Privacy Elasticity of Demand

• Privacy elasticity of demand is defined as the responsiveness of demand-related outcomes to modifications in privacy parameters across diverse applications.
• It spans multiple settings—from energy demand response and smart meter anonymization to personalized pricing—each employing distinct methodologies and elasticity measures.
• Empirical studies highlight that effective privacy interventions and clear information disclosure significantly influence welfare, participation, and operational demand.

Privacy elasticity of demand denotes the responsiveness of a demand-related outcome to changes in privacy conditions. In the literature, the relevant outcome is not uniform: it may be aggregate accepted load or welfare under differentially private dispatch, participation or operational data demand under privacy contracts, the probability of choosing anonymised smart-meter data sharing, or the take-up of a paid privacy option under personalized pricing. The concept therefore functions as a family of elasticities indexed by application, privacy instrument, and behavioral margin rather than as a single canonical statistic (Karapetyan et al., 2017, Ratliff et al., 2014, Chhachhi et al., 27 Aug 2025, Bó et al., 2023).

1. Conceptual scope and formal definitions

Across the cited literature, privacy elasticity is defined by combining a demand variable with a privacy-relevant argument. In centralized event-based demand response for microgrids, the demand variable is either welfare or accepted apparent demand, and the privacy argument is the differential privacy parameter $\epsilon$ or the Laplace noise scale $b$. In screening models for demand-side management, the relevant margins are participation, operational data demand, and chosen privacy levels. In smart-meter anonymisation studies, demand is proxied by choice probabilities, willingness to share, or smart-meter adoption. In personalized pricing experiments, demand refers to the take-up of a privacy option that prevents data-driven price discrimination.

Setting	Demand object	Privacy lever
Centralized DR in microgrids	Welfare $J^{DP}(\epsilon)$ and accepted demand $D^{DP}(\epsilon)$	Differential privacy level $\epsilon$ or noise scale $b$
DSM privacy contracts	Participation $D$, operational demand proxy $r(x)$, chosen privacy $x_i^*$	Privacy level $x$, breach risk, type distribution
Smart-meter anonymisation	Choice probability $b$0, willingness-to-share, smart-meter demand	Anonymisation availability and information provision
Personalized pricing	Privacy-option take-up $b$1	Context similarity and expected price consequences

The formal objects likewise differ. The microgrid study defines welfare elasticity and demand elasticity as

$b$2

The contract-theoretic study states explicitly that it does not define “privacy elasticity of demand” and instead formalizes elasticities for participation, operational demand, and optimal privacy choices, such as

$b$3

The anonymisation study uses logit-based derivatives and, for binary anonymisation, semi-elasticities and arc elasticities; the personalized-pricing experiment uses arc elasticities for binary context similarity and point elasticities with respect to belief-based price proxies (Karapetyan et al., 2017, Ratliff et al., 2014, Chhachhi et al., 27 Aug 2025, Bó et al., 2023).

2. Differential privacy in event-based demand response

In centralized, event-based demand response for microgrids, privacy elasticity is tied to the welfare consequences of differential privacy in optimization. The load-serving entity coordinates customers over a discrete horizon and solves either an inelastic quadratically constrained mixed-integer program or an elastic convex quadratic program under Branch Flow Model constraints, feeder capacity, and voltage bounds. Only customer utilities $b$4 are privatized. Each utility is perturbed locally before transmission to the aggregator using the Laplace-based mechanism

$b$5

which yields an $b$6-DP decision after optimization by post-processing.

The paper defines the relative privacy cost for elastic demand response as

$b$7

where $b$8 is the non-private optimum and $b$9 is the true-utility value attained by the optimizer using perturbed utilities. A high-probability bound gives

$J^{DP}(\epsilon)$0

so the absolute and relative privacy costs satisfy

$J^{DP}(\epsilon)$1

The scaling is central: $J^{DP}(\epsilon)$2 grows with $J^{DP}(\epsilon)$3 and only logarithmically with $J^{DP}(\epsilon)$4.

Within this framework, privacy elasticity quantifies how welfare and accepted demand respond to $J^{DP}(\epsilon)$5 or, equivalently, the noise scale $J^{DP}(\epsilon)$6. Using the approximation

$J^{DP}(\epsilon)$7

with $J^{DP}(\epsilon)$8, the paper derives

$J^{DP}(\epsilon)$9

Writing $D^{DP}(\epsilon)$0 yields the equivalent expression

$D^{DP}(\epsilon)$1

which increases when $D^{DP}(\epsilon)$2 is small, the customer population is large, or utility dispersion is wide.

The same study links demand elasticity to utility-demand correlation. Under quadratic utilities,

$D^{DP}(\epsilon)$3

higher-demand customers tend to have higher utilities, so privacy noise can invert rankings and shed larger loads. In that case, if average utility per VA at the margin is $D^{DP}(\epsilon)$4, then $D^{DP}(\epsilon)$5, and the paper interprets $D^{DP}(\epsilon)$6. Under uncorrelated utilities, accepted demand is less tightly coupled to welfare, and demand elasticity may be smaller in magnitude than welfare elasticity.

The empirical study uses a 4-bus feeder from the Canadian benchmark distribution system, with microgrid apparent capacity 4 MVA and up to 1500 customers. In the QMF case with 500 customers, $D^{DP}(\epsilon)$7 at $D^{DP}(\epsilon)$8 and $D^{DP}(\epsilon)$9 at $\epsilon$0, implying $\epsilon$1 and $\epsilon$2, respectively. A finite-difference estimate around $\epsilon$3 gives $\epsilon$4, while the theoretical upper-bound perspective using $\epsilon$5 gives $\epsilon$6. With heterogeneous privacy levels in the QMV case, the average privacy cost remains near $\epsilon$7 across customer-count variations. The paper emphasizes that feasibility is preserved because privacy affects only the objective coefficients; the trade-off appears as welfare loss and, indirectly, as lower accepted demand rather than as operational infeasibility (Karapetyan et al., 2017).

3. Screening models, breach risk, and operational demand

In privacy-contract models for demand-side management, privacy is represented as a contract attribute rather than as a noise parameter. The privacy level is $\epsilon$8, with $\epsilon$9, where higher $b$0 means higher privacy, for example through lower sampling rates. Consumer types are $b$1 with $b$2. Risk enters through the probability of avoiding a privacy breach, $b$3, which is strictly increasing in $b$4, and a loss from breach, $b$5, which is strictly increasing in type. The risk-adjusted utility is

$b$6

The utility company’s payoff is

$b$7

where $b$8 is strictly increasing and convex, capturing the reduction in data quality and the increase in operational cost as privacy rises.

The screening problem yields a menu $b$9 under incentive compatibility and individual rationality. Under the standard two-type reductions, the low-type IR constraint and the high-type IC constraint bind:

$D$0

The utility’s problem separates into

$D$1

and

$D$2

The high-type receives the first-best $D$3, whereas the low-type’s privacy level is distorted downward.

Within this framework, the paper formalizes several elasticity notions. Type-specific participation is

$D$4

and aggregate participation is $D$5 at the optimal menu. A direct implication is that participation elasticity with respect to privacy is generically zero away from thresholds: under optimal screening, privacy changes do not smoothly move participation because both types accept. The more informative object is the elasticity of operational data demand. For the proxy $D$6,

$D$7

which becomes large in magnitude when privacy is high.

The paper also derives elasticities of optimal privacy choices with respect to determinants such as the breach-risk parameter $D$8, breach losses, and the type distribution $D$9. In the DLC example,

$r(x)$0

so

$r(x)$1

Then

$r(x)$2

and

$r(x)$3

The high-type elasticity with respect to $r(x)$4 is

$r(x)$5

while the low-type elasticity for an interior solution is

$r(x)$6

The comparative statics are asymmetric. The paper states that $r(x)$7 weakly increases with risk and that $r(x)$8 with risk versus without risk. The low-type response depends on the sufficient statistic $r(x)$9:

$x_i^*$0

With the calibration $x_i^*$1, $x_i^*$2, $x_i^*$3, $x_i^*$4, $x_i^*$5, $x_i^*$6, and $x_i^*$7, the paper reports $x_i^*$8, $x_i^*$9, $x$0, $x$1, aggregate privacy elasticity $x$2, and operational demand elasticities $x$3 and $x$4. The large magnitude of $x$5 illustrates that operational demand can be highly privacy-elastic even when participation itself is locally inelastic (Ratliff et al., 2014).

4. Anonymisation, information provision, and smart-meter choices

A later smart-meter study defines privacy elasticity of demand as the responsiveness of a demand outcome, such as the probability of choosing a data-sharing option, to changes in privacy attributes such as anonymisation availability. Demand is modeled through a discrete choice experiment estimated by Mixed Logit under random utility maximization. If a choice probability is

$x$6

then for a continuous attribute $x$7,

$x$8

and the corresponding elasticity is

$x$9

For binary anonymisation, the study reports semi-elasticities

$b$00

and arc elasticities

$b$01

with $b$02 and $b$03 for a $b$04 change.

The study uses a representative sample of $b$05 Great Britain energy bill payers and embeds a randomized controlled trial on privacy information. Anonymisation is a binary attribute indicating whether half-hourly, daily, or real-time consumption data shared with suppliers would be anonymised so that it “cannot be linked to a particular person and cannot be used to identify individuals or build profiles.” The treatment arm receives explicit information showing that smart-meter data can reveal appliance usage, occupancy, income level, marital or employment status, and other household details.

The central quantitative elasticity results concern high-resolution data sharing. In the control arm, simulated market shares for high-resolution sharing are $b$06 without anonymisation and $b$07 with anonymisation. The reported semi-elasticity is therefore

$b$08

and the arc elasticity is approximately $b$09. In the treatment arm, the corresponding probabilities are $b$10 without anonymisation and $b$11 with anonymisation, yielding a semi-elasticity of $b$12 and an arc elasticity of approximately $b$13. These estimates show that information provision can amplify the responsiveness of sharing decisions to anonymisation.

The same study reports monetary valuations that corroborate the elasticity evidence. In the control group, average willingness to pay for anonymisation is $b$14 of the monthly bill for anonymised half-hourly sharing, $b$15 for anonymised real-time sharing, and $b$16 for anonymised daily sharing; the corresponding willingness to accept estimates are $b$17, $b$18, and $b$19. The full-sample WTA/WTP ratio is $b$20, which the paper interprets as a large endowment-effect asymmetry. Without anonymisation, frequency itself matters: non-anonymised daily versus real-time sharing has control-group WTP $b$21 and WTA $b$22, supporting the claim that lower frequency is valued because it reduces privacy risks.

The non-monetary responses identify further margins of demand. In the control group, $b$23 are initially willing to share half-hourly data; when anonymisation is introduced, $b$24 report being more likely to share, and $b$25 report being less likely to share if data are not anonymised. Smart-meter demand remains incomplete even when anonymisation is available: in the control arm, $b$26 would have a smart meter, while $b$27 would not. Logistic-regression marginal predicted refusal probabilities are $b$28 in control and $b$29 in treatment, with no significant treatment difference. The paper argues that these patterns reveal information asymmetries that suppress demand for anonymisation and support stronger privacy defaults, user-centric design, and consent mechanisms that produce genuinely informed decisions (Chhachhi et al., 27 Aug 2025).

5. Personalized pricing and the demand for privacy

In the personalized-pricing experiment, privacy elasticity concerns the demand for a paid privacy option when consumers know that a statistical model uses observed behavior to set individualized prices. Personalized pricing is implemented through a model $b$30 trained on survey data, and privacy is operationalized as a take-up decision on a £0.10 option that hides survey responses from the pricing algorithm. When privacy is chosen, the participant faces the anonymous price $b$31, the revenue-maximizing uniform price from the training sample.

The experiment varies context similarity exogenously. In the high-similarity “Risk” treatment, the survey is a 10-item risk-profiling instrument directly related to willingness to pay for a lottery. In the low-similarity “Movies” treatment, the survey is a 10-item movie-genre instrument whose relation to lottery willingness to pay is indirect. Predictive power is lower in Movies, with adjusted $b$32 versus $b$33 in Risk. The pricing function discretizes predicted willingness to pay into three bins. In Risk,

$b$34

and in Movies the upper threshold is $b$35.

Privacy take-up differs sharply across contexts. The paper reports

$b$36

The Probit marginal effect for Movies relative to Risk is $b$37 with $b$38. Because context similarity is binary, the paper computes an arc elasticity

$b$39

which gives approximately $b$40 when moving from Movies to Risk. The interpretation offered is that a more similar and comprehensible data context increases privacy demand by about $b$41-$b$42 in proportional terms.

The paper also derives a belief-based elasticity using participants’ incentivized beliefs about price ranges. A higher average believed individualized price significantly reduces privacy take-up, with

$b$43

per £1. Evaluated at the sample means, the paper reports an elasticity of approximately $b$44, with the interpretation that a $b$45 increase in the expected price level reduces privacy demand by about $b$46 at the mean. The study is explicit that this is a reduced-form elasticity with respect to perceived economic stakes, not the direct monetary fee for privacy, because the £0.10 privacy price is fixed and not experimentally varied.

A distinctive feature of this experiment is the interaction between privacy demand and strategic manipulation. In Risk, participants manipulate survey answers on $b$47 items relative to the training data, and predicted willingness to pay falls by about £0.081-£0.088, reducing individualized prices. In Movies, only $b$48 items differ significantly, and predicted willingness to pay is not significantly lower than in training when controlling for age and gender. Individualized prices are significantly higher in Movies than in Risk by £0.085-£0.087. Yet privacy take-up is also lower in Movies. The paper therefore rejects a pure substitution story in which successful manipulation simply replaces privacy purchase. Instead, when consumers understand the relevance of the data to pricing, they both manipulate more effectively and demand privacy more frequently. That conclusion is reinforced by the optimality results: the share of optimal privacy choices is much higher in Risk, and the average difference is $b$49 in Movies relative to Risk. Among those who did not buy privacy, only $b$50 are optimal in Movies, versus $b$51 in Risk (Bó et al., 2023).

6. Determinants, regimes, and implications

Several common determinants recur across the literature, although they operate on different demand margins. First, stronger privacy protection often raises the sensitivity of welfare or data demand losses. In microgrid demand response, smaller $b$52 increases the Laplace noise scale, the bound $b$53, the privacy cost $b$54, and the elasticity magnitude; the paper warns against very small $b$55, especially in large or mixed portfolios, because the privacy cost can approach $b$56 and elasticity becomes large (Karapetyan et al., 2017). In privacy contracts, the proxy elasticity $b$57 shows that operational demand becomes highly sensitive when privacy $b$58 is already high, and breach risk raises the high-type’s optimal privacy choice unambiguously (Ratliff et al., 2014).

Second, heterogeneity is repeatedly shown to matter. In the microgrid study, elasticity is high when customer portfolios are large, mixed, and characterized by strong utility-demand correlation, whereas heterogeneous privacy levels reduce average privacy cost to around $b$59 and improve robustness under dynamic capacity variation (Karapetyan et al., 2017). In the anonymisation study, responses vary by gender, age, socio-economic group, smart-meter ownership, tariff type, IHD engagement, and general data-sharing attitudes; for example, women and older respondents are more privacy-sensitive, and non-owners display substantially greater reluctance toward smart meters (Chhachhi et al., 27 Aug 2025). In the contract model, the low-type response depends on the type probability $b$60 and the ratio $b$61 rather than on breach risk alone (Ratliff et al., 2014).

Third, information and comprehension alter observed elasticities. The anonymisation study finds that privacy education increases caution even under anonymised framing, while simultaneously making anonymisation much more powerful as a determinant of high-resolution sharing: the semi-elasticity rises from $b$62 in control to $b$63 in treatment (Chhachhi et al., 27 Aug 2025). The personalized-pricing experiment reaches a closely related conclusion from a different angle: low context similarity suppresses privacy demand because consumers do not understand how apparently unrelated data affect prices, whereas higher context similarity raises both privacy demand and the optimality of privacy choices (Bó et al., 2023). A plausible implication is that measured privacy elasticities are partly artifacts of disclosure design, not only of underlying privacy preferences.

Several misconceptions are corrected by these studies. Privacy elasticity is not always about participation: in the contract model, participation is generically fixed at $b$64 under the optimal menu, so the more informative elasticity concerns operational data demand or privacy choice rather than uptake itself (Ratliff et al., 2014). Stronger privacy protection does not necessarily threaten feasibility: in differentially private demand response, optimization constraints are unchanged and only the objective coefficients are perturbed (Karapetyan et al., 2017). Nor does privacy demand move mechanically with all forms of privacy-enhancing intervention: the smart-meter study shows that anonymisation can increase sharing even while information provision makes respondents more cautious overall, and the personalized-pricing experiment shows that manipulation and privacy demand are not pure substitutes (Chhachhi et al., 27 Aug 2025, Bó et al., 2023).

The literature’s policy implications follow directly from these determinants. The microgrid study recommends moderate $b$65 values, especially for large or mixed customer sets, and advocates heterogeneous privacy offerings when possible (Karapetyan et al., 2017). The contract model recommends privacy menus calibrated to binding IC and IR constraints, together with security investment or breach insurance to reduce the effective breach-risk parameter $b$66 when privacy demand is elastic (Ratliff et al., 2014). The anonymisation study recommends privacy-by-design defaults, clear user-facing dashboards, and consent mechanisms capable of reducing information asymmetry (Chhachhi et al., 27 Aug 2025). The personalized-pricing experiment recommends richer disclosure of which data categories influence prices, arguing that notice-and-consent regimes are inadequate when consumers misinfer the relevance of cross-context data (Bó et al., 2023).

Taken together, these results suggest that “privacy elasticity of demand” is best understood as a structured comparative-statics concept. Its sign, magnitude, and practical meaning depend on whether the object of demand is welfare, accepted physical load, operational data fidelity, participation, anonymised data sharing, smart-meter adoption, or privacy-option take-up. The literature converges, however, on a common proposition: privacy responses are largest when privacy interventions materially alter economic consequences and when those consequences are sufficiently transparent to be understood.