The Privacy Paradox Is Real and I'm the Exception

There is a finding in the privacy literature that should embarrass anyone who builds tools in the name of privacy, and it embarrasses me specifically. People say, consistently and across every survey you care to run, that they value their privacy and want control over their data. Then they hand it away for almost nothing. A free app, a faster checkout, a smarter assistant, and the stated value evaporates at the first small convenience. Researchers call it the privacy paradox, the gap between what people claim to care about and what they actually do, and it has held up across two decades of studies that keep expecting it to close and keep finding it does not.

I have run a small, accidental experiment on exactly this gap for the last 6 months, and the result is clean enough to hurt. So this essay is the one where I stop pretending the series is an argument about what you should do.

The paradox, stated plainly

The privacy paradox is not a claim that people are lying when they say they care. The research is more interesting than that. People genuinely report valuing privacy, and they are not being cynical when they say it. The gap opens at the moment of choice, where a concrete, immediate convenience sits on one side of the scale and a diffuse, future, hard-to-picture risk sits on the other. The convenience is real and now. The cost is abstract and later. The scale tips the same way almost every time, and it tips that way even for the people who, asked in the abstract a minute earlier, said they would pay to protect the thing they are about to give away.

You can watch this run in the AI world in real time, and the cleanest example arrived this year wearing the costume of a personal agent. A tool called OpenClaw shipped as the assistant that, in its own words, actually does things: it runs on your own machine with full file access, shell execution, and browser control, operating in the background while you sleep. To work, it needs the keys to your computer. And people handed them over, granting shell and file access to a system driven by a remote model, largely because it sounded like it knew what it was doing. Set aside whether that was wise. Notice only what it reveals. Offered enough convenience, people will give a cloud-driven agent root over their machine, the precise opposite of the control they would tell you, sincerely, that they want. The same paradox, now with a terminal.

This is the fact a sovereignty argument has to swallow rather than wish away. The whole premise of self-hosting is that control is worth paying for. Revealed preference says, at scale, it is not. Not because people are foolish, but because the cost of control is immediate and legible while the benefit is deferred and abstract, and that is exactly the shape of trade humans are worst at making.

The receipt with my name on it

I do not have to reach for survey data to make this concrete, because I ran the experiment on myself and published the number.

I built a value-for-value payment channel into this site. A Lightning address, a working QR code in the footer of every page, real channels open, a tip that would clear in under a second. No paywall, no subscription, no email capture, no advertising. The single most aligned possible way for a reader who valued the work to support it without surrendering anything in return. I built the sovereign channel, the one the philosophy says people want, and I left it standing for half a year.

The revenue at 6 months was 0 sats. Not rounded down from a handful. Zero. I have built things that failed; this is the first that failed at giving money away. Against roughly 1,000 visitors a month, with Lightning-wallet penetration in the audience running under 1%. The channel that asked for nothing and surrendered nothing got used by no one.

I want to be precise about what that number is and is not. It is not a failure of the channel, which works exactly as built. It is not proof that nobody read or valued the writing. What it is, is the privacy paradox measured on my own doorstep with my own instrument. The sovereign, no-surveillance, no-lock-in option was sitting right there, free to use, costing the reader nothing but a few seconds and a wallet they did not have. The same people who would tell you, sincerely, that they hate subscriptions and resent surveillance, declined the alternative that removed both, because it asked them to do one small unfamiliar thing and the status quo asked them to do nothing.

That is the privacy paradox, lived, with a receipt. I am the one who built the channel almost nobody used. If I am going to hold the honesty line that this site is built on, I cannot file that under bad luck. I have to file it under the rule, and then ask what the rule does to the argument.

The man in the jar

There is a long tradition of the person who lives the principle the crowd only professes, and the founding figure of it slept in a pot. Diogenes of Sinope, who lived roughly 412 to 323 BCE, started Cynic philosophy and is remembered less for what he argued than for what he did. He reputedly lived in a large ceramic jar, a pithos, in the Athenian marketplace, and he performed his philosophy in public instead of merely defending it over dinner. The crowd that watched him admired the consistency and had no intention of copying it. He was the exception, the eccentric who actually lived the thing the rest discussed, and everyone understood that distinction perfectly.

That is the role, and I should name it without flattering it. The honest case for sovereignty is never everyone should move into the jar. The man in the jar is not making a recruitment pitch. He is a demonstration that the principle can be lived, by someone, at a cost he has chosen to pay in full view. My desk machine is a pithos with better cooling. Nobody owes it an upgrade, and the argument does not improve if a hundred people move in next door.

What the figure gets right is the shape of an honest claim. The crowd in the marketplace was not lying when it praised simplicity, any more than the survey respondent is lying when he says he values his privacy. The gap between the praise and the practice is the whole story, and the person standing in the gap, visibly paying, is the only one not caught in the paradox. He never asked the crowd to weigh the trade his way. He weighed it himself, out loud, and let them watch. That is precisely the claim I am narrowing this series down to: here is what living in the jar costs me, and here is what it buys me.

Morozov, turned on my own side

Here is where I have to turn a critic I usually quote against my opponents back onto myself, because the honest move is to aim the sharpest tool at my own position first.

Evgeny Morozov coined a word for a particular failure of thought: solutionism, the reflex of recasting complex social situations as neat problems with clean technological fixes, then shipping the fix and declaring the situation solved. His target was the technologist who looks at obesity, or crime, or civic disengagement, and sees an app-shaped hole. The fix is real, the problem is real, and the connection between them is a fantasy that survives only because nobody checks whether the fix changed anything.

I have to admit that just self-host can be a solutionist answer in exactly Morozov’s sense. There is a version of this argument, and I have been close enough to it to recognize the smell, that treats surveillance capitalism and rented dependence as problems with a clean technical fix: run your own model, own your own channel, and the problem dissolves. It does not dissolve. The privacy paradox is not a missing feature waiting for the right open-source release. It is a fact about how people weigh immediate convenience against deferred risk, and no amount of better self-hosting tooling repeals it. To present self-hosting as the answer to the privacy problem is to do precisely what Morozov warns against: to mistake a thing I can build for a thing that solves the situation, and to skip the cost-benefit accounting that the people I am supposedly helping would actually have to run.

I covered the same ground from the price side in the essay on the radical monopoly: the rented model manufactured the need it now meters, and renting feels inevitable from inside that frame. But noticing the monopoly is not the same as having an answer that other people will take. The solutionist mistake would be to assume that because I can see the trap, and because I built an exit, everyone else will walk through it. The receipt says they will not. So the honest position is not just to name the cost of self-hosting. It is to admit that even named, costed, and built, the alternative goes mostly unused, and that this is not a marketing problem to be fixed but a feature of the terrain I am writing on.

The steelman: it is a hobby with a manifesto

So let me build the strongest version of the objection, because conceding it fully is the only way the reframe earns anything.

If almost nobody will self-host, and the people who say they care about privacy reliably choose convenience anyway, and even the operator who built the sovereign payment channel watched it sit at 0 sats for half a year, then what exactly is this? Not a movement, because a movement needs people moving. Not a market, because the market revealed its preference and the preference was no. Strip away the philosophy and what is left looks like an expensive personal hobby with an unusually well-written manifesto bolted on the front. The desk machine, the open weights, the V4V channel, the nine essays: a man building an elaborate alternative that the world, given a free and frictionless chance to use, declined. The evangelist’s pitch was everyone should do this, and the evidence is in, and the evidence says everyone will not.

I concede all of it. Every clause. The adoption is not there and is not coming at any scale that would make this a movement. The privacy paradox is real and it is not on my side. The channel went unused. If the argument of this series depended on people following me, the argument would be dead, and I would be the last person standing in a room I had decorated for a crowd that never arrived.

Now watch what survives the concession, because something does, and it is the part that was load-bearing the whole time.

What I am actually claiming

The evangelist makes a claim about other people: you should do this, it is better for you, you will be glad you did. That claim lives or dies on adoption. When nobody follows, it collapses into wishful thinking, and the privacy-paradox receipt is its death certificate.

I am not making that claim, and I have to stop letting the series be read as if I were. The honest claim is about exactly one person. Here is the trade I made: I pay roughly 80 hours of setup and a machine that loses to the frontier on capability and to the cloud on raw dollars, and in exchange I get a stack I can inspect, modify, and keep operating after every external party changes its mind about me. Here is what it costs me, stated first because the cost is the argument, not the fine print. Here is what it buys me, narrowly, measured, no rounding up. That claim does not need a single other person to take the same trade. It is true at one user. It was true at 0 sats. It will be true if this site has 1,000 visitors a month forever and not one of them ever self-hosts a thing.

This is why the honesty outlasts the evangelism, and it is a structural reason, not a pose. An argument that needs adoption is hostage to the privacy paradox, which will keep voting against it. An argument that only claims here is the exact trade and what it costs me is immune to the paradox, because it never depended on anyone else weighing the trade my way. The evangelist is falsified by an empty room. The operator who says I am the exception, not the argument was never counting heads; he was counting the cost, and that ledger balances whether the room holds a thousand people or just him. The comparison table at the top of this essay is that single difference unrolled: same hardware, same weights, same channel, two different sentences in front of them, and only one survives contact with how people actually behave.

There is a quieter strength in this too. The evangelist has to soften the cost to keep the pitch alive, which means the evangelist is always one honest accounting away from undermining the sale. I have no sale to undermine. I can put the 0 sats, the under-1% wallet penetration, the lost capability bet, and the 80-hour wall right at the front, because none of them threaten a claim that was only ever about what one operator chose with full knowledge of the bill. You can trust a man who tells you his alternative went unused, in a way you can never quite trust the one still insisting you will love it.

So I will say it as plainly as the literature says the paradox. Almost nobody is going to self-host, and the people most likely to say they want control will, at the moment of choice, take the convenience, and I have the receipt to prove I could not even give the sovereign option away. That is not a counterargument to anything I have written. It is the ground I have stood on the whole time, finally named. The case was never that everyone should. The case is that here is the exact trade, here is what it costs me, and here is why I made it with my eyes open, and that case does not need you to make it too.

This is essay nine of a series, and it is the one that fixes the stance of all the others: read every prior essay as a report from the exception, not a recruitment pitch. The series spine, and why each essay concedes its strongest objection before answering it, lives on the philosophy page. The structured, complete version is the forthcoming book, for which these essays are the public workshop. If you take nothing else, take the distinction the whole series turns on, now stated outright on the philosophy page: the operator is the exception, and the honesty about that is stronger than any number of people agreeing.