way their personal data are collected and used they may be more willing to provide their personal infor- (figure 1). What is surprising, though, is that—across the mation if companies: world—this sense of losing control has actually returned to a level close to what it was in 1999 after spiking in • Are transparent about how they intend to use 2014. In fact, the latter seemed to be a watershed year consumer data for data hacking and cybersecurity breaches, close • Allow consumers to easily opt out of data sharing on the heels of Edward Snowden’s 2013 leak of classi- fied National Security Agency (NSA) documents to the • Provide brief and readily understandable privacy Guardian. policies and agreements With developments such as the repeal of protections requiring Internet service providers to obtain permission Age matters—and so does the from consumers before sharing personal data, concerns perception of receiving value around the collection and use of personal data remain high. However, the reversion to 2014 levels suggests that Considering how many feel that they’ve lost control of their own data, one might think that some consum- Figure 1. Having spiked in 2014, ers prefer not to share information with anyone at all. consumer concerns about data However, most appear to be at least somewhat more collection and usage have returned open; for instance, more than two-thirds of our respon- to previous levels dents were willing to share social media activity with Percentage of surveyed US consumers that agreed family and friends. More interestingly for companies, US or strongly agreed with the statement, consumers’ willingness to share certain information— “Consumers have lost control over how personal specifically, browsing history and social media activity— information is collected and used by companies.” with companies with whom they do business has more than doubled since 2014 (figure 2). 90% A closer look shows that this willingness to share infor- mation with companies varies by age. While approxi- 80% 82% 81% mately half the consumers in each age group say they sometimes provided information online, younger con- sumers surveyed were more likely to provide fake infor- mation on websites than older consumers. Younger generations also take more protective actions, such as adjusting privacy settings on their mobile devices, than older generations (figure 3)—which could also explain 1999 2012 2014 2016 why Gen Z expressed the greatest feeling of control over their data. Sample size: 2,000 (1999), 5,000 (2012), 4,234 (2014), Across the board, consumers surveyed also appear more 1,538 (2016). Source: 1999, 2012, 2014: J. D. Power and Associates/ willing to share data when they feel they get some value in SSI consumer survey; 2016: Deloitte/SSI 2016 return. Seventy-nine percent of our respondents agreed consumer survey. that they would be willing to share their data if there Deloitte University Press | dupress.deloitte.com 22

To share or not to share What consumers really think about sharing their personal information Figure 2. Consumers have become more open to sharing certain information with businesses Percentage of US respondents that said that they would be willing to share these kinds of information with “companies whose products or services I purchase.” 2012 6% 2.1x 2014 7% increase 2016 15% 2012 7% 2.4x 2014 5% increase 2016 12% Website activity Social postings Sample size: 5,000 (2012), 4,234 (2014), 1,538 (2016). Source: 2012, 2014: J. D. Power and Associates/SSI consumer survey; 2016: Deloitte/SSI 2016 consumer survey. Deloitte University Press | dupress.deloitte.com Figure 3. Younger consumers take more protective action Percentage of US respondents who agreed that they have taken action in last 12 months “due to concerns over data privacy.” 17% Adjusted privacy 25% settings on my mobile phone 25% 33% 18% Adjusted privacy 22% settings on 24% social media 26% 9% Provided fake 10% information to companies 13% 19% Boomers Gen X Gen Y Gen Z Sample size: 374 (Boomers), 306 (Gen X), 558 (Gen Y), 301 (Gen Z). Source: Deloitte/SSI 2016 consumer survey. Deloitte University Press | dupress.deloitte.com 33

To share or not to share What consumers really think about sharing their personal information • Offer valuable benefits to those consumers who choose to share data • Customize the organization’s data-gathering strategy to different age segments Consumers don’t forgive was a clear benefit for them. This means that compa- and forget nies should consider thinking about giving consumers a return on data.5 Whether it is something that entertains, While the consumers we surveyed are more willing to informs, or rewards the consumer, companies should share data if they see some benefits, they won’t hesi- understand that many consumers may provide informa- tate to take action against companies involved in a data tion in exchange for something that benefits them. breach, whether they’ve personally experienced a breach or heard about it in the media. On average, one in four WHAT CAN COMPANIES DO TO consumers will take cautionary actions after hearing of ENCOURAGE CONSUMERS TO a breach to digitally protect themselves and avoid future SHARE DATA MORE FREELY? data breaches. While industry observers have long sus- pected as much, this survey is the first time we have The good news from these results is that the consumers heard this directly from consumers. surveyed appear increasingly willing to share data with companies—if there’s something in it for them. Here’s The actions that consumers take in these situations can what organizations can do: range from cautionary, such as disabling cookies or not downloading certain apps, to more extreme puni- • Make it easy for consumers to choose what they share tive actions, such as not purchasing products (figure 4). or do not share While punitive actions may more directly affect compa- nies, cautionary actions can also hinder companies from building consumer trust and offering better solutions. Figure 4. Consumers are unforgiving when it comes to data breaches Percentage of US respondents who agreed that they have taken action in last 12 months “due to concerns over data privacy.” Disabled cookies 28% Paid close attention to privacy agreements 26% Adjusted privacy settings on mobile phone 47% Deleted or did not download specific apps 64% Not visited or closed specific websites 27% Did not buy a certain product, or purchased 9% the same product from a different brand Cautionary actions Punitive actions Sample size: 1,538. Source: Deloitte/SSI 2016 consumer survey. Deloitte University Press | dupress.deloitte.com 4 4

To share or not to share What consumers really think about sharing their personal information WHAT CAN COMPANIES DO TO Consumers are less likely HELP KEEP CONSUMERS’ TRUST? than ever to complete • Enforce privacy measures to prevent breaches in the feedback surveys—thanks first place: to privacy concerns – Encrypt data at rest – Destroy consumer data when not needed Consumer surveys are typically an important, time- tested practice for companies seeking opinions on cur- • Systematically control the damage after a breach has rent products, potential line extensions, other new occurred by identifying causes and implementing offerings, and overall brand awareness. That’s why it’s remedies that hasten recovery:6 not great news for companies that many consumers are – Identify affected systems and isolate them increasingly rejecting market research survey requests: Fifty-five percent of our US respondents said they – Gather all available evidence, and analyze it to declined to take a survey over the past year. determine cause, severity, and impact – Document how the incident came to light— Yet, at the same time, many consumers continue to say who reported it and how he or she discov- that companies should be soliciting their feedback, with ered the problem—and report findings to 75 percent of our respondents saying companies should relevant stakeholders do so twice a year. If the majority of consumers are open to companies asking for their opinion, why is the survey – Assess the possibility of insider involvement rejection rate so high? – Strengthen network security and Privacy concerns were the most common reason—by a improve protocols considerable margin—that our US respondents gave for – Enhance monitoring to mitigate the risk of declining to participate in a survey (figure 5). Among future breaches consumers for whom privacy was not the main reason, • Develop an integrated, enterprise-level approach to motives for deciding not to take a survey again differed data governance, and ensure the leader of this initia- by age group. Younger consumers tended to survey tive is a C-level executive requests more often than older consumers because they Figure 5. Consumers are less likely to take surveys than in the past, mainly due to privacy concerns During the past 12 months, did you Why did you decline to participate in a survey? decline to participate in any survey? Percentage of US respondents that declined to participate in a survey 52% Privacy concerns 49% 47% 55% 2012 2014 2016 9% Inadequate incentive 17% Didn’t have the time 18% Wasn’t interested in the topic Sample size: 5,000 (2012), 4,234 (2014), 1,538 (2016). Source: 2012, 2014: J. D. Power and Associates/SSI consumer survey; 2016: Deloitte/SSI 2016 consumer survey. Deloitte University Press | dupress.deloitte.com 55

To share or not to share What consumers really think about sharing their personal information weren’t interested in the topic or didn’t have the time, while older consumers were more likely than younger ones to be put off by a request to download an app or software. Another possible reason for the higher survey rejection rate is that consumers may be suffering from “survey fatigue,” partly because of the exponential rise in survey requests in the Internet era. One survey firm conducts about a million surveys per month, while another con- ducts 60 million surveys every year—a mind-boggling 7 175,000 per day. This possibility can make it all the more important for consumer businesses to craft their • Offer survey incentives: surveys carefully, offer respondents something of value in return, and explore alternative ways of gathering – Give a token award to consumers who complete information from consumers. That said, with privacy the survey being the main sticking point, nothing can replace the – Communicate potential outcomes—such as ways need to reassure consumers that their information will the survey data are used to improve offerings— be protected and used appropriately when companies to consumers ask them to take surveys. WHAT CAN COMPANIES DO TO ENCOURAGE Don’t be complacent CONSUMERS TO TAKE SURVEYS? While our results indicate that younger generations are • Improve survey design: currently less concerned about data privacy and more – Limit the number of surveys you ask your con- willing to share data, that doesn’t mean that privacy sumers to take concerns will become less of an issue for companies as younger consumers enter the job market, build financial – Limit the number of questions to 20 or fewer equity, and make more financial transactions online. If consumer-related data breaches continue or increase, – Keep questions easy to understand and quick younger consumers may take even greater measures to to answer protect their personal information—making the efforts – Ensure that the survey can run on any device of companies to build a relationship with them that much harder. • Modify survey content: The bottom line: An important way companies can build – Focus questions more on the transaction rather and maintain consumer trust is to both put in place pro- than the consumer’s personal details active data security and privacy measures and to engage – Request feedback on how to improve data privacy in a transparent, ongoing dialogue with consumers on data privacy. 6

To share or not to share What consumers really think about sharing their personal information ENDNOTES 1. China, Germany, the United States, Japan, the Netherlands, and Australia. 2. Unless otherwise specified, all survey results described in this report apply to US respondents only. 3. Bill Hardekopf, “The big data breaches of 2014,” Forbes, January 13, 2015, https://www.forbes.com/sites/moneybuild- er/2015/01/13/the-big-data-breaches-of-2014/#12b8d64eefe6, accessed January 13, 2015. 4. “U.S. warns of security flaw that could allow hackers control of heart devices,” CBS News, January 10, 2017, http://www. cbsnews.com/news/cybersecurity-flaw-that-could-allow-hackers-control-of-heart-devices-united-states-warns/. 5. A relatively new metric, return on data (ROD) is a percentage derived by first assessing the gain to the consumer from the data, then subtracting the cost of the data, and then dividing this difference by the cost of the data. ROD gives researchers the ability to assess the potential investment in data analytics. To learn more, see Dorin Selz, “Return on data—ROD,” January 20, 2016, https://squirro.com/2016/01/20/return-on-data/. 6. Deloitte, Cyber crisis management: Readiness, response, and recovery, 2016, https://www2.deloitte.com/content/dam/De- loitte/global/Documents/Risk/gx-cm-cyber-pov.pdf. 7. David Wheeler, “The rising revolt against customer surveys,” The Week, September 30, 2015, http://theweek.com/ articles/577882/rising-revolt-against-customer-surveys. 7

To share or not to share What consumers really think about sharing their personal information AUTHORS GINA PINGITORE Gina Pingitore is managing director of Deloitte Services LP’s Center for Industry Insights. Based in Los Angeles, Pingitore is responsible for developing and driving consumer and industrial products (C&IP) sector research initiatives, managing the development of the Center’s eminence and thought leadership, and supporting C&IP industry leadership. She holds a PhD in applied social psychology from Loyola University in Chicago and a master’s in clinical psychology from Edinboro University, and is a licensed clinical psychologist. VIKRAM RAO Vikram Rao is a senior manager in Deloitte’s Advisory business with over 15 years of experience. He is a leader in Deloitte’s Cyber Risk Services practice, which helps clients to be Secure.Vigilant.Resilient.™ He has helped Fortune 100 companies in various consumer business sectors with evaluating their cyber risks and advised executives on investment strategies to bolster their cybersecurity posture. KRISTIN CAVALLARO Kristin Cavallaro is SSI’s knowledge and data analysis specialist, focusing on new market and product developments to ensure, maintain, or improve data quality and participant experience. In this role, she leverages her strategic view to conduct research on new methodology, including consumer privacy, blending, source consistency, and partner certifications. Cavallaro has a master’s degree in mathematics with a concentration in statistics as well as an MBA. She has a love for data both big and small, and is con- stantly looking for new ways to apply data-related methods to improve sampling and survey research. KRUTTIKA DWIVEDI Kruttika Dwivedi, a senior quantitative analyst with the Deloitte Center of Industry Insights, has close to five years of experience in advanced data modelling and statistical analysis. She specializes in busi- ness research projects focused on consumer-facing industries and has contributed to a number of research studies in the consumer and industrial products space. With a strong affinity for analysis and visualization, she has been able to successfully help clients find innovative solutions. 8

To share or not to share What consumers really think about sharing their personal information ACKNOWLEDGEMENTS The authors would like to thank Marcello Gasdia and Aijaz Shaik Hussain for their contributions to this project. ABOUT THE DELOITTE CENTER FOR INDUSTRY INSIGHTS The Deloitte Center for Industry Insights is the research division of Deloitte LLP’s Consumer and Industrial Products practice. The Center’s goal is to inform stakeholders across the consumer business and manufacturing ecosystem of critical business issues, including emerging trends, challenges, and opportunities. Using primary research and rigorous analysis, the center provides unique perspectives and seeks to be a trusted source for relevant, timely, and reliable insights. To learn more, visit www. deloitte.com/us/cb and www.deloitte.com/us/manufacturing. ABOUT SSI Celebrating 40 years in business, SSI is the premier global provider of data solutions and technology for consumer and business-to-business survey research. SSI reaches participants in 90+ sample coun- tries via Internet, telephone, mobile/wireless, and mixed-access offerings. SSI staff operates from 40 offices and remote staff in over 20 countries, offering sample, data collection, CATI, questionnaire design consultation, programming and hosting, online custom reporting, and data processing. SSI’s employees serve more than 3,500 customers worldwide. Visit SSI at www.surveysampling.com. Deloitte offers a complete portfolio of services to help complex organizations establish their cyber risk ap- petite, design and implement Secure.Vigilant.Resilient. programs, and assist in the ongoing management, maintenance, and adaptation of their programs as the business and threat environments change. Contact the authors for more information, or read more about our cyber risk services at https://www2.deloitte.com/ us/en/pages/risk/solutions/cyber-risk-services.html. 9

To share or not to share What consumers really think about sharing their personal information CONTACTS Gina Pingitore Vikram Rao Kruttika Dwivedi Managing director Senior manager Senior analyst Center for Industry Insights Deloitte & Touche LLP Center for Industry Insights Deloitte Services LP +1 617 437 3950 Deloitte Support Services India +1 213 553 3093 [email protected] Pvt. Ltd. [email protected] [email protected] +1 615 718 1384 [email protected] 10

Follow @DU_Press Sign up for Deloitte University Press updates at www.dupress.deloitte.com. About Deloitte University Press Deloitte University Press publishes original articles, reports and periodicals that provide insights for businesses, the public sector and NGOs. Our goal is to draw upon research and experience from throughout our professional services organization, and that of coauthors in academia and business, to advance the conversation on a broad spectrum of topics of interest to executives and government leaders. Deloitte University Press is an imprint of Deloitte Development LLC. About this publication This publication contains general information only, and none of Deloitte Touche Tohmatsu Limited, its member firms, or its and their affiliates are, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your finances or your business. Before making any decision or taking any action that may affect your finances or your business, you should consult a qualified professional adviser. None of Deloitte Touche Tohmatsu Limited, its member firms, or its and their respective affiliates shall be responsible for any loss whatsoever sustained by any person who relies on this publication. About Deloitte Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. In the United States, Deloitte refers to one or more of the US member firms of DTTL, their related entities that operate using the “Deloitte” name in the United States and their respective affiliates. Certain services may not be available to attest clients under the rules and regulations of public accounting. Please see www.deloitte.com/about to learn more about our global network of member firms. Copyright © 2017 Deloitte Development LLC. All rights reserved. Member of Deloitte Touche Tohmatsu Limited