The development of effective privacy policies rests critically on the question of whether people are capable of engaging in rational tradeoffs regarding the use of their personal information. This study investigates the extent to which people's decisions in this domain exhibit consistency with an underlying rational preference for privacy. We develop a novel experiment in which people allocate privacy levels between different personal information items, allowing us to classify people depending on whether their choices are consistent with the Generalized Axiom of Revealed Preference. We find 63 percent of subjects act consistently with a rational preference ordering when allocating privacy levels, despite the substantial heterogeneity of privacy attitudes. We further investigate the extent to which these revealed privacy preferences can be measured by monetary equivalents and whether preferences elicited over choices in our experiment have any predictive power for explaining real-world privacy behavior. We find that the classification of rationality from choices is also predictive of monetary tradeoffs: irrational types, on average, squander 260 percent more money than rational types through inconsistencies in their monetary valuations. Despite the presence of noise, monetary valuations nevertheless capture some of the underlying privacy preferences, as more private types require significantly more compensation for sharing personal data. Finally, the measures of privacy preferences elicited in the laboratory are correlated with a widely-used question eliciting self-reported privacy concerns and with behavioral outcomes in real-world domains of personal information sharing. We conclude that, despite the fact that we study choices in a fairly simple decision environment, there is considerable heterogeneity in rationality that should be considered when designing future privacy policies.