Overview
Create a PowerPoint presentation on chapter 4 pro-privacy why the readings support protecting consumer privacy.
Create 12 PowerPoint slides with details and images
CHAPTER 4
WHAT’S IT TO YOU?
Understanding What Privacy Is Worth
Social scientists, behavioral economists, think tanks, and government researchers have undertaken studies attempting to measure what privacy is worth. The jury is still out, as it’s proven to be a complex question, but the findings so far have been illuminating. First, how much people value privacy depends in part on their default position—that is, whether they have to pay to gain privacy or are being paid to give it up. Second, people sometimes value privacy differently in online transactions than they do when interacting face-to-face. And third, despite the fact that companies can make a handsome profit from our data, there is virtually no market existing today that allows individuals to directly profit from the information that might be considered “their own.”
PAYING TO GET PRIVACY, AND BEING PAID TO GIVE IT UP
In an influential paper titled, “What Is Privacy Worth?” Carnegie Mellon University academic researcher Alessandro Acquisiti and his co-authors tried to measure the value of privacy. Their conclusion:
Individuals assign markedly different values to the privacy of their data depending on a) whether they consider the amount of money they would accept to disclose otherwise private information, or the amount of money they would pay to protect otherwise public information; and b) the order in which they consider different offers for that data.1
Acquisiti’s work, in this and other papers, has laid the foundation for applying behavioral economics to questions about privacy. The research demonstrates some of the reasons why it’s notoriously tricky to assign a monetary value to privacy.2 First, data asymmetry is endemic: data subjects rarely know as much as data holders do about what’s being collected and how it’s being used. Second, data subjects seldom have complete visibility into, or a full appreciation of, the complex interactions among the many ways that data can be used. Third, even with that information and appreciation, consumers find their choices are limited. For all these reasons, people don’t always make what appear to be fully rational choices when it comes to privacy.3
In addition to these challenges, society doesn’t have agreed-upon yardsticks to measure the cost of privacy harms, and this lack of context leads individuals to make decisions on their own. The situation is different for many other kinds of harms, where the law and cultural norms give us well-established ways to calculate the injury, or “damages,” that are involved. When someone is the victim of medical malpractice or injured in a car accident, when they’re swindled in a business deal or wrongfully fired from their job, judges and juries can apply time-honored formulas for considering how much money those harms might be worth. When it comes to privacy, however, we don’t have the same body of clear precedent or widely agreed-upon formulas. On the contrary, relatively few data privacy cases result in any financial compensation for the individuals whose privacy was intruded upon.
Recent years have brought a wave of data breaches involving credit card data held by department stores, Social Security numbers held by federal government agencies, and password information held by webmail providers, along with a range of other personal details. Yet many federal courts have held that plaintiffs in the resulting lawsuits don’t have standing because even if millions of credit card numbers were stolen by cyber criminals, the breach of that data doesn’t amount to enough of an immediate, tangible injury to the plaintiffs to support a claim for monetary damages in federal court. Given the reluctance of these judges to recognize standing for “traditional” data breaches involving credit cards and Social Security numbers, it’s perhaps not surprising that the barrier to bringing a data privacy lawsuit is even higher when it comes to non-credit-related information like personal photos, biometric data, and password-protected online activity on social media sites, apps, and other web-based forums. Many people would consider those kinds of data to be more personal than a credit card number, and more like the “tastes, habits, prejudices, sensitiveness, manners, relations with friends and family, and the like,” which Godkin argued it was so important to protect. Nonetheless, many courts haven’t decided yet if they’ll recognize an injury at all when that kind of information is misused, much less how much the resulting privacy harms might be worth.
Researchers like Acquisiti have discovered that one way to assess the value that people assign to privacy is to measure the gap between how much a person will accept in exchange for their personal data and how much they’re willing to pay to keep it private. As the research shows, real- life privacy decisions can involve either kind of decision.4 For example, we might demonstrate “willingness-to-pay” through accepting minor inconveniences like using search engines that don’t track our history even if their search results aren’t as complete as the market-dominating but privacy-intrusive results provided by Google search. Our willingness-to-pay could also take the form of increased out-of-pocket costs to enjoy more privacy, like subscribing to a paid online service that promises not to sell our information as opposed to a “free” version that isn’t as privacy- protective. “Willingness-to-accept” decisions also abound in everyday life. In many instances, we make them by implication rather than deliberately,
such as when we give up detailed personal information in exchange for free online services, from social media to using free tax preparation software or earning a pittance for completing online surveys.
To measure these differences, researchers offered mall shoppers two versions of a gift card: one worth $10 that didn’t track the user’s spending, and the other worth $12 that tracked how the card balance was spent. Shoppers with the $10 card were offered the chance to upgrade to a $12 card if they were willing to have their spending tracked. Most shoppers said no. When shoppers started with a default condition of privacy and asked what they would be willing to accept to give their privacy up, $2 wasn’t enough.
For shoppers with the $12 card, the experiment’s conditions were reversed. For these shoppers, the default condition was lack of privacy. When asked if they’d rather have private shopping on a $10 card instead, the majority of the shoppers declined. When it came to willingness-to-pay, it wasn’t worth $2 to gain added privacy.5 The shoppers reached opposite conclusions: for one group, privacy was more important than gaining an additional $2; for the other group, the $2 mattered more than their privacy. The shoppers had been selected randomly, and the findings underscored both the gap that can arise between willingness-to-accept and willingness- to-pay, and how much influence a person’s default condition of privacy can have.
As Acquisiti and his colleagues point out, the decision in real life is rarely so stark as the ones presented in these experiments. As a result, it’s very hard to gauge precisely what trade-offs between privacy, cost, convenience, and other factors people truly value the most.6 When we’re making real-life decisions about which smartphone to buy or which app to download, we likely consider a range of factors including cost, convenience, familiarity with the operating system and the device, availability of particular features, the opinion of a trusted friend, online reviews and ratings, privacy considerations—and more. How we weigh these factors is often complicated by having limited options. For search engines, social media, video streaming platforms, and other data-intensive services, there are often only one or two major providers in a particular
niche, and a handful of minor competitors that might offer more privacy but whose service or functionality isn’t as complete.
It begs the question: How meaningful are privacy choices, when the limited alternatives leave consumers to compare apples to oranges, weighing privacy features against other aspects of functionality, convenience, design, accessibility, and more? And how do we correct the asymmetry that leaves us all prone to undervaluing the potential privacy impact of the everyday decisions we make?
Just as most of us aren’t single-issue voters when we step into the polling booth, most of us aren’t single-issue consumers when it comes to making decisions about various products, services, and apps. Do we think about privacy? Generally, yes, to some degree, and some of us think about privacy more often or weigh its importance more heavily than others. But seldom do we make a purchase, download, or registration decision solely on the basis of privacy. The multifaceted nature of these decisions, coupled with the limited number of choices that we face in many instances—the available search engines, social media platforms, mobile phone operating systems, and device models—makes it difficult, no matter how well informed we are, to make judgments that assign a consistent value to privacy. We seldom face a straightforward calculation when deciding how much we’re willing to accept to give up our privacy, or how much we’re willing to pay to keep it.
The nation’s leading economists also grapple on a macroeconomic level with measuring what privacy is worth. In an October 2019 speech, Federal Reserve Chairman Jerome Powell noted that traditional models of economic growth didn’t seem to explain the level of gross domestic product in the United States when compared with other economic indicators.7 Part of the explanation may lie in work being done by government and academic researchers trying to understand how free online services contribute to economic value and growth.8 According to a team at MIT, when consumers were asked how much they would demand in exchange for giving up free apps and online services, the numbers were significant. The average American Facebook user, for example, spends twenty-two hours per week on the platform and would demand $48 to give it up for one month.9 According to similar studies, mobile phone users in the European Union
would demand €59 to give up navigation apps for a month, €97 to give up Facebook for a month, and €536 to give up WhatsApp for a month.10 Giving up search engines was seen as the greatest sacrifice, with US users demanding $17,000 to forgo using them for one year.11
Although the Fed’s research isn’t aimed specifically at measuring privacy, it provides important insights into the value of free online services —services that are only “free” because the platforms can monetize their users’ data. This exchange of personal data and the monetary value online services assign to it means that when measuring the value of data-intensive services, privacy is always part of the equation, even if it’s unexpressed. Despite this inextricable link, there aren’t yet many studies examining the intersection between no-fee services, the privacy cost (to the individual and society), and the economic value (to the individual, the company providing the service, and the economy and society as a whole). For example, in the MIT study, the researchers concluded that people who would demand large payments to give up free services must find value in those tools; therefore, free platforms and apps contribute to consumer well-being—yet the word privacy appears nowhere in their research.12 It’s clear that these research participants would want to be paid to give up data-intensive digital tools; but it isn’t clear whether they know, or were asked if they care, about how much privacy they’re currently giving up.
When measuring the value of data-intensive services, privacy is always part of the equation, even if it’s unexpressed.
This kind of research is expanding globally as countries around the world grapple with the privacy and other impacts of data-driven technologies. In 2019, the Australian Competition and Consumer Commission (ACCC) published its Digital Platforms Inquiry, one of the most comprehensive studies to date of the impact that large data platform providers have on individuals. The ACCC found that the business model of companies like Facebook and Google harms individuals in a number of important ways, allowing corporations to “exploit the information asymmetries and bargaining power imbalances between digital platforms and consumers.”13 That is to say, although each person may have different
levels of risk tolerance when it comes to privacy, and different preferences when it comes to weighing privacy against cost or convenience, the digital platform model offers consumers very little opportunity to exercise choices related to those preferences.14
Although a great deal more research remains to be done, some striking patterns are clear. How much people value privacy depends in part on the amount of privacy they start with as their default. It also depends on how many options they have and how complex the trade-offs are that they have to weigh. People find value in data-driven online services, and it appears they are also swayed by how those services are marketed. That last factor is illustrated by the definition of “free” goods and services that’s relied on by the nation’s top consumer protection watchdog, the Federal Trade Commission. Under a 2012 FTC rule:
The offer of “free” merchandise or service is a promotional device frequently used to attract customers. When making “free” or similar offers all of the terms and conditions upon which one can receive and retain the free item should be set forth clearly and conspicuously at the outset of the offer so as to leave no reasonable probability that the terms of the offer might be misunderstood.15
Currently, however, this rule hasn’t yet resulted in a requirement that Google, YouTube, Facebook, Instagram, or other platforms explain to its users, in truly conspicuous terms, that “free” means “we’re offering you the use of our service at no cost in exchange for mining—and perhaps selling to others—comprehensive data about what you have, what you do, who you are, and what you think, believe, and know.” If the trade-off were presented that way, more people might pause before using some of these platforms and services and might create more market pressure for other options. Instead of demanding $17,000 to walk away from Google search, it might be that a little bit of inconvenience with less-tailored search results on a more-privacy-protective search engine is all that some people really want.
These experiments and research provide important insights into how our behavior reflects the true value we place on privacy. However, that isn’t nearly the end of the analysis, especially as technology and data growth continue to accelerate. Much of American and European data protection law depends on the concept of informed consent. Consequently, it’s important to ask what kinds of information an individual needs in order to be informed in today’s data-rich environment—and whether the data ecosystem has become so complex, and the range of choices so limited, that it’s no longer possible to give meaningful informed consent. A key challenge for the future will be how to clearly present people with useful information in an economic environment that offers meaningful alternatives in a manner that empowers them to consciously decide what privacy is worth to them, and then choose what trade-offs they are willing to make.