I have to confess I didn't see the link to the whitepaper in my first read through - shame on me for commenting before I did :) I think you all did a pretty good job putting this together overall after reading through it, and I applaud the effort. That said, the critical HNer in me sees some bias in the questions and answers. Specifics:

* The results on page 17 jumped out at me the most. There are 4 specific options for negative emotional reactions, and one generic positive option. It's easy to underestimate the powerful effect this has on pushing the responder to a specific answer. Imagine if your answer options were only "content, secure, informed, protected, neutral, misled" and how different your results might be.

* The question for the above, specifically the tone of "[...] does not offer any additional protection [...]" is also a form of leading the responder to an answer. While the statement is mostly true, there's some contention on the point esp. regarding cookies (see the other comments on this thread). Either way, you'd get a more honest answer if you strictly list the things private browsing does, and the things it does not do in a way that's as objective and incontrovertible as possible.

* It would be useful to see the benefits underlying the "correctly identified" category on page 13. I couldn't find those anywhere which was a bit suspicious.

In consulting, I used to survey users on their personal security practices (password strength, adherence to policies, secure disposal, etc.) and gained a huge appreciation for how powerful bias and misinterpretation can be in surveys, and how hard it is to control. But to reiterate, I think this is overall pretty well done and has some really interesting results, esp. the usage data in the first few sections.