Why Companies Change Privacy Policies: A Principal-Agent Perspective

Companies often update their privacy policies, but it is unclear whether these updates strengthen or weaken user privacy. Using a principal-agent theoretical lens, we analyze over 200 changes to privacy policies of five prominent Internet companies over a period of fifteen years. We find that over time, privacy policy updates are more likely to weaken, rather than strengthen, user privacy on the Internet. Moreover, analysis of pilot data suggests that companies are more likely to update their privacy policies if they experience negative revenue growth over successive financial reporting periods. Since our results show that changes in privacy policies benefit companies at the expense of user privacy, we conclude that the principal-agent problem exists in the information privacy arena.