The authors are thankful for comments and suggestions from participants at several seminars and conferences: Foundations of Utility and Risk Workshop, Society for the Advancement of Economic Theory Conference, Stanford Institute of Theoretical Economics (SITE), Security and Human Behavior Workshop, Annual Digital Information Policy Scholar Conference, Symposium: Privacy at Michigan, ESA World Meeting, seminar participants at University of Amsterdam, University of Vienna, George Mason University, Chinese University of Hong Kong, Law and Economics Seminar, Empirical Legal Research Workshop, Evidence-based Economics Summer Meeting, and Experimental and Behavioral Economics Seminar. The authors are especially grateful to Alessandro Acquisti for comments on an early version of their manuscript.