Chapter 2 shows the falseness of two ideas that underlie the central elements of privacy law: that people make fully rational privacy choices and that they don’t care about their privacy. These notions create a dissonance between law and reality, which prevents laws from providing meaningful privacy protections. Contrary to rationality, context has an outsized impact on our privacy decisions and we can’t understand what risks are involved in our privacy “choices,” particularly with AI inferences. The notion that we’re apathetic is prevalent in popular discourse about how much people share online and the academic literature about “the privacy paradox.” Dismantling the myth of apathy shows there’s no privacy paradox. People simply face uncertainty and unknowable risks. People make privacy choices in a context of anti-privacy design, such as dark patterns. In this process, we’re manipulated by corporations, who are more aware of our biases than regulators are.

Much of the research discussed previously will have relied on participants consenting to have data collected from their smartphone. However, smartphones continue to pose an inherent security risk within and beyond research. They also provide ways in which criminals can operate and communicate across larger networks. Despite the majority of devices holding large quantities of personal information, many people continue to ignore advice when it comes to securing their device. This is particularly problematic when it comes to carrying out tasks on unsecured networks. Malware can also gain access to a smartphone and compromise its function.

The popularity of smartphones provide another digital outlet for illegal data capture and this chapter will consider why, despite multiple security concerns, the majority of smartphone users and even large organisations are unable to recognise the importance of developing sound security practices. A second stand considers how psychologists and software developers are attempting to improve the security of existing devices and encourage security focused beahviours. While data in the digital age can be tremendously valuable for research purposes, developing good practice remains essential when developing software that collects sensitive data from smartphones and associated devices.