All surveys and in particular such for sensitive data, suffer from declining cooperation rates. As a consequence, in practice, a sample, whether probabilistic or non-probabilistic, is partitioned into several subsamples: One subset of the whole sample consists of those survey elements who provide the true values of the variables of interest; one subset consists of those units who cannot be reached (Unit-Nonresponse); another subset consists of those sample members who refuse to answer on these questions (Item-Nonresponse); the last group consists of those sampling units who unconsciously or even deliberately answer incorrectly. A respondent's (non-)membership of the last two mentioned subsets might be the result of the level of privacy protection that he or she perceives in the survey process. In particular, it is important that the actual level of the protection that a questioning design offers in this regard is not underestimated by the respondents. Such a misjudgement could lead to even higher rates of Item-Nonresponse and untrue responses as usual with bad effects on the inference quality.

In the talk, indirect questioning designs serve as examples to point out that the level of privacy protection objectively offered by a questioning design might be different from the level of privacy protection subjectively perceived by the respondents. These designs are particularly suitable for this purpose because they intend to positively affect the respondents' willingness to cooperate by a design-inherent protection of their privacy. Measures that formalize both aspects of privacy protection are presented. Furthermore, results from an experiment with students show how a counter-productive underestimation of the actually offered privacy protection might be avoidable.