Undergraduates interviewed about privacy concerns related to online data collection made apparently contradictory statements. The same issue could evoke concern or not in the span of an interview, sometimes even a single sentence. Drawing on dual-process theories from psychology, we argue that some of the apparent contradictions can be resolved if privacy concern is divided into two components we call intuitive concern, a "gut feeling," and considered concern, produced by a weighing of risks and benefits. Consistent with previous explanations of the so-called privacy paradox, we argue that people may express high considered concern when prompted, but in practice act on low intuitive concern without a considered assessment. We also suggest a new explanation: a considered assessment can override an intuitive assessment of high concern without eliminating it. Here, people may choose rationally to accept a privacy risk but still express intuitive concern when prompted.