EXPRESS: Navigating a Changing Privacy Landscape: The Effect of Data Requests on the Acquisition, Retention, and Deletion of Consumers’ Information

Privacy regulations, such as the General Data Protection Regulation (GDPR, Article 17) and California Consumer Privacy Act (CCPA), give consumers the right to request the deletion of their personal information. While researchers have begun to examine the implications of these laws, the effects of different data request options (to provide, keep, or delete information) on consumers’ personal information-sharing behavior have not been thoroughly studied. Drawing on prior work on autonomy, we investigate a new construct, ‘enactment autonomy.’ We demonstrate that data requests can alter perceptions of shared autonomy, influencing feelings of vulnerability and subsequent information-sharing behavior. Six experimental studies, including one behavioral study and a within-paper meta-analysis, provide support for the proposed data request effect, as well as boundary conditions related to perceived information sensitivity and the presence of a third party.