For years, the argument against strong privacy law has rested on a single, mostly unexamined assumption: give people more control over their data, and they'll share less of it. Fewer donor records. Thinner prospect files. A colder pipeline.

A new Harvard Business School working paper says that assumption is wrong.

What the privacy research found

"In Privacy We Trust: The Effect of Privacy Regulations on Data Sharing Behavior," by Ozge Demirci (Imperial College London), Ayelet Israeli, and Eva Ascarza (both HBS), studied what happened when the California Privacy Rights Act and Virginia Consumer Data Protection Act took effect in January 2023. Both laws required clearer disclosures, added a right to opt out of data sales, and gave consumers more control over sensitive information.

The researchers studied data from a major receipt-upload rewards platform — an app where users photograph shopping receipts in exchange for points — and found that consumers in California and Virginia were more active in data-sharing after the regulation took effect in their states instead of shying away from it because they now had more opt-out rights. 

In fact, users in CA and VA uploaded 7% more receipts per week than users in states without the new protections, which translates to roughly 0.29 additional receipts per user per week. New account sign-ups on the platform rose 5.7% in the treated states. And users who'd stopped uploading receipts before the laws took effect were more likely to start again afterward.

The increase wasn't evenly distributed, either. The users who responded most were the ones who'd shared the least before the regulations took effect. 

Why this data-sharing research held up

The researchers didn't stop at correlation. They ruled out the two most obvious alternative explanations. The platform hadn't sweetened its rewards to juice engagement; offer volume and point values were flat before and after. And people weren't just buying more stuff and therefore generating more receipts — Consumer Expenditure Survey data showed no corresponding jump in underlying consumption in the treated states.

What they found instead, across three independent data sources, was a consistent trust signal. Google search interest in privacy rose in California and Virginia after the laws took effect. But two nationally representative surveys — the NTIA Internet Use Survey and the Consumer Expenditure Survey — showed people in those states became less likely to avoid online shopping over privacy concerns, and less likely to voice privacy concerns to survey interviewers.

Attention to privacy went up. Anxiety about it went down.

Using privacy research to reframe your budget conversation

For nonprofits, the reward-based analogy isn't perfect, but the underlying point transfers directly. Every organization I work with eventually asks some version of "won't stricter consent requirements shrink our donor list?" This is the first individual-level evidence I've seen that the answer, at least directionally, is no — and that trust-building compliance may do more for engagement than another round of acquisition spend would.

If your organization is treating consent banners, opt-out links, and privacy notices as a compliance tax to be minimized, this research is worth digesting. Constituents who understand what you're doing with their data, and who can see they have a real choice, engage more, not less.

What's next for your privacy program

If you're rethinking how your privacy program shows up to donors and constituents — not just what it says in a policy, but what it actually looks and feels like at the point of consent to encourage trust — let's talk.