The debate over online privacy pays too little attention to the costs and benefits of the current systems of privacy protection and advertising-supported online applications. The costs of online privacy-related harm (such as identity theft) and of protective activities are small relative to the benefits from applications that are supported by online advertising, which depends on the collection of personal information. Advocates of increased privacy focus too much on increased privacy as a solution, and not enough on alternative forms of information security. Surveys show that consumers do not like targeted advertising, or the information collection that allows it, but this may be a form of rational irrationality. That is, it may not pay for consumers to understand the costs and benefits of reduced information use.