When you tick a box on an online privacy notice, just how much personal information are you giving away? Is the tradeoff worthwhile?