ON THE INTERNET : AN ECONOMIC ANALYSIS

This paper seeks to address the sharp increase in public debate about privacy issues, particularly on the issues of Internet privacy and the value of personal information. The research questions we are addressing here are  How should an Internet Service Provider (ISP) price its service given that the consumers vary in their valuation for privacy and also vary in terms of the value of their personal information to a third party? Should the ISP have a blanket policy of never collecting, or a policy of always collecting and revealing information? We calculate the separating and pooling strategies for the ISP under asymmetric information and compare them with the full information benchmarks. We find that in some cases the ISP may be no worse off than in the full information case while in other cases it may have to restrict the set of contracts so that they are incentive compatible and individually rational. Introduction The technological developments that have made e-commerce possible have also enhanced the ability of companies to collect, store, transfer, and analyze vast amounts of data, from and about the consumers who visit their store on the World Wide Web (FTC 2000). These developments have increased privacy concerns among consumers, especially online consumers. According to a recent Business Week/Harris poll (Business Week 1998), privacy is the number one consumer issue facing the Internet. These concerns about privacy need to be addressed to enable the growth of E-commerce. Te other side of the story is that personal information is a valuable asset to private and governmental institutions, which use it to reduce their costs of operation (Laudon 1996). The increasing thirst for personal information, and innovations in targeting technique have made targeted marketing the hottest form of marketing, growing at twice the rate of Americas GNP. In 1995, direct marketing resulted in $600 billion in sales (Solove 2000). It is evident that a proper balance needs to be achieved between the consumers concerns for privacy and the needs of firms for personal information. This paper seeks to address the sharp increase in public debate about privacy issues, particularly on the issues of Internet privacy and the value of personal information. Past research (Laudon 1996, Kang 1998, Sovern 1999) has suggested an information market-based solution where consumers reveal potentially useful personal information in return for money and personalized services. However to the best of our knowledge, there has not been much research addressing the economic analysis of transactions privacy and information markets. It is the intention of this research to fill that void. In this paper the problem that we model is that of an Internet Service Provider (ISP). It is technically feasible for the ISP to track the browsing habits of its consumers. If allowed to collect data on browsing habits, the ISP can potentially build up a profile of the consumer, which may include but is not limited to information about preferences, income segment etc. This information may be of great use to a third party who wants to target the consumers with a personalized product or service. By providing the third Business Models for the Digital Economy 362 2002  Eighth Americas Conference on Information Systems party access to this information, the ISP enables the matching of the third party with the right consumers. This collection and release of consumer information if done without the permission of the consumer is what is termed as privacy violation in our context. However the release of information to a third party if done with the consent of the consumer could lead to overall increase in social welfare. The research questions we are addressing here are  How should the ISP price its service given that the consumers vary in their valuation for privacy and also vary in terms of the value of their personal information to the third party? Should the ISP have a blanket policy of never collecting, or a policy of always collecting and revealing information? Is it better off providing its customers with a choice of several pricing options each varying in the amount of information collected and revealed? Which of these options is Pareto Optimal? The rest of the paper is organized as follows: Section 2 covers the background literature on privacy. We specify our assumptions and the model framework in section 3. Section 4 summarizes the results and the managerial implications. In Section 5 we look at the limitations of our results and possible extensions. Background Privacy is defined as the moral claim of the individuals to be left alone and to control the flow of information about themselves (Coase 1960; Westin 1967). Coasian logic suggests that given sufficient flexibility in contracting, stringent privacy laws are unnecessary to achieve efficiency in concealment or revelation of information (Kahn et al 2000). For a background on the evolution of privacy concerns see Culnan (1993). More recently Wang et al (1998) have provided a taxonomy of consumer privacy concerns specific to the Internet marketing area. Past research on privacy can be classified into three different streams  Legal, Information Systems and Economic. Sovern (1999) addresses the issue of opting in or opting out of databases and mailing lists. The article argues that businesses have both the incentive and the ability to increase consumers transaction costs in protecting privacy. Faced with this and other constraints, many consumers decide ultimately not to protect their privacy. The paper proposes several ways by which consumers transaction costs can be reduced or eliminated. Kang (1998) is more relevant to our research question since it focuses on the problem of personal data generated in cyberspace transactions. Kang proposes solving the problem by treating personal information as a commodity that interested parties should contract for in the course of negotiating a cyberspace transaction. Literature in the Information Systems stream has concentrated on the technical aspects of privacy. The World-Wide Web Consortium (W3C)s Platform for Privacy Preference Project (P3P) provides a framework for informed online interactions. P3P applications will allow users to be informed about Web Site practices, delegate decisions to their computer agent when they wish, and tailor relationships with specific sites (Reagle and Cranor 1999). Tools available for privacy protection include Crowds (Reiter and Rubin 1997), Onion Routing (Goldschlag et al 1999), Anonymizer (www.anonymizer.com), and anonymous remailers (Bacard 1996). Laudon (1996) proposes a framework for an Information Market where consumer profiles would aggregated and sold as commodities. Consumers would be compensated for the loss of privacy by money or personalized services. Economic studies of Privacy include Hirshleifer (1980), Stigler (1980) and Posner (1981). Most of these were written at a time when technology was in its infancy  Internet was not even in existence. More recently Kahn et al (2000) have looked at efficiency gains under different privacy regimes. Their environment is characterized with complete information and they look at the social planners problem of when and when not transactional information should be made public knowledge. Model There are three sets of agents in the market the consumers (A), the ISP (B) and the third parties (C). There are a large number of consumers and third parties but just a single ISP (firm). Some of the consumers can be potential customers of a third party C. However without prior information about consumer As buying profile, it is prohibitively expensive for a third party C to target Jaisingh et al./Privacy on the Internet An example of targeting could be sending a sample product. If the third party has no information about the consumers interests then sending samples to the entire set of consumers would be very expensive. Risk Neutrality means that the agents utility function is linear in wealth. Reservation utility is the utility that the agent gets by not subscribing to the ISP. 2002  Eighth Americas Conference on Information Systems 363 a consumer A. If A allows B to collect information on her browsing behavior and subsequently release that information to C, then C can identify if A can be a potential customer or not. The consumers differ in their valuation for privacy and also in their value to a third party based on their interests. Let Consumer type be a vector . " represents the valuation for privacy (L) , ( β α θ = Low, H-High). $ represents whether the buyer information is useful to the third party and affiliates of the ISP (HHigh Value, L-Low Value). All consumers are assumed to have the same valuation for the Internet service provided by B. Thus there are four consumer types: . All agents are risk-neutral and the reservation utility ) , ( ); , ( ); , ( ); , ( 4 3 2 1 L L H L H H L H = = = = θ θ θ θ of all consumers is assumed to be zero. The firm B is a profit-maximizing monopolist. We consider a two period model similar to Kahn et al (2000). In the first period the consumer A chooses to subscribe to the Internet Service provided by B. Based on the option chosen by A (to allow B to collect information or not), B collects information on the browsing behavior of A and then releases the information to a third party C. Now C knows As type perfectly and targets her with a personalized service or product. As a result of this targeting, the utility of agents A, B and C change. Since B enables the matching between A and C, B can extract a rent from C. Notation: v is the reservation utility of all consumers for Internet Service provided by B. pj is the price charged for the service for consumer type . vi is the utility of agent i ( ) due to agent A subscribing to the service provided 4 , 3 , 2 , 1 , = j j θ C B A i , , = by B. wi is the change in utility of agent i ( ) due to release of in