This paper explores why some people say they’d like to protect their personal data then take few measures to do so. Hypotheses include limited information, self-control problems, behavioural distortions, and bounded rationality. The authors suggest an experimental design that would allow their hypotheses to be tested.