Cappuccinos and croissants make for a delicious breakfast, even more so when you think they're free, but are they worth your personal data and privacy?

Surfshark, a provider of consumer antivirus, virtual private network and other data privacy products, wanted to find out. So it took over an upscale New York City coffee shop Thursday morning. Instead of paying with cash or credit, the sometimes confused customers who walked in were asked to hand over pieces of their personal data.

A cappuccino or latte cost them their email address, while exotic, single-origin pour-overs required them to hand over their mailing address. Food items like avocado toast or a quinoa salad cost them the security code off their credit card. The information was written down on a card and handed to the cashier, who promptly shredded the card. 

There were some strange looks for sure, but more often than not people jumped at the chance to get something for "free" in exchange for data that they may not actually think of as personal. That mirrors the everyday behavior of many people who are all too eager to hand over their phone number to get a discount at the grocery store, or an email address to rack up rewards points at a favorite restaurant.

But those seemly harmless actions can have consequences down the road. Data collected by businesses can be stolen by cybercriminals looking to use it for fraudulent purposes, or sold to data brokers who use and share it for their own profit. In either case, it chips away at what's left of a person's digital privacy.

Lina Survila, Surfshark's head of global technology public relations, said those concepts can seem very abstract to people. The coffee shop demonstration was an attempt to add a relatable, visual element and make people stop and think before they hand over their information.

"There were so many reactions," Survila said toward the end of the event. "Hopefully we made people think."

For example, when one man was asked for his email address she said he laughed and said: "Why not? Everyone else has it anyway."

Survila, who is based at the company's headquarters in Lithuania, added that that mentality appears to be uniquely American. Europeans are much more cautious with their personal information, she said, and less likely to hand it over, even for something free. 

It's also important to note that Thursday's exercise was about awareness, not actual data collection. There was nothing stopping customers from handing over fake data, and Surfshark ceremonially shredded each card in front of the customer as they received their food and drinks.

So despite the old saying that there's no such thing as a free lunch (or breakfast), everyone who walked into that coffee shop Thursday morning did get one.