Internet users generously disclose personal information to consume supposedly "free" digital services despite severe privacy concerns-a phenomenon termed privacy paradox. Humanities have thoroughly studied this discrepancy in attitude and behavior, yet have not developed a conclusive explanation for its occurrence, let alone a means to counter it. Both the quantity and the quality of data privacy laws, as well as the increasing number of court rulings dealing with digital business models, show the urgent need to better understand the cause of the privacy paradox and to mitigate it. This paper analyzes the contradictory phenomenon from an economic point of view. By applying the two-state of the world-model, the authors demonstrate that uncertainty about the extent and the likelihood of a data breach are explanatory factors for the privacy paradox. Taking the European General Data Protection Regulation as an exemplary showcase, the authors further examine the role of privacy laws to offset Internet users' inconsistent privacy behavior. In theory, such a "rights and remedies" scheme is intended to counter the uncertainty factors provoking the privacy paradox; however, in practice, this intention is only partially served.