FTC PrivacyCon: Personal Data Recording and the Market for Digital Privacy

This article is one of a series covering the Federal Trade Commission’s 2018 PrivacyCon event. The conference featured research on privacy implications of Internet technologies and smart devices. For a full list of Consumers’ Research’s articles on this event, click here.

Is the Market for Digital Privacy a Failure?

Caleb Fuller, an assistant professor of economics at Grove City College performed an empirical study on how consumers value privacy. The professor tests three common claims about privacy as a market failure.

Fuller talked about why so many digital firms engage in information collection rather than alternative methods of earning revenue. He asserts that firms pursue this strategy because consumers are ill-informed and thus susceptible to exploitation. Fuller also mentioned that individuals only express a significant demand for digital privacy when they are not forced to consider the opportunity cost of making that choice. According to Fuller, should consumers prefer a higher level of privacy than markets currently afford, there is a profitable opportunity in exposing Google’s practices and establishing alternative business models, as has been done by DuckDuckGo, a search engine that does not track browsers.

The paper attempts to evaluate those three claims through survey evidence:

There is widespread information asymmetry between firms and consumers

  • The survey found that 90 percent of Google users were aware that Google collected data on them and the majority of users were able to correctly identify the type of data that Google collects. Fuller argues that because users know what kind of data is collected, and are aware of the collection, there is no information asymmetry.
    Consumers value their privacy highly

  • Fuller asks users whether or not they would prefer Google not to collect information about them and 71 percent answered that they would prefer google to not collect information and 29 percent would prefer Google to collect information. Of those users that said they would be willing to pay for Google to not collect data, respondents assigned an average value to their data of $76.78 annually or 21 cents per day. The median annual value was $20 or 5.5 cents per day. Only 8 percent of total users were willing to pay $20 annually for increased privacy while using Google, suggesting consumers may place a low financial value on privacy.
  • In another question, 59 percent of users said they were only willing to pay less than 1 cent daily to prevent Google from collecting their data.

    Fuller also points out that for Google to maintain their level of profitability, they would need to charge $70 annually from every user. This amount is far above what most users are willing to pay to protect their privacy, per the survey results.
    Consumers dislike information collection for one of four reasons all of which are features of unhampered markets

  • When asked about why consumers disliked Google collecting information about them, the top reasons given were: risk of identity theft, uneasiness about who knows what about you, the threat of spam, advertisers being able to target you directly, a government agency forcing an Internet entity to hand over information they have about a user, and price discrimination.
  • Fuller’s conclusion is that there likely is no market failure when it comes to privacy ,and the lack of privacy likely stems from low consumer valuation rather than market failure.

    No boundaries: Exfiltration of personal data by session-replay scripts

    Gunes Acar of Princeton University presented the exfiltration of personal data by session-replay scripts. According to Acar, these scripts are known to record keystrokes, mouse movements, and scrolling behavior, along with the entire contents of the web pages visited and sent them to third-party servers. Unlike typical web analytics services that provide aggregate statistics, session replay scripts are intended for the recording and playback of individual browsing sessions, as if someone is looking over the visitor’s shoulder. The underlying problem is that the collection of page content by third-party replay scripts may cause sensitive information such as medical conditions, credit card details and other personal information displayed on a page to be sent to the third-party as part of the recording. This may expose users to identity theft, online scams, and other unwanted behavior. The same is true for the collection of user inputs during checkout and registration processes.

    Image Source: Image, License Summary.

    + posts



    Subscribe to get the latest consumer news

    More consumer News