citations

COLUMBIA LAW REVIEW
VOL. 117

OCTOBER 2017

NO. 6

ARTICLE
PAYING FOR PRIVACY AND THE PERSONAL DATA
ECONOMY
Stacy-Ann Elvy*
Growing demands for privacy and increases in the quantity and
variety of consumer data have engendered various business offerings
to allow companies, and in some instances consumers, to capitalize
on these developments. One such example is the emerging “personal
data economy” (PDE) in which companies, such as Datacoup,
purchase data directly from individuals. At the opposite end of the
spectrum, the “pay-for-privacy” (PFP) model requires consumers to
pay an additional fee to prevent their data from being collected and
mined for advertising purposes. This Article conducts a simultaneous
in-depth exploration of the impact of burgeoning PDE and PFP
models. It identifies a typology of data-business models, and it
uncovers the similarities and tensions between a data market
controlled by established companies that have historically collected
and mined consumer data for their primary benefit and one in which
consumers play a central role in monetizing their own data.
The Article makes three claims. First, it contends that PFP
models facilitate the transformation of privacy into a tradable
product in the online setting, may worsen unequal access to privacy,
and could further enable predatory and discriminatory behavior.
Second, while the PDE may allow consumers to regain a semblance
of control over their information by enabling them to decide when
and with whom to share their data, consumers’ direct transfer or
disclosure of personal data to companies for a price or personalized
deals creates challenges similar to those found in the PFP context
and generates additional concerns associated with innovative
monetization techniques. Third, existing frameworks and proposals
may not sufficiently ameliorate these concerns. The Article concludes
by offering a path forward.
*. Associate Professor of Law, New York Law School. For their valuable comments and
insights, I am grateful to Julie Cohen, Paul Schwartz, Chris Jay Hoofnagle, Jan Whittington, Peter
Swire, Kirsten Martin, Angela Campbell, Olivier Sylvain, Mary Madden, LaVonda Reed, Pamela
Foohey, Jim Hawkins, Stephen Sepinuck, Creola Johnson, Heather Hughes, Melissa Lonegrass,
Esme Caramello, Bennett Capers and Serena Williams.

1369

Electroniccopy
copyavailable
available at:
at: https://ssrn.com/abstract=3058835
Electronic
https://ssrn.com/abstract=3058835

1370

COLUMBIA LAW REVIEW

[Vol. 117:1369

INTRODUCTION .........................................................................................1371
I. PRIVACY DEMAND AND DATA VOLUME ......................................................1378
II. TYPOLOGY OF DATA AND PRIVACY MODELS .............................................1383
A. Traditional Data and Privacy Models ...............................................1383
1. Data-as-Payment Model ...............................................................1384
2. Freemium Model ..........................................................................1386
B. Pay-for-Privacy Models ...................................................................1387
1. Privacy-as-a-Luxury Model .........................................................1387
2. Privacy-Discount Model ..............................................................1390
C. Personal Data Economy Models ......................................................1392
1. Data-Insights Model .....................................................................1392
2. Data-Transfer Model ....................................................................1396
III. IMPLICATIONS OF PFP AND PDE MODELS ................................................1398
A. Unequal Access to Privacy ...............................................................1399
1. PFP Models ..................................................................................1399
2. PDE Models .................................................................................1404
B. Illusory Control and Choice ............................................................ 1411
1. PDE Models ................................................................................. 1411
2. PFP Models ..................................................................................1416
C. The PDE and New Monetization Techniques ..................................1417
D. Predatory and Discriminatory Behavior...........................................1420
1. PFP Models ..................................................................................1421
2. PDE Models .................................................................................1423
IV. EXISTING FRAMEWORKS AND RESPONSES................................................1425
A. FTC ..................................................................................................1425
B. Children’s Online Privacy Protection Act ........................................1431
C. Proposals to Restore the FCC Rules ................................................1433
V. THE PATH FORWARD ...................................................................................1438
A. The Promise of the PDE ...................................................................1438
B. Restrictions on PFP Discount Programs ..........................................1443
C. The FTC as the Main Regulator .......................................................1445
D. Monetization Restrictions ................................................................1450
E. Structuring PDE Arrangements ........................................................1451
CONCLUSION ..................................................................................................1453

Electroniccopy
copyavailable
available at:
at: https://ssrn.com/abstract=3058835
Electronic
https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1371

INTRODUCTION
“The benefits of the Internet have been proven and privacy is in
demand and people are willing to pay.”1
Nico Sell, Wickr
“It would make for a far more efficient market if consumers were
consciously aware of the trade-off occurring with regards to their
data, and were able to participate in the value-chain of their data,
beyond the opacity of a free app or service that appears unrelated to
data sales.”2
Matt Hogan, Datacoup
“Prior to Meeco, the power to capture, analyse and profit from
personal data has resided with businesses, government and social
networks. Meeco flips that model entirely around so that the individual
is an equal participant in the value created, controlling the use of his
or her personal data derived from every day occurrences and
transactions.”3
Katryna Dow, Meeco
In 2017, the Economist magazine proclaimed that “the world’s most
valuable resource is no longer oil, but data.”4 Companies, such as Facebook
and Google, have based their business models on collecting and analyzing user
data.5 These companies have amassed vast quantities of data, which “give[]
them enormous power.”6
1. Cadie Thompson, The Next Thing You’ll Pay for: Your Online Privacy, CNBC (Mar. 7, 2014),
http://www.cnbc.com/2014/03/07/the-next-thing-youll-pay-for-your-online-privacy.html
[http://perma.cc/ACM5-K93M].
2. Hollie Slade, Here’s How Slice Is Monetizing Over Two Million People’s Everyday Online
Purchases,
Forbes
(Sept.
26,
2014),
http://www.forbes.com/sites/hollieslade/
2014/09/26/heres-how-slice-is-monetizing-over-two-million-peoples-every-online-receipt/
#1a8db21068a6 [http://perma.cc/773X-EVH2].
3. Liz Leigh, Meeco Is a Life Management Platform that Gives Users Total Control of
Their Data, Startup Daily (Apr. 13, 2016), http://www.startupdaily.net/2016/04/meeco-lifemanagement-platform-gives-users-total-control-data/ [http://perma.cc/6XBH-H8RH].
4. Regulating the Internet Giants: The World’s Most Valuable Resource Is No Longer Oil, but Data,
Economist (May 6, 2017), http://www.economist.com/news/leaders/21721656-data-economydemands-new-approach-antitrust-rules-worlds-most-valuable-resource
[http://perma.cc/NRW8-DG7T] [hereinafter Regulating the Internet Giants].
5. See generally Chris Jay Hoofnagle & Jan Whittington, Free: Accounting for the Costs of
the Internet’s Most Popular Price, 61 UCLA L. Rev. 606, 628 (2014) [hereinafter Hoofnagle &
Whittington, Accounting for the Costs] (discussing Facebook’s and Google’s business models);
Nathan Newman, The Costs of Lost Privacy: Consumer Harm and Rising Economic Inequality in
the Age of Google, 40 Wm. Mitchell L. Rev. 849, 865 (2014) (discussing Google’s business
model).
6. Regulating the Internet Giants, supra note 4.

Electronic copy available at: https://ssrn.com/abstract=3058835

1372

COLUMBIA LAW REVIEW

[Vol. 117:1369

Established data brokers have played a central role in the market for
consumer data.7 A U.S. Senate Committee on Commerce, Science, and
Transportation staff report notes that data brokers compile information about
consumers from various sources, including social media and contracts with
other businesses.8 It is estimated that Acxiom, one of the largest data brokers,
has approximately twenty-three thousand servers scrutinizing the data of
millions of individuals.9 Once data brokers obtain consumer data, they
frequently transfer this information to unaffiliated parties.10
The Internet of Things (IOT)—a network of connected devices—presents
new opportunities for data brokers and other businesses to collect real-time and
increasingly detailed data about the habits, lives, and activities of consumers.11
Companies that provide IOT consumer products, such as Internet-enabled
washing machines, thermostats, baby monitors, and security cameras, can use
consumer data for their own purposes, and in many instances these companies
may also transfer or disclose this information to third parties.12 These data
include consumption-rate data, location data, health-related data, and
recordings of children’s voices.13 Thus, what has “changed [in the data market]
is the volume and nature of the data being mined from the Internet[,] . . . mobile

7. Staff of S. Comm. on Commerce, Sci. & Transp., 113th Cong., A Review of the Data
Broker Industry: Collection, Use, and Sale of Consumer Data for Marketing Purposes 1 (2013)
[hereinafter Staff of S. Comm. on Commerce, Sci. & Transp., Review of the Data Broker
Industry];
How
Much
Is Your
Personal
Information
Worth?,
WebpageFX,
http://www.webpagefx.com/blog/general/what-are-data-brokers-and-what-is-your-data-worthinfographic/ [http://perma.cc/UHR4-3HLX?type=image] [hereinafter PI Worth] (last visited July 28,
2017).
8. Staff of S. Comm. on Commerce, Sci. & Transp., Review of the Data Broker Industry, supra
note 7, at 15.
9. Natasha Singer, Mapping and Sharing the Customer Genome, N.Y. Times (June 16, 2012),
http://www.nytimes.com/2012/06/17/technology/acxiom-the-quiet-giant-of-consumer-databasemarketing.html (on file with the Columbia Law Review); see also PI Worth, supra note 7.
10. Data Brokers and “People Search” Sights, Privacy Rights Clearinghouse (Sept. 1, 2014),
http://www.privacyrights.org/consumer-guides/data-brokers-and-people-search-sites
[http://perma.cc/4DC6-PBYG] (last updated June 8, 2017).
11. AIG, The Internet of Things: Evolution or Revolution?, 4 (2015),
http://www.aig.com/content/dam/aig/america-canada/us/documents/business/casualty/
aigiot-english-report.pdf [http://perma.cc/98YJ-MCCC] (last visited July 28, 2017). See generally
Stacy-Ann Elvy, Commodifying Consumer Data in the Era of the Internet of Things, 59 B.C. L.
Rev. (forthcoming 2018) [hereinafter, Elvy, Commodifying Consumer Data] (on file with the
Columbia Law Review) (describing the different types of data that can be generated by IOT
devices).
12. Elvy, Commodifying Consumer Data, supra note 11, at 5 (describing the various ways in
which companies can disclose and monetize consumer data and discussing companies’ rights in
consumer-generated data).
13. Adam Greenfield, Rise of the Machines: Who Is the ‘Internet of Things’ Good for?, Guardian
(June 7, 2017), http://www.theguardian.com/technology/2017/jun/06/internet-of-things-smart-homesmart-city [http://perma.cc/7L9H-9ZTP] (discussing consumption, health and biometric data, and IOT
devices).

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1373

devices [and IOT devices].”14 As former Federal Trade Commission (FTC)
Commissioner Julie Brill has noted, consumers are losing “control over [their]
most private and sensitive information.”15
Today, companies have developed various approaches to monetizing
consumer data and privacy to exploit the rising data gold rush and corresponding demands for more privacy. The discount pay-for-privacy (PFP)
approach—which requires consumers to pay higher fees to avoid data
collection and targeted advertisements while offering discounts to consumers
who consent to these practices—is the latest business scheme to receive
widespread attention.16 In other types of PFP offerings, companies simply
charge higher prices for products that offer more privacy controls and data
protection without encouraging consumers to consent to data tracking and
disclosures by providing discounts.17
At least one Internet service provider (ISP) previously implemented a PFP
discount program. In response to the Federal Communications Commission’s
(FCC) privacy rules (FCC Rules), some ISPs contended in 2016 that they
should be permitted to charge higher prices to consumers who want to opt out
of tracking and the use of their data for advertisement purposes.18 The FCC
Rules would have imposed various notice-and-consent requirements and were
intended to “give consumers the tools they need to choose how their [ISPs] use
and share their personal data.”19 Congress subsequently repealed the FCC
Rules and the FCC’s ability to adopt similar rules in the future appears to be

14. Steve Kroft, The Data Brokers: Selling Your Personal Information, CBS News (Mar. 9,
2014),
http://www.cbsnews.com/news/data-brokers-selling-personal-information-60-minutes/
[http://perma.cc/K6MP-HM2L].
15. Julie Brill, Demanding Transparency from Data Brokers, Wash. Post (Aug. 15, 2013),
http://www.washingtonpost.com/opinions/demanding-transparency-from-data-brokers/2013/
08/15/00609680-0382-11e3-9259-e2aafe5a5f84_story.html?utm_term=.da2a9a935d04
[http://
perma.cc/A6Z9-G95X].
16. Letter from Senator Elizabeth Warren to Tom Wheeler, Chairman, FCC 2 (June 21,
2016)
[hereinafter
Warren
Letter],
http://www.warren.senate.gov/files/documents/2016-621_Letter_to_FCC_re_Privacy_Rulemaking.pdf [http://perma.cc/9WWT-7362] (describing Internet
service provider discount plans as “requir[ing] consumers to pay hundreds of dollars extra each
year so that [a company] does not collect and sell information on the websites they visit, the ads
they see, and the terms they enter into search engines”).
17. See infra section II.B.1.
18. Curtis Silver, Comcast Wants to Charge You Less for Broadband at the Expense of Privacy,
Forbes (Aug. 4, 2016), http://www.forbes.com/sites/curtissilver/2016/08/04/comcast-broadbandprivacy-fcc/#6a2308e6226d [http://perma.cc/PTW9-5KRP] (reporting that Comcast wants to
“present lower tiered broadband options to customers who have no problem with their data being
mined and exposed to advertisers”); see also Protecting the Privacy of Customers of Broadband
and Other Telecommunications Services, 81 Fed. Reg. 87,274 (Dec. 2, 2016), repealed by Act of
Apr. 3, 2017, Pub. L. No. 115-22, 131 Stat. 88 (codifying a joint resolution disapproving of the
FCC “Broadband and Telecommunications Services” privacy rules).
19. Fact Sheet: FCC Adopts Order to Give Broadband Consumers Increased Choice
over
Their
Personal
Information,
FCC
[hereinafter
FCC
Fact
Sheet],
http://apps.fcc.gov/edocs_public/attachmatch/DOC-341938A1.pdf (on file with the Columbia Law
Review) (last visited July 28, 2017).

Electronic copy available at: https://ssrn.com/abstract=3058835

1374

COLUMBIA LAW REVIEW

[Vol. 117:1369

restricted.20 Industry trade associations filed several petitions attacking various
aspects of the FCC Rules, including the notice and customer-approval requirements that would have been applicable to PFP discount programs.21 The repeal
of the FCC Rules is concerning in light of the common carrier exemption under
the Federal Trade Commission Act and ongoing litigation challenging the
FTC’s ability to regulate certain potentially harmful practices of common
carriers.22 These recent developments suggest that the issues this Article
evaluates are timely and significant.
While ISPs and other companies have been busy finding new ways to
capitalize on consumer data and demands for privacy, the growing “personal
data economy” (PDE) threatens to challenge the central role of data brokers
and other established companies in the consumer data market. The PDE is a
“user-centric” data concept that permits “individuals [to] take ownership of
their information so they can share it with businesses on their terms.”23
Commentators use various names to describe the PDE, including “the API of
Me” and the “Internet of Me.”24 In the last few years several domestic and
foreign Internet start-ups, such as Datacoup, Digi.me, and Meeco, have
emerged with the stated goal of allowing consumers to choose what data they
share and disclose to businesses.25 PDE companies depend significantly on
consumers, rather than data brokers and conventional businesses, to provide
consumer data, and some provide a venue for consumers to monetize their own
data.26
Some PFP and PDE models adopt seemingly divergent approaches to
consumer privacy and data collection. The discount PFP program maintains the
20. See 131 Stat. at 88 (codifying a joint resolution disapproving of the FCC “Broadband and
Telecommunications” Services privacy rules); 163 Cong. Rec. S1941 (daily ed. Mar. 23, 2017)
(statement of Sen. McConnell regarding the Congressional Review Act resolution to disapprove of
the FCC privacy rules); see also 5 U.S.C. § 801(b)(2) (2012) (noting that a rule that is
“substantially the same” as an agency rule disapproved under the Congressional Review Act “may
not be reissued” unless “specifically authorized by a law”); Jenna Ebersole, Trump Signs Bill
Nixing
FCC’s
Broadband
Privacy
Rules,
Law360
(Apr.
3,
2017),
http://www.law360.com/articles/908812/trump-signs-bill-nixing-fcc-s-broadband-privacy-rules
[http://perma.cc/8FHN-97H2].
21. Protecting the Privacy of Customers of Broadband & Other Telecomms. Servs., 32 FCC
Rcd. 1793, 1794 (Mar. 1, 2017) (granting stay petition in part).
22. See FTC v. AT&T Mobility LLC, 835 F.3d 993, 998 (9th Cir. 2016) (reasoning that the
common carrier exemption under the Federal Trade Commission Act is a “status-based”
exemption), reh’g en banc granted, No. 15-16585, 2017 WL 1856836, at *1 (9th Cir. May 9,
2017).
23. Mobile Ecosystem Forum, Understanding the Personal Data Economy: The Emergence
of
a
New
Data
Value-Exchange
3
[hereinafter
MEF
White
Paper],
http://mobileecosystemforum.com/wp-content/uploads/2016/11/Understanding-the-Personal-DataEconomy-Whitepaper.pdf [http://perma.cc/A6HZ-W79T] (last visited July 28, 2017).
24. Id.
25. Id.
26. Id.; see also Jaron Lanier, Who Owns the Future 20 (2014) (describing a proposal
similar to PDE monetization options in which consumers are compensated with “nanopayments”
for their contributions to customer databases).

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1375

existing data-market model whereby the benefits of mined consumer data flow
primarily between companies, with the added twist that consumers can pay
extra fees to avoid data collection and disclosures.27 In contrast, PDE programs
are described as empowering consumers to extract value from their own data
by, for instance, selling or providing access to their information to data
buyers.28
PFP and PDE models raise crucial questions about data collection,
privacy, and the role of consumers in the data market. Are PFP programs that
offer discounts to consumers that consent to data collection, data disclosures,
and data transfers beneficial to consumers? In the PDE setting, will companies
give consumers the opportunity to play a meaningful role in negotiating data
trade terms with PDE companies and unaffiliated entities as well as in
determining who can subsequently obtain and use their data? If consumers are
provided with a marketplace to actively monetize their own information,
should restrictions be imposed on the ability of parents to monetize the data of
their children pursuant to agreements with PDE companies? Should landlords
be able to monetize data generated by renters to obtain discounts from companies? Should landlords be permitted to require renters to consent to providing
access to their social media accounts or data from household IOT devices to
enable PDE companies to provide landlords with insights about renters? What
legal frameworks should be used to structure and govern agreements between
PDE companies and consumers? Should courts view PDE data-exchange
arrangements as enforceable contracts if significant portions of the terms of the
arrangement are contained in a privacy policy?29 Are there new ways in which
high-value, data-generating consumers can begin to monetize their own data—
for instance, by using their data as collateral to obtain financing in a transaction
subject to Article 9 of the Uniform Commercial Code (UCC)?
Rather than seeking to provide complete and comprehensive answers to all
of these inquiries, this Article aims to evaluate these questions with the goal of
generating discourse about the long-term viability of PFP and PDE models and
their potential impact on consumers.30 In doing so, this Article makes
27. See, e.g., Warren Letter, supra note 16, at 2 (describing the practice of ISPs that charge
consumers extra fees to prevent the provider’s collection and sale of their data).
28. See generally Tony Abraham & Marguerite Oneto, Consumers as Data Brokers: Should They
Sell Their Own Personal Data? 1–5 (May 6, 2015) (unpublished student paper, University of California,
Berkeley),
http://www.ischool.berkeley.edu/sites/default/files/projects/abraham-oneto-final-paper.pdf
[http://perma.cc/T7ZS-YGTG] (suggesting the PDE model may give consumers more control over their
privacy).
29. See Pamela Samuelson, Privacy as Intellectual Property?, 52 Stan. L. Rev. 1125, 1137
(2000) (describing a licensing framework for the privacy market prior to the rise of the PDE);
Abraham & Oneto, supra note 28, at 4 (hypothesizing a world of personal data markets).
30. Legal scholars have addressed related questions; however, this Article focuses on the
nascent PDE and PFP models. See generally Ian Ayres & Matthew Funk, Marketing Privacy, 20
Yale J. on Reg. 77, 96–97 (2003) (proposing a consumer opt-in regime for telemarketing); Scott
R. Peppet, The Unraveling of Privacy: The Personal Prospectus and the Threat of a FullDisclosure Future, 105 Nw. U. L. Rev. 1153, 1162–63 (2015) [hereinafter Peppet, The Unraveling
of Privacy] (discussing the signaling economy); Paul M. Schwartz, Property, Privacy, and

Electronic copy available at: https://ssrn.com/abstract=3058835

1376

COLUMBIA LAW REVIEW

[Vol. 117:1369

contributions to pressing privacy debates about how regulators, legislators, and
courts should respond to the collection, transfer, disclosure, and use of
consumer data.
The Article makes three points. First, it contends that PFP models
facilitate the transformation of privacy into a tradable or luxury product that is
primarily affordable by a select few in the online setting, subsequently
worsening unequal access to privacy and further enabling predatory and
discriminatory behavior.
Second, while the PDE may seemingly allow consumers to regain a
semblance of control over their information by enabling them to decide “when
and with whom to share their data,”31 the direct transfer or disclosure of
personal data by consumers to companies for a price or personalized deals
creates challenges similar to those found in the PFP context. The PDE also
generates additional concerns associated with innovative monetization options,
including the possible monetization of the data of minors and renters. As more
domestic companies begin to adopt the PDE model, these concerns may
become more prevalent. Some PDE companies may subsequently monetize
consumer data. If data access and transfer restrictions are not imposed, it may
be possible for the data to be bought by or disclosed to data brokers after the
initial transfer or disclosure by the consumer for a meager price or customized
discounts. Data transferees may use user data to make inferences about
consumer preferences as well as combine PDE data with consumer data from
other sources.
Third, current frameworks, such as the Children’s Online Privacy
Protection Act (COPPA) and other regulatory responses suffer from several
limitations and may not consistently remedy the concerns noted above. For
instance, COPPA, the main federal statute governing the data and privacy of
children, is limited to protecting the information of children under the age of
thirteen.32 Statutory and regulatory frameworks that rely excessively on a
notice-and-choice model are unlikely to adequately protect the interests of
Personal Data, 117 Harv. L. Rev. 2055, 2066–68 (2004) [hereinafter Schwartz, Property, Privacy,
and Personal Data] (discussing issues regarding compensating consumers for agreeing to listen to
telemarketing calls); Adam B. Thimmesch, Transacting in Data: Tax, Privacy, and the New
Economy, 94 Denv. L. Rev. 145, 157–81 (2016) (discussing the tax implications of the personaldata market); Scott R. Peppet, Smart Mortgages, Privacy and the Regulatory Possibility of
Infomedia 5 (Univ. of Colo. Law Sch., Working Paper No. 09-13, 2009) (calling for “fiduciary
information intermediaries to serve as trustees to sensitive information flows”); Abraham &
Oneto, supra note 28 (discussing PDE companies exclusively).
31. Dutch eHealth Start-Up 112Motion Introduces Wearable and a New Open Healthcare
Platform,
Medica
Mag.
(Oct.
3,
2016),
http://www.medica-tradefair.com/cgibin/md_medica/lib/pub/tt.cgi/Dutch_eHealth_start-up_112Motion_introduces_wearable_
and_a_new_open_healthcare_platform.html?oid=81828&lang=2&ticket=g_u_e_s_t
[http://
perma.cc/L2CT-ZFXZ].
32. 15 U.S.C. § 6501(1) (2012); see also Paul M. Schwartz & Daniel J. Solove, The PII
Problem: Privacy and a New Concept of Personally Identifiable Information, 86 N.Y.U. L. Rev.
1814, 1891–92 (2011) [hereinafter Schwartz & Solove, The PII Problem] (noting limitations of
the COPPA framework, including that it applies only to children under the age of thirteen).

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1377

consumers in the IOT setting.33 A sectoral approach to privacy may also lead to
regulatory gaps.
While there will likely be various instances in which PFP and PDE models
may be problematic, the Article not only highlights concerns about
discriminatory and predatory behavior and unequal access to privacy faced by
low-income consumers but also concentrates on the potential impact of PDE
models on children and tenants. The Article focuses on these groups for several
reasons. Housing is a necessity, and evidence suggests that members of
marginalized groups are more likely to rent.34 Poor families contribute a
significant share of their income to rent.35 Moreover, children are particularly
vulnerable to exploitation. The digital dossiers that may be compiled about
children from a young age may have long-term consequences once a child
reaches adulthood. The ubiquitous nature of IOT toys, social networks, and
various devices that minors use to access the Internet ensure that children begin
leaving digital footprints much earlier than previous generations.36
The Article concludes by proposing initial steps to alleviate potential
concerns associated with PFP and emerging PDE models. These steps include,
among other things, restrictions on the use of PFP discount programs in
industries that provide products that are necessary for equal participation by
citizens in the digital age; recommendations to PDE companies to ensure that
consumers have sufficient control over their data; evaluations of whether
restrictions should be imposed on the monetization of certain types of data,
including the data of children and renters; guidance on the best ways to
structure PDE agreements; and increased regulation of existing data brokers
and PDE markets to ensure that PDE companies keep their promises of
providing consumers with control over their data.
The remainder of this Article proceeds as follows: Part I evaluates the role
of the rapid expansion of the IOT, increases in the quantity and variety of data,
and the large number of prominent data breaches and leaks. These
developments have likely created an atmosphere in which consumers desire
some level of privacy, data control options, and data security. This Part
suggests that given potential increases in data volume and quality and privacy

33. See Elvy, Commodifying Consumer Data, supra note 11, at 10.
34. Matthew Desmond, Inst. for Research on Poverty, Fast Focus: Unaffordable America:
Poverty, Housing and Eviction 1 (2015) [hereinafter Desmond, Unaffordable America],
http://www.irp.wisc.edu/publications/fastfocus/pdfs/FF22-2015.pdf
[http://
perma.cc/W3J8-HKWF] (noting that the majority of African American and Hispanic families rent their
homes); see also Matthew Desmond, Housing, Pathways, Special Issue 2017, at 16, 16,
http://inequality.stanford.edu/sites/default/files/Pathways_SOTU_2017.pdf
[http://perma.cc/
TY23-KEMK] (“Whereas 71 percent of white families live in owner-occupied housing, only 41
percent of black families and 45 percent of Hispanic families do.”).
35. See Desmond, Unaffordable America, supra note 34, at 1.
36. See generally Amanda Lenhart, Pew Research Ctr., Teens, Social Media & Technology
Overview
2015
(2015),
http://www.pewinternet.org/files/2015/04/PI_TeensandTech_
Update2015_0409151.pdf [http://perma.cc/XVN3-ZWLC] (discussing recent trends in social media and
technology use by teenagers).

Electronic copy available at: https://ssrn.com/abstract=3058835

1378

COLUMBIA LAW REVIEW

[Vol. 117:1369

demand, it is not surprising that companies are offering and generating various
programs to exploit these developments.
Part II identifies a typology of data business models for use by scholars
doing future work in this area and highlights the connections between older
data business schemes and PDE and PFP programs.
Part III argues that while some of the concerns highlighted in earlier data
models discussed in Part II can also be found in both PFP and PDE models,
these new schemes may widen the gap between the “privacy haves and havenots.”37 Moreover, these models may permit companies to continue to monetize
consumer data to the detriment of consumers and engage in predatory and
discriminatory behavior while hiding behind the veneer of consumer
empowerment and control. These challenges, as well as issues associated with
how to structure monetization transactions involving consumers, must be
addressed.
In light of the concerns discussed in previous sections, Part IV evaluates
the efficacy of existing legislation and regulatory responses, such as COPPA;
the activities of the FTC; and recent proposals to restore the FCC Rules. Part V
concludes by discussing a path forward to begin addressing the concerns noted
in this Article. PDE companies face significant challenges that must be
considered in order to effectuate socially beneficial change across the data
market.
I. PRIVACY DEMAND AND DATA VOLUME
The precipitous growth of the IOT and the frequently reported data leaks
suffered by large companies will likely contribute to an environment in which
consumer demands for privacy and data security rise along with increases in
the quantity and types of consumer data. This presents various opportunities for
companies to monetize consumer privacy.
The IOT is expected to have a substantial impact on the lives of consumers.38 Increasingly, ordinary objects, such as refrigerators and washing
machines, are being connected to the Internet. Technology consulting firms
project that by 2020 there will be billions of Internet-enabled devices “in use
worldwide.”39 These IOT devices will likely provide convenience and
efficiency to consumers. However, this increased level of connectivity
simultaneously provides multiple opportunities for everyday objects to serve as
37. Colin J. Bennett & Rebecca Grant, Conclusion, in Visions of Privacy: Policy Choices
for the Digital Age 263, 266 (Colin J. Bennett & Rebecca Grant eds., 1999) (discussing the
“privacy haves and have-nots”). See generally Colin J. Bennett & Charles D. Raab, The
Governance of Privacy: Policy Instruments in Global Perspective 40 (2003) (same).
38. See generally Scott R. Peppet, Regulating the Internet of Things: First Steps Toward
Managing Discrimination, Privacy, Security, and Consent, 93 Tex. L. Rev. 85 (2014) [hereinafter
Peppet, Regulating the Internet].
39. Press Release, Gartner, Gartner Says 8.4 Billion Connected “Things” Will Be in Use in 2017, Up
31 Percent from 2016 (Feb. 7, 2017), http://www.gartner.com/newsroom/id/3598917
[http://perma.cc/56R3-8AYR].

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1379

continuous surveillance equipment that monitors and collects data about the
activities of consumers.
A 2017 FTC staff report illustrates this problem.40 Companies are frequently using cross-device tracking—connecting the activities of users “across
[their] smartphones, tablets, desktop computers,” and IOT devices—to collect
information about consumers.41 Companies can pervasively monitor
consumers’ activities and behaviors and create a “device graph”—“a map of
devices attached to each consumer, their devices and home.”42 Cross-device
tracking allows consumers to access their various online accounts from several
devices and supports businesses’ goals to combat fraud—for instance, by
flagging unknown devices.43 However, companies can combine a consumer’s
device graph data with offline information for data analytics and targeted
advertising purposes.44 Cross-device tracking can also be done not only by the
company that provides the initial service or product to the consumer but also by
third-party businesses.45 Companies frequently do not adequately disclose
cross-device tracking to consumers.46 The FTC’s review of the privacy policies
of one hundred top websites uncovered only three privacy policies that
specifically addressed “third-party cross-device tracking.”47
Despite this lack of disclosure and the likelihood that consumers may not
thoroughly understand the implications of continuous cross-device tracking,
surveys indicate that a significant number of consumers are using various selfhelp measures to protect their privacy.48 A Pew Research Center survey found
that approximately eighty-six percent of Americans have tried to hide their
online activities by deleting cookies and encrypting emails, and fifty-five
percent of those surveyed have also “taken steps to avoid observation by
specific people, organizations, or the government.”49 Results from another
report indicate that at least 309 million consumers currently use advertisementblocking tools,50 and another study found that thirty-two percent of American
40. FTC, Cross-Device Tracking, at ii (2017) [hereinafter FTC Cross-Device Report],
http://www.ftc.gov/system/files/documents/reports/cross-device-tracking-federal-trade-commissionstaff-report-january-2017/ftc_cross-device_tracking_report_1-23-17.pdf
[http://
perma.cc/EF7V-JSQU].
41. Id. at i.
42. Id. Other scholars have also forecasted the effects of “privacy-destroying technologies”
prior to the rise of the IOT. See generally A. Michael Froomkin, The Death of Privacy?, 52 Stan.
L. Rev. 1461 (2000).
43. FTC Cross-Device Report, supra note 40, at 5.
44. Id. at i.
45. Id. at 3–4, 8.
46. Id. at 8.
47. Id.
48. Id. at 8–9.
49. Lee Rainie et al., Pew Research Ctr., Anonymity, Privacy, and Security Online 2 (2013),
http://www.pewinternet.org/files/old-media//Files/Reports/2013/PIP_AnonymityOnline_
090513.pdf [http://perma.cc/66XH-A8CR].
50. PageFair, Adblocking Goes Mobile 5 (2016), http://pagefair.com/downloads/
2016/05/Adblocking-Goes-Mobile.pdf [http://perma.cc/4E4U-4QNB].

Electronic copy available at: https://ssrn.com/abstract=3058835

1380

COLUMBIA LAW REVIEW

[Vol. 117:1369

respondents use these tools because of concerns about privacy.51 These studies
suggest that consumers have some level of awareness about the extent to which
their online activities are being monitored.
In the IOT setting, a consumer’s online activity now includes the
performance of ordinary tasks, such as doing laundry using an Internet-enabled
washing machine52 and drinking water from an Internet-enabled Brita water
pitcher.53 Thus, in the age of the IOT “virtually every activity creates a digital
trace—more raw material for the data distilleries.”54
Given that the nature of online activities has expanded, it is not surprising
that the IOT and the development of smart cities provide new opportunities for
companies and institutions to track consumer activities and behaviors. In a case
currently before the Seventh Circuit, the court has to determine whether Fourth
Amendment protection extends to data smart-city readers collect regarding
citizens’ energy usage.55 The meters at issue generate 2,880 readings per
month, in contrast to predecessor analog meters that “provided only a single
monthly assessment, and a single reading per month.”56 The meters also
allegedly provide information about the time at which the energy was used by
the homeowner.57
The copious quantities of data that consumers generate from use of
everyday objects that are now connected to the Internet will increase the
amount of data and information about consumers and members of their
households and communities that are available for collection, analytics,
disclosure, and transfer to third parties. This new wealth of data can be used to
51. FTC Cross-Device Report, supra note 40, at 9 (citing Mimi An, Hubspot Research, Why
People Block Ads: And What It Means for Marketers and Advertisers 8 (2016),
http://research.hubspot.com/reports/why-people-block-ads-and-what-it-means-for-marketers-andadvertisers [http://perma.cc/BBH6-YEMQ]).
52. See, e.g., Connected Washers & Dryers, GE Appliances, http://www.geappliances.com/
ge/connected-appliances/washer-dryer-laundry.htm [http://perma.cc/7644-36UK] (last visited July 28,
2017).
53. See, e.g, Brita Infinity Wi-Fi Connected Pitcher, Brita, http://www.brita.com/
water-pitchers/infinity [http://perma.cc/AK4D-VNZ4] (last visited July 28, 2017).
54. Regulating the Internet Giants, supra note 4.
55. Allison Grande, Smart Meter Data Needs Privacy Protection, 7th Circ. Told, Law360
(Mar. 2, 2017), http://www.law360.com/articles/897628/smart-meter-data-needs-privacy-protection-7thcirc-told [http://perma.cc/Y3P4-3CNF] [hereinafter Grande, Smart Meter Data]; see also
Naperville Smart Meter Awareness v. City of Naperville, No. 11 C 9299, 2016 WL 5373052 (N.D.
Ill. Sept. 26, 2016) (granting summary judgment in favor of the city), appeal docketed, No. 16-3766
(7th Cir. Oct. 26, 2016); Naperville Smart Meter Awareness v. City of Naperville, 69 F. Supp. 3d
830, 841 (N.D. Ill. 2014) (granting defendant’s motion to dismiss plaintiff’s amended complaint
alleging Fourth Amendment claims, among other things). Additionally, the Supreme Court’s
anticipated decision in Carpenter v. United States is expected to address the connections between
data collection and disclosures and privacy expectations in specific circumstances. See United
States v. Carpenter, 819 F.3d 880, 890 (6th Cir. 2016) (holding that “the government’s collection
of business records containing cell-cite [location] data was not a search under the Fourth
Amendment”), cert. granted, 137 S. Ct. 2211 (2017).
56. Grande, Smart Meter Data, supra note 55.
57. Id.; see also Naperville Smart Meter Awareness, 69 F. Supp. 3d at 836.

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1381

more accurately make inferences about consumer preferences and to target
consumers for contracting.58
Additionally, in the IOT setting, “Cyberattacks and data breaches are facts
of life for government agencies, businesses and individuals alike . . . .”59
Notable cyberattacks have involved the Democratic National Committee and
Yahoo.60 The recent voter-data leak suffered by Deep Root Analytics, a data
analytics company employed by the Republican National Committee, exposed
the profiles of almost 200 million voters.61 A 2016 survey of consumer
responses to the prevalence of data breaches found that sixty-four percent of
Americans “have personally experienced a major data breach, and relatively
large shares of the public lack trust in key institutions . . . to protect their personal
information.”62 A 2017 report on consumer attitudes in ten countries, including
the United States, found that forty-nine percent of respondents were concerned
that their information could be stolen, and forty-eight percent were worried that
their data could be disclosed without their permission.63
The IOT will significantly impact the app economy, which is already a
$143 billion market.64 The IOT is expected to “drive the development of
millions of new [mobile] apps”—software programs that facilitate access to
services and other products.65 In some instances, companies describe mobile
applications as services in the terms of service agreements provided to

58. Regulating the Internet Giants, supra note 4 (“Algorithms can predict when a consumer
is ready to buy . . . or a person is at risk [of] a disease.”).
59. Kenneth Olmstead & Aaron Smith, Pew Research Ctr., Americans and
Cybersecurity
3
(2017),
http://assets.pewresearch.org/wp-content/uploads/sites/14/2017/
01/26102016/Americans-and-Cyber-Security-final.pdf [http://perma.cc/86SM-QEP5].
60. Id.
61. Natasha Bertrand, GOP Data Firm that Exposed Millions of Americans’ Personal
Information Is Facing Its First Class-Action Lawsuit, Bus. Insider (June 22, 2017),
http://www.businessinsider.com/deep-root-analytics-sued-after-data-breach-2017-6
[http://
perma.cc/TE98-SMZJ].
62. Olmstead & Smith, supra note 59, at 3.
63. Mobile Ecosystem Forum, Global Consumer Trust Report 2017, at 21 (2017) [hereinafter
MEF
2017
Consumer
Report],
http://mobileecosystemforum.com/wp-content/
uploads/2017/06/MEF_Global_Consumer_Trust_Report_2017.pdf
[http://perma.cc/HB9H-Z82C]
(discussing a survey of 6,500 consumers in ten countries, including the United States).
64. Brian Scarpelli et al., ACT | The App Ass’n, State of the App Economy 2 (5th ed. 2017),
http://actonline.org/wp-content/uploads/App_Economy_Report_2017_Digital.pdf
[http://
perma.cc/B6EH-8LGE].
65. The App Economy Forecast 2016, Waracle (June 21, 2016), http://waracle.net/app-economyforecast-2016/ [http://perma.cc/69JS-8Q5A]; see also Louis Columbus, Roundup of Internet of
Things
Forecast
and
Market
Estimates,
2016,
Forbes
(Nov.
27,
2016),
http://www.forbes.com/sites/louiscolumbus/2016/11/27/roundup-of-internet-of-things-forecastsand-market-estimates-2016/#73848438292d [http://perma.cc/L8AK-6W79] (discussing the economic
impact of the IOT and applications); Understanding Mobile Apps, FTC Consumer Info.,
http://www.consumer.ftc.gov/articles/0018-understanding-mobile-apps#basics
[http://perma.cc/FKX3-FGM8] (last visited July 28, 2017) (“A mobile app is a software program
you can download and access directly using your phone or another mobile device, like a tablet or
music player.”).

Electronic copy available at: https://ssrn.com/abstract=3058835

1382

COLUMBIA LAW REVIEW

[Vol. 117:1369

consumers.66 Users frequently control IOT devices through mobile and other
online applications.67 As manufacturers create more IOT devices, there will
likely also be a corresponding increase in the number of applications
companies provide and additional opportunities for the collection of IOT
consumer data.
A Pew Research Center survey evaluating consumer perceptions of smart
products found that consumers are “often cautious about disclosing their
information and frequently unhappy about what happens to that information
once companies have collected it.”68 Consumers are concerned about
identifying which entities are collecting their data, the types of data that those
entities are collecting, and who can subsequently obtain their data after it is
collected.69 Another Pew Research Center survey reports that seventy-four
percent of individuals believe that it is “very important” that they have the
ability to control who is able to obtain their data.70 Consumers across various
age ranges are concerned about their online privacy.71 These survey results
suggest that there is some level of consumer demand for mechanisms that
provide consumers with the ability to control their data and protect their
privacy, even though consumers may not be fully aware of when and how
companies use their data.

66. Mobile Applications as a Service: The SaaS Approach to Enterprise Mobile Apps,
mediafly,
http://www.mediafly.com/news/mobile-applications-as-a-service
[http://
perma.cc/LH6V-US4P] (last visited July 28, 2017) (describing mobile applications as services and
discussing a software-as-a-service approach to mobile applications); Terms of Service, Nest,
http://nest.com/legal/terms-of-service/ [http://perma.cc/5AP2-V5TW] (last updated Mar. 10, 2016)
(describing the company’s mobile application as services); Terms of Use, Weather Channel,
http://weather.com/legal [http://perma.cc/34NJ-RKLL] (last updated Dec. 6, 2013) (same).
67. Stacy-Ann Elvy, Hybrid Transactions and the Internet of Things: Goods, Services or
Software?, 74 Wash. & Lee. L. Rev. 77, 96, 98 (2017) [hereinafter Elvy, Hybrid Transactions]
(explaining how consumers control Nest thermostats through a mobile application); see also
Scarpelli et al., supra note 64, at 2 (“Without mobile apps, the $8 trillion internet of things (IoT)
revolution would not exist.”).
68. Lee Rainie & Maeve Duggan, Pew Research Ctr., Privacy and Information Sharing 2
(2016) [hereinafter Rainie & Duggan, Privacy Study], http://www.pewinternet.org/files/
2016/01/PI_2016.01.14_Privacy-and-Info-Sharing_FINAL.pdf [http://perma.cc/URE8-G4KB].
69. See Mary Madden & Lee Rainie, Pew Research Ctr., Americans’ Attitudes About
Privacy, Security, and Surveillance 3 (2015), http://www.pewinternet.org/2015/05/20/
americans-views-about-data-collection-and-security/#few-feel-they-have-a-lot-of-control-over-how-muchinformation-is-collected-about-them-in-daily-life [http://perma.cc/W5JM-ZNNS].
70. Lee Rainie, The State of Privacy in Post-Snowden America, Pew Research Ctr.: Fact
Tank (Sept. 21, 2016), http://www.pewresearch.org/fact-tank/2016/09/21/the-state-of-privacy-inamerica/ [http://perma.cc/7ZD7-D98J]; see also Jay P. Kesan et al., A Comprehensive Empirical Study of
Data Privacy, Trust, and Consumer Autonomy, 91 Ind. L.J. 267, 267 (2016) (contending that
survey data on the question of consumer demand for privacy indicates that “consumers often want
more options than the market gives them”).
71. Jay Stanley, Do Young People Care About Privacy?, ACLU: Free Future (Apr. 29, 2013),
http://www.aclu.org/blog/do-young-people-care-about-privacy [http://perma.cc/2X9P-TJY5] (discussing
various polls indicating that millennials and young people are deeply concerned about their online
privacy).

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1383

As consumers obtain more knowledge about the types of data that online
entities can collect from their use of everyday Internet-enabled products, it is
likely that consumer concerns about privacy will become even more prevalent,
resulting in additional calls for more privacy and options for consumers to
control their IOT-generated data. When privacy is in demand and data volume
and quality increases significantly, enterprises are likely to develop offerings to
exploit these developments.
II. TYPOLOGY OF DATA AND PRIVACY MODELS
This section identifies a typology of several business approaches to user
data and privacy. The typology includes earlier models, such as the data-aspayment and freemium models, and variations of PFP and PDE models. The
typology fosters a better understanding of the various privacy and datacollection issues each approach raises and uncovers the similarities and
differences between these new approaches and older business models.
By relying significantly on mining consumer data and the resulting
advertising revenue, large Internet companies successfully using the data-aspayment and freemium models have likely also contributed to a setting in
which some consumers are interested in obtaining more privacy and data
controls. The success of companies using these older approaches has likely
encouraged other businesses, including ISPs and a new generation of start-ups,
to adopt innovative methods to capitalize on consumer data and demands for
privacy, resulting in the rise of PFP and PDE offerings.
A.

Traditional Data and Privacy Models

The data-as-payment (free) and freemium models raise significant privacy
concerns for consumers. While consumers may have some understanding of the
types of data that companies collect, as discussed in Part I above, consumers
may not fully understand the extent to which they have traded away their data
and privacy in exchange for a “free” product. The interconnected world of the
IOT, where it may eventually be possible to link an Internet-enabled washing
machine to a user’s Facebook or Google account, exacerbates these concerns.
Imagine what companies could do with this wealth of information.
The term freemium refers to a combination of “free” and “premium,”
whereby the introductory features of a product are offered for free but a user
must pay a fee to access advanced features.72 The freemium model generates
72. Anja Lambrecht et al., How Do Firms Make Money Selling Digital Goods Online?, 25
Marketing Letters 331, 332 (2014) (“Firms can also combine multiple revenue streams, for example, charge customers for a subset of services and generate additional revenues from selling
advertising or information.”); Clarence Lee et al., Designing Freemium: Strategic Balancing of
Growth
and
Monetization
2
(July
14,
2017)
(unpublished
manuscript),
http://faculty.som.yale.edu/vineetkumar/research/Freemium_LeeKumarGupta_2017.pdf
[http://perma.cc/VD2Z-5YBQ] (describing the freemium model as a hybrid strategy); Vineet
Kumar, Making “Freemium” Work, Harv. Bus. Rev. (May 2014), http://hbr.org/2014/05/makingfreemium-work [http://perma.cc/6WL2-GU57].

Electronic copy available at: https://ssrn.com/abstract=3058835

1384

COLUMBIA LAW REVIEW

[Vol. 117:1369

similar privacy concerns as the data-as-payment model. Consumers generally
have little control over their data and privacy under both models. Consumers
may not always be aware of the extent to which companies that use freemium
models monitor their activities and how their data can be used and disclosed to
third parties. Despite this lack of awareness, as other privacy scholars
critiquing the notice-and-choice model have noted, more notice and choice is
not likely the solution since Internet companies could use additional notice of
privacy and data policies to justify data practices that are detrimental to consumer interests.73
1. Data-as-Payment Model. — Numerous companies base their business
models on the collection and monetization of consumer data.74 Twitter,
Instagram (Facebook), Google, and the makers of hundreds of mobile
applications advertise their products as “free” to consumers.75 At least one
scholar has critiqued the use of the data-as-payment label, contending that such
a description is misleading since “Internet users do not know the ‘prices’ they
are paying for products and services . . . because they cannot reasonably
estimate the marginal disutility that particular instances of data collection
impose on them.”76 While this is likely true, regardless of the label used to
describe this model (for example, “free model,” “data-as-payment model,”
“bartering-with-data model,” “online advertisement-based business model,”
“zero-price model,” or “ad-supported model”), consumers generally provide
their data (and perhaps their attention) to companies when using products that
are described as “free.” Thus, these products are not actually “free,” and as
such, use of the terms “free model” or “zero-price model” is perhaps also
misleading. Once a consumer elects to use a “free” mobile application software
or other “free” online product, the consumer engages in an unequal bargain of
sorts in which data generated from their use of the product will be provided to

73. See, e.g., Helen Nissenbaum, A Contextual Approach to Privacy Online, Dædalus, J.
Am. Acad. Arts & Sci., Fall 2011, at 32, 34 (“[T]here is considerable agreement that transparencyand-choice has failed.”).
74. See, e.g., Bernard E. Harcourt, Exposed: Desire and Disobedience in the Digital Age 6
(2015) (describing Facebook’s Atlas product, which shares user information collected through
data-mining technology).
75. See, e.g., Erin Bernstein & Theresa J. Lee, Where the Consumer Is the Commodity: The
Difficulty with the Current Definition of Commercial Speech, 2013 Mich. St. L. Rev. 39, 40
(“Companies like Facebook, Google, and Twitter offer services used by billions of users that have
become central to our day-to-day lives. These services are free to users.” (footnote omitted));
Nicole A. Ozer, Putting Online Privacy Above the Fold: Building a Social Movement and
Creating Corporate Change, 36 N.Y.U. Rev. L. & Soc. Change 215, 226–28 (2012) (discussing
Facebook’s and Google’s use of the data-as-payment model and noting that users pay for “free
services” with “data about themselves”); see also John M. Newman, Copyright Freeconomics, 66
Vand. L. Rev. 1409, 1439 (2013) [hereinafter Newman, Copyright Freeconomics] (discussing the
ad-supported model in which “consumers . . . are able to access zero-price content that is
accompanied by advertisements” and firms “pay the content provider for advertisement space”).
76. Katherine J. Strandburg, Free Fall: The Online Market’s Consumer Preference
Disconnect, 2013 U. Chi. Legal F. 95, 96–99.

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1385

the company.77 Data are traded (whether knowingly or unknowingly) by the
consumer to acquire the “free” product.78 It is an imperfect barter transaction in
which data are swapped for a product. The value of the data may exceed the
value of the product provided. Of course, use of the term “data-as-payment” in
this Article is not meant to suggest that data are money or currency, or that
consumers understand the “price” they pay for “free” products. Instead, it is
simply one of many imperfect labels that could be used to describe consumers’
provision of data in order to obtain “free” or “zero-price” products in the online
setting.
Companies can monitor a consumer’s habits, including Internet browsing
on third-party websites, not only from the consumer’s direct use of the product
but also by using cookies and other mechanisms that enable data collection and
tracking even when the product is not in use.79 The Twitter, Facebook, and
Google icons on various websites enable this process.80
Further evidence of the use of the data-as-payment model can be found in
a report on the app economy by the Organization for Economic Cooperation
and Development.81 The report found that free apps, which frequently depend
on the use of targeted advertising as a revenue model, are significantly more
“likely to ask for permissions to see account information, location information,

77. Hoofnagle & Whittington, Accounting for the Costs, supra note 5, at 624–25 (describing
the exchange of consumer data for a free product as “trade, even if the trade occurs without a
price”); see also 16 C.F.R. § 251.1 (2017) (discussing the meaning of “Free,” “the offer of ‘Free’
merchandise or service as a special bargain,” and the potential for consumers to be misled).
78. See generally Bernstein & Lee, supra note 75, at 82 n.208 (“In many ways the new
information economy is a barter economy, with something of value, in this case data, exchanged
for a good or service in lieu of using money.”); Hoofnagle & Whittington, Accounting for the
Costs, supra note 5, at 626 (describing the use of the data-as-payment business model);
Thimmesch, supra note 30, at 147 (describing the data-as-payment model as a “barter transaction”
and contending that “the digital products of today’s economy are not free even though they are
provided without a cash charge [because] consumers buy access to those products with
their data.”); Sparks & Honey Cultural Strategists, Bartering with Personal Data: In the Future,
Everyone Will Be Private for 15 Minutes, Big Think, http://bigthink.com/amped/bartering-withpersonal-data-in-the-future-everyone-will-be-private-for-15-minutes
[http://perma.cc/D6LX-XSMG]
(last visited July 28, 2017) (describing the exchange of data for free services).
79. Harcourt, supra note 74, at 3–4; see also Cookies & Other Storage Technologies,
Facebook, http://www.facebook.com/policies/cookies/ [http://perma.cc/8MZ5-GXGW] (last
updated Mar. 20, 2017).
80. Harcourt, supra note 74, at 3–4; see also What Kinds of Information Do We Collect?,
Facebook, http://www.facebook.com/about/privacy/update#what-kinds-of-information-do-we-collect
[http://perma.cc/DCT7-QMFN] (last updated Sept. 29, 2016).
81. Deborah Alcocer Delano & Taylor Reynolds, The App Economy 25 (OECD Dig. Econ. Papers,
No. 230, 2013), http://dx.doi.org/10.1787/5k3ttftlv95k-en (on file with the Columbia Law Review); see also
Mark Hachman, The Price of Free: How Apple, Facebook, Microsoft and Google Sell You to Advertisers,
PC
World
(Oct.
1,
2015),
http://www.pcworld.com/article/2986988/
privacy/the-price-of-free-how-apple-facebook-microsoft-and-google-sell-you-to-advertisers.html
[http://perma.cc/QX5L-457E] (describing the data-collection practices of companies that provide
free services).

Electronic copy available at: https://ssrn.com/abstract=3058835

1386

COLUMBIA LAW REVIEW

[Vol. 117:1369

personal information and messages.”82 Additionally, in some instances
companies that provide free apps obtain additional revenue from “in-app
purchases,” “promotion of non-digital goods,” and “resale of data collected via
app use.”83
When products are provided for “free” in exchange for data, claims of
alleged violations of statutes aimed at protecting consumers may not be
viable.84 For instance, in Ellis v. Cartoon Network, Inc., the Eleventh Circuit
held that “a person who download[ed] and use[d] a free mobile application on
his smartphone to view freely available content, without more, [was] not a
‘subscriber’ and therefore not a ‘consumer’ under the [Video Privacy Protection
Act].”85 The court reasoned that while an individual need not pay for a mobile
application in order to qualify as a subscriber, “some type of commitment,
relationship, or association (financial or otherwise) between a person and an
entity” was required.86
2. Freemium Model. — Over the last several years, freemium has been
the “dominant business model among internet start-ups and smartphone app
developers.”87 Dropbox and LinkedIn are examples of companies that have
used this model.88 With freemium, companies may obtain revenue not only
from advertisements but also from the subscription fees users pay to access
upgraded options.89
Under the freemium model, consumers are still exchanging their data or
privacy to access the free features of the product, but some consumers are also

82. Delano & Reynolds, supra note 81, at 41 (noting that these permissions may not always
be necessary in order for the app to function).
83. Id. at 22–25.
84. Hoofnagle & Whittington, Accounting for the Costs, supra note 5, at 658–59 (suggesting
that “the transfer of personal information [should be viewed] as an exchange for value”).
85. 803 F.3d 1251, 1252 (11th Cir. 2015); see also id. at 1253, 1256 (stating that under the
Video Privacy Protection Act “the term ‘consumer’ means any renter, purchaser, or subscriber of
goods or services from a video tape service provider” and that payment is one factor a court
should evaluate in assessing whether an individual qualifies as a subscriber under the statute);
Recent Cases, Statutory Interpretation—The Video Privacy Protection Act—Eleventh Circuit
Limits the Scope of “Subscriber” for VPPA Protections.—Ellis v. Cartoon Network, Inc., 803 F.3d
1251 (11th Cir. 2015), 129 Harv. L. Rev. 2011, 2011 (2015).
86. Ellis, 803 F.3d at 1256.
87. Kumar, supra note 72; see also Newman, Copyright Freeconomics, supra note 75, at
1439–40 (suggesting that “‘freemium’ allows content providers to price discriminate by offering
one version of their platform (typically with fewer products, more advertisements, bandwidth
limitations, or some combination of the three) for $ 0.00, while offering a premium version of the
platform at a positive price”); Koen Pauwels & Allen Weiss, Moving from Free to Fee: How
Online Firms Market to Change Their Business Model Successfully, 72 J. Marketing 14, 27–28
(2008) (discussing how companies can transition from a data-as-payment model to a freemium
model).
88. Kumar, supra note 72.
89. Newman, Copyright Freeconomics, supra note 75, at 1441 (“[T]o the extent
some freemium models contain an ad-supported, zero-price element, that element similarly
generates revenues based on usage.”).

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1387

paying a monetary price to access the other features of the product.90 As
Professors Chris Hoofnagle and Jan Whittington have noted, “Many firms with
freemium business models have products to sell, yet devote remarkable
amounts of attention and investment to the collection of data from and about
free-riding consumers of their products.”91 For instance, Everalbum was
recently accused of deceiving its users into providing information from their
contacts and subsequently sending automated text messages to every person in
a user’s contacts.92
B.

Pay-for-Privacy Models

The most significant concern raised by PFP models is the further
transformation of privacy into a product that can be sold and purchased. This
occurs when consumers must pay for privacy (whether as a luxury product
offered at moderate or expensive prices or a higher price offered in conjunction
with a privacy-invasive discount). Pay-for-privacy models also raise concerns
similar to those found in traditional models, including a potential lack of
consumer knowledge and understanding about data and privacy-related issues.
Consumers may simply purchase products that lack privacy and security
features because they are cheaper than devices that have such features without
considering broader privacy and security issues associated with less expensive
products. Moreover, consumers may not understand the implications associated
with accepting a discount in exchange for permitting companies to collect,
mine, and disclose their data. As a result, these models exacerbate concerns
about unequal access to privacy and questionable control and choice as will be
discussed in Part III below.
1. Privacy-as-a-Luxury Model. — Under the privacy-as-a-luxury model,
companies offer services and devices that provide consumers with more
privacy and data-protection options at a higher price than other competing
products. Companies using aspects of this model recognize the growing
demand for privacy and security controls described in Part I above.
Primium, a term that consulting firm Arthur D. Little appears to have
coined, means “privacy at a premium.”93 This proposed model recognizes that
90. See, e.g., Life Is Connected, Ever, http://www.ever.com/#lifes-connected
[http://perma.cc/2MZQ-J9GG] (last visited July 28, 2017) (describing free and paid options Ever
offers).
91. Hoofnagle & Whittington, Accounting for the Costs, supra note 5, at 634; see also
Privacy
Policy,
LinkedIn,
http://www.linkedin.com/legal/privacy-policy
[http://
perma.cc/MW7B-HLDV] (last visited July 28, 2017) (“We use cookies and similar technologies . . . to recognize you and/or your device(s) on, off and across different Services and
devices. . . . You can also opt out . . . .”).
92. Shayna Posses, App Maker Faces Suit over Text to Users, Law360 (May 15, 2017),
http://www.law360.com/articles/923105/app-maker-faces-suit-over-texts-to-users-contacts
[http://
perma.cc/9XAB-YR7W].
93. Sai Prakash Iyer et al., Primium—Business Models for a Privacy-Conscious World, 2014 Prism,
no. 1, at 55, 55–57, http://www.adlittle.com/downloads/tx_adlprism/Primium.pdf [http://perma.cc/4Q8P64ZD] (describing primium and distinguishing it from the free and freemium models). The

Electronic copy available at: https://ssrn.com/abstract=3058835

1388

COLUMBIA LAW REVIEW

[Vol. 117:1369

some consumers are prepared to pay higher fees for privacy. 94 This model
“considers privacy control by the user as a key product attribute that can be
used to differentiate [related] offerings from current free and paid (including
Freemium) offerings that provide low levels of privacy control to users.”95
Arthur D. Little estimates that by 2020 the “market size” for businesses using
the primium model will expand to $5 to $6 billion.96 The consulting firm
expects the user base of the data-as-payment and the freemium models to
splinter into additional segments with an increase in the number of users that
are willing to pay higher prices for better privacy options.97 Thus, a company
could offer three types of products to consumers: (1) a free product, (2) a basic
paid product (freemium), and (3) a primium product that combines the basic
paid product with more privacy and data controls.98 The revenue streams of
companies using this model would include advertisement revenue and fees
freemium and primium customers pay.99
Companies that do not adopt the primium model could also begin to offer
products with more privacy controls while simultaneously charging consumers
higher prices in order to access such products. At this point, one can only
assume that companies that adopt the privacy-as-a-luxury model will attempt to
ensure third parties do not have unlimited access to consumer data generated
from the use of their products. This could eventually impact the ability of data
brokers to obtain consumer data associated with such products. Despite
arguments that suggest that consumers are unwilling to pay for privacy, given
the expected data gold rush and privacy issues associated with the IOT
discussed in Part I, there may very well be high consumer demand for such
products.100
Although one could view privacy as being different from security,
evidence of some aspects of the privacy-as-a-luxury model can also be found in
the smartphone context. Android is the most frequently used operating system
consulting firm suggests that “[s]ome intermediaries” currently provide “Primium-like products to
specific customer segments such as schools, government institutions and enterprises.” Id. at 57.
94. Id. at 55.
95. Id. at 56.
96. Id. at 57.
97. Id. at 57–58.
98. Id. at 58 (discussing a visual depiction of the market evolution of primium business
models).
99. Id.
100. Alastair R. Beresford et al., Unwillingness to Pay for Privacy: A Field Experiment 6 (Inst. for the
Study of Labor, Discussion Paper No. 5017, 2010), http://ftp.iza.org/dp5017.pdf [http://perma.cc/2TP4DUP2]; see also Adam Shostack & Paul Syverson, Naval Research Lab. Release No. 04-1221.11128, What Price Privacy? (And Why Identity Theft Is About Neither Identity nor Theft) 1
(2004),
http://www.nrl.navy.mil/itd/chacs/sites/
www.nrl.navy.mil.itd.chacs/files/pdfs/ShostackSyverson2004.pdf [http://perma.cc/23A9-FUFT]; David
Hoffman, Privacy Is a Business Opportunity, Harv. Bus. Rev. (Apr. 18, 2014),
http://hbr.org/2014/04/privacy-is-a-business-opportunity [http://perma.cc/69SS-84AV] (contending that
because of the IOT, “individuals will need products to manage their online reputations and protect
their identities”). See generally L. Jean Camp & Stephen Lewis, “Economics of Information
Security,” Advances in Information Security (2004).

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1389

on smartphones;101 yet, commentators suggest that Google’s efforts to encrypt
Android devices lags significantly behind Apple’s encryption mechanisms102
and that very few Android phones are encrypted when compared to iPhones.103
Consumers can purchase less secure Android phones for as little as $49.99.104
On the other hand, Silent Circle offers a privacy and security-centered Android
smartphone at a premium price of $799.105
101. Adrian Fong, The Role of App Intermediaries in Protecting Data Privacy, 25 Int’l J.L.
Info. Tech. 85, 86 (2017) (“Apple’s iOS [has] more than 700 million active iOS users, and
Google’s Android OS [has] more than 1.4 billion users.”); Steven J. Vaughn-Nichols, Sorry
Windows, Android Is Now the Most Popular End-User Operating System, ZDNet (Apr. 3, 2017),
http://www.zdnet.com/article/sorry-windows-android-is-now-the-most-popular-end-user-operatingsystem/ [http://perma.cc/3W7S-WL82].
102. Kaveh Waddell, Encryption Is a Luxury, Atlantic (Mar. 28, 2016),
http://www.theatlantic.com/technology/archive/2016/03/the-digital-security-divide/475590/
[http://perma.cc/2ATJ-SF2H] (“Google recently required that all new Android devices encrypt
device data by default—but exempted slower (and therefore cheaper) phones, making encryption
a de-facto luxury feature.”); see also Conner Forrest, The State of Mobile Device Security:
Android
vs.
iOS,
ZDNet
(July
11,
2016),
http://www.zdnet.com/
article/the-state-of-mobile-device-security-android-vs-ios/ [http://perma.cc/X92L-FVZ2] (contending
that IOS systems offer more security than Android systems); Matthew Green, The Limitations of
Android N Encryption, A Few Thoughts on Cryptography Engineering (Nov. 24, 2016),
http://blog.cryptographyengineering.com/2016/11/24/android-n-encryption/
[http://
perma.cc/36J6-LG7Y] (describing ineffective Android encryption in comparison to Apple’s); Ari Levy,
Can Apple Still Claim Its iPhones Are Secure?, CNBC (Mar. 29, 2016),
http://www.cnbc.com/2016/03/29/can-apple-still-claim-its-iphones-are-secure.html
[http://
perma.cc/R967-74S4] (stating that Android phones are “known for being less secure than
iPhones”); Christopher Soghoian, Your Smartphone Is a Civil Rights Issue, TED (June 2016),
http://www.ted.com/talks/christopher_soghoian_your_smartphone_is_a_civil_rights_issue
[http://perma.cc/4HMM-6ZEY] (describing the encryption differences between Android and
Apple); Liam Tung, iPhone Encryption Is Six Years Ahead of Android: Cryptographer, CSO
(Nov. 25, 2016), http://www.cso.com.au/article/610671/iphone-encryption-six-years-ahead-androidcryptographer [http://perma.cc/ST4V-LDRB] (describing Google’s allegedly ineffective full-disk
encryption system and comparing it to Apple’s).
103. Jack Nicas, Google Faces Challenges in Encrypting Android Phones, Wall St. J. (Mar. 14, 2016),
http://www.wsj.com/articles/google-faces-challenges-in-encrypting-android-phones-<PRESIDIO_ANONYMIZED_PHONE_NUMBER> (on file
with the Columbia Law Review) (suggesting “that less than ten percent of Android phones
worldwide are encrypted in comparison to ninety-five percent of iPhones”); Nathan OlivarezGiles, Google’s Android Security Improves—for the Few; Only 4.6% of Supported Android Devices
Run Latest, Most Secure Version, Wall St. J. (Mar. 14, 2016), http://www.wsj.com/articles/as-googlesandroid-security-improves-fragmentation-problems-linger-1461240003 (on file with the Columbia Law
Review); see also Andrew Cunningham, Why Are So Few Android Phones Encrypted, and Should You
Encrypt Yours?, Arstechnica (Mar. 16, 2016), http://arstechnica.com/gadgets/2016/03/why-are-sofew-android-phones-encrypted-and-should-you-encrypt-yours/ [http://perma.cc/FFV5-Z6RC].
104. See Dan Cohen, It’s Not Only the Rich Teens that Have Smartphones, Atlantic (Apr. 15,
2016),
http://www.theatlantic.com/technology/archive/2016/04/not-only-rich-teens-have-cellphones-digital-divide/478278/ [http://perma.cc/YA48-FJJJ] [hereinafter Cohen, Rich Teens];
Sascha Segan, Get America’s Cheapest Android Nougat Phone via Amazon, PC Mag. (Mar. 24,
2017),
http://www.pcmag.com/news/352602/get-americas-cheapest-android-nougat-phone-viaamazon [http://perma.cc/E89T-77PG] (discussing Android phones ranging in price from $49.99 to
$99.99).
105. See Devices, Silent Circle, http://silent-circle.myshopify.com/collections/devices
[http://perma.cc/7BQS-P3PX] (last visited Sept. 7, 2017) (offering a refurbished Blackphone 2 for

Electronic copy available at: https://ssrn.com/abstract=3058835

1390

COLUMBIA LAW REVIEW

[Vol. 117:1369

Companies may also use a subscription-based, pay-for-privacy model.
These companies charge seemingly moderate monthly fees for privacycentered products.106 For instance, businesses that provide virtual private
network (VPN) products require users to pay monthly or annual subscription
fees.107 VPN products can secure a user’s Internet connection and provide users
with “greater control over how [they] appear online” by hiding a user’s IP
address, thereby “making it harder for advertisers (or spies, or hackers) to
track . . . online [activity].”108 Rather than paying a subscription fee to access
an additional service that is seemingly unrelated to privacy protection,
consumers are paying a subscription fee for privacy protection. Since the repeal
of the FCC Rules, interest in consumer use of VPNs has increased.109 In some
instances, a VPN company may also provide some of its services for “free”
through an “ad-supported” freemium model.110 Other companies, such as
FastMail, provide privacy driven services through monthly or yearly
subscription fees as an alternative to companies that offer similar products via
the data-as-payment model.111
2. Privacy-Discount Model. — When a company implements a privacydiscount program, consumers also pay for privacy controls by incurring higher
fees. However, unlike in the privacy-as-a-luxury model, consumers are
encouraged to relinquish their privacy and data through the use of discounts.
For instance, one ISP previously provided a plan that gave consumers
approximately $30 off monthly fees if they allowed the company to use their
$539); see also Zack Whittaker, Silent Circle Blackphone 2 Review: A Secure Android Phone with
a Privacy Punch, ZDNet (Sept. 28, 2015), http://www.zdnet.com/product/silent-circle-blackphone-2/
[http://perma.cc/R5W6-MQ2D].
106. See, e.g., Pricing, HideIPVPN, http://www.hideipvpn.com/pricing [http://perma.cc/
EEH4-5DFG] (last visited July 28, 2017) (describing VPN products ranging from $9.99 per month
(or $119.88 per year) to $5.99 per month (or $71.88 per year)).
107. Max Eddy, The Best VPN Services of 2017, PC Mag. (Feb. 28, 2017),
http://www.pcmag.com/article2/0,2817,2403388,00.asp (on file with the Columbia Law Review)
[hereinafter Eddy, Best VPN Services]; see also Max Eddy, Spotflux Premium VPN Review, PC
Mag. (May 1, 2017), http://www.pcmag.com/article2/0,2817,2453787,00.asp (on file with the
Columbia Law Review) (noting that one provider’s VPN subscription fees range from a mobileonly plan for $29.99 a year to more costly subscription fees that cover multiple devices for $37.99
a year).
108. Eddy, Best VPN Services, supra note 107.
109. Congress Voted to Roll Back Internet Privacy Rules. Now People Are Looking to VPNs,
Fortune (Mar. 28, 2017), http://fortune.com/2017/03/28/congress-internet-privacy-rules-vpns/
[http://perma.cc/VT8E-JB9Z].
110. Max Eddy, Protect Yourself with a Free VPN, PC Mag. (May 11, 2017),
http://au.pcmag.com/software/47857/feature/protect-yourself-with-a-free-vpn-service (on file with the
Columbia Law Review).
111. FastMail, http://www.fastmail.com/ [http://perma.cc/9ENE-YF9N] (last visited July 28,
2017) (“As a paid service, we only serve you, our customer. This means we have no split
loyalties, no mining of your personal data, no sharing it with third parties, and no ads, ever.”);
see also Pauline Glikman & Nicolas Glady, What’s the Value of Your Data?, TechCrunch (Oct.
13, 2015), http://techcrunch.com/2015/10/13/whats-the-value-of-your-data/ [http://perma.cc/MM3PLVJC] (describing FastMail as an alternative to Gmail and Zoho as an alternative to Google
Docs).

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1391

web-browsing information “to tailor ads and offers.”112 Not surprisingly, the
company reported that since it began offering its PFP program, a large segment
of its customers chose to participate in the program.113
The use of PFP discount programs suggests that companies are aware that
some segments of consumers are willing to pay for privacy and data controls.
In the data-as-payment model, companies monetize consumer data and rely
significantly on advertisement revenue. In the freemium context, “the user pays
for enhanced features,” which may include “the absence of adverts.”114 With
the discount model consumers are providing various sources of revenue to
companies, including but not limited to: (1) data provided by consumers who
accept discounts, which can be analyzed and used to generate advertisement
revenue, among other things, and (2) higher fees paid by those consumers who
are willing to pay for privacy and opt out of data collection.
In the discount-program setting, consumers who choose to take the
discount must trade in their privacy and data. Under the data-as-payment
model, consumers may unknowingly barter using their data to acquire a “free”
service. In the discount model, consumers exchange their data and privacy for a
discount. One could argue that consumers receive compensation (a reduced
price) in exchange for their data. Consumers who elect to take the discount
could be viewed as active brokers who monetize their own data. This
monetization may not always be subject to transfer and disclosure restrictions
as the companies that offer these discounts are also likely to subsequently
monetize the data.
Given the pressing security issues associated with the IOT and the FTC’s
efforts in this area, companies concerned about their reputation may refrain
from using the discount model and may instead choose to build privacy and
security into their products. Such options may come with a higher price tag.
However, companies may simply manufacture or offer more secure and
privacy-oriented products without charging premium prices for such options.
For instance, DuckDuckGo, a search engine, promises not to “collect or share
personal information [such as search terms]” of its users.115 The IOT may also
create an environment in which consumers demand that privacy and data
protection mechanisms be offered at affordable rates, and companies that
choose not to do so may lose customers to companies with strong user privacy
112. Protecting the Privacy of Customers of Broadband and Other Telecommunications Services, 81
Fed. Reg. 23,360, 23,392 (proposed Apr. 20, 2016). But see Warren Letter, supra note 16, at 2
(explaining that AT&T’s PFP program may have required “consumers to pay as much as $66 in
additional monthly costs for service that maintains their privacy”).
113. Protecting the Privacy of Customers of Broadband and Other Telecommunications
Services, 81 Fed. Reg. at 23,392.
114. Iyer et al., supra note 93, at 55. To the extent that freemium customers are required to
pay subscription fees to avoid advertisements, a user could be described as paying for privacy.
115. We
Don’t
Collect
or
Share
Personal
Information,
DuckDuckGo,
http://duckduckgo.com/privacy [http://perma.cc/9GVC-3MD8] (last visited July 28, 2017); see
also Chris Matthews, DuckDuckGo: We’re Profitable Without Tracking You, Fortune (Oct. 9,
2015),
http://fortune.com/2015/10/09/duckduckgo-profitable/
[http://
perma.cc/5AU9-MGFX].

Electronic copy available at: https://ssrn.com/abstract=3058835

1392

COLUMBIA LAW REVIEW

[Vol. 117:1369

and security controls. To date, this environment has not yet emerged as IOT
manufacturers continue to inundate the market with insecure IOT products that
can be used to enable distributed denial of service attacks, among other
things.116
C.

Personal Data Economy Models

The data-insights model and the data-transfer model are the two models
PDE companies currently use. The primary goal of companies using the datainsights model appears to be providing users with platforms to control,
compile, aggregate, and obtain insights from their data while in some cases also
offering a marketplace for users to monetize their data through various means.
In contrast, the main objective of a company using the data-transfer model is
seemingly to provide a marketplace for users to transfer their data (or rights in
the data) directly to the PDE company or to unaffiliated third parties. Data
monetizations by consumers via PDE marketplaces presume to some extent
that consumers have transferable rights in or ownership of the data they
generate, but various non-PDE companies may also simultaneously assert
rights in such data. This may be particularly true in the IOT setting. The data
insights that PDE companies offer allow users to more easily recognize the
inherent value of their data to themselves and companies. These offerings could
potentially increase consumer knowledge and understanding of data value.
Unlike traditional data models in which the products offered are seemingly
unconnected to data transfers, PDE models may increase transparency
surrounding data-trade arrangements. However, a primary concern associated
with the use of PDE models is whether this transparency and consumer
understanding of data value and data-trade arrangements will also extend to
how companies use data once consumers provide access to data via PDE
marketplaces. Lack of consumer understanding and knowledge about data
value, data-trade arrangements, and companies’ use of data analytics to
aggregate and manipulate data has long been a concern even in traditional data
models. Yet PDE companies have been described as offering something new to
consumers.117 PDE models also raise additional concerns that will be explored
in detail in Part III below.
1. Data-Insights Model. — A 2020 cybersecurity scenario developed by
U.C. Berkeley’s Center for Long-Term Cybersecurity describes a potential
future in which “[t]he privacy calculations that people make in 2016 when it
comes to their Fitbits, smartphones, and connected cars will seem
anachronistic, because what you get in return for your data in 2020 will be a
new set of insights about yourself . . . that are barely distinguishable from
116. Letter from Senator Mark Warner to Tom Wheeler, Chairman, FCC (Oct. 25, 2016) [hereinafter
Warner
Letter],
http://www.scribd.com/document/328854049/DDoS-Letter-to-Chairman-Wheeler
[http://perma.cc/QMU9-CHZ5]; Bree Fowler, Hackers Apparently Used Internet-Enabled
Cameras, Toys in Cyberattacks, Yahoo! Tech (Oct. 22, 2016), http://www.yahoo.com/tech/hackersapparently-used-internet-enabled-184903923.html
[http://
perma.cc/YD5M-ATSF].
117. See, e.g., Leigh, supra note 3 (discussing new options provided by Meeco).

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1393

magic.”118 The stated aims of PDE companies, such as Digi.me, Meeco, and
Cozy include helping individuals organize and obtain insights from their data,
giving users control over whom they share their data with, and recognizing the
valuable role that consumers play in generating data.119
These companies achieve their goals through various means. For instance,
Cozy provides a “personal cloud solution” that allows “customers to host their
data [including IOT data, emails, and bills] on a personal server.”120 Digi.me’s
application allows users to combine data from multiple sources, and the
company forecasts that its product will serve as a hub for various types of data,
including financial data and health-related data.121 Meeco offers a free platform
118. Ctr. for Long-Term Cybersecurity, Cybersecurity Futures 2020, at 34 (2016),
http://cltc.berkeley.edu/files/2016/04/cltcReport_04-27-04a_pages.pdf [http://perma.cc/B9S9-G72R].
119. About Cozy, Cozy, http://cozy.io/en/about/ [http://perma.cc/3F82-SP7Z] [hereinafter
Cozy, About Cozy] (last visited July 28, 2017) (“We see Cozy evolving from a personal private
cloud and app platform into a universal tool that can help you organize your life . . . . We []
believe in empowering users by providing them free and open source tools that can help them . . .
remain
independent
from
commercial
service
providers.”);
About,
Digi.me,
http://www.getdigime.com/about [http://perma.cc/6UCR-7GZJ] (last visited July 28, 2017) (“Get
your data, see how powerful it is, and control how you share it on your terms . . . .”); Why
Meeco?, Meeco, http://meeco.me/why-meeco.html [http://perma.cc/5HVJ-NEKM] [hereinafter
Meeco, Why Meeco] (last visited July 28, 2017) (“Meeco is about helping you gain the insight
and have the data to negotia[te] better outcomes for you and your family.”); see also MEF White
Paper, supra note 23, at 13 (stating that Cozy “is a high-profile supporter of the personal data
economy”). Beagli is another PDE-like company with the stated goal of providing users with
insights about their data. About Us, Beagli, http://www.beagli.com/about/ [http://perma.cc/3GZCCAYU] (last visited July 28, 2017) (“Personal data is a tremendously useful asset but at the
moment there just aren’t that many tools out there that will help the user obtain the type of
powerful learning from his data that will actually enable him to improve his work-life. Beagli is
set out to remedy this.”); Terms & Conditions, Beagli, http://beagli.com/legal/
[http://perma.cc/2TVG-Z9NF] (last visited July 28, 2017) (“Beagli is a platform that allows users
to store their data and analyze it.”). The company’s website suggests that it is still in the testing
phase. See id.
120. MEF White Paper, supra note 23, at 13; see also Cozy, About Cozy, supra note 119.
Cozy currently offers its products for free to users but the company notes that it eventually plans
to charge users a fee. FAQ, Cozy, http://cozy.io/en/faq/ [http://perma.cc/P3VT-SSRD] (last visited
July 28, 2017) (“Cozy is available free of charge as software you can run on your own Linux
machine. The hosted version of Cozy is free during the beta period. After that, the hosting plan is
expected to cost between €5 and €10 per month.”). The company’s products appear to also target
businesses. See Cozy, About Cozy, supra note 119 (describing three types of potential clients:
“hosting providers,” “chief digital officers,” and “educational and academic institutions”). But see
Run Your Cloud at Home, Cozy, http://cozy.io/en/run-your-cloud-at-home/ [http://perma.cc/73LZ5K2G] (last visited July 28, 2017) (“Cozy is a versatile and extensible platform that can be put to
a variety of practical uses: from sharing your photos with friends and family to contacts and
schedule management.”).
121. Eileen Brown, Digi.me Gives Away Free Backup Software to Keep Your Social Media
Memories Intact, ZDNet (Mar. 26, 2015), http://www.zdnet.com/google-amp/article/digi-me-givesaway-free-backup-software-to-keep-your-social-media-memories-intact/ [http://perma.cc/N42S-ULTP]
(stating the Digi.me application allows users to “download [their] online social life and unite
[their] social networks”); MEF White Paper, supra note 23, at 11–12; see also Emma Firth,
Evolution of a Personal Data Start-Up: The Digi.me Story, Digi.me: Blog (Apr. 27, 2017),
http://blog.digi.me/2017/04/27/evolution-of-a-personal-data-start-up-the-digi-me-story/
[http://perma.cc/PEU6-PNZD] [hereinafter Firth, The Digi.me Story] (noting the product will

Electronic copy available at: https://ssrn.com/abstract=3058835

1394

COLUMBIA LAW REVIEW

[Vol. 117:1369

that permits users to “curate a huge amount of information about themselves
[such as] . . . basic profile information, contacts, browsing habits, favourite
brands and so on.”122 The company’s products also allow users to obtain
insights from the data they provide as well as prevent their online activity from
being tracked.123
Additionally, some PDE companies either currently provide or intend to
provide consumers with the opportunity to monetize their own data.124 Meeco
forecasts that users will use its products to create an anonymous wish list of
items from certain brands that can make offers (such as rewards and discounts)
to users using the wish list.125 Digi.me expects that consumers will share their
continue to allow users to back up information they post on social media sites and the company’s
new application will allow users to include health, financial, and shopping data).
122. MEF White Paper, supra note 23, at 12–13; see also Meeco, Online Advertising—Booming
or
Broken?:
Meeco
Case
Study
14
(2015),
http://meeco.me/assets/pdf/
Meeco_Case_Study_Online_Advertising-Booming_or_Broken_Sept_2015.pdf
[http://perma.cc/
X9HY-Y67L] (noting that in Meeco’s “intentions marketplace” users can store and curate “data in
their own secure Personal Data Store,” communicate with brands, and broadcast “their purchasing
intentions . . . in the Data Marketplace” to brands making tailored offerings); How It Works, Meeco,
http://meeco.me/how-it-works.html
[http://perma.cc/
U35L-434P] [hereinafter Meeco, How It Works] (last visited July 28, 2017) (stating that Meeco is
a free platform that “is designed to be part of your every-day digital life”). User data are
“encrypted and securely stored on non-US based infrastructure.” Introduction to Meeco, Meeco,
http://blog.meeco.me/guide/introduction/ [http://perma.cc/FE57-JTAQ] [hereinafter Meeco, Introduction
to Meeco] (last visited July 28, 2017).
123. MEF White Paper, supra note 23, at 13; see also Bookmark, Meeco,
http://blog.meeco.me/guide/bookmark/ [http://perma.cc/H4FP-Y5RH] (last visited July 28, 2017)
(“Bookmark is your personal web to browse and visit your favourite sites without leaving a data
trail or being tracked by cookies.”); Experience Meeco, Meeco, http://meeco.me/experience.html
[http://perma.cc/M27T-V7C3] (last visited July 28, 2017) (“New plugins for Chrome and Firefox
give you even more control over your online activity and anonymity.”); Meeco, How It Works,
supra note 122 (“Meeco provides a more holistic view of your digital behaviour and is a more
accurate picture of who you really are. More importantly it is insight you own. Analytics and
reports bring new insight to your connected life, providing a visual dashboard of your quantified
self.”); Learn, Meeco, http://blog.meeco.me/guide/learn/ [http://perma.cc/5G2L-CNWL] (last
visited July 28, 2017) (“Meeco provides you with the context and wisdom to fully appreciate the
value of your personal data, digital behaviour, preferences and purchasing intentions.”); My
Insights Is Your Quantified Digital Self, Meeco, http://blog.meeco.me/guide/my-insights-archive/
[http://perma.cc/6X3J-KTEX] (last visited July 28, 2017) (describing how Meeco provides
analytical insights through “actionable charts and graphs”).
124. Laura Secorun, Ozy.com: Selling Your Own Data, USA Today (June 30, 2014),
http://www.usatoday.com/story/money/business/2014/06/30/ozy-selling-data/
11760339/ [http://perma.cc/VV3D-VXU4] (stating that Meeco and Handshake “are personal data
marketplaces . . . and their goal is to cut out the data-mining middleman by allowing users to share
their personal information with companies—and get paid for it”).
125. MEF White Paper, supra note 23, at 13; see also Leading in the Intention Economy,
Meeco, http://meeco.me/business/ [http://perma.cc/SG8E-6XXV] [hereinafter Meeco, Business]
(last visited Aug. 19, 2017) (“Bypass data brokers and advertising costs by incentivising your
customers [sic] loyalty with status, discounts or financial rewards.”); Signal, Meeco,
http://blog.meeco.me/guide/signal/ [http://perma.cc/3AN6-L5NE] (last visited July 28, 2017)
(“Signal is your private list of wishes and goals; a place to capture the products and services you
need or wish for. Your identity remains anonymous so you can decide the right time to share more
information under your own terms when the market comes to you.”).

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1395

data on its platforms with companies in exchange for a more personalized
service and offers that could include customized discounts.126 For instance,
Digi.me suggests that rather than a bank going to a data aggregator to obtain
information about a user, the bank could obtain access to the user’s data
directly from the user through Digi.me’s platforms for the limited purpose of
assessing the user’s creditworthiness.127
The data-insights model seems quite similar to the data-as-payment and
privacy-discount models in that consumers also appear to be bartering away
their privacy and data in exchange for discounts or a free product. However,
PDE companies may offer more control to consumers. Digi.me’s website
indicates that user data are stored in such a manner that the company cannot
access the data.128 Meeco touts that it uses a “Privacy by Design approach.”129
In the PDE setting, consumers may be able to choose which businesses may
advertise their products to them.130 Additionally, some PDE companies may
provide users with searchable, organized, and aggregated copies of their own
data, unlike companies that use a data-as-payment model and other established

126. MEF White Paper, supra note 23, at 13; see also Firth, The Digi.me Story, supra note
121 (stating that the consent access aspect of the company’s product will “allow businesses, who
want access to these rich, deep datasets that our users will soon hold, to approach them directly
and offer them personalised offers in exchange for seeing some slices of that data”).
127. Julian Ranger, Fixing the Personal Data Privacy Paradox by Sharing More, Digi.me:
Blog (May 23, 2017), http://blog.digi.me/2017/05/23/fixing-the-privacy-paradox-by-sharing-morepersonal-data/ [http://perma.cc/7HWJ-7NK2].
128. Privacy Comes as Standard, Digi.me, http://digi.me/privacy [http://perma.cc/M7QW-8X3M]
[hereinafter Digi.me, Privacy] (last visited July 28, 2017) (“We never sell or share your data. We
can’t see it and don’t hold it, so we couldn’t even if we wanted to—and we don’t.”); Your Security
Detail,
Digi.me,
http://www.digi.me/security
[http://perma.cc/
7LCK-PHUY] [hereinafter Digi.me, Security] (last visited July 28, 2017) (“Your digi.me library is
securely held on the cloud storage service of your choice, such as DropBox, GoogleDrive,
Microsoft OneDrive or a device such as a Western Digital myCloud (with more storage options to
come).”); see also Firth, The Digi.me Story, supra note 121 (noting that a user’s data are stored on
the user’s device instead of Digi.me’s servers). Digi.me’s approach to storing data is somewhat
similar to the Coasean filter approach Professor Eric Goldman proposed in that users retain
control and possession of their data. See Eric Goldman, A Coasean Analysis of Marketing, 2006
Wis. L. Rev. 1151, 1214 [hereinafter Goldman, Coasean Analysis] (“[T]he Coasean filter could
store the consumer’s dataset on the device itself rather than in central third-party-operated
repositories. Thus, the data remains within the consumer’s control, giving consumers the benefit
of personalized content without the risks associated with third-party possession of the
personalization data.”).
129. Meeco, Why Meeco, supra note 119 (“Privacy by Design is a principle and international
standard. It makes privacy a core foundation in the way products and services are designed. Meeco has
adopted PbD as the guiding principle for the design and architecture of all our applications.”); Meeco,
Meeco Privacy Policy 1 [hereinafter Meeco, Privacy Policy], http://meeco.me/meeco-privacy.pdf
[http://perma.cc/U3B4-LMWP] (last visited July 28, 2017) (“We will never sell, or give access to
Your Data to a third party (unless we are legally required to), because we know that it is yours.”).
130. Meeco, Business, supra note 125 (“Meeco is an advertising free platform. That means
your content is permissioned by your customers because it is relevant and gives them priority
access.”).

Electronic copy available at: https://ssrn.com/abstract=3058835

1396

COLUMBIA LAW REVIEW

[Vol. 117:1369

companies.131 One PDE company suggests that users’ having a copy of their
own data can decrease the effects of cyberattacks on large entities.132
Alternatively, attacks targeting individual consumers could increase.
Large data brokers that have collected data about consumers for decades
may have more sophisticated mechanisms and capabilities to generate insights
from large sets of consumer data in comparison to the insights that a single
start-up PDE company could provide to a consumer. To the extent that PDE
companies act as vaults for consumer data and access to the data by third-party
companies is significantly reduced, some types of consumer data could be less
accessible to data brokers. Of course, this would not impact other sources of
consumer data that data brokers use, such as public records, and data brokers
may still be able to obtain information from social media websites and other
companies using the data-as-payment model.
Through the data-insights model, consumers serve as active brokers by
monetizing their own data in exchange for personalized deals, thereby
becoming active rather than passive players in the consumer-data market. As a
result, some PDE companies obtain consumer data directly from consumers
rather than from existing data brokers who rely on various sources to indirectly
obtain information about consumers. By providing opportunities for consumers
to capitalize on their data, consumers can share in the profits their data
create.133 Both consumers and companies are able to extract value directly from
consumer-generated data. If existing PDE data-insight companies are
successful, more domestic entities may begin widely using this model.
2. Data-Transfer Model. — Companies using the data-transfer model
purchase or obtain rights to use consumer-generated data directly from users.
Datacoup’s stated “mission is to help people unlock the value of their personal
data . . . [by] getting people compensated for the asset that they produce . . .
[and placing them] in control of [their] data.”134 The company anticipates
creating a marketplace for third parties to purchase consumer data or obtain

131. Mecast by Meeco, Meeco, http://www.mecast.me/ [http://perma.cc/2NV6-3KQG] (last visited
Aug. 19, 2017) (describing Mecast, a new Meeco app that provides a “searchable personal
timeline” of users’ social media posts); MEF White Paper, supra note 23, at 11–13 (discussing
Cozy’s ability to allow users to aggregate their data and Digi.me’s ability to aid users in
organizing their social media data).
132. Emma Firth, NHS Cyber Attack Shows Perils of Not Holding Our Own Personal Data,
Digi.me: Blog (May 15, 2017), http://blog.digi.me/2017/05/15/nhs-cyber-attack-shows-perils-ofnot-holding-our-own-personal-data/ [http://perma.cc/UAS5-8ANT] (contending that recent
cyberattacks on the UK health system emphasize “the loss of control that we all have over our
personal data, when instead of having a copy ourselves, it is held in giant siloes controlled by
others”).
133. Meeco, Why Meeco, supra note 119.
134. About Us, Datacoup, http://datacoup.com/docs#about [http://perma.cc/M96S-6SCW]
[hereinafter Datacoup, About Us] (last visited July 28, 2017). Datacoup suggests that one of the
company’s goals is to change the “asymmetric dynamic that exists around our personal data” in
which data brokers “offer no discernible benefit” to consumers who are the producers of data. Id.

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1397

access to data directly from consumers.135 Datacoup allows consumers to
connect their social media accounts, among other things, to the company’s
services and compile financial and demographic data.136 Once the company
assigns “data attributes,” value, and a potential price to the consumer’s
information, the company transfers the data into its marketplace where buyers
can purchase it, and users are then subsequently notified and compensated once
their data are purchased.137 Datacoup’s target audience for purchasing the user
data it collects and anonymizes includes “brands, retailers, media agencies,
wireless carriers, insurance companies and banks.”138
As with the data-insights model discussed above, consumers are permitted
to monetize their data, and companies obtain the data directly from consumers.
However, with the data-transfer model, in some instances, the PDE company
seems to provide direct monetary compensation to the user in exchange for the
data in contrast to other PDE models. At the launch of Datacoup’s operations,
the company offered to purchase consumer data for $8 per month.139
Datacoup’s website suggests that the company determines how much to pay the
consumer based on its analysis of the value of the data, and it is unclear
whether users have the ability to negotiate terms or the price of the data.140
135. How
It
Works,
Datacoup,
http://datacoup.com/docs#faq
[http://perma.cc/
49DM-4233] [hereinafter Datacoup, How Datacoup Works] (last visited July 28, 2017)
(“Datacoup is lining up data purchasers to sustainably purchase data on the platform. However, to
get the ball rolling, Datacoup is the primary purchaser of your data.”); see also Thimmesch, supra
note 30, at 156 n.57 (contending that scholars have experimented “with cash markets for data in
laboratory experiments” and companies such as Datacoup are providing such services); Privacy
Policy, Datacoup, http://datacoup.com/docs#pp [http://perma.cc/6P78-SYTA] [hereinafter
Datacoup, Privacy Policy] (last visited July 28, 2017) (“Datacoup also enables you to sell or
otherwise share your information with third parties.”). Datacoup is also a member of the Personal
Data Ecosystem. See Personal Data Ecosystem Consortium Directory, PDE,
http://pde.cc/directory/
[http://perma.cc/
4MMW-TAC5] (last visited July 28, 2017). Professors Hoofnagle and Whittington have described
the Personal Data Ecosystem Consortium as representing a second generation of companies
focused on helping consumers obtain control over their data. Chris Jay Hoofnagle & Jan
Whittington, Unpacking Privacy’s Price, 90 N.C. L. Rev. 1327, 1347 (2012) [hereinafter
Hoofnagle & Whittington, Unpacking Privacy’s Price].
136. Datacoup, How Datacoup Works, supra note 135; see also MEF White Paper, supra note
23, at 27. The company’s website also indicates that the company does not view or store the
usernames and passwords of users’ social-network accounts, and the company promises to
anonymize data before transferring the information into the large pool of user data that purchasers
can access. See Datacoup, How Datacoup Works, supra note 135. Users may eventually have the
ability to opt in to having data purchasers contact them. Id.
137. Datacoup, How Datacoup Works, supra note 135.
138. Id. But see Adam Tanner, Others Take Your Data for Free, This Site Pays Cash, Forbes
(Mar. 3, 2014), http://www.forbes.com/sites/adamtanner/2014/03/03/others-take-your-data-for-free-thissite-pays-cash/#4574f3379461 [http://perma.cc/GS52-7EPT] (suggesting new PDE companies face
several challenges including “that marketers will not pay much for details about just thousands of
people when data brokers who pay nothing to individuals offer detailed dossiers on millions” and
that “few users will sign up to share their data for just pennies”).
139. Datacoup, How Datacoup Works, supra note 135 (“Today, Datacoup is purchasing your
data.”); MEF White Paper, supra note 23, at 27.
140. Datacoup, How Datacoup Works, supra note 135.

Electronic copy available at: https://ssrn.com/abstract=3058835

1398

COLUMBIA LAW REVIEW

[Vol. 117:1369

Companies adopting the data-transfer model could also provide data insights to
users,141 but it appears that the primary goal of data-transfer companies is to
transfer (sell) or provide access to data to third parties or the PDE company.142
In the current consumer-data marketplace that data brokers dominate,
“most people have no idea that [their data are] being collected and sold, and
that it is personally identifiable and that the information is in basically a profile
of them.”143 In fact it is not entirely clear how many companies purchase and
sell consumer data.144 Datacoup has indicated that as its marketplace grows the
company may provide users with additional features that allow them to control
the transaction between themselves and the data buyer.145 To the extent that
PDE companies purchase data directly from consumers and disclose the
identity of data purchasers,146 users may be able to more easily obtain
information about who is buying their data. In contrast, “It’s much harder for
Americans to get information on [data brokers, such as] Acxiom.”147 Other
types of companies may also provide a marketplace for consumers to monetize
their data. For instance, at least one individual has used Kickstarter to trade his
information for $2 per day.148
III. IMPLICATIONS OF PFP AND PDE MODELS
PFP and PDE models generate significant concerns for consumers, such as
a possible widening of the gap between the “privacy haves and have-nots,”
companies’ continued monetization of consumer data, and the enablement of
predatory and discriminatory behavior while simultaneously hiding behind a
141. See id. (“You also may use our data analysis tools to visualize summaries of your data
and identify trends or patterns.”); Unlock the Value of Your Personal Data, Datacoup,
http://datacoup.com/ [http://perma.cc/LYW2-A633] (last visited Sept. 12, 2017) (stating that Datacoup
gives users the tools to “better understand” their data and themselves).
142. MEF White Paper, supra note 23, at 27 (stating that Datacoup’s “premise was that as
companies buy anonymous aggregated data to better understand consumer behaviour, why not just
buy it from the people themselves rather than from a data broker”).
143. Kroft, supra note 14; see also FTC, Data Brokers: A Call for Transparency and Accountability 46
(2014)
[hereinafter
FTC
Data
Broker
Report],
http://www.ftc.gov/
system/files/documents/reports/data-brokers-call-transparency-accountability-report-federal-tradecommission-may-2014/140527databrokerreport.pdf (on file with the Columbia Law Review).
144. See Kroft, supra note 14.
145. Datacoup, How Datacoup Works, supra note 135.
146. MEF White Paper, supra note 23, at 27 (stating that Datacoup allows users to “see what
information is bought, who is buying it and why it is of value”).
147. Kroft, supra note 14. But see AboutTheData, http://aboutthedata.com
[http://perma.cc/8N3Z-GPXT] (last visited July 28, 2017) (providing information about the data
that companies hold).
148. Federico Zannier, A Bite of Me, Kickstarter, http://www.kickstarter.com/projects/
1461902402/a-bit-e-of-me [http://perma.cc/6VE4-DJA5] (last visited July 28, 2017) (discussing a
service through which one individual sells his data, including websites visited, webcam images,
cursor movements, and geolocation, for $2 per day); see also Billy Ehrenberg, How Much Is Your
Personal
Data
Worth?,
Guardian
(Apr.
22,
2014),
http://www.theguardian.com/news/datablog/2014/apr/22/how-much-is-personal-data-worth
[http://perma.cc/WKB9-CTWM].

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1399

shroud of consumer empowerment, control, and choice.149 Concerns associated
with new monetization methods may prove challenging to existing legal
frameworks.
A.

Unequal Access to Privacy

1. PFP Models. — To the extent that financially disadvantaged consumers
cannot afford the prices of companies that adopt a privacy-as-a-luxury model
charge, use of this model is likely to contribute to the divide between those that
can afford privacy and those that cannot.150 Research on the historical digital
divide and the demographics of smartphone users indicates that iPhone users
tend to have significantly higher incomes than Android users, and low-income
individuals frequently rely on smartphones for internet access since “they do
not have broadband.”151 The cost of an Apple iPhone can range from $399 to as
much as $1149, while some Android phones with weak privacy and security
149. Brian Fung, Your Internet Privacy Shouldn’t Be a Luxury Item, FCC Chief Says, L.A.
Times (Aug. 5, 2016), http://www.latimes.com/business/technology/la-fi-tn-internet-privacy-fcc20160805-snap-story.html [http://perma.cc/6TVK-KL4W].
150. Other commentators have discussed the relationship between unequal access to privacy
and vulnerable communities and consumers in several contexts. See, e.g., Kimberly D. Bailey,
Watching Me: The War on Crime, Privacy, and the State, 47 U.C. Davis L. Rev. 1539, 1565
(2014) (discussing the relationship between stops-and-frisks and unequal access to privacy); Julie
E. Cohen, Examined Lives: Informational Privacy and the Subject as Object, 52 Stan. L. Rev.
1373, 1398 (2000) [hereinafter Cohen, Examined Lives] (“[A]n important determinant of choice
within markets is wealth. If data privacy costs money—or, conversely, if surrendering privacy
saves money—access to privacy will be more unequal than if it did not.”); Elaine Gibson, Wired
Identities: Retention and Destruction of Personal Health Information in an Electronic World, 38
Dalhousie L.J. 385, 406 (2015) (evaluating access to privacy in the Canadian health care context
and stating “[p]rivacy may be experienced differently by persons from disabled, racialized, and
otherwise socially and economically marginalized groups”); Kami Chavis Simmons, Future of the
Fourth Amendment: The Problem with Privacy, Poverty and Policing, 14 U. Md. L.J. Race,
Religion, Gender & Class 240, 251 (2014) (discussing poor communities’ unequal access to
privacy rights in the transportation context and the impact of the Fourth Amendment).
151. See Pew Research Ctr., U.S. Smartphone Use in 2015, at 3–4 (2015) [hereinafter U.S.
Smartphone
Use
2015],
http://www.pewinternet.org/files/2015/03/PI_Smartphones_
0401151.pdf [http://perma.cc/R59H-6VHU] (describing the “smartphone-dependent” population);
Aaron Smith, Pew Research Ctr., Smartphone Ownership—2013 Update 6 (2013),
http://www.pewinternet.org/files/old-media//Files/Reports/2013/PIP_Smartphone_
adoption_2013_PDF.pdf [http://perma.cc/HCX5-4JWU] (“[Cell phone owners] from the upper
end of the income and education spectrum are much more likely than those with lower income
and educational levels to say they own an iPhone.”); Jim Edwards, These Maps Show that
Android Is for Poor People, Bus. Insider (Apr. 3, 2014), http://www.businessinsider.com/android-isfor-poor-people-maps-2014-4 [http://perma.cc/F4EJ-W3A5] (“The rich, it seems, use iPhones while the
poor tweet from Androids . . . . Android users are less lucrative than iPhone users . . . . It’s a socioeconomic split on class lines, in favor of iPhone over Android.”); see also Monica Anderson,
Digital Divide Persists Even as Lower-Income Americans Make Gains in Tech Adoption, Pew
Research Ctr.: Fact Tank (Mar. 22, 2017), http://www.pewresearch.org/fact-tank/2017/03/22/digitaldivide-persists-even-as-lower-income-americans-make-gains-in-tech-adoption/ [http://perma.cc/H3LM32RJ] (noting that “[i]n 2016, one-fifth of adults living in households earning less than $30,000 a
year were ‘smartphone-only’ internet users—meaning they owned a smartphone but did not have
broadband internet at home”).

Electronic copy available at: https://ssrn.com/abstract=3058835

1400

COLUMBIA LAW REVIEW

[Vol. 117:1369

protections can be bought for much less.152 This is not to suggest that iPhone
users are absolutely free from “surveillance capitalism” or attempts at
government intrusion.153 Companies can use tracking technologies to monitor
the online activities of smartphone users.154 However, iPhone users obtain the
benefit of a company that is willing to implement measures to ensure some
level of information protection and may actively attempt to guard against
government requests for user data.155
Currently, many IOT devices have insufficient security features, and
limited encryption mechanisms are provided in connection with such
products.156 In the IOT setting, one could easily imagine a scenario in which
companies that offer devices accompanied by high-level encryption technology
and other privacy and security mechanisms charge significantly higher prices
than those that do not. In such an instance, more secure, privacy-oriented
products would be beyond the reach of low-income consumers.
To avoid continuous online tracking and data collection, commentators
have suggested that all consumers should use a VPN.157 However, as noted in
section II.B(i), VPN services are generally paid products that require users to
pay monthly subscription fees.158 This cost highlights concerns about unequal
access to privacy, as not all consumers may be able to afford an additional
monthly subscription fee to protect their privacy. Low-income consumers may
be at a distinct disadvantage.
Users who are able to pay for privacy and security-centered products, such
as smartphones with encryption technologies and VPN services, are better off
152. See Buy iPhone7 and iPhone7 Plus, Apple, http://www.apple.com/shop/buyiphone/iphone-7 [http://perma.cc/VBN7-4XG7] (last visited Aug. 19, 2017); iPhone X, Now
Choose
Your
Capacity,
Apple,
http://www.apple.com/shop/buy-iphone/iphonex#00,10,31[http://perma.cc/S72L-ATK4](last visited Sept. 25, 2017); see also Cohen, Rich Teens,
supra note 104; Alfred Ng, These Cheap Phones Come at a Price—Your Privacy, CNET (July 27,
2017), http://www.cnet.com/news/these-cheap-phones-are-costing-you-your-privacy/ (on file with
the Columbia Law Review) (describing a $60 Android phone available for sale on Amazon that
surreptitiously transfers users’ “private data to China” and summarizing research on the privacy
and security failings of other cheaper Android products).
153. See generally Shoshana Zuboff, Big Other: Surveillance Capitalism and the Prospects of
an Information Civilization, 30 J. Info. Tech. 75 (2015) (defining and discussing surveillance
capitalism).
154. See
Ghostery,
http://www.ghostery.com/lp1/product-offers/?pk_campaign=goga_us6
[http://perma.cc/KXJ2-6FHB] (last visited July 28, 2017) (offering a “browser extension and
mobile browser” to combat tracking).
155. See Eric Lichtblau & Katie Benner, Apple Fights Order to Unlock San Bernadino
Gunman’s iPhone, N.Y. Times (Feb. 17, 2016), http://www.nytimes.com/2016/02/18/
technology/apple-timothy-cook-fbi-san-bernardino.html?mcubz=2&_r=0 (on file with the
Columbia Law Review); Soghoian, supra note 102 (discussing issues associated with a lack of
encryption).
156. Elvy, Hybrid Transactions, supra note 67, at 87; Warner Letter, supra note 116.
157. See, e.g., Lee Mathews, What a VPN Is, and Why You Should Use It to Protect Your Privacy,
Forbes (Jan. 27, 2017), http://www.forbes.com/sites/leematleem/2017/01/27/what-is-a-vpn-and-whyshould-you-use-one/#5933448b4b8f [http://perma.cc/AQ6D-FAWS].
158. Eddy, Best VPN Services, supra note 107.

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1401

than those who cannot. Those who can afford to pay for privacy obtain at least
some level of data protection when compared to those who cannot afford to pay
for such products and services. This privacy gap threatens to exacerbate the
socioeconomic digital divide. The Pew Research Center reports that in today’s
digital age, low-income and minority consumers continue to have “fewer
options for online access.”159 PFP models complicate this problem. Even when
these groups of consumers obtain access to the Internet, they may be subjected
to increased data collection and a lack of privacy and control with respect to
their data unless they are able to pay for the products and services offered by
PFP companies to minimize these concerns. These consumers may also lack
knowledge of privacy protection options or products. Unequal access to
information may contribute to unequal access to privacy.
Admittedly, there is a plethora of free products that companies offer to
consumers of all socioeconomic groups to combat data surveillance and
security concerns. Moreover, PFP products may not provide complete
protection or anonymity to users. As explained in section II.A, when companies
offer products for free, consumers usually trade in their data and some level of
privacy to obtain the product. For instance, in 2016, Web of Trust, a free
browser extension,160 was accused of recording and selling user data.161 To the
surprise of many of its users, Unroll.me, a free service162 that helps users
unsubscribe from email lists, was recently accused of selling to unaffiliated
companies anonymized data obtained from users’ emails.163 The scandal
highlights consumers’ lack of understanding about the privacy trade-offs
associated with free services.164 Perhaps this is because, as the FTC notes, there
is not much clarity about when data are sold or disclosed, how data are sold or
transferred, and to whom.165 A company may simply inform users that it
collects and anonymizes their data to provide either targeted advertising or a
better experience to the consumer. While these reasons seem benign, the
inferences that could be made about consumers by compiling previously
disparate sources of data are concerning. A 2017 report on corporate
159. Anderson, supra note 151; see also U.S. Smartphone Use 2015, supra note 151.
160. Rick Broida, How to Tell Whether a Website Is Safe, PC World (Jan. 23, 2011),
http://www.pcworld.com/article/217248/safe_websites.html
[http://perma.cc/2AZR-EVWT]
(describing Web of Trust as “a free browser plug-in” that inspects online search results and
recommends links to avoid).
161. Matthew Humphries, Web of Trust Browser Extension Cannot Be Trusted, PC Mag.
(Nov. 4, 2016), http://www.pcmag.com/news/349328/web-of-trust-browser-extension-cannot-betrusted [http://perma.cc/EE3T-J6RM].
162. Unroll.me, http://unroll.me/ [http://perma.cc/HQK7-XYFL] (last visited July 28, 2017).
163. Joe Kukura, Unroll.me Founder Unloads in Wake of Uber Scandal, SF Wkly. (Apr. 26,
2017),
http://www.sfweekly.com/news/unroll-me-founder-unloads-in-wake-of-uber-scandal/
[http://perma.cc/MXV6-XPQT] (discussing Unroll.me’s sale of user data, such as the sale of Lyft
receipts to Uber).
164. Amanda Hess, How Privacy Became a Commodity for the Rich and Powerful, N.Y.
Times Mag. (May 9, 2017), http://www.nytimes.com/2017/05/09/magazine/how-privacy-becamea-commodity-for-the-rich-and-powerful.html (on file with the Columbia Law Review).
165. FTC Data Broker Report, supra note 143, at 46; Singer, supra note 9.

Electronic copy available at: https://ssrn.com/abstract=3058835

1402

COLUMBIA LAW REVIEW

[Vol. 117:1369

surveillance suggests that this data compilation is not anonymous and that
social media companies provide a platform for businesses “to find and target
exactly those persons they have email addresses or phone numbers on.”166
Research suggests that social media data and information about a user’s
website choices can be used to determine a user’s personality.167 One can only
envision the inferences that companies could make by combining social media
and website choice information with IOT data.168 Consumers who can pay for
privacy are in a more advantageous position than those who cannot in that they
can afford to avail themselves of technological offerings to limit tracking and
data collection while accessing the Internet. This remains true even though PFP
products are not completely immune from vulnerabilities and may not prevent
the collection and disclosure of consumer data in all instances.
Advocates of PFP discount offerings in the broadband context contend
that (1) different groups of consumers have distinct preferences for privacy; (2)
most consumers are prepared to trade privacy for convenience and discounts
and can make decisions about the issues associated with such plans; and (3)
these plans can help consumers of various socioeconomic backgrounds.169
Opponents of the FCC Rules, which would have addressed PFP discount
programs, argued that the regulation unfairly targeted ISPs while leaving other
166. Wolfie Christl, Cracked Labs, Corporate Surveillance in Everyday Life: How Companies
Collect, Combine, Analyze, Trade and Use Personal Data on Billions 47 (2017),
http://crackedlabs.org/dl/CrackedLabs_Christl_CorporateSurveillance.pdf
[http://perma.cc/
K7MC-8XN5].
167. Michal Kosinski et al., Manifestations of User Personality in Website Choice and
Behaviour on Online Social Networks, 95 Machine Learning J. 357, 378 (2014); see also Hess,
supra note 164, at 2 (discussing the use of social media data to make inferences as well as the use
of data analytics in elections).
168. See generally U.S. Gov’t Accountability Office, GAO-17-75, Internet of Things: Status
and Implications of an Increasingly Connected World 6 (2017) (discussing the impact of the IOT
and the use of advanced data analytics to analyze IOT data to uncover “subtle, or hidden patterns,
correlations and other insights”).
169. Notice of Proposed Rulemaking: Protecting the Privacy of Customers of Broadband and
Other Telecommunications Services, WC Docket No. 16-106, at 142–47 (Apr. 1, 2016)
(dissenting statement of O’Rielly, comm’r) [hereinafter O’Rielly Dissenting Statement],
http://apps.fcc.gov/edocs_public/attachmatch/FCC-16-39A1.pdf (on file with the Columbia Law
Review) (“[The nature of the Internet economy] is a trade-off—consumers receive ‘free’ stuff
offered by Internet companies while in return the companies receive other things . . . that
consumers may or may not want . . . .”); Petition for Reconsideration by the United States
Telecom Association at 6, Protecting the Privacy of Customers of Broadband & Other Telecomms.
Servs., WC Docket No. 16-106 (FCC filed Jan. 3, 2017) [hereinafter Petition for
Reconsideration],
http://www.ustelecom.org/sites/
default/files/documents/Privacy_PFR_01.03.17_lf_krs%20.pdf [http://perma.cc/7E7S-GFPC] (“Most
consumers are happy to share information with online service providers in exchange for free or
discounted services.”); Doug Brake, Info. Tech. & Innovation Found., Why Broadband Discounts
for Data Are Pro-Consumer 4 (2016) (“In considering the value to consumers of such a program,
it is worth recognizing that consumer privacy preferences vary considerably.”); see also Verizon,
Comments on Protecting the Privacy of Customers of Broadband and Other Telecommunications
Services 4 (2016) [hereinafter Verizon Comments], http://ecfsapi.fcc.gov/file/60002078934.pdf
[http://perma.cc/NBM3-XMPV] (“[Restricting discount programs] conflicts with the fundamental
premise . . . that consumers are capable of making informed choices about the uses of their information.”).

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1403

online companies, who are the primary users of consumer information, to
freely collect and use this data, thereby confusing consumers.170 Other
commentators suggest that technological developments, such as encryption,
may prevent ISPs from viewing and accessing consumers’ data and
activities.171 However, despite encryption, ISPs may be able to see certain
domains viewed by users.172
Privacy-discount plans may force consumers to make difficult choices
between privacy and other necessities.173 As the FCC notes, broadband Internet
access service (BIAS) companies provide consumers with access to the
Internet, a critical service in the digital age.174 Through the Internet, consumers
can access various opportunities and engage in commercial transactions—for
instance by purchasing and selling goods and services.175 One commentator has
suggested that “for a struggling family, [the decision to pay to opt out of data
sharing] could mean choosing between paying [an extra $29] for privacy and
paying for groceries or the public transportation needed to get to work.”176 The
170. Verizon Comments, supra note 169, at 3–4.
171. Peter Swire et al., Online Privacy and ISPs: ISP Access to Consumer Data Is Limited
and Often Less than Access by Others 3 (2016) (unpublished working paper),
http://www.iisp.gatech.edu/sites/default/files/images/online_privacy_and_isps.pdf (on file with the
Columbia Law Review); see also Maureen K. Ohlhausen, Acting Chairman, FTC, Remarks: Internet
Privacy: Technology and Policy Developments 6 (May 1, 2017) [hereinafter Ohlhausen Remarks],
http://www.ftc.gov/system/files/documents/public_statements/1213203/
ohlhausen_-_internet_privacy_remarks_rayburn_hob_5-1-17.pdf
[http://perma.cc/7T7Y-ZNLG]
(supporting a privacy framework that is “technology neutral—that is, that ISPs be treated like any
other large platform”).
172. Opposition to Petitions for Reconsideration at 2–3, Protecting the Privacy of Customers of
Broadband & Other Telecomms. Servs., WC Docket No. 16-106 (FCC filed Mar. 6, 2017),
http://ecfsapi.fcc.gov/file/1030755074740/Coalition%20Opposition%20Final.pdf
[http://
perma.cc/Y2HZ-J876] (“But even with encryption (implemented at the discretion of the website operator,
not the consumer), the ISP can still see the top-level and second-level domains accessed by its customers.”).
173. See Warren Letter, supra note 16, at 2 (contending that companies should not transform
privacy into a luxury good and such practices may harm low-income consumers); see also
Electronic Privacy Information Center, Comment Letter on Proposed Rule on Protecting the
Privacy of Customers of Broadband and Other Telecommunications Services 25 (May 27, 2016)
[hereinafter
EPIC
Comments],
http://ecfsapi.fcc.gov/file/60002079241.pdf
[http://perma.cc/U4MF-JSFB] (urging the FCC to prohibit PFP schemes as “[f]inancial pressures
reduce the voluntariness of consumer consent”).
174. Protecting the Privacy of Customers of Broadband and Other Telecommunications Services, 81
Fed. Reg. 87,274 (Dec. 2, 2016) (to be codified at 47 C.F.R. pt. 64), repealed by Act of Apr. 3,
2017, Pub. L. No. 115-22, 131 Stat. 88 (codifying a joint resolution disapproving of the FCC
“Broadband and Telecommunications Services” privacy rules).
175. Id.; see also Olivier Sylvain, Network Equality, 67 Hastings L.J. 443, 447 (2016) (“The
Internet has become the platform through which people learn about and seek jobs, health care,
housing, and education.”).
176. Sandra Fulton, Pay-for-Privacy Schemes Put the Most Vulnerable Americans at Risk,
Free Press (May 10, 2016), http://www.freepress.net/blog/2016/05/10/pay-privacy-schemes-putmost-vulnerable-americans-risk [http://perma.cc/9FES-AM2L]; see also Protecting the Privacy of
Customers of Broadband and Other Telecommunications Services, 81 Fed. Reg. at 87,274
(“Thirty-eight public interest organizations expressed concern that financial incentives can result
in consumers paying up to $ 800 per year—$62 per month—for plans that protect their privacy.”).

Electronic copy available at: https://ssrn.com/abstract=3058835

1404

COLUMBIA LAW REVIEW

[Vol. 117:1369

FCC has acknowledged the potential negative impact of PFP plans on lowincome consumers.177 In a survey conducted by the Pew Research Center, fiftyfive percent of respondents found it unacceptable for a company to collect data
about activities in their homes in exchange for savings on their energy bills.178
Research on consumer choices and privacy policies also suggests that
consumers do not always make rational choices about their privacy or data
collection.179 Further, as Professors Nancy Kim and D.A. Jeremy Telman have
noted, “[S]urvey data indicates that consumers would not willingly choose to
sacrifice their privacy in exchange for targeted advertising.”180 A 2016 study of
consumer preferences found that more than eighty percent of respondents had
given data to companies online “when they wished that they did not have to do
so.”181
Opponents of PFP discount programs in the broadband setting have
suggested that perhaps such programs could be improved by providing users
with “fair value for their data” and an adequate discount rather than a “privacy
penalty,” and increasing consumer knowledge about how their data are used.182
In some cases, PDE programs attempt to meet at least some of these goals, yet
the danger of unequal access to privacy remains.
2. PDE Models. — In the PDE setting, consumers who are not
economically disadvantaged may avoid participating in a PDE marketplace,
while other consumers may sell their data at the first opportunity, particularly if
companies elect to provide significant compensation for the data. Thus, under
the data-transfer model, low-income consumers and those from other at-risk
communities could dominate the personal data-selling market, thereby
widening the gap between those who have privacy and those who do not. Of
course, a wide range of consumers in different income brackets could use other
177. Protecting the Privacy of Customers of Broadband and Other Telecommunications Services, 81
Fed. Reg. at 87,274 (noting that there are “legitimate concerns that financial incentive practices
can also be harmful if presented in a coercive manner, mislead consumers into surrendering their
privacy rights . . . [and have a] disproportionate effect on low income individuals”).
178. Rainie & Duggan, Privacy Study, supra note 68, at 37. But see Greg Lindsay et al., Atl. Council,
Smart Homes and the Internet of Things 3 (2016), http://www.atlanticcouncil.org/
images/publications/Smart_Homes_0317_web.pdf [http://perma.cc/97EK-W499] (suggesting that
“[f]orty percent of consumers are willing to share data from their wearable devices with retailers
or brands in exchange for coupons, discounts or information” (internal quotation marks omitted)
(quoting The Internet of Things: The Future of Consumer Adoption, Accenture,
http://www.accenture.com [http://perma.cc/3F9U-GZ85] (last visited Aug. 16, 2017))).
179. See generally Omri Ben-Shahar & Adam Chilton, Simplification of Privacy Disclosures:
An Experimental Test, 45 J. Legal Stud. S41 (2016) (concluding the use of simpler disclosures
does not significantly affect consumers’ understanding of the disclosure, “willingness to share
personal information,” or “expectations about their rights”).
180. Nancy S. Kim & D.A. Jeremy Telman, Internet Giants as Quasi-Governmental Actors
and the Limits of Contractual Consent, 80 Mo. L. Rev. 723, 729, 738–39 (2015) (discussing a
2013 survey by Consumer Action that showed sixty-nine percent of respondents would not be
“willing to allow companies to track, collect, and share data with permission in exchange for a
free product or service”).
181. Kesan et al., supra note 70, at 267.
182. Fulton, supra note 176.

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1405

PDE models that primarily provide insights to consumers about their data, and
these consumers could refrain from using the monetization options provided by
these companies. One could also contend that consumers who elect to engage
in the PDE marketplace are more likely to be sophisticated and informed about
the value of their data. PDE companies may have the potential to provide
consumers with more options for extracting value from their data, but the
monetization options these companies provide also raise concerns. Further,
PDE companies on their own cannot remedy all ills associated with pervasive
data collection and a lack of consumer privacy. A collaborative effort by
multiple stakeholders with a resulting shift towards comprehensive privacy
protection for consumers is needed.
The danger of unequal access to privacy is also alarming when one
considers the monetization of children’s data. Companies could mine and
analyze child data to predict or make “probabilistic inferences” about the
current and expected adulthood preferences and activities of children. Imagine
a scenario in which a PDE company offers to purchase the data of everyone in
a consumer’s household, and, in addition to personalized discounts and offers,
the parent receives $100 a month for authorizing tracking and data collection.
Luth Research has offered similar monthly payments to users who agree to the
tracking and collection of their online activities.183 In the data-as-payment
setting, parents frequently disclose information (including pictures and videos)
about their children.184 Parents could intentionally (or unintentionally, such as
when child-related data is combined with household data or when parents and
children share devices) engage in the PDE marketplace using child data.185
There have been repeated instances of parents who have faced economic
challenges and resorted to using their children’s identities for financial gain or
to provide their families with necessities.186 Exploitation of child data may be
exacerbated in the IOT setting as the quality and quantity of data about children
increase. This data could be viewed as an asset that can generate tangible
183. Winston Ross, How Much Is Your Privacy Worth?, MIT Tech. Rev. (Aug. 26, 2014),
http://www.technologyreview.com/s/529686/how-much-is-your-privacy-worth/
[http://
perma.cc/9VJ5-MHB7] (noting as many as “20,000 PC users and 6,000 smartphone users” have
participated in Luth Research’s program and the information the company collects is sold to
various companies that use the data to make advertising decisions).
184. Tara Haelle, Do Parents Invade Children’s Privacy When They Post Photos Online?, NPR (Oct.
28, 2016), http://www.npr.org/sections/health-shots/2016/10/28/499595298/do-parents-invade-childrensprivacy-when-they-post-photos-online [http://perma.cc/L4Q9-LYFM].
185. But see Terms of Service, Datacoup, http://datacoup.com/docs#tos [http://
perma.cc/BU4B-RUJ4] [hereinafter Datacoup, Terms of Service] (last updated Nov. 1, 2013)
(noting users of the company’s service agree not to “solicit personal information from minors”).
186. Gerry Smith, Family Secrets: Parents Prey on Children’s Identities as Victims Stay Silent,
Huffington Post (Nov. 11, 2011), http://www.huffingtonpost.com/2011/11/11/child-identity-theftparents-credit-fraud-debt_n_1010093.html [http://perma.cc/GX32-GQGA]; see also Blake Ellis,
Financial Abuses of Deadbeat Parents, CNN Money (June 8, 2010),
http://money.cnn.com/2010/06/08/pf/parents_financial_abuses/index.htm
[http://
perma.cc/A3G3-UQG9] (summarizing different methods and articulating examples of ways parents
could use their children’s identities for financial gain, such as “taking out loans,” “opening credit cards,”
“creating new accounts,” or “co-signing a lease”).

Electronic copy available at: https://ssrn.com/abstract=3058835

1406

COLUMBIA LAW REVIEW

[Vol. 117:1369

compensation. Parents could potentially enter into an agreement for the sale or
license of their child’s data to a PDE company. Such arrangements may be
attractive to cash-strapped parents who are unable to pay for basic services,
such as utilities. As noted earlier, it is also possible that parents may provide
access to data about their children inadvertently simply by providing
information about their household. In either case, the level of privacy provided
to a child depends on the parent’s choice, with the result being that the children
of parents who elect not to directly provide access to household data or their
child’s data to third parties may receive more privacy protections than children
of parents who decide to accept PFP discounts or participate in the burgeoning
PDE marketplace. Admittedly, this concern is prevalent regardless of whether
parents participate in the PDE marketplace. However, increases in data volume
and quality generated by the IOT as well as the new venues offered by PDE
companies to aggregate and share data with unaffiliated parties in exchange for
discounts and other deals could prove to be problematic. Eventually
information about a child’s behavioral status, preferences, experiences and
other sorts of child-related data could be used to determine the types of
opportunities that children receive during childhood as well as negatively
impact their adulthood lives and prospects. Thus, rising data quality and
quantity and increases in the digital footprints of children combined with new
platforms for collecting and sharing household (and child) data may exacerbate
privacy concerns for children.
Additional concerns arise in the landlord–tenant context. Landlords
typically supply appliances in a rental unit. Soon, every household good will be
connected to the Internet and will generate information about users.187
Landlords could elect to sell or provide access to data generated from a renter’s
use of landlord IOT devices in the PDE marketplace.188
A nationwide report on the rental housing market published by the Joint
Center for Housing Studies of Harvard University found that “[b]y income, the
largest increase in renters—4.0 million—was among households earning less
than $25,000 annually, both because low-income households are much more
likely to rent and because their numbers had swelled following the

187. See Lee Rainie & Janna Anderson, The Internet of Things Connectivity Binge: What Are the
Implications?, Pew Research Ctr., (June 6, 2017), http://www.pewinternet.org/2017/
06/06/the-internet-of-things-connectivity-binge-what-are-the-implications/
[http://perma.cc/
4V87-RNPF] [hereinafter Rainie & Anderson, IOT Connectivity Binge] (discussing results from a
canvassing of IOT experts and noting IOT “connection is inevitable” as more manufacturers will
begin to “add the internet” to devices).
188. Other commentators have expressed similar concerns with respect to the rise of smart
home technology. See Kaveh Waddell, Would You Let Companies Monitor You for Money?, Atlantic (Apr.
1, 2016), http://www.theatlantic.com/technology/archive/2016/04/would-you-let-companies-monitor-youfor-money/476298/ [http://perma.cc/PVW4-LTXT] (expressing concerns regarding the rise of smart
home technology and the willingness of surveyed individuals to sell their personal data for cash).
See generally A. Michael Froomkin & P. Zak Colangelo, Self-Defense Against Robots and
Drones, 48 Conn. L. Rev. 1, 32–33 (2015) (noting surreptitious installation of monitoring devices
may lead to landlord liability under tort theories).

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1407

recession.”189 The report also found that a significant segment of Hispanic and
African American households that rent are “severely cost burdened.”190
To the extent that renters elect to directly participate in the PDE
marketplace, landlords could require renters to consent to sharing insights
produced by PDE companies. Some renters may object to such arrangements,
but if such provisions become widely used, a tenant may have no option but to
consent to such terms to obtain housing.
Landlords may have valid reasons for requiring data collection. IOT
appliances could be manufactured to not only provide notices to landlords
about when the device needs to be serviced but also lead to energy savings.191
The appliance may also need to receive software updates from the
manufacturer to continue to function. Monitoring could also allow landlords to
know whether an appliance has malfunctioned because of ordinary wear and
tear or because of tenant misuse. Tenants may also benefit from access to IOT
devices. For instance, a device may be able to continually measure and record
the temperature in a tenant’s home and provide evidence of safety issues in the
home that have not been corrected by the landlord.192 Data collection in the
tenancy context may become more prevalent as more “smart buildings” are
constructed and IOT devices begin to replace static devices. Whether tenants
will be provided with notice of this or understand the implications of their use
of IOT devices provided by landlords is unclear.
Landlords could use renter data to obtain insights about renters and to
make housing determinations. Most landlords already use “tenant-screening
companies” to generate reports on prospective tenants, and tenants typically
bear the costs of these reports.193 Companies that provide services to landlords
could directly obtain data about renters by engaging in PDE marketplaces, or
they could obtain the information from other companies that are allowed to
participate in PDE marketplaces. The costs of PDE data insights could be
189. Joint Ctr. for Hous. Studies of Harvard Univ., America’s Rental Housing: Expanding Options
for Diverse and Growing Demand 2 (2015), http://www.jchs.harvard.edu/sites/
jchs.harvard.edu/files/americas_rental_housing_2015_web.pdf [http://perma.cc/6TH9-6VP4].
190. Id. at 5. The study defines cost-burdened as “paying more than 30 percent of income for
housing” and severely cost-burdened as “paying more than half of income for housing.” Id. at 4.
191. See Surabhi Kejriwal & <PRESIDIO_ANONYMIZED_PERSON>, Deloitte Ctr. for Fin. Servs., Smart
Buildings: How IOT Technology Aims to Add Value for Real Estate Companies 9 (2016),
http://www2.deloitte.com/content/dam/Deloitte/nl/Documents/real-estate/deloitte-nl-fsi-real-estatesmart-buildings-how-iot-technology-aims-to-add-value-for-real-estate-companies.pdf
[http://perma.cc/RW4J-PKTZ]; see also Matt Power, The Green Landlord: 5 New Technologies
that
Save
Energy
and
Money,
Green
Builder
Media
(June
9,
2014),
http://www.greenbuildermedia.com/internet-of-things/blog/the-green-landlord-fivenew-technologies-that-save-energy-and-money [http://perma.cc/7RF2-Y8B6].
192. Klint Finley, How to Use the Internet of Things to Fight Slumlords, Wired (Aug. 28,
2014), http://www.wired.com/2014/08/heat-seek-nyc/ [http://perma.cc/X5VK-P7SK].
193. See Eric Dunn & Marina Grabchuk, Background Checks and Social Effects:
Contemporary Residential Tenant-Screening Problems in Washington State, 9 Seattle J. Soc. Just.
319, 323 (2010) (explaining that the entire cost of tenant-screening reports is “generally passed
along to the applicant”).

Electronic copy available at: https://ssrn.com/abstract=3058835

1408

COLUMBIA LAW REVIEW

[Vol. 117:1369

passed on to renters. Tenant-screening reports could become more expensive as
a result. Groups that already face significant barriers accessing housing are
particularly vulnerable as they are generally required to pay for new screening
reports for each application to a landlord prior to obtaining housing.194 Not
only is a lack of privacy a concern, but the danger for such renters and their
families is possible homelessness if they are unable to bear the costs of
multiple screening reports during their search for housing.
Consider that a UK company, Tenant Assured, has developed a program to
permit landlords to analyze the social media data of renters.195 The program
scans renters’ social media conversations and posts for “information about the
user’s personality, life events (like giving birth or getting married), and even
their ‘financial stress level’—a measure of how easy it is for them to pay their
rent, based on the frequency with which keywords like ‘no money,’ ‘poor,’ and
‘staying in’” appeared in their posts.196
Naborly, another start-up company, touts that it “goes beyond the basics”
of credit reports,197 which the Fair Credit Reporting Act (FCRA) may
regulate,198 and utilizes artificial intelligence to compile and scrutinize tenant
information for landlords.199 As Professor Daniel Solove has observed, “Not
only are our digital biographies reductive, but they are often inaccurate.”200
Companies such as Naborly could qualify as consumer reporting agencies.201
194. Id. at 333.
195. James Vincent, Startup Lets Landlords Scan Tenants’ Facebook to Check if They Can Pay Rent,
Verge (June 10, 2016), http://www.theverge.com/2016/6/10/11903082/landlord-social-media-credit-check
[http://perma.cc/9GWM-MKDR].
196. Id.
197. We Let You Know Exactly Who You’re Renting to, Before They Move In, Naborly.Co,
http://naborly.com [http://perma.cc/3JVS-EQGZ] [hereinafter Naborly] (last visited July 28, 2017).
198. See 15 U.S.C. § 1681a(d)(1) (2012) (defining “consumer report” as “any written, oral,
or other communication of any information by a consumer reporting agency bearing on a
consumer’s credit worthiness, credit standing, credit capacity, character, general reputation,
personal characteristics, or mode of living”); Daniel J. Solove & Paul M. Schwartz, Privacy Law
Fundamentals 86 (1st ed. 2011) [hereinafter Solove & Schwartz, Privacy Law Fundamentals]
(noting the FCRA “applies to ‘any consumer reporting agency’ that furnishes ‘a consumer report’”
(quoting 15 U.S.C. § 1681b (2006))).
199. Naborly, supra note 197.
200. Daniel J. Solove, The Digital Person: Technology and Privacy in the Information Age 46
(2004).
201. See 15 U.S.C. § 1681a(f) (defining “consumer reporting agency” as “any person which,
for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages . . . in the practice
of assembling or evaluating consumer credit information or other information on consumers for
the purpose of furnishing consumer reports to third parties”); Chris J. Hoofnagle, Federal Trade
Commission Privacy Law and Policy 277 (2016) [hereinafter Hoofnagle, FTC Privacy Law and
Policy] (“Companies selling data that are aware that they are being used for credit, insurance,
employment, or tenancy screening are [consumer reporting agencies].”). The FTC explains that “tenant
background-screening companies” are considered “consumer reporting agencies” under the FCRA
when they “sell or provide” reports that “serve as a factor in determining . . . eligibility for
housing, employment, credit, insurance, or other purposes and they include information ‘bearing
on a consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal
characteristics, or mode of living.’” What Tenant Background Screening Companies Need to Know

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1409

To the extent that these reports are being used “in a covered circumstance,” one
could contend that the company producing and transferring such a report is a
covered entity and should comply with the FCRA requirements.202 If these
companies are not viewed as consumer reporting agencies or the FCRA does
not cover the artificial intelligence reports they generate, it is not entirely clear
whether consumers will have access to such reports or have an opportunity to
dispute inaccuracies in these reports.203
Professor Hoofnagle contends that if “companies merge non-FCRA
information with FCRA data it is all subject to the act.”204 It could be possible,
however, for companies to separate artificial intelligence, social media, and
PDE reports from traditional credit reports. An FTC staff letter evaluating a
business that transferred background reports that contained social media
information suggests that even when companies produce social media reports,
the FCRA rules may still apply.205

About the Fair Credit Reporting Act, FTC (quoting 15 U.S.C. § 1681a(d)(1)),
http://www.ftc.gov/tips-advice/business-center/guidance/what-tenant-background-screeningcompanies-need-know-about-fair [http://perma.cc/8BW9-DMN4] (last visited July 28, 2017).
202. Letter From Maneesha Mithal, Assoc. Dir., FTC, to Renee Jackson, Nixon Peabody LLP
1
(May
9,
2011)
[hereinafter
FTC
Social
Intelligence
Letter],
http://
www.ftc.gov/sites/default/files/documents/closing_letters/social-intelligence-corporation/
110509socialintelligenceletter.pdf [http://perma.cc/R256-RNVE] (finding that a company that
provided “Internet and social media background screening service used by employers . . . [is] a
consumer reporting agency because it assembles or evaluates consumer report information that is
furnished to third parties that use such information as a factor in establishing a consumer’s
eligibility for employment”); see also Alexander Reicher, The Background of Our Being: Internet
Background Checks in the Hiring Process, 28 Berkeley Tech. L.J. 115, 131–33 (2013) (discussing
the FTC’s conclusion that Social Intelligence is a consumer reporting agency under the FCRA).
203. See A Summary of Your Rights Under the Fair Credit Reporting Act, CFPB,
http://files.consumerfinance.gov/f/201410_cfpb_summary_your-rights-under-fcra.pdf
[http://
perma.cc/859V-A853] (last visited Sept. 25, 2017) (describing the right to view and contest
information in consumer reports under the FCRA); Disputing Errors on Credit Reports, FTC,
http://www.consumer.ftc.gov/articles/0151-disputing-errors-credit-reports
[http://
perma.cc/VXV2-A6P8] (last visited July 28, 2017) (“Under the FCRA, both the credit reporting
company and the information provider (that is, the person, company, or organization that provides
information about you to a credit reporting company) are responsible for correcting inaccurate or
incomplete information in your report.”); Using Consumer Reports: What Landlords Need to
Know, FTC, http://www.ftc.gov/tips-advice/business-center/guidance/using-consumer-reports-whatlandlords-need-know
[http://
perma.cc/9VJR-G9ZF] (last visited July 28, 2017) (stating that when landlords “use consumer
reports to make tenant decisions, [they] must comply with the Fair Credit Reporting Act”).
204. Hoofnagle, FTC Privacy Law and Policy, supra note 201.
205. FTC Social Intelligence Letter, supra note 202; see also Lesley Fair, The Fair Credit
Reporting Act and Social Media: What Businesses Should Know, FTC: Bus. Blog (June 23, 2011),
http://www.ftc.gov/news-events/blogs/business-blog/2011/06/fair-credit-reporting-act-social-mediawhat-businesses [http://perma.cc/GX4M-F466]. PDE and social media reports could also simply be
viewed as data about an individual’s reputation. Hoofnagle, FTC Privacy Law and Policy, supra
note 201, at 276 (contending that information about someone’s reputation is not a consumer report
under the FCRA). But see 15 U.S.C. § 1681a(d)(1) (defining “consumer report” as “any written,
oral, or other communication of any information by a consumer reporting agency bearing on a
consumer’s . . . character, general reputation, [or] personal characteristics”).

Electronic copy available at: https://ssrn.com/abstract=3058835

1410

COLUMBIA LAW REVIEW

[Vol. 117:1369

Renter data could also be used in contexts that are not directly connected
to rental determinations. In theory, a landlord could enter into an arrangement
with a PDE company to provide all data generated by IOT devices the landlord
owns and provides in a building. While there may be practical and
technological obstacles to such an arrangement (for instance, the tenant may
have supplied the IOT appliances), the landlord could provide the information
to receive personalized services, discounts, or monetary compensation. Such an
arrangement may not have a direct connection to housing determinations, yet
the privacy and data of renters would still be at issue. Given the studies that
suggest that economically vulnerable and minority consumers are more likely
to rent,206 and the possible unequal bargaining power between landlords and
renters, particularly when housing supply is low, monetization by landlords
may also exacerbate concerns about unequal access to privacy.
The National Conference of State Legislators reports that only one state
has adopted a “social media privacy” statute applicable to landlords.207 The
Wisconsin statute prohibits landlords from requiring tenants to provide access
to their Internet accounts as a “condition of tenancy.”208 The statute defines a
personal Internet account as an “[i]nternet-based account that is created and
used by an individual exclusively for purposes of personal communications.”209
While personal Internet accounts likely include social media accounts, it is not
entirely clear whether accounts with PDE companies or the data insights such
companies provide will be protected by the statute.
The Wisconsin statute also does not prevent landlords from reviewing or
utilizing data about tenants that a landlord can acquire without the tenant’s user
name, password, or other security data.210 This suggests that to the extent that
the data are public or prospective tenants engage in the PDE marketplace, the
information they provide could still be used or perhaps obtained by landlords if
landlords do not require the tenants to disclose their passwords and other
related information. Consider that Datacoup provides users with a “public link”

206. See supra note 189 and accompanying text.
207. State Social Media Privacy Laws, Nat’l Conference of State Legislators (May 5, 2017),
http://www.ncsl.org/research/telecommunications-and-information-technology/state-laws-prohibitingaccess-to-social-media-usernames-and-passwords.aspx [http://perma.cc/D2HL-VK6Q] (noting that twentyfive states have adopted social media privacy laws applicable to employers, sixteen of which have
enacted similar laws that are applicable to educational institutions, but that Wisconsin is the only
state to have adopted legislation that is applicable to landlords).
208. Wis. Stat. § 995.55 (2014) (stating that no landlord may “[r]equest or require a tenant or
prospective tenant, as a condition of tenancy, to disclose access information for the personal
Internet account of the tenant or prospective tenant or to otherwise grant access to or allow
observation of that account”).
209. Id.
210. Id. The statute defines defines “access information” as “a user name and password or
any other security information that protects access to a personal Internet account” and explains
that the statute “does not prohibit a landlord from viewing, accessing, or using information about a
tenant or prospective tenant that can be obtained without access information or that is available in
the public domain.” Id.

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1411

of their data profiles that can be shared with potential data buyers.211 Once a
user distributes the link to encourage interest by data buyers, one could argue
that the user’s PDE data profile is now “available in the public domain” and
therefore a landlord is not prohibited from using the data profile under the
statute.
Landlords frequently obtain criminal background checks as part of the
tenancy-application process, which may have a discriminatory impact on
groups that have a “disproportionate rate of incarceration.”212 Commentators
have highlighted the risks that may flow from protecting information privacy in
the landlord–tenant context, such as when a landlord fails to notify tenants of
the criminal history or tendencies of another tenant when there is a foreseeable
risk.213 However, the dangers associated with unequal access to privacy should
not be ignored, and an appropriate balance between allowing disclosures to
ensure the physical safety of co-tenants and providing baseline privacy rights to
citizens on an equal basis is necessary. Careful consideration must be given to
the ways in which the perceived and supposed criminality of certain groups
may be used to justify data disclosures.
B.

Illusory Control and Choice

1. PDE Models. — PDE companies suggest that their products offer
consumers more choice and control over what happens to their data.214 In some
instances, what may be provided to consumers is the illusion of control and
choice. A review of the terms and conditions and privacy policies of these
companies indicates that some PDE companies could still monetize or disclose
data once the consumer transfers or provides access to their data.215
Transferees of user data in Datacoup’s marketplace “have access to a large
pool
of
aggregated,
de-identified,
anonymous
Datacoup
user
data.”216 Datacoup’s terms and conditions state that by using the data
consolidation, importation, and aggregation features of their service, a user
grants the company a “non-exclusive, perpetual, irrevocable, royalty-free,
sublicensable, transferable right” to aggregate, utilize, and divulge the data “for
any purpose.”217 Datacoup could not only transfer this data to data buyers but
also subsequently provide this information to third parties, such as advertisers
and the company’s analytics affiliates.218 This subsequent potential disclosure
211. MEF White Paper, supra note 23, at 27.
212. Carol Necole Brown, Experiencing Housing Law, 1323, 1409–10 (2016). Professor Brown
contends that, except for a small number of local ordinances, “presently, there are no fair housing
protections at the state or federal levels for individuals with criminal backgrounds.” Id. at 1409.
213. E.g., Eugene Volokh, Tort Law vs. Privacy, 114 Colum. L. Rev. 879, 928 (2014).
214. See supra section III.A.2.
215. See Abraham & Oneto, supra note 28, at 3.
216. Datacoup, How Datacoup Works, supra note 135.
217. Datacoup, Terms of Service, supra note 185. Additionally, the company’s terms and
conditions note that users retain all intellectual property rights in their data. Id.
218. Datacoup, Privacy Policy, supra note 135 (“We may disclose aggregated or de-identified
data derived from information about you to any third party. By registering for or using our

Electronic copy available at: https://ssrn.com/abstract=3058835

1412

COLUMBIA LAW REVIEW

[Vol. 117:1369

of anonymized and aggregated data may be no different from the de-identified
data disclosures and transfers made by conventional companies, except that
Datacoup suggests that the company’s primary goal is to empower individuals
to reacquire control of their data.219 Moreover, Datacoup’s privacy policy also
notes that “[u]nless expressly stated otherwise,” once the company transfers
consumer data to a data buyer, the information is subject only to the privacy
protections that the buyer has agreed to, and “absent express limitations,” the
data buyer may subsequently “resell [the user’s] personal information or use it
in other ways that are not described in [Datacoup’s] Privacy Policy.”220 Similar
provisions exist in the privacy policies of other PDE-like companies.221
Companies often use anonymization to justify disclosures of consumer
data.222 Overreliance on anonymization to protect consumers presumes to some
extent that consumers are primarily bothered by the possibility that their names
could be attached to their data.223 However, individuals may have various
reasons for objecting to the commercial use of their data.224 As is the case in the
non-PDE setting, disclosures of aggregated and de-identified data are a cause
for concern in light of evidence suggesting that anonymized data could be deanonymized or re-identified.225 Companies may be able to make inferences and
Services you consent to the collection, use and sharing of such aggregated data and/or or deidentified information as Datacoup deems appropriate.”). The company’s privacy policy notes that
the company may “analyze and draw conclusions” from a user’s personal information and use the
data to target users with special offers from unaffiliated parties. Id. As to personal information
(defined by the company as information that can be used to identify a user), the company
promises not to share this data without the user’s consent, but personal information is defined to
exclude aggregated or de-identified data. Id.
219. Datacoup, About Us, supra note 134 (“We are building for a future where individuals
like you are in control of your data and are the chief beneficiaries of its value.”); see also
Datacoup, Privacy Policy, supra note 135 (“Datacoup empowers you to take control of your
data . . . .”).
220. Datacoup, Privacy Policy, supra note 135.
221. See, e.g., Privacy Policy, Beagli, http://www.beagli.com/legal/ (click “Privacy Policy”
tab) [http://perma.cc/NH8W-3DAM] (last visited July 28, 2017) (“Beagli can share aggregated
level information based on your data with third parties (any third parties). When creating this
report/analysis Beagli will not allow third parties to identify you based on your data and will not
pass on any contact information to third parties.”); Privacy, Cozy, http://forum.cozy.io/privacy
[http://perma.cc/8YUK-YMRT?type=image] (last visited July 28, 2017) (“We do not sell, trade, or
otherwise transfer to outside parties your personally identifiable information. . . . However, nonpersonally identifiable visitor information may be provided to other parties for marketing,
advertising, or other uses.”).
222. See Schwartz & Solove, The PII Problem, supra note 32, at 1836–47.
223. Bonnie Kaplan, Selling Health Data: De-Identification, Privacy, and Speech 8 (Yale Inst.
for Soc. & Policy Studies, Bioethics Working Paper No. 14-024, 2014),
http://bioethics.yale.edu/sites/default/files/files/ISPS14-024.pdf [http://perma.cc/G586-X2XP].
224. Id.
225. See Sharona Hoffman, Electronic Health Records and Medical Big Data: Law and
Policy 136 (2016) [hereinafter Hoffman, Electronic Health] (discussing the possible reidentification of de-identified electronic health records through “nonmedical data, such as voter
registration records” as well as “records of patients’ medication purchases, media stories about
accidents and illnesses, Facebook, and other sources”); Paul Ohm, Broken Promises of Privacy:
Responding to the Surprising Failure of Anonymization, 57 UCLA L. Rev. 1701, 1701 (2010)

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1413

estimates about users from anonymized data and combine PDE data with information obtained from other sources to identify users.226 Consumers have no
control over how companies that make “probabilistic inferences” and identify
patterns from anonymized data will treat them.227 Hence, the artifice of
consumer control. In addition to the potential harms to individual consumers,
one must also consider that privacy “is also a public value (of value to the
democratic political system) and it is a collective value.”228
By going directly to the source of the data—the consumer—PDE
companies can obtain access to consumer data without having to rely on
established data brokers. However, some PDE companies are arguably also
data brokers to the extent that they compile and share user data. The FTC
describes data brokers as “companies that collect consumers’ personal
information and resell or share that information with others” for several
purposes.229 PDE companies could also purchase information about consumers
from various sources and then sell or provide access to the data to third parties.
Absent explicit restrictions imposed on the types of transferees that are
permitted to participate in PDE marketplaces, established data brokers may be
able to obtain consumer data in the PDE marketplace. A company that has
entered into an agreement with a data broker could obtain access to PDE data
and subsequently provide this information to the data broker. Thus, consumer
data may simply move from one data broker to another with the difference
being that there is now direct (or seemingly more active) consumer interaction
enabling this process.
Admittedly, some PDE data-insight companies have taken a seemingly
more proactive approach to addressing consumer-privacy and data-protection
concerns. Digi.me’s privacy summary notes that it does not track consumer
(contending that computer “scientists have demonstrated that they can often ‘reidentify’ or
‘deanonymize’ individuals hidden in anonymized data with astonishing ease”); Ira S. Rubinstein
& Woodrow Hartzog, Anonymization and Risk, 91 Wash. L. Rev. 703, 705 (2016) (contending
that “the failure of anonymization has identified a weakness in the focus of the law surrounding
data releases”). Professor Sharona Hoffman suggests that even though the risk of re-identification
may appear small, re-identification could impact “tens of thousands or even hundreds of
thousands of records.” Hoffman, Electronic Health, supra, at 225. For a discussion of how medical
records might be de-anonymized, see Kaplan, supra note 223, at 8–9 (contending that as “the
information kept in medical records grows to include patients’ genomes and other genetic
information as well as data on social and behavioral determinants of health . . . it will be easier to
identify patients from their records”).
226. Solon Barocas & Helen Nissenbaum, Big Data’s End Run Around Procedural Privacy
Protections, Comm. ACM, Nov. 2014, at 31, 32–33 (contending that anonymization practices
make it harder for third parties to discover “embarrassing, discrediting, or incriminating facts, but
they do nothing to limit the ability of these companies to draw upon this information in shaping a
growing share of everyday experiences that take place on these companies’ platforms.”).
227. Id.
228. Kirsty Hughes, The Social Value of Privacy, the Value of Privacy to Society and Human
Rights Discourse, in Social Dimensions of Privacy: Interdisciplinary Perspectives 225, 225 (Beate
Roessler & Dorota Mokrosinska eds., 2015); see also Priscilla M. Regan, Legislating Privacy:
Technology, Social Values, and Public Policy 220–43 (1995).
229. FTC Data Broker Report, supra note 143, at i.

Electronic copy available at: https://ssrn.com/abstract=3058835

1414

COLUMBIA LAW REVIEW

[Vol. 117:1369

activity, and it does not store or see social media account information or any
associated personal data.230 As a result, it cannot sell or use user data. Digi.me
collects certain “anonymized statistics” about users, but the company’s terms of
service indicate that users can opt out of this process.231 Meeco’s privacy policy
indicates that it does not monetize consumer data, and the company’s website
acknowledges that consumers should have the “right to be free from
surveillance [and] targeted and intrusive advertising.”232 However, the
company’s terms and conditions also note that if a user grants a third party
access to their information, the user is subject to that third party’s terms and
conditions.233
Even if consumers have the option to control which companies can obtain
access to their data profiles, issues similar to those prevalent in previously
discussed data-business models (such as the data-as-payment and freemium
models) may also arise.234 These issues include a lack of consumer
understanding of the potential implications of providing consent to data
collection and disclosure. For instance, although consumers may be provided
with consent terms and information about potential data buyers before agreeing
230. See Digi.me Is Free . . . so How Do We Make Money?, Digi.me,
http://www.digi.me/business-model [http://perma.cc/D9FA-AJCU] (last visited July 28, 2017)
(“We never see, touch or hold your personal data so we couldn’t use or sell it even if we wanted to. And
we
don’t.”);
Your
Privacy
Is
Paramount,
Digi.me,
http://docs.wixstatic.com/ugd/
03cafa_cf269cf4470a45d0b226cca73edb0263.pdf [http://perma.cc/9ZVJ-BZJW] [hereinafter Digi.me,
Paramount] (last visited Sep. 7, 2017) (“We do not: 1. Store any personal data on you except your
name & email address, your country of residence and the language you are using in the
application . . . 3. Track your activity except for checking that your license is valid when you use
the application.”). The company’s website also indicates that, even when a user accepts a
company’s data request via a consent contract, “digi.me makes the agreed data available to the
company for a limited time via a secure connection, encrypted so only they can see it.” A Better
Way to Share, Digi.me, http://www.digi.me/sharing [http://perma.cc/8Z5F-MC8F] (last visited
July 28, 2017).
231. Digi.me End User Terms, Digi.me, http://www.digi.me/terms [http://perma.cc/
L2N8-E5WW] (last visited July 28, 2017) (noting that the company collects anonymized statistics
“including but not limited to version numbers of software, the features within the digi.me app
being used and information on which services are being synced,” but users have the ability to opt
out of the anonymous data collection process). The company’s website suggests that the
information collected is fully anonymized so it cannot identify users and does not have any access
to user data through the anonymization process. Id.; Digi.me, Paramount, supra note 230.
232. Meeco, How It Works, supra note 122; see also Abraham & Oneto, supra note 28, at 3;
Meeco, Introduction to Meeco, supra note 122 (“Unlike other services, Meeco does not mine or
sell your data.”); Meeco, Privacy Policy, supra note 129. Meeco’s privacy policy states that the
company may disclose aggregated data by, for instance, publishing reports on “trends in the usage
of [the company’s] website or anonymous intentions” and users may opt out of direct marketing
from the company. Id. As to licenses, Meeco’s privacy policy notes that “to facilitate the Meeco
Services on Your behalf, You hereby grant to Meeco a non-exclusive, royalty-free license to store,
reproduce and display Your Data solely as reasonably necessary to provide the Meeco Services at
Your direction and on Your behalf, and subject to this Agreement and our Privacy Policy.” Id.
233. General Terms and Conditions for Meeco & Mecast Users, Meeco,
http://www.meeco.me/meeco-terms.pdf [http://perma.cc/DGY8-L5FW] [hereinafter Meeco,
Terms and Conditions] (last updated Sept. 15, 2015).
234. See supra section III.A.

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1415

to transfer or provide access to their data and may be given the ability to deny
data access or sale requests, it is unclear whether consumers engaging in the
PDE marketplace will review and understand any such disclosures or rights
before agreeing to the transfer or disclosure. The lure of compensation and
discounts (even if minor) may outweigh considerations regarding potential
purchasers of consumer data and subsequent data usage. Consumers who
choose to participate in the PDE marketplace may not grasp the extent to which
their data can be subsequently monetized once it is disclosed or transferred and
how the data can be used by companies to make inferences about their lives
and impact the opportunities they receive. Consumers may be unlikely to
impose use restrictions on data transferees, such as prohibiting data analytics
and generating inferences or review the terms and conditions and privacy
policies of a company accessing their data to determine what will happen to
their data after transfer or disclosure. Thus, problems associated with notice
and choice in older business models may continue under PDE models.
Additionally, it is not entirely clear whether consumers will be able to
consistently negotiate contract terms to exert sufficient control over how data
buyers or companies that gain access to their data will use the data once it is
obtained. These companies may simply provide their terms and conditions and
privacy policies on a take-it-or-leave-it basis. PDE companies may not always
provide users with the ability to negotiate such terms. At least one PDE
company touts that it allows users to control third-party access to their data as
well as issue their own terms and conditions and notes,235 but the company’s
terms and conditions indicate that a user-generated term can be treated as a
mere request and may be unenforceable.236
Companies’ earlier efforts to provide consumers with more control over
their data have not been widely successful for various reasons, especially
because other companies have been able to simultaneously obtain access to
consumer data.237 Professor Eric Goldman contends that the “infomediaries” of

235. Meeco, http://meeco.me [http://perma.cc/535Y-RFEQ] [hereinafter Meeco, Homepage]
(last visited July 28, 2017) (describing Meeco’s “sharing on your terms” policy and Consent
Manager).
236. Meeco, Terms and Conditions, supra note 233. The company’s terms and conditions
provide that “Sharing Permissions will default to ‘do not share with Third Parties or make Public
without my permission’ and ‘do not sell or trade without my permission.’” Id. This suggests that
users may have the ability in some instances to limit disclosures of their data, but this ability may
not extend to other forms of monetization or inferences that can be made once user data are
accessed or obtained by third parties.
237. See Hoofnagle & Whittington, Unpacking Privacy’s Price, supra note 135, at 1347
(describing how the “diffusion of personal information in the marketplace” allows others to easily
access consumer data). For discussions of “infomediaries” and their failures, see Paul M.
Schwartz, Privacy and Democracy in Cyberspace, 52 Vand. L. Rev. 1609, 1686 (1999) (“Taken by
themselves, however, infomediaries are unlikely to turn fair information practices into
cyberspace’s predominant norms. Infomediaries negotiating around a default of maximum
disclosure of personal information will be incapable of shifting the customs of the Web through
their practices.”); Bethany L. Leickly, Intermediaries in Information Economies (Apr. 30, 2004)
(unpublished M.A. thesis, Georgetown University), http://extrafancy.net/bethany/intermediaries.pdf

Electronic copy available at: https://ssrn.com/abstract=3058835

1416

COLUMBIA LAW REVIEW

[Vol. 117:1369

the dot-com era may have failed because of “marketer disincentives to pay to
participate, consumer reluctance to invest, and operation costs.”238 Although
PDE companies may give consumers the ability to decide with whom to share
their data, tracking by other companies that use a data-as-payment or a
freemium model may undermine these efforts. These other companies may
have access to the exact same information that consumers provide to PDE
companies and, as a result, may continue to monetize and disclose consumer
data.
2. PFP Models. — The privacy-as-a-luxury model may provide more
options for consumers to protect their privacy. Yet it is not entirely clear
whether all companies using this model will refrain from monetizing consumer
data. Of course, given the fact that the primium model is based on providing
privacy controls and protection to consumers, one can only assume that selling
or providing access to consumer data to advertisers or data brokers is contrary
to the essence of the product that is provided to the primium user.
Privacy-conscious consumers who elect to pay for and use VPN services
may also be misled into believing that their online activities will be completely

[http://perma.cc/V35Y-3DR8] (providing a case study of earlier generations of infomediaries and
identifying various reasons for their failures).
238. Goldman, Coasean Analysis, supra note 128, at 1198–99; see also Net Worth: Shaping
Markets when Customers Make the Rules, Harv. Bus. Sch. Press (Oct. 12, 1999),
http://hbswk.hbs.edu/archive/812.html [http://perma.cc/LV3Z-DRW9] (describing an infomediary
as a “trusted third party to act as the custodian, agent, and broker of [consumer] information,
marketing it to businesses on the consumer’s behalf while at the same time protecting consumer
privacy”). PDE companies share some characteristics with the “infomediaries” proposed by John
Hagel III and Marc Singer and discussed by Professor Goldman, such as protecting consumer
privacy. See Goldman, Coasean Analysis, supra note 128, at 1198 (describing the characteristics
of the “infomediaries” proposed by Hagel and Singer); see also John Hagel III & Jeffrey F.
Rayport, The Coming Battle for Customer Information, Harv. Bus. Rev., Jan.–Feb. 1997, at 53, 54
(proposing and discussing the role of “infomediaries”). However, some PDE companies do not
appear to “actively seek out the lowest price for a desired good or service,” one of the
characteristics or objectives of “infomediaries.” Goldman, Coasean Analysis, supra note 128, at
1198; see also John Hagel III & Marc Singer, Net Worth: Shaping Markets when Customers Make
the Rules 19, 35 (1999) (discussing the role of infomediaries in targeted marketing and obtaining
the best prices for users). Some PDE companies have acknowledged that users should have a right
to be free from targeted advertising in contrast to an “infomediary” that “anticipate[s] its clients’
purchasing behavior and suggest[s] products and services before the client begins to search for
them.” Allison B. Smith, Net Worth: Shaping Markets when Customers Make the Rules, 18 J.
Pub. Pol’y & Marketing 275, 276 (1999) (book review); see also Meeco, How It Works, supra
note 122 (discussing users’ right to be free from “targeted and intrusive advertising”). While PDE
companies share some characteristics with “infomediaries,” to the extent that PDE companies
adopt an approach to data and privacy that focuses on the best interests of consumers rather than
primarily “facilitating targeted advertisements,” they may be more akin to the professional
Personal Data Guardian (PDG) proposed by Professor Jerry Kang and others. See Jerry Kang et
al., Self-Surveillance Privacy, 97 Iowa L. Rev. 809, 837 (2012) (“[T]he goal of the PDG is not to
minimize transaction costs of online shopping by facilitating targeted advertisements. Instead, the
role ideology . . . is to intentionally and mindfully slow down data flows, advise the individual of
unexpected consequences, and adopt default best practices . . . in the individual’s best interests.”).

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1417

anonymized.239 Some VPN providers may “advertise an ‘anonymous service’
on their website but the fine print in their privacy policy suggests they log a
significant amount of customer data.”240 In some instances non-VPN
companies may prevent consumers from accessing their websites and services
while using VPNs and may prevent their payment platforms from being used in
VPN-related transactions.241 In such an event, the consumer may need to
temporarily disconnect from the VPN in order to access unaffiliated websites
and services. Thus, the privacy and control promised by a VPN company may
not always be absolute.
As to PFP discount programs in the broadband context, there is also an
illusion of control and choice. Even customers who elected not to take the
discount previously offered by one ISP to entice consent to its data collection
practices may have had some of their activities monitored. These consumers
paid higher monthly fees (thereby paying for privacy) in order to avoid data
collection. The FCC has noted that the ISP company mentioned above
previously acknowledged “that it nonetheless ‘may collect and use web browsing
information for other purposes, as described in [the company’s] Privacy Policy,
even [for customers who] do not participate in the Internet Preferences
program.’”242
C.

The PDE and New Monetization Techniques

Currently, PDE companies utilize two main monetization options: (1)
providing data insights, control, customized deals, and personalized
experiences in exchange for access to consumer data; and (2) providing
monetary compensation in exchange for purchasing or obtaining rights in
consumer data and transferring that data to third parties or the PDE company.
239. See I Am Anonymous When I Use a VPN—10 Myths Debunked, Golden Frog: Blog
(July 28, 2015), http://www.goldenfrog.com/blog/myths-about-vpn-logging-and-anonymity
[http://perma.cc/39UZ-7Y4U] (describing the “disturbing trend” of VPN providers promising
“anonymous service” without detailing how exactly data are handled).
240. Id.
241. Klint Finley, VPNs Won’t Save You from Congress’ Internet Privacy Giveaway, Wired
(Mar. 28, 2017), http://www.wired.com/2017/03/vpns-wont-save-congress-internet-privacygiveaway/ [http://perma.cc/5LS6-VHTS] [hereinafter Finley, VPNs Won’t Save You]; see also
Julia Greenberg, For Netflix, Discontent over Blocked VPNs Is Boiling, Wired (Mar. 7, 2016),
http://www.wired.com/2016/03/netflix-discontent-blocked-vpns-boiling/
[http://perma.cc/CVM4ASYQ] (describing Netflix’s blocking of VPNs); Matt Kamen, Paypal Bans VPN and DNS Services,
Wired
(Feb.
5,
2016),
http://www.wired.co.uk/
article/paypal-bans-vpn-and-dns-services [http://perma.cc/9UQ7-H7PS] (describing PayPal’s blocking
of VPNs).
242. Notice of Proposed Rulemaking, Protecting the Privacy of Customers of Broadband and
Other Telecommunications Services, 31 FCC Rcd. 2500, 2582 n.402 (2016). AT&T recently
indicated that it will end its PFP offerings, but given the repeal of the FCC Rules other ISPs may
begin to offer such plans and AT&T could elect to reinstate its program. See Aaron Pressman,
Here’s Why AT&T Internet Customers Won’t Pay Extra for Privacy Anymore, Fortune (Sept. 30,
2016), http://fortune.com/2016/09/30/att-internet-fees-privacy/ [http://perma.cc/PSF7-XX9P]
(quoting AT&T as stating that it “plan[s] to end the optional Internet Preferences advertising
program”).

Electronic copy available at: https://ssrn.com/abstract=3058835

1418

COLUMBIA LAW REVIEW

[Vol. 117:1369

Given the expected volume of IOT data, additional monetization schemes may
also be offered to users. However, concerns may arise when new monetization
schemes are used.
If the value, velocity, and quantity of consumer data increase with the rise
of the IOT, both lenders and consumers could eventually view consumer data as an
attractive asset for use in routine secured transactions.243 Consumer data could be
viewed as a general intangible under Article 9 of the UCC. A consumer could
then elect to use her data as collateral to obtain financing from a lender who
retains a security interest in the collateral. This would provide an alternative
source of financing for consumers. Companies may be able to use their
intangible assets, such as customer lists, to obtain financing from lenders, and
consumer databases are valuable assets that can be transferred to third parties
during bankruptcy proceedings.244 Thus, if companies can monetize consumer
data and lists for financing schemes, perhaps consumers should be permitted to
do the same. However, consumers may be more adequately protected if transfer
and assignment restrictions are imposed on certain types of data.245
The largest obstacle to such a monetization method is the perceived value
of a consumer’s individual data, which may be worth significantly less than the
243. Bos. Consulting Grp., The Value of Our Digital Identity 2, 22 (2012),
http://www.libertyglobal.com/PDF/public-policy/The-Value-of-Our-Digital-Identity.pdf
[http://
perma.cc/BF7C-8MNN] (suggesting that “as the volume and variety of data grows, so does its
value” and the value created through digital identity has a twenty-two percent annual growth rate);
FTC,
Big
Data:
A
Tool
for
Inclusion
or
Exclusion?
2
(2016),
http://www.ftc.gov/system/files/documents/reports/big-data-tool-inclusion-or-exclusionunderstanding-issues/160106big-data-rpt.pdf [http://perma.cc/V7FA-7MH4] (describing
the velocity of data as “the speed with which companies can accumulate, analyze, and use new
data”); Terrell McSweeny, Comm’r, FTC, Remarks to the U.S. Chamber of Commerce at TecNation 8
(Sept.
20,
2016),
http://www.ftc.gov/system/
files/documents/public_statements/985773/mcsweeny_-_tecnation_2016_9-20-16.pdf
[http://
perma.cc/VEJ3-L68H] (“What is changing in the digital economy is the volume, velocity, variety
and value of data—or the four Vs.”); The Increasing Value of Data, Future Agenda,
http://www.futureagenda.org/insight/the-increasing-value-of-data [http://perma.cc/8WT4-5W9A] (last
visited July 28, 2017) (suggesting that by 2020 “the sum of all the digitally available information
about [individuals] will be worth €1 trillion”); see also Schwartz, Property, Privacy, and Personal
Data, supra note 30, at 2056 (“The monetary value of personal data is large and still
growing . . . .”); Omer Tene, Privacy Law’s Midlife Crisis: A Critical Assessment of the Second
Wave of Global Privacy Laws, 74 Ohio St. L.J. 1217, 1228 (2013) (contending that there has been
a “surge in the value of personal data for governments, businesses, and individuals”).
244. Xuan-Thao N. Nguyen, Collateralizing Privacy, 78 Tul. L. Rev. 553, 576–77 (2004)
(describing consumer databases as intangible assets that can be used as collateral). See generally
Walter W. Miller, Jr. & Maureen A. O’Rourke, Bankruptcy Law v. Privacy Rights: Which Holds
the Trump Card?, 38 Hous. L. Rev. 777 (2001) (discussing the use of customer databases in
bankruptcy proceedings).
245. Elvy, Commodifying Consumer Data, supra note 11, at 75 (discussing the imposition of
transfer and assignment restrictions on companies’ use of certain consumer data); Miller &
O’Rourke, supra note 244, at 847 (“[T]here may be some information that should be inalienable
because of its highly personal nature.”); see also Helen Nissenbaum, Privacy as Contextual
Integrity, 79 Wash. L. Rev. 119, 121, 154–55 (2004) (arguing for the adoption of a contextualintegrity approach to protecting privacy that can consider “the nature of the information,” among
other things).

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1419

vast quantities of aggregated data and customer lists companies hold.246 In
evaluating whether such a monetization method should be permissible, the
policy reasons associated with a historical federal approach that frowns upon
non-purchase money security interests in certain consumer items with minimal
resale value must also be considered.247 Digi.me suggests that its product will
allow users to create “rich, deep datasets” that will be attractive to
companies.248 Cozy anticipates that users will use its platform as a “personal
data hub” to aggregate data from multiple aspects of their lives.249 The
company has created an app that allows users to “import data” from their
Google accounts.250 Once a PDE company aggregates and processes an
individual’s data, it could be viewed as an attractive valuable asset on an
individual level.
While permitting consumers to use their data for financing transactions
under Article 9 is a promising idea, there are possible negative consequences
that may result from allowing such transactions to occur. For example, Article 9
permits secured parties to foreclose on collateral in the event of a default as
defined by the security agreement.251 Failure to make timely payments is a
common event of default. After default, the secured party may dispose of the

246. Additionally, Article 9 of the UCC excludes certain assignments in consumer transactions
from its scope. More specifically, Article 9 does not apply to “assignment[s] of . . . deposit
account[s] in . . . consumer transaction[s].” U.C.C. § 9-109(d)(13) (Am. Law Inst. & Nat’l
Conference of Comm’rs on Unif. State Laws 2014) (stating that Article 9 does not apply to “an
assignment of a deposit account in a consumer transaction, but Sections 9-315 and 9-322 apply
with respect to proceeds and priorities in proceeds”). The official comments to Article 9 state that
the aim of the exclusion of deposit accounts “as original collateral in consumer transactions” is to
ensure that such transactions are left to “law other than” Article 9. Id. § 9-109 cmt. 16. One could
contend that assignments of data in consumer transactions should not be subject to Article 9.
247. See, e.g., Hoofnagle, FTC Privacy Law and Policy, supra note 201, at 301–02 (discussing 16 C.F.R. pt. 444 and the policy concerns associated with a “blanket security interest in
household goods,” such as the imposition of “psychological discomfort on debtors”); see also 16
C.F.R. § 444.1 (2011) (defining household goods as used within § 444.2); id. § 444.2 (“[I]t is an
unfair act or practice . . . for a lender or retail installment seller directly or indirectly to take or
receive from a consumer an obligation that . . . [c]onstitutes or contains a nonpossessory security
interest in household goods other than a purchase money security interest.”).
248. Firth, The Digi.me Story, supra note 121 (stating that the company’s product will “allow
businesses, who want access to these rich, deep datasets that our users will soon hold, to approach
them directly and offer them personalised offers in exchange for seeing some slices of that data”).
249. Make Sense of Your Data, Cozy, http://cozy.io/en/make-sense-of-your-data/
[http://perma.cc/8P57-SYH6] (last visited July 28, 2017) (“Health data coming from a fitness
tracker, information flowing from sensors and appliances in your home, your travel itineraries and
hotel bookings, bank transactions and financial information—there is a wealth of data pouring in
from multiple sources.”).
250. Applications, Cozy, http://cozy.io/en/apps/ [http://perma.cc/N22L-U3YC] (last visited
July 28, 2017).
251. U.C.C. § 9-601(a); id. § 9-610 (providing rules for foreclosure via a “disposition of the
collateral”); id. § 9-620 (providing rules for foreclosure via “acceptance of collateral in full or
partial satisfaction of the obligation”). Article 9 also provides that “in a consumer transaction, a
secured party may not accept collateral in partial satisfaction of the obligation it supports.” Id. § 9620(g).

Electronic copy available at: https://ssrn.com/abstract=3058835

1420

COLUMBIA LAW REVIEW

[Vol. 117:1369

collateral, including by selling it to third parties.252 Data brokers and entities
that prey on financially struggling consumers would of course be prime
potential purchasers of this type of collateral (assuming that they do not already
have access to the same information contained in a user’s PDE data profile).
Consumer-data monetizations under Article 9’s financing scheme may
also exacerbate concerns about unequal access to privacy. If secured-financing
monetization methods become viable, economically vulnerable consumers may
be more likely to grant security interests in their data, thereby monetizing their
privacy. Even if user data are not viewed as a desirable standalone asset, they
could be combined with other consumer assets to form a valuable asset
package. Additionally, if consumer data are viewed as a common asset to be
used for financing transactions, the market may eventually require all
consumers (even those who would desire more privacy) to provide their PDE
data profiles to obtain financing. Therefore, if a market develops for consumers
to monetize their data for secured financing purposes and such transactions are
covered by the UCC, the application of Article 9 to consumer-data transactions
must be closely monitored to ensure that its provisions, including default and
enforcement rules, do not consistently harm consumer interests, even though
Article 9 references the application of consumer protection laws.253
D.

Predatory and Discriminatory Behavior

After collecting consumer data, data brokers have generated categories
and labels to describe consumers, such as “Retiring on Empty: Singles,” “Rural
and Barely Making It,” “Tough Start: Young Single Parents,” and “Credit
Crunched: City Families.”254 Data brokers use these labels in providing
consumer information to data buyers.255 Some companies have used consumer
data to identify low-income and vulnerable consumers for predatory marketing
campaigns.256 During the housing bubble preceding the most recent financial
crisis, companies used data about consumers to engage in predatory lending
252. Id. § 9-610.
253. Other laws regulating debt collection may also need to be considered. The Consumer
Financial Protection Bureau (CFPB), which has “overlapping jurisdiction” with the FTC, may
also play a role in protecting consumers in such transactions. Hoofnagle, FTC Privacy Law and
Policy, supra note 201, at 269. Additionally, the Gramm-Leach Bliley Act (and similar state laws),
which regulates data collection, disclosures, and transfer of “nonpublic personal information” by
financial institutions and uses a notice-and-choice framework could also be applicable to any such
transactions. Id. at 292–94; Daniel J. Solove & Paul M. Schwartz, Consumer Privacy and Data
Protection 88–92 (2015) [hereinafter Solove & Schwartz, Consumer Privacy] (contending that
under the Gramm-Leach Bliley Act “[f]inancial institutions can share personal information with
nonaffiliated companies only if they first provide individuals with the ability to opt out of the
disclosure” and discussing confidentiality and use restrictions imposed on data transfers to third
parties and similar state laws); see also 15 U.S.C. § 6802 (2012).
254. Staff of S. Comm. on Commerce, Sci. & Transp., Review of the Data Broker Industry,
supra note 7, at ii.
255. Id.
256. See Amy J. Schmitz, Secret Consumer Scores and Segmentations: Separating “Haves”
from “Have-Nots,” 2014 Mich. St. L. Rev. 1411, 1413; see also Fulton, supra note 176.

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1421

and discriminatory behavior to the detriment of marginalized communities.257
The IOT and the use of PFP and PDE models may provide opportunities to
further enable this type of behavior.
1. PFP Models. — Recall from section III.A that consumers from vulnerable communities may be more willing to accept discounts offered under
PFP discount models.258 IOT devices often rely on a Wi-Fi connection provided
by ISPs to function and access the Internet.259 In theory, even consumers that
rely primarily on their smartphones to access the Internet could use their
smartphones as Wi-Fi hotspots to enable their IOT devices to function. In the
IOT setting, in which consumers are generating more data than ever before,
privacy-discount models could enable companies to stockpile increasingly
intimate details about marginalized consumers who are more willing to accept
privacy-invasive discounts. As Professor Scott Peppet notes, with the IOT
“everything reveals everything,” and IOT data could be combined “in
unexpected ways, giving rise to powerful inferences from seemingly innocuous
data sources.”260 Once consumers accept a privacy-invasive discount,

257. See andré douglas pond cummings, Racial Coding and the Financial Market Crisis, 2011
Utah L. Rev. 141, 159; see also Carol Necole Brown, Intent and Empirics: Race to the Subprime,
93 Marq. L. Rev. 907, 908–12 (2010) (discussing housing discrimination and subprime lending);
Pamela Foohey, Lender Discrimination, Black Churches, and Bankruptcy, 54 Hous. L. Rev. 1079,
1102–14 (2017) (discussing discrimination in lending to African American churches); Jim
Hawkins, Are Bigger Companies Better for Low-Income Borrowers?: Evidence from Payday and
Title Loan Advertisements, 11 J.L. Econ. & Pol’y 303, 324 (2015) (discussing how payday and
title lenders target minorities); Creola Johnson, America’s First Consumer Financial Watchdog Is
on a Leash: Can the CFPB Use Its Authority to Declare Payday-Loan Practices Unfair, Abusive,
and Deceptive?, 61 Cath. U. L. Rev. 381, 419 (2012) (discussing the impact of advertisement by
payday lenders on consumer choice); Kristin Johnson, Steven Ramirez & Cary Martin Shelby,
Diversifying to Mitigate Risk: Can Dodd-Frank Section 342 Help Stabilize the Financial Sector?,
73 Wash. & Lee L. Rev. 1795, 1813 (2016) (exploring the causes of the 2007–2009 financial
crisis); Steven A. Ramirez, The Virtues of Private Securities Litigation: An Historic and
Macroeconomic Perspective, 45 Loy. U. Chi. L.J. 669, 708 (2014) (discussing predatory lending
practices).
258. See supra section III.A; see also Fulton, supra note 176.
259. Press Release, Gartner, Gartner Says Organizations Must Update Their Network Access
Policy to Address Attack of IoT Devices (Sept. 8, 2016), http://www.gartner.com/
newsroom/id/3436717 [http://perma.cc/Q45P-S2VL] (“[M]any IoT devices will be connected via WiFi . . . .”); Verizon Wi-Fi, Verizon, http://www.verizon.com/home/wifi-wireless-internet-service/
[http://perma.cc/7GWE-BR2X] (last visited Sept. 9, 2017) (discussing Verizon’s Wi-Fi service).
260. Peppet, Regulating the Internet, supra note 38, at 117–40 (discussing concerns regarding
discrimination, privacy, and security on the IOT). Professor Hoffman discusses the implications in
the medical industry:
[O]pen data may enable discrimination by employers, financial institutions,
and anyone with a stake in people’s health. These entities may attempt to reidentify publicly available health records that belong to applicants or to
employees. In the alternative, they may mine medical data to find statistical
associations between particular attributes, habits, or behaviors (for example,
obesity or smoking) and health risks. Then, based on their findings, entities
could formulate discriminatory policies that exclude from employment,
financial, or other opportunities individuals they perceive as high-risk.

Electronic copy available at: https://ssrn.com/abstract=3058835

1422

COLUMBIA LAW REVIEW

[Vol. 117:1369

companies that obtain consumer data through this model can deploy “predictive
data devices to discriminate against consumers they deem less valuable or too
risky.”261 The chief executive officer of one cable company has openly
discussed the use of consumer lifestyle data and data analytics in making
choices about services offered to consumers and suggested that the “company’s
technicians [were not] going to ‘spend 15 minutes setting up an iPhone app’ for
a customer who has a low FICO score.”262
Some mobile carriers have allegedly packaged and transferred to third
parties data generated from consumers’ use of their products.263 In some
instances, purchasers of this data do not disclose which companies are
transferring the information.264 The Electronic Frontier Foundation reports that
ISPs have previously hijacked “consumers’ search queries” (the process of
redirecting queries to third party websites that may record the traffic and
Sharona Hoffman, Citizen Science: The Law and Ethics of Public Access to Medical Big Data, 30
Berkeley Tech. L.J. 1741, 1746 (2015).
261. Schmitz, supra note 256, at 1414; see also Solon Barocas & Andrew D. Selbst, Big
Data’s Disparate Impact, 104 Calif. L. Rev. 671, 677 (2016) (discussing how data mining has the
potential to be used in a discriminatory manner); Mary Madden et al., Privacy, Poverty, and Big
Data: A Matrix of Vulnerabilities for Poor Americans, 95 Wash. L. Rev. (forthcoming 2017)
(manuscript at 53), http://ssrn.com/abstract=2930247 (on file with the Columbia Law Review)
(discussing the negative impact of big data in “employment screening,” “predictive policing,” and
“access to higher education” on poor communities). See generally Cathy O’Neil, Weapons of
Math Destruction: How Big Data Increases Inequality and Threatens Democracy (2016)
(discussing big data and discrimination).
262. Daniel Frankel, Cable One Using FICO Scores to Qualify Video Customers, Might
Says, Fierce Cable (May 23, 2016) (quoting Thomas Might, CEO, Cable One),
http://www.fiercecable.com/cable/cable-one-using-fico-scores-to-qualify-video-customers-might-says
[http://perma.cc/N8Z4-L4DC]. Cable One later attempted to clarify these comments. Daniel
Frankel, Cable One Clarifies FICO Score Usage with FCC, Says It Has Its Own System for
Determining
Customer
Value,
Fierce
Cable
(June
28,
2016),
http://www.fiercecable.com/cable/cable-one-clarifies-fico-score-usage-fcc-says-it-has-its-ownsystem-for-determining-customer [http://perma.cc/77LK-QYWW]; see also Warren Letter, supra note
16 (discussing statements made by Cable One’s CEO and urging the FCC to scrutinize PFP
models in the broadband setting).
263. David Goldman, Your Phone Company Is Selling Your Personal Data, CNN Money (Nov. 1,
2011),
http://money.cnn.com/2011/11/01/technology/verizon_att_sprint_tmobile_
privacy/index.htm [http://perma.cc/V6KZ-HZ3N] (describing AT&T’s and Sprint’s use of
consumer data and changes in Verizon’s privacy policy that allowed the company to “record
customers’ location data and Web browsing history, combine it with other personal
information . . . , aggregate it with millions of other customers’ data, and sell it on an anonymous
basis”); Kate Kaye, The $24 Billion Data Business that Telcos Don’t Want to Talk About,
AdvertisingAge (Oct. 26, 2015), http://adage.com/article/datadriven-marketing/24-billion-databusiness-telcos-discuss/301058/ [http://perma.cc/HMA6-PVA3] (describing how mobile carriers are
working with partners to sell data); Jay Stanley, Why Broadband Carriers Are a Menace to
Privacy, ACLU: Free Future (Aug. 1, 2016), http://www.aclu.org/blog/free-future/why-broadbandcarriers-are-menace-privacy [http://perma.cc/WJZ2-KG43] (suggesting that broadband companies
“eavesdrop[] on . . . communications to sell targeted advertising”).
264. Kaye, supra note 263; see also Jeremy Gillula, Five Creepy Things Your ISP Could Do
if Congress Repeals the FCC’s Privacy Protections, Elec. Frontier Found. (Mar. 19, 2017),
http://www.eff.org/deeplinks/2017/03/five-creepy-things-your-isp-could-do-if-congress-repeals-fccsprivacy-protections [http://perma.cc/2PUP-BGJG].

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1423

provide search results primarily from companies that have paid for increased
traffic), snooped through consumer browsing traffic and subsequently placed
targeted advertisements in consumer web traffic, and preinstalled software on
smartphones to view and record applications and websites that consumers
access.265 Companies could engage in predatory behavior to encourage or
coerce consumers to consent to PFP discount plans that further these practices,
while pretending to provide consumers with the choice of accepting a discount
or paying a higher price for products and services. They may also use consumer
data to engage in discriminatory behavior to the detriment of vulnerable communities and cities in which low-income consumers are concentrated. This
concern may also be present in the PFP luxury model as well as in the non-PFP
context. However, use of PFP models may deceive consumers into believing
that their data and privacy will be completely protected if they can pay enough
for privacy, while simultaneously providing companies with the opportunity to
collect more data from the financially disadvantaged as well as some
information about those who pay higher fees. Thus, PFP models provide a
vehicle through which companies can obtain consumer data that can be used to
target specific groups of consumers as well as further facilitate predatory and
discriminatory behavior.
2. PDE Models. — PDE models can also facilitate predatory behavior.
Some PDE companies may have access to social media accounts and other
information about consumers, and these companies could permit advertisers
and other third parties to access consumer data profiles or aggregated data
based on those profiles. The quantity and variety of consumer data may
increase as consumers begin integrating their IOT devices with the data
compilation platforms offered by PDE companies. This creates additional
avenues for the disclosure of new types of consumer data. Admittedly,
consumer data could be used in ways that are beneficial to consumers, and this
may in fact be the goal of some PDE companies. However, once access to the
data is granted to third parties, these companies could use the information for
purposes that are detrimental to vulnerable consumers.266 There are numerous
examples of such behavior in the non-PDE context.267 One retailer has

265. Gillula, supra note 264; see also Finley, VPNs Won’t Save You, supra note 241
(explaining AT&T, Sprint, and T-Mobile “all sold smartphones with preinstalled tracking
software”); John Stephens, Repeal of FCC Privacy Rules Leaves America Vulnerable, Law360
(Apr. 26, 2017), http://www.law360.com/articles/917279/repeal-of-fcc-privacy-rules-leavesamerica-vulnerable [http://perma.cc/443M-6CX8] (discussing ISP’s “insertion of adware and spyware”
into consumers’ “browsers and mobile phones” to facilitate targeted advertising and contending
that the repealed “FCC privacy rules would have ended this practice”).
266. See Cohen, Examined Lives, supra note 150, at 1398 (“A perverse consequence of a
purely market-based approach to data privacy rights, then, may be more discounts for the rich. If
so, then the poor will lose twice over. They will have less privacy, and they will also pay more for
goods and services than more desirable customers.”).
267. See generally Rory Van Loo, Helping Buyers Beware: The Need for Supervision of Big
Retail, 163 U. Pa. L. Rev. 1311, 1311 (2015) (contending that empirical data suggests that the
“behavioral economics-related practices” of various retailers that rely on data analytics and

Electronic copy available at: https://ssrn.com/abstract=3058835

1424

COLUMBIA LAW REVIEW

[Vol. 117:1369

allegedly used data about consumers to provide individuals living in neighborhoods with higher average incomes with discounted prices while individuals
living in areas with lower average incomes “tended to see higher prices.”268
Datacoup’s terms of service suggest that retailers and other third parties may
use their products to provide targeted offers to specific types of users.269
Companies that obtain access to consumer data from PDE companies should
not be allowed to subsequently monetize the data in ways that are harmful to
consumers.
In the tenancy context, the use of PDE-renter insights or data obtained by
tenant screening companies or landlords could also engender discriminatory
behavior. Federal and state legislation prohibiting discrimination in housing
may alleviate some of these concerns. These statutes generally restrict the ability of parties to discriminate on the basis of race and sex, among other things.270
Wisconsin’s social media statute, discussed in section III.A above, and other
housing regulation prohibit landlords from engaging in discriminatory behavior
on similar grounds.271 Rather than electing to discriminate explicitly based on
traditionally prohibited reasons, such as race or sex, landlords could use PDE
data insights to make rental decisions in new ways that are detrimental to
specific groups or types of renters. As Professors Kate Crawford and Jason
consumer data “in the aggregate may significantly harm all households, costing even a family at
the poverty line hundreds of dollars annually”).
268. Jennifer Valentino-Devries, Jeremy Singer-Vine & Ashkan Soltani, Websites Vary
Prices, Deals Based on User’s Information, Wall St. J. (Dec. 24, 2012), http://www.wsj.com/
articles/SB10001424127887323777204578189391813881534 (on file with the Columbia Law
Review).
269. Datacoup, Terms of Service, supra note 185 (“Retailers, online companies, and other
third parties may use our Services to target offers to certain types of users based on parameters
that they provide to us.”).
270. 42 U.S.C. § 3604(b) (2012) (stating it is unlawful “[t]o discriminate against any person
in the terms, conditions, or privileges of sale or rental of a dwelling, or in the provision of services
or facilities in connection therewith, because of race, color, religion, sex, familial status, or
national origin”); Wis. Stat. § 106.50 (2017) (prohibiting discrimination in housing on the basis of
“sex, race, color, sexual orientation, disability, religion, national origin, marital status, family
status, status as a victim of domestic abuse, sexual assault, or stalking, lawful source of income,
age, or ancestry”); Fair Housing—It’s Your Right, U.S. Dep’t of Hous. & Urban Dev.,
http://portal.hud.gov/hudportal/HUD?src=/
program_offices/fair_housing_equal_opp/FHLaws/yourrights [http://perma.cc/F8V9-DF9H] (last
visited July 28, 2017) (noting the Fair Housing Act protects individuals from discrimination in
housing on the basis of “race, color, national origin, religion, sex, disability, and the presence of
children”).
271. See supra section III.A. The Wisconsin statute states that no landlord may:
[d]iscriminate in a manner described in [Wis. Stat. § 106.50] against a
tenant or prospective tenant for exercising the right under subd. 1. to refuse
to disclose access information for, grant access to, or allow observation of
the personal Internet account of the tenant or prospective tenant, opposing a
practice prohibited under subd. 1., filing a complaint or attempting to
enforce any right under subd. 1., or testifying or assisting in any action or
proceeding to enforce any right under subd. 1.
Wis. Stat. § 995.55(4)(a)(2) (2017).

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1425

Schultz have noted, “correlative attributes” isolated by data analytics could be
used as a “proxy for traits such as race or gender,” and this could permit landlords and the companies that provide related services to more easily avoid
accusations of overt discrimination.272 Scholars have frequently highlighted the
potential discriminatory impacts of “big data,” but the quantity and variety of
data are expected to increase exponentially with the expansion of the IOT, as
previously noted. Therefore, any resulting discriminatory effects may become
more prevalent in the IOT setting.
IV. EXISTING FRAMEWORKS AND RESPONSES
As discussed in Part III above, there are certain challenges and concerns
associated with the use of PFP and PDE models. Existing regulatory
frameworks and calls to reinstate the FCC Rules are unlikely to sufficiently
meet these challenges for several reasons. First, litigation challenging the
jurisdiction of a federal agency to regulate the activities of certain companies
exposes issues associated with a sectoral approach to privacy. Second, in some
instances the scope of existing and proposed regulation leaves segments of the
consumer population unprotected or does not apply to all companies. Third,
existing rules and proposals do not effectively recognize the limitations
associated with relying on contractual consumer consent and notice and choice.
A.

FTC

In FTC v. AT&T the Ninth Circuit held that common carriers were exempt
from Section 5 liability under the Federal Trade Commission Act (FTCA).273
The court reasoned that the common-carrier exemption under the FTCA is a
“status-based” rather than an “activity-based” exemption.274 The FTC alleged
that disclosures related to AT&T’s “data throttling program” were
inadequate.275 This decision appears to limit the ability of the FTC to regulate
272. Kate Crawford & Jason Schultz, Big Data and Due Process: Toward a Framework to
Redress Predictive Privacy Harms, 55 B.C. L. Rev. 93, 100 (2014). But see Tex. Dep’t of Hous. &
Cmty. Affairs v. Inclusive Cmtys. Project, Inc., 135 S. Ct. 2507, 2525 (2015) (addressing disparate
impact and housing discrimination).
273. FTC v. AT&T Mobility LLC, 835 F.3d 993, 995 (9th Cir. 2016), reh’g en banc granted,
864 F.3d 995 (9th Cir. 2017). But see FTC v. Verity Int’l, Ltd., 443 F.3d 48, 60 (2d Cir. 2006)
(finding “none of ACL’s activities gave it the status of a common carrier subject to the
Communications Act of 1934, and accordingly, the FTC Act common-carrier exception would not
apply”); FTC v. Am. eVoice, Ltd., No. CV 13-03-M-DLC, 2017 U.S. Dist. LEXIS 36388, at *12–
13 (D. Mont. Mar. 14, 2017) (distinguishing AT&T Mobility LLC and finding that defendants were
not common carriers); FTC v. Verity Int’l, Ltd., 194 F. Supp. 2d 270, 275 (S.D.N.Y. 2002)
(finding that “whether an entity is a common carrier for regulatory purposes depends on the
particular activity at issue” or, in other words, that “an entity may be a common carrier . . . for
some purposes and not for others”).
274. AT&T Mobility LLC, 835 F.3d at 999.
275. Id. at 995; see also Brief of the FCC as Amicus Curiae in Support of Plaintiff-Appellee
at *4, FTC v. AT&T Mobility LLC, No. 15-16585 (9th Cir. filed May 30, 2017), 2017 WL
2398744 [hereinafter, FCC AT&T Brief] (stating that the FTC brought suit prior to the FCC’s
reclassification of broadband as a common carrier telecommunications service).

Electronic copy available at: https://ssrn.com/abstract=3058835

1426

COLUMBIA LAW REVIEW

[Vol. 117:1369

common carriers who engage in “non-common-carrier activities” that are
unfair and deceptive. The court’s decision is troubling when one considers that
various Internet companies could begin to perform common-carrier functions
or activities to negatively impact the FTC’s jurisdictional reach, and existing
common carriers have acquired Internet companies that the FTC traditionally
regulates.276 The FTC petitioned for a rehearing en banc of the court’s
decision,277 and the Ninth Circuit recently agreed to rehear the case.278
Regardless of the outcome of the rehearing, the case highlights the
potential for jurisdictional gaps in existing regulatory frameworks.279 One
should not ignore the role that the American sectoral approach to privacy may
play in contributing to these gaps. Under the sectoral approach, various laws
and regulatory bodies govern “different industries.”280 If the jurisdiction of one
agency is questioned, regulatory holes may result when the ability of other
agencies to effectively regulate that space is undermined. The FCC has
indicated that it intends to reverse the classification of “broadband as a
common carrier service.”281 The FTC has called on Congress to amend the
FTCA to remove the common- carrier exemption.282
276. See Anthony Ha, Verizon Reportedly Closes In on a Yahoo Acquisition with a $250M
Discount,
TechCrunch
(Feb.
15,
2017),
http://techcrunch.com/2017/02/15/
verizon-yahoo-250-million/ [http://perma.cc/4Z6Q-TVYM]; see also Brief of Amici Curiae Data
Privacy and Security Law Professors in Support of FTC’s Petition For Rehearing En Banc at 12–
13, AT&T Mobility LLC, 864 F.3d 995 (9th Cir. 2017) (No. 15-16585) (discussing the impact of
the court’s decision and contending that under the court’s rationale the FTC may no longer have
jurisdiction over Yahoo if Verizon acquires Yahoo).
277. Petition of the FTC for Rehearing En Banc, AT&T Mobility LLC, 864 F.3d 995 (No. 1516585).
278. AT&T Mobility LLC, 864 F.3d 995 (9th Cir. 2017) (order granting rehearing en banc).
279. FCC AT&T Brief, supra note 275, at 5 (“If the en banc Court were to adopt AT&T’s
position . . . the fact that AT&T provides traditional common-carrier voice telephone service could
potentially immunize the company from any FTC oversight of its non-common-carrier offerings,
even when the FCC lacks authority over those offerings . . . .”).
280. See Woodrow Hartzog & Daniel J. Solove, The Scope and Potential of FTC Data
Protection, 83 Geo. Wash. L. Rev. 2230, 2267 (2015) [hereinafter Hartzog & Solove, FTC Data
Protection] (describing the role of the FTC in the regulation of privacy); see also What
Information Do Data Brokers Have on Consumers, and How Do They Use It?: Hearing Before the
S. Comm. on Commerce, Sci. & Transp., 113th Cong. 28 (2013) (explaining that the Fair Credit
Reporting Act, the Gramm-Leach-Bliley Act, the Federal Trade Commission Act, the Health
Insurance Portability and Accountability Act of 1996, and the Children’s Online Privacy
Protection Act all regulate “the collection and use of consumer information”).
281. Restoring Internet Freedom, 82 Fed. Reg. 25,568, 25,570 (proposed June 2, 2017) (to be
codified at 47 C.F.R. pts. 8, 20) (proposing to “reinstate the information service classification of
broadband Internet access service and return to the light-touch regulatory framework first
established on a bipartisan basis during the Clinton Administration”); Jenna Ebersole, FCC’s Net
Neutrality Plan Sets Up Repeal Without Replace, Law360 (Apr. 28, 2017),
http://www.law360.com/articles/918488/fcc-s-net-neutrality-plan-sets-up-repeal-without-replace
[http://perma.cc/8BAM-RZ92]. But see Press Release, FCC, FTC, Joint Statement of FCC
Commissioner Mignon Clyburn and FTC Commissioner Terrell McSweeny on Leaving
Broadband Consumers and Competition Unprotected (Apr. 27, 2017) [hereinafter McSweeny &
Clyburn Joint Statement], http://apps.fcc.gov/edocs_public/attachmatch/DOC-344627A1.pdf (on file
with the Columbia Law Review) (critiquing the proposal to dismantle the Open Internet Order and

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1427

As to data brokers, the FTC has encouraged Congress to adopt legislation
to “make data broker practices more visible to consumers and to give
consumers greater control over the immense amounts of personal information
about them collected and shared by data brokers.”283 Companies that adopt PFP
or PDE models but do not qualify as common carriers—or otherwise fall into
one of the exemptions under the FTCA—are likely subject to FTC
supervision.284
suggesting that doing so “would also create an environment where neither the FCC nor FTC could
protect the privacy of the customers of some of our largest broadband companies”). The FCC
contends that its proposal to reclassify broadband as a “non–common carrier ‘information
service,’” even if adopted, may not sufficiently address the issues posed in AT&T Mobility
because “in addition to the broadband services at issue in the FCC’s proceeding, AT&T also
provides traditional wireline and wireless voice telephone service, which are (and always have
been) Title II common-carrier services.” FCC AT&T Brief, supra note 275, at 4–5; see also U.S.
Telecom Ass’n v. FCC, 855 F.3d 381, 382 (D.C. Cir. 2017) (per curiam) (denying en banc review
of a decision upholding the FCC’s Open Internet Order in light of the FCC’s notice of proposed
rulemaking that would “dismantle or reduce the Open Internet Order rules”); id. (Srinivasan, J.,
concurring) (noting, with the other concurring judges, that the denial was made).
282. Ohlhausen Remarks, supra note 171, at 7 (calling on Congress to amend the FTCA to
remove the common carrier exemption because the “current exemption no longer makes sense in
today’s environment where the lines between telecommunications and other services are
increasingly becoming blurred”); see also H.R. 2520, 115th Cong. (2017) (proposing to grant the
FTC the power to regulate broadband providers and require opt-in approval for sensitive
information and opt-out approval for non-sensitive information). The bill is similar to the repealed
FCC Rules in that it would prohibit providers from terminating services if a user fails to “waive
privacy rights guaranteed by law.” Id. § 4; see also Protecting the Privacy of Customers of
Broadband and Other Telecommunications Services, 81 Fed. Reg. 87,274, (Dec. 2, 2016) (to be
codified at 47 C.F.R. pt. 64), repealed by Act of Apr. 3, 2017, Pub. L. No. 115-22, 131 Stat. 88
(codifying a joint resolution disapproving of the FCC “Broadband and Telecommunications
Services” privacy rules). But see Jenna Ebersole, GOP Plan Revives, Expands Part of Nixed FCC
Privacy Rules, Law360 (June 1, 2017), http://www.law360.com/articles/930296/gop-plan-revivesexpands-part-of-nixed-fcc-privacy-rules [http://perma.cc/78MH-YWTZ] (contending that the bill
“would have the FTC use the FCC’s opt-in approach to consumer consent, and it would also
extend the rules beyond ISPs to content companies—so-called edge providers like Google and
Facebook”).
283. Press Release, FTC, FTC Recommends Congress Require the Data Broker Industry to be More
Transparent and Give Consumers Greater Control over Their Personal Information (May 27, 2014),
http://www.ftc.gov/news-events/press-releases/2014/05/ftc-recommends-congress-require-data-brokerindustry-be-more [http://perma.cc/CM7V-LA5L]; see also FTC, Protecting Consumer Privacy in an
Era of Rapid Change 11–12 (2012) [hereinafter FTC Rapid Change Report],
http://www.ftc.gov/sites/default/files/documents/reports/federal-trade-commission-report-protectingconsumer-privacy-era-rapid-change-recommendations/
120326privacyreport.pdf [http://perma.cc/H68N-BEK4] (discussing data brokers and acknowledging
that “self-regulation has not gone far enough”).
284. Meeco, Digi.me, Cozy, and Beagli appear to be foreign rather than domestic entities.
MEF White Paper, supra note 23. The FTC has pursued foreign companies for FTCA violations.
See, e.g., ASUTeK Comput., Inc., FTC File No. 142 3156, No. C-4587, at 1–2 (F.T.C. July 28,
2016), http://www.ftc.gov/system/files/documents/cases/1607asustekdo.pdf [http://perma.cc/75BRSVXU] (deciding an action against a Taiwan-based company); Andrew F. Popper, In Personam
and Beyond the Grasp: In Search of Jurisdiction and Accountability for Foreign Defendants, 63
Cath. U. L. Rev. 155, 188–89 (2013) (suggesting that Section 5 of the FTCA gives the FTC the
ability to pursue both domestic and foreign entities and “the enforcement power of the FTC

Electronic copy available at: https://ssrn.com/abstract=3058835

1428

COLUMBIA LAW REVIEW

[Vol. 117:1369

Professors Solove and Schwartz contend that “[t]he FTC lacks practical
rulemaking authority.”285 The FTC’s self-regulatory method of evaluating
privacy- and security-related matters under the FTCA has been described as
“too measured and conservative.”286 The FTCA prohibits “unfair or deceptive
acts or practices in or affecting commerce.”287 According to a policy statement
issued by the FTC, the following elements are central to deception cases: (a)
the existence of “a representation, omission, or practice that is likely to mislead
consumers;” (b) the materiality of the activity (whether it is “likely to affect the
consumer’s conduct or decision with regard to a product or service”); and (c)
the point of view of a reasonable consumer or the group impacted by the
activity.288 Deception cases include “broken promises of privacy and data
security, deceptive actions to induce the disclosure of information and failure to
give sufficient notice of privacy invasive practices.”289 In determining whether
a practice is deceptive, the FTC considers the extent to which representations
are clear and unambiguous, the importance of any absent information, as well
as the conspicuousness of “qualifying information.”290 This approach relies
extends beyond domestic borders if the foreign action ‘ha[s] a direct, substantial, and reasonably
foreseeable effect’ on U.S. markets” (alteration in original) (quoting 15 U.S.C. § 45(a)(3)(A)
(2012))); Letter from Edith Ramirez, Chairwoman, FTC, to Johann N. Schneider-Ammann, Head
of the Dep’t of Econ. Affairs, Educ. & Research, Swiss Fed. Council 3 (Jan. 9, 2017),
http://www.ftc.gov/
system/files/documents/public_statements/1049563/ramirez_swiss_privacy_shield_letter.pdf
[http://perma.cc/FP52-VBS6] (“[FTC] enforcement actions . . . have a global impact. The FTC
Act’s prohibition on unfair or deceptive acts or practices . . . includes those practices that (1) cause
or are likely to cause reasonably foreseeable injury in the United States, or (2) involve material
conduct in the United States.”); A Brief Overview of the Federal Trade Commission’s
Investigative and Law Enforcement Authority, FTC, http://www.ftc.gov/about-ftc/what-wedo/enforcement-authority [http://perma.cc/H3MW-CCGJ] (last visited July 28, 2017) (explaining
that under Section 5(a) of the FTC Act, the FTC’s jurisdiction includes “acts or practices
involving foreign commerce that cause or are likely to cause reasonably foreseeable injury within
the United States or involve material conduct occurring within the United States”).
285. Solove & Schwartz, Consumer Privacy, supra note 253, at 161; see also Hoofnagle, FTC
Privacy Law and Policy, supra note 201, at 334 (“[T]he Magnuson-Moss Warranty Act stripped
the FTC of ordinary rule-making procedures, putting in its place a system for promulgating rules
that is unwieldy and time consuming.”); Justin (Gus) Hurwitz, Data Security and the FTC’s
UnCommon Law, 101 Iowa L. Rev. 955, 964 (2016) (contending that legislation has “imposed
heightened procedural requirements on the Commission’s unfairness-related rulemaking and
prohibited the Commission from regulating certain industries”).
286. Hartzog & Solove, FTC Data Protection, supra note 280, at 2234.
287. 15 U.S.C. § 45(a)(1).
288. Letter from James C. Miller III, Chairman, FTC, to John D. Dingell, Chairman, House
Comm. on Energy & Commerce (Oct. 14, 1983) [hereinafter FTC Policy Statement on
Deception],
http://www.ftc.gov/system/files/documents/public_statements/410531/
831014deceptionstmt.pdf [http://perma.cc/G4BF-4CEX]; see also Hoofnagle, FTC Privacy Law and
Policy, supra note 201, at 123 (contending that “[a]t any time, the Commission could abandon the
Deception Statement formally as it is a self-imposed and voluntary restriction on the FTC’s
powers”).
289. Hartzog & Solove, FTC Data Protection, supra note 280, at 2234.
290. FTC Policy Statement on Deception, supra note 288; see also Hoofnagle, FTC Privacy
Law and Policy, supra note 201, at 125.

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1429

excessively on a notice-and-choice model and promises made by companies
regarding privacy and security. As a result, it may not consistently protect the
interests of consumers.291
The FTC has broad unfairness authority.292 Professors Daniel Solove and
Woodrow Hartzog have identified five theories of unfair practices that may be
subject to FTC scrutiny: “(1) retroactive policy changes, (2) deceitful data
collection, (3) improper use of data, (4) unfair design, and (5) unfair
information security practices.”293 The FTC’s policy statement on unfair
practices suggests that the extent to which a practice violates recognized public
policy, is “unethical or unscrupulous,” as well as whether consumers suffer
substantial injury that is not “outweighed by any offsetting consumer or
competitive benefits” and “which consumers could not reasonably have
avoided” are all relevant in assessing the unfairness of a practice.294
To the extent that consumers consent to the terms of PFP or PDE products
or plans that businesses offer and the company provides adequate notice of its
terms (during its course of dealing with consumers, including in its privacy
policies, user-interface, email communications, and other materials), keeps its
implicit and express promises, makes no material omissions, uses data in
compliance with its promises, and does not otherwise engage in deceptive or
deceitful practices, there may be no grounds for FTC intervention in the
absence of lax or non-existent data security practices. Of course, if a PDE
company made explicit or implied statements promising not to track consumers
291. See Elvy, Commodifying Consumer Data, supra note 11, at 51–53; see also Daniel J.
Solove & Woodrow Hartzog, The FTC and the New Common Law of Privacy, 114 Colum. L.
Rev. 583, 628 (2014) [hereinafter Solove & Hartzog, New Common Law] (contending that
although “[m]uch of the FTC’s privacy jurisprudence is based upon a deception theory of broken
promises,” the FTC now “considers the entirety of a company’s dealings with the consumer, not
just the specific promises made in the company’s privacy policy”).
292. Hartzog & Solove, FTC Data Protection, supra note 280, at 2247 (“The FTC’s
unfairness authority is . . . comprehensive [and] . . . the FTC can find a practice unfair even when
it is otherwise legally permissible.”); see also Letter from Michael Pertschuk, Chairman, FTC, et
al., to Wendell H. Ford, Chairman, Senate Consumer Subcomm. on Commerce, Sci. & Transp.,
and John C. Danforth, Ranking Minority Member, Senate Consumer Subcomm. on Commerce,
Sci. & Transp. (Dec. 17, 1980) [hereinafter FTC Policy Statement on Unfairness],
http://www.ftc.gov/public-statements/1980/12/ftc-policy-statement-unfairness
[http://perma.cc/79E2-KEY9] (identifying “three factors” to evaluate whether a practice is unfair:
“(1) whether the practice injures consumers, (2) whether it violates established public policy, and
(3) whether the conduct is unethical or unscrupulous”).
293. Solove & Hartzog, New Common Law, supra note 291, at 640; see also 15 U.S.C. §
45(n) (2012) (delineating the FTC’s authority to declare acts or practices unlawful on the grounds
that “such act or practice is unfair”); Solove & Schwartz, Privacy Law Fundamentals, supra note
198, at 165 (contending that the following “privacy practices will trigger FTC complaints (1)
inadequate security, (2) security gaffes and failure to train, (3) broken promises, (4) retroactive
privacy policy changes, (5) deceptive data collection and (6) inadequate disclosure of extent of
data gathering”).
294. FTC Policy Statement on Unfairness, supra note 292; see also Solove & Hartzog, New
Common Law, supra note 291, at 639. Professor Hoofnagle suggests that whether an activity
violates public policy cannot “independently support a claim of unfairness.” Hoofnagle, FTC
Privacy Law and Policy, supra note 201, at 131.

Electronic copy available at: https://ssrn.com/abstract=3058835

1430

COLUMBIA LAW REVIEW

[Vol. 117:1369

or view social media account information and the company violated those
promises, this activity may be viewed as deceptive. Similarly, if the design or
default settings of PDE companies do not provide consumers with sufficient
control over their data as promised or sufficient notice regarding data sharing
and collection practices, such actions may be viewed as unfair or deceptive.
The FTC has also attempted to protect certain vulnerable consumers, such as
the elderly.295
While protecting consumers from unfair and deceptive practices is an
important regulatory goal, issues related to unequal access to privacy and its
negative impact on low-income consumers may not fit neatly into current
theories “of what constitutes an unfair [or deceptive] trade practice.”296 For
instance, claims related to broken promises, retroactive changes to privacy policies, or settings that were implemented without providing notice and obtaining
consent or claims related to a failure to implement reasonable security
procedures do not completely address one of the main concerns associated with
unequal access to privacy: that certain consumers by the nature of their social
and economic circumstances are less likely to receive the same level of privacy
as other consumers. This likely remains true even if companies provide lowincome consumers with notice and choice not only via a company’s privacy
policy but also in other communications with the company, such as website
design or icons.
Concerns about unequal access to privacy could be viewed as abstract and
“speculative” rather than “substantial,” or alternatively, the benefits that PDE
and PFP companies and their products provide to “consumers or competition”
could outweigh the harms of unequal access to privacy.297 One could also
contend that issues associated with unequal access to privacy are not the
primary concern or objective of the FTC. The FTC has stated that “[a]n injury
may be sufficiently substantial . . . if it does a small harm to a large number of
people, or if it raises a significant risk of concrete harm.”298 One could contend
that unequal access to privacy is a significant societal harm that could impact
large numbers of consumers and that societal harm should constitute a
substantial injury for purposes of evaluating whether a practice is unfair.299
However, one may also posit that low-income consumers could avoid harms
associated with PDE and PFP offerings simply by electing not to participate in
295. Hartzog & Solove, FTC Data Protection, supra note 280, at 2282.
296. Solove & Hartzog, New Common Law, supra note 291, at 640.
297. Id. at 639 (“In evaluating whether a trade practice is unfair, the FTC focuses largely on
substantial injury to consumers. Monetary, health, and safety risks are common injuries
considered ‘substantial’ but trivial, speculative, emotional and other ‘more subjective harm’ are
usually not considered substantial for unfairness purposes.” (quoting FTC Policy Statement on
Unfairness, supra note 292)).
298. FTC Policy Statement on Unfairness, supra note 292, at n.12.
299. Hartzog & Solove, FTC Data Protection, supra note 280, at 2283 (“In determining
whether an injury is outweighed by any countervailing benefits to consumers or competition, the
FTC considers not only the consumer’s cost to remedy the alleged injury, but also the cost to
society in general.”).

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1431

PDE marketplaces and PFP discount programs or choosing not to use the services and products PFP luxury companies provide.300 Thus, it is not entirely
clear whether concerns about unequal access to privacy and subsequent
monetization by companies, discussed in Part III, will be consistently and
effectively addressed.
Finally, one may argue that the conduct of low-income consumers who are
not specifically targeted by a practice—and who nevertheless elect to engage in
the PDE marketplace without first acquiring sufficient knowledge of the
implications of directly trading data—is “arguably not reasonable,” which may
impact the extent to which a practice is viewed as deceptive.301 As Professor
Hoofnagle notes, however, “unreasonable consumers are likely to be the most
in need of protection.”302 Further, in light of evidence that suggests that
companies can significantly impact the privacy expectations of consumers,303
even a strong focus on the reasonable expectations of consumers may not be
sufficient to protect consumer privacy.
B.

Children’s Online Privacy Protection Act

COPPA governs websites and online services, including mobile applications, that obtain personal information, such as voice and geolocation data,
from children under the age of thirteen.304 The operator of the online service or
website must direct its website or services to children or have “actual
knowledge” that it is obtaining information from a user under the age of
thirteen.305 The FTC has recently announced that businesses that offer child
IOT devices, such as connected toys, are subject to COPPA.306 IOT data and
300. See Solove & Hartzog, New Common Law, supra note 291, at 639 (“If consumers could
have reasonably avoided the alleged injury, the FTC will not consider a trade practice unfair.”).
301. Hoofnagle, FTC Privacy Law and Policy, supra note 201, at 128.
302. Id.
303. Kim & Telman, supra note 180, at 736 (discussing techniques by large Internet giants to
shape consumer actions and perceptions); see also Jim Hawkins, Exploiting Advertising, 80 Law
& Contemp. Probs., no. 3, 2017, at 43, 43–45 (describing behavioral advertisement and its impact
on consumers).
304. 15 U.S.C. § 6502(a)(1) (2012); 16 C.F.R. § 312.12 (2012) (defining child, Internet,
personal information, and “[w]eb site or online service directed to children” under COPPA).
Additionally, “the collection of personal information under COPPA also includes passive tracking
of a child online.” 16 C.F.R. § 312.2; see also, Solove & Schwartz, Consumer Privacy, supra note
253, at 202.
305. 15 U.S.C. § 6502(a)(1); Solove & Schwartz, Consumer Privacy, supra note 253, at 204
(contending that “COPPA only applies when a website has actual knowledge that a user is under
[thirteen] or operates a website specifically targeted to children”); Hoofnagle, FTC Privacy Law
and Policy, supra note 201, at 200 (“To trigger the COPPA obligations, a website or service must
be directed at children, or have actual knowledge that it has collected information from
children.”).
306. Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business,
FTC,
http://www.ftc.gov/tips-advice/business-center/guidance/childrens-online-privacyprotection-rule-six-step-compliance [http://perma.cc/M8X8-HQ45] (last visited July 28, 2017);
see also Behnam Dayanim & Mary-Elizabeth Hadley, After FTC’s Update, A Refresher on Complying
with
COPPA,
Law360
(June
26,
2017),
http://www.law360.com/

Electronic copy available at: https://ssrn.com/abstract=3058835

1432

COLUMBIA LAW REVIEW

[Vol. 117:1369

social media information may qualify as personal information.307 Companies
subject to COPPA must provide adequate notice about their data collection
practices, among other things.308 Businesses are required to provide direct
notices to parents and post policies on their websites describing the types of
information that the company collects from children and how the company will
use and disclose the information.309 Companies should obtain “verifiable
parental consent” to collect, use, or disclose the data of children.310
COPPA has several limitations. First, data collected from minors over the
age of thirteen are arguably not subject to the statute.311 Professor Anupam
Chander contends that “COPPA was designed [in part] to protect children from
prying adults, but not from themselves . . . [and the statute’s age restriction]
leaves youth precisely when they enter that time in their lives where they need
it most.”312 If companies using PFP or PDE models obtain data from children
over the age of thirteen, the statute’s protections are likely not applicable.
Second, the statute likely does not apply to data adults supply about
children, as its coverage is limited to information supplied directly by children.313

articles/937897/after-ftc-s-update-a-refresher-on-complying-with-coppa [http://perma.cc/8V6B-4XXU]
(noting that the FTC’s 2017 updated six-step compliance plan for businesses to comply with
COPPA “makes clear that companies providing ‘connected toys or other internet of things (IoT)
devices’ are covered by COPPA”).
307. 16 C.F.R. § 312.2.
308. 16 C.F.R. § 312.4; Hoofnagle, FTC Privacy Law and Policy, supra note 201, at 203.
309. See 15 U.S.C. § 6502(b)(1)(A)(i) (requiring notice on website); 16 C.F.R. §§ 312.4(b)–(c)
(providing rules for direct parental notice); 16 C.F.R. § 312.4(d) (providing rules for posting
website or service notices); Hoofnagle, FTC Privacy Law and Policy, supra note 201, at 203
(“COPPA’s notice requirements include a duty to provide a general privacy notice as well as
special, direct notices to parents before the service collects information from children.”).
310. 15 U.S.C. § 6502(b)(1)(A)(ii); 16 C.F.R. § 312.5 (discussing parental consent and
exceptions); see also Children’s Online Privacy Protection Rule, 16 C.F.R. § 312.8 (2013) (noting
that operators “must establish and maintain reasonable procedures to protect the confidentiality, security,
and integrity of personal information collected from children”).
311. In contrast, a related California statute that applies to minors is not limited to children
under thirteen. Cal. Bus. & Prof. Code § 22580(d) (2015); see also 1 Raymond T. Nimmer &
Holly K. Towle, Data Privacy, Protection, and Security Law § 2.08(10)(a)(i), LexisNexis (2017)
(stating that the California “statute concerns ‘minors’ as opposed to the COPPA subset of children
under the age of 13 [and] [u]nder the CA statute, a minor is a natural person under 18 years who
resides in CA”). Previous attempts to expand COPPA’s coverage have stalled. See Summary: H.R.
2734—114th Congress (2015-2016), Congress.gov, http://www.congress.gov/bill/114th-congress/housebill/2734 [http://perma.cc/Y4LU-5QKK] (last visited July 28, 2017) (indicating the last action on the
bill occurred on June 12, 2015); see also 114 Legislative Outlook H.R. 2734, LexisNexis
(database updated 2017) (available in full on LexisAdvance and on file with the Columbia Law
Review) (indicating the bill failed).
312. Anupam Chander, Youthful Indiscretion in an Internet Age, in The Offensive Internet
124, 128 (Saul Levmore & Martha C. Nussbaum eds., 2010).
313. Solove & Schwartz, Consumer Privacy, supra note 253, at 203; Complying with
COPPA: Frequently Asked Questions, FTC, http://www.ftc.gov/tips-advice/businesscenter/guidance/complying-coppa-frequently-asked-questions
[http://perma.cc/RT2T-PKHS]
[hereinafter FTC, Complying with COPPA] (last updated Mar. 20, 2015) (“Does COPPA apply to
information about children collected online from parents or other adults? No. COPPA only applies

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1433

Thus, to the extent that a parent submits child-related data for the purpose of
participating in a PDE monetization program as discussed in section III.A
above, COPPA’s protections may not be applicable. Third, COPPA also relies
on notice and parental consent to justify data-collection practices.314
Consumers frequently do not read or understand privacy policies, and this
practice may continue even though parental consent is received.315 Lastly, as
Professor Angela Campbell has noted, in many instances it is unclear whether a
company’s website or service targets children and the “multifactor test
employed by the FTC leaves room for subjective interpretation.”316 Since the
COPPA rule “does not require operators of general audience sites to investigate
the ages of visitors to their sites or services,” complications may arise when
attempting to determine whether an operator of a website or service has “actual
knowledge” that children are using their service.317
C.

Proposals to Restore the FCC Rules

As of the date of writing, members of Congress opposed to the repeal of
the FCC Rules have proposed various legislation to restore the rules.318 The
to personal information collected online from children, including personal information about
themselves, their parents, friends, or other persons.”).
314. Hoofnagle, FTC Privacy Law and Policy, supra note 201, at 202–08 (discussing
COPPA’s notice-and-choice framework). The FTC’s enforcement of COPPA has also been
criticized. See generally Angela J. Campbell, Rethinking Children’s Advertising Policies for the
Digital Age, 29 Loy. Consumer L. Rev. 1, 21–35 (2016).
315. Under the COPPA framework, the mechanism used to obtain parental consent should be
“reasonably calculated, in light of available technology, to ensure that the person providing
consent is the child’s parent.” 16 C.F.R. § 312.5(b); see also Hoofnagle, FTC Privacy Law and
Policy, supra note 201, at 203–04 (discussing various ways to obtain parental consent).
316. Campbell, supra note 314, at 27.
317. Id. (contending that children may be untruthful about their birthdates and “the FTC does
not require operators to investigate the ages of their users”); FTC, Complying with COPPA, supra
note 313.
318. Restoring American Privacy Act of 2017, H.R. 1868, 115th Cong. § 2 (2017)
(“Notwithstanding any other provision of law [BIAS providers] shall be subject to . . . the [FCC]
Report and Order in the matter of protecting the privacy of customers of broadband and other
telecommunications services that was adopted by the Federal Communications Commission on
October 27, 2016 (FCC 16–148) . . . .”); see also S. 878, 115th Cong. (2017) (proposing to direct
the FCC to adopt regulation similar to the recently repealed FCC Rules); Press Release, Senator
Ed Markey, Senator Markey Leads Senators in Legislation to Fully Restore Broadband Privacy
Protections (Apr. 6, 2017), http://www.markey.senate.gov/news/press-releases/senator-markey-leadssenators-in-legislation-to-fully-restore-broadband-privacy-protections [http://perma.cc/GG3E-35YC] (“The
[proposed] legislation reinstates the Federal Communications Commission (FCC) rules which
require internet service providers to obtain consent before sharing their subscribers’ sensitive
information and adopt reasonable data security protections.”); Press Release, Congresswoman
Jackie Rosen, Rosen Introduces Bill to Restore Americans’ Internet Privacy Protections (Apr. 4,
2017), http://rosen.house.gov/media/press-releases/rosen-introduces-bill-restore-americans-internetprivacy-protections [http://perma.cc/5FTV-2FMQ] (“H.R. 1868, the Restoring American Privacy Act of
2017, . . . will reverse the Congressional resolution signed by President Trump allowing internet
providers to sell their customers’ personal information without their knowledge or consent.”). The
S. 878 bill would authorize the FCC to adopt rules to prohibit a “telecommunications carrier from
refusing to serve a customer who doesn’t consent to the use and sharing of his or her customer

Electronic copy available at: https://ssrn.com/abstract=3058835

1434

COLUMBIA LAW REVIEW

[Vol. 117:1369

recently repealed FCC Rules required BIAS companies that offer “financial
incentives,” such as discounts, “in exchange for a customer’s approval to use,
disclose, and/or permit access to the customer’s proprietary information” to
provide information about the terms of the PFP discount plan to consumers
using clear, noticeable, understandable, and non-deceptive language.319 The
FCC Rules would have required BIAS providers to explain what information
the BIAS companies will collect, how they will use and share that information,
and “that the program requires opt-in approval.”320 In addition, BIAS providers
would have needed to provide consumers with information about equivalent
non-PFP discount plans as well as the ability to withdraw from the plan.321
In the wake of the recent repeal of the FCC Rules, some ISPs have
attempted to reassure consumers by suggesting that “they do not and will not
sell customers’ sensitive web browsing history to third parties without
consumers’ knowledge or consent.”322 Other providers have expressly noted
that they do not sell consumer “web browsing history” but have also indicated
that they may use aggregated and de-identified information for targeted
advertising.323 One ISP drew the attention of the FCC after using behaviortracking mechanisms to monitor consumers’ online activities without sufficiently
informing consumers and allowing opt outs.324 User data obtained through these
proprietary information for commercial purposes (commonly known as ‘take-it-or-leave-it
offers’).” S. 878 § 1(3)(e).
319. Protecting the Privacy of Customers of Broadband and Other Telecommunications Services,
81 Fed. Reg. 87,274 (Dec. 2, 2016) (to be codified at 47 C.F.R. pt. 64), repealed by Act of Apr. 3,
2017, Pub. L. No. 115-22, 131 Stat. 88 (codifying a joint resolution disapproving of the FCC
“Broadband and Telecommunications Services” privacy rules). The term “customer proprietary
information” means “information that BIAS providers and other telecommunications carriers
acquire in connection with their provision of service, which customers have an interest in
protecting from disclosure.” Id. at 87,824.
320. Id. at 87,346.
321. Id.
322. Suevon Lee, Senate Dems Float Bill to Revive Nixed FCC Privacy Rules, Law360 (Apr.
7, 2017), http://www.law360.com/articles/911118/senate-dems-float-bill-to-revive-nixed-fccprivacy-rules (on file with the Columbia Law Review); see also Gerard Lewis, Our Commitment
to
Consumer
Privacy,
Comcast:
Consumer
Voices
(Mar.
31,
2017),
http://corporate.comcast.com/comcast-voices/our-commitment-to-consumer-privacy
[http://
perma.cc/N4D3-GBBJ] (explaining that Comcast has never sold its customers’ web-browsing
history and does not intend to do so); Bob Quinn, Reversing Obama’s FCC Regulations, AT&T
Pub.
Pol’y
(Mar.
31,
2017),
http://www.attpublicpolicy.com/privacy/
reversing-obamas-fcc-regulations-a-path-to-consumer-friendly-privacy-protections/
[http://
perma.cc/4A2D-QMVK] (explaining that the company is still subject to section 222 of the
Communications Act, even though Congress eliminated the FCC privacy rules).
323. See, e.g., Karen Zacharia, Verizon Is Committed to Your Privacy, Verizon (Mar. 31,
2017),
http://www.verizon.com/about/news/verizon-committed-your-privacy
[http://perma.cc/
QTR5-QA84] (explaining Verizon does not sell the web-browsing data of its customers but does
provide optional services that use aggregated and de-identified customer information for
personalized or targeted advertising).
324. Karl Bode, Verizon May Soon Get to Enjoy a Lawsuit Over Its Sneaky Use of PermaCookies,
Techdirt
(Nov.
7,
2014),
http://www.techdirt.com/articles/20141105/
11315029057/verizon-may-soon-get-to-enjoy-lawsuit-over-their-sneaky-use-perma-cookies.shtml
[http://perma.cc/THP2-PZDR] (describing the Verizon Select and Relevant Mobile Ad system as

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1435

methods could ultimately be processed, disclosed and transferred to third
parties.325
Critics of the FCC Rules argued that consumers would pay higher
broadband prices if the rules were implemented and that the opt-in provisions
of the FCC Rules “would stop the modern digital economy in its tracks and
transform many ‘free’ Internet services into smaller, subscription-based
enterprises.”326 Opponents also criticized the rules for their supposed potential
to “undermin[e] protection for sensitive data and chill[] innovative uses for
nonsensitive data.”327
Despite criticisms from the common-carrier industry, some provisions of
the FCC Rules would certainly benefit consumers, such as the prohibition on
“take-it-or-leave-it offers” that are “contingent on surrendering privacy
rights.”328 However, restoring the FCC Rules without considering their
shortcomings is problematic. First, the FCC Rules would not have applied to all
companies implementing PFP discount programs, such as mobile applications
or websites governed by the FTC.329 Thus, the rules had a limited reach. This is
likely due to the limited jurisdiction of the FCC.
well as Verizon’s use of stealth cookies that covertly track user activities “without users being able
to disable them via browser settings”); see also Karl Bode, Two and a Half Years Later, Verizon
Finally Lets People Opt Out of Its Stealth Zombie Cookie, Techdirt (Apr. 6, 2015),
http://www.techdirt.com/articles/20150402/06110930520/t%20.%20.%20.%20later-verizon-finally-letspeople-opt-out-stealth-zombie-cookie.shtml [http://perma.cc/B2CP-66VG] (noting after public outcry
Verizon now allows consumers to opt out of its stealth tracking); Press Release, FCC, FCC Settles
Verizon Supercookie Probe, Requires Consumer Opt-In for Third Parties (Mar. 7, 2016) (on file
with the Columbia Law Review) (discussing Verizon’s settlement with FCC over “supercookies”).
325. See Finley, VPNs Won’t Save You, supra note 241; Stephens, supra note 265.
326. Petition for Reconsideration, supra note 169, at 7; see also O’Rielly Dissenting
Statement, supra note 169 (“Heightening the limitations on the use of information, as
contemplated by [the FCC Rules], will impact every other pricing component of Internet access
and eventually edge providers.”).
327. Michael Macagnone, FTC Commissioner Continues Attack on FCC Data Rules, Law360 (June
28, 2016), http://www.law360.com/articles/811995/ftc-commissioner-continues-attack-on-fcc-data-rules
[http://perma.cc/QCC5-7NR2]; see also Jenna Ebersole, FCC’s Halt Of Privacy Rule Signals Net
Neutrality Reversal, Law 360 (Mar. 2, 2017), http://www.law360.com/articles/897486/fcc-s-halt-ofprivacy-rule-signals-net-neutrality-reversal [http://perma.cc/HH37-B76U] [hereinafter Ebersole,
FCC’s Halt of Privacy Rules] (suggesting that under the Obama Administration the FTC and the
FCC “‘appeared to have a more adversarial relationship’ on questions of jurisdiction”). See
generally FTC, Internet of Things: Privacy and Security in a Connected World 18 (2015),
http://www.ftc.gov/system/files/documents/reports/federal-trade-commission-staff-report-november2013-workshop-entitled-internet-things-privacy/150127iotrpt.pdf
[http://perma.cc/
2A6P-G7YH] (“[P]erceived risks to privacy and security, even if not realized, could undermine the
consumer confidence necessary for the technologies to meet their full potential, and may result in
less widespread adoption.”).
328. Protecting the Privacy of Customers of Broadband and Other Telecommunications Services,
81 Fed. Reg. 87,274, 87,276 (Dec. 2, 2016) (to be codified at 47 C.F.R. pt. 64), repealed by Act of
Apr. 3, 2017, Pub. L. No. 115-22, 131 Stat. 88 (codifying a joint resolution disapproving of the
FCC “Broadband and Telecommunications Services” privacy rules).
329. FCC Fact Sheet, supra note 19, at 4 (stating the FCC Privacy Rules “[d]o not regulate
the privacy practices of websites or apps, like Twitter or Facebook, over which the Federal Trade
Commission has authority”).

Electronic copy available at: https://ssrn.com/abstract=3058835

1436

COLUMBIA LAW REVIEW

[Vol. 117:1369

Second, proposals to restore the FCC Rules must adequately address PFP
discount plans.330 The FCC Rules did not prohibit PFP discount plans but rather
relied on a notice-and-choice model and required opt-in consumer consent as
noted above.331 Under the rules, notices about PFP discount plans would have
been provided separately from a company’s privacy policy, and the FCC
indicated that it would assess the validity of such programs on a “case-by-case
basis.”332 Opt-in consent is likely better than opt-out consent, since consumers
may be unaware of how to opt out of data collection and the implications of
their failure to opt out of such programs. It may also be time-consuming for
consumers to locate opt-out mechanisms on a company’s website.
The FCC has previously indicated that the goal of imposing “heightened
disclosure and consent requirements” for PFP plans offered by BIAS providers
was to ensure that consumers’ decisions about such plans “are based on
informed consent.”333 Research has challenged the notion of informed consent
in the consumer context, and various theories have been offered to explain the
failure of consumers to review form contracts.334 This may hold true even when
opt-in consent is required. Research on consumers’ understanding of privacy
policies has also consistently found that a significant number of consumers do
not understand the meaning of the term “privacy policy,” and many mistakenly
believe that the existence of a privacy policy means that their data will not be

330. The Restoring American Privacy Act of 2017 would restore the FCC Rules as is. See
Restoring American Privacy Act of 2017, H.R. 1868, 115th Cong. § 2 (2017). The S. 878 bill does
not clearly address PFP discount programs, and a grant of authority to the FCC to reinstate the
repealed FCC Rules could possibly lead to the adoption of similar rules that would have been
applicable to PFP discount programs. S. 878, 115th Cong. (2017).
331. Protecting the Privacy of Customers of Broadband and Other Telecommunications
Services, 81 Fed. Reg. at 87,275.
332. Id. at 87,346; see also id. at 87,317 (“Mindful of the potential benefits and harms
associated with financial incentive practices, we adopt heightened disclosure and choice
requirements [and] . . . BIAS providers must make financial incentive notices easily accessible
and separate from any other privacy notifications . . . .”).
333. Id. at 87,317 (“We therefore find that that heightened disclosure and affirmative
customer consent requirements will help to ensure that customers’ decisions to share their
proprietary information in exchange for financial incentives are based on informed consent.”).
334. See Florencia Marotta-Wurgler, Does Contract Disclosure Matter?, 168 J. Institutional
& Theoretical Econ. 94, 110 (2012) (discussing a study of “the twenty-five most trafficked sites
likely to have information about [end-user license agreement] terms . . . [which found] that
shoppers accessed EULA information in consumer review sites in only three out of 148,552
sessions with at least two pages accessed”); see also Wayne R. Barnes, Toward a Fairer Model of
Consumer Assent to Standard Form Contracts: In Defense of Restatement Subsection 211(3), 82
Wash. L. Rev. 227, 257–58 (2007) (“[P]eople evaluate data based on factors immediately
available to them, often giving disproportionate value to such factors . . . [and] make erroneous
decisions based on statistically unsound samplings of data they nevertheless judge to be
sufficiently representative.”). Professor Wayne Barnes further explains that individuals may also
“value present and immediate benefits and expenditures disproportionately more than they value
benefits or expenditures which may occur in the future . . . [while] systematically underestimating
the risks that they undertake.” Id. at 258.

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1437

disclosed or shared with third parties.335 One study found that “if all American
Internet users were to annually read the online privacy policies word-for-word
each time they visited a new site, the nation would spend about 54 billion hours
reading privacy policies . . . [and] lose the value of about $781 billion from the
opportunity cost value of the time.”336 Consumers may want more privacy and
control over their data as noted in Part I, but they may not know how to achieve
this result, and many unwittingly consent to data collection practices that
undermine these goals. A recent empirical study of privacy policies found that
the “average policy complies with only 39% of the FTC guidelines,”337 and
“most firms do not follow FTC recommendations to adopt short, streamlined,
and standardized privacy policies.”338
Consumers are already overwhelmed with the wealth of disclosures that
they must review when they engage in daily transactions. In a single
transaction, companies provide consumers with separate privacy policies, terms
and conditions, end-user license agreements, and warranty information for their
products.339 Imposing an additional disclosure requirement that consumers
must attempt to read and understand before opting in is unlikely to sufficiently
protect consumers. The imposition of a clear and conspicuous language
requirement would likely not have adequately alleviated this concern. As to the
issue of subsequent monetization, if the company’s PFP discount notice
complied with the FCC Rules, and a consumer consented, the company would

335. Pew Research Ctr., What Internet Users Know About Technology and the Web 7 (2014),
http://www.pewinternet.org/files/2014/11/PI_Web-IQ_112514_PDF.pdf
[http://perma.cc/
2LGY-B83L] (finding that fifty-two percent of survey respondents incorrectly believed that “when
a company posts a privacy policy, it ensures that the company keeps confidential all the
information it collects on users”); Joseph Turow, Lauren Feldman & Kimberly Meltzer,
Annenberg Pub. Policy Ctr. of the Univ. of Pa., Open to Exploitation: American Shoppers Online
and Offline 20 (2005) (unpublished working paper), http://repository.upenn.edu/
cgi/viewcontent.cgi?article=1035&context=asc_papers [http://perma.cc/9JUF-ZYWH] (finding that fiftynine percent of survey respondents said the statement “[w]hen a web site has a privacy policy, I
know that the site will not share my information with other websites or companies” was true).
336. Aleecia M. McDonald & Lorrie Faith Cranor, The Cost of Reading Privacy Policies, 4
I/S: J.L. & Pol’y for the Info. Soc. 543, 563–64 (2008); see also MEF 2017 Consumer Report,
supra note 63, at 19 (noting that only thirty-four percent of surveyed consumers in ten countries
indicated that they “always read” a company’s “privacy policy or terms and conditions first”);
Yannis Bakos, Florencia Marotta-Wurgler & David R. Trossen, Does Anyone Read the Fine Print?
Consumer Attention to Standard Form Contracts, 43 J. Legal Stud. 1, 6 (2014) (discussing
theories arguing that not reading form contracts may be rational); Ben-Shahar & Chilton, supra
note 179, at S42 (contending that “the average person encounters so many privacy disclosures
every year . . . that it would take 76 days to read them”).
337. Florencia Marotta-Wurgler, Understanding Privacy Policies: Content, Self-Regulation
and Markets 1 (N.Y. Univ. Law & Econ. Working Paper No. 435, 2016),
http://lsr.nellco.org/cgi/viewcontent.cgi?article=1439&context=nyu_lewp
[http://perma.cc/
XH5H-96CZ].
338. Id. at 4.
339. Elvy, Hybrid Transactions, supra note 67, at 95–96.

Electronic copy available at: https://ssrn.com/abstract=3058835

1438

COLUMBIA LAW REVIEW

[Vol. 117:1369

likely have been free under the FCC Rules to monetize the data in whatever
manner it chose, including potentially disclosing the data to data brokers.340
V. THE PATH FORWARD
Given the limitations of existing legal frameworks in remedying the
concerns associated with the rise of PFP and PDE models, discourse about
various approaches to regulating these nascent business programs is necessary.
This Part offers five potential points to consider with the goal of alleviating or
preventing the concerns and inadequacies discussed in Parts III and IV. First,
PDE companies must consistently implement measures to ensure that
consumers have sufficient control over their data, acknowledge the limitations
of the notice-and-choice model, and address issues that contributed to the
failure of earlier generations of infomediaries. In addition, cooperation by nonPDE companies may be necessary in order for PDE companies to significantly
change the data industry. Second, in industries that provide necessities in the
digital age, PFP discount programs could be prohibited. Third, as the primary
regulator of data-security and privacy issues, the FTC’s approach in this area
must consider (and address when possible) the concerns highlighted in this
Article. Ambiguities in the FTC’s jurisdiction and potential jurisdictional gaps
must be resolved, and existing regulation that may be beneficial to consumers
should not be dismantled. Increased regulation of the activities of data brokers
is long overdue, and there should be rigorous oversight of PDE markets.
Fourth, it may be necessary to impose restrictions on the monetization of
certain types of data, including data that children or renters generate. Fifth,
guidance on the best ways to structure PDE arrangements to protect consumers
is necessary.
A.

The Promise of the PDE

PDE companies are attempting to provide consumers with more control
over their data, which is a laudable endeavor. However, to effectuate a
comprehensive change in the structure of the existing industry, PDE companies
must overcome several challenges. Data brokers and established companies can
obtain consumer information from multiple sources and may have no incentive
to change their current approaches. The data in a consumer’s PDE profile may
be more accurate and current given the fact that consumers play an active role
340. Protecting the Privacy of Customers of Broadband and Other Telecommunications Services,
81 Fed. Reg. 87,274, 87,344 (Dec. 2, 2016) (to be codified at 47 C.F.R. pt. 64) (prescribing that “a
telecommunications carrier may not use, disclose, or permit access to customer proprietary
information except with the opt-out or opt-in approval of a customer”), repealed by Act of Apr. 3,
2017, Pub. L. No. 115-22, 131 Stat. 88 (codifying a joint resolution disapproving of the FCC
“Broadband and Telecommunications Services” privacy rules); see also id. at 87,346 (“A BIAS
provider that offers a financial incentive . . . must do all of the following: . . . Obtain customer
opt-in approval in accordance with § 64.2004(c) for participation in any financial incentive
program.”).

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1439

in logging their data. In contrast, information about consumers obtained by data
brokers may not always be correct and could be out of date. This could make
PDE data more desirable to data brokers and other companies. PDE
marketplaces may provide additional venues for established companies to
access or purchase data. Absent valid and effective restrictions, third parties
that obtain access to user data from PDE companies could potentially transfer
this information to conventional data brokers and other companies, as well as
use the data to make inferences about users in ways that may negatively impact
the opportunities they receive.
To address the foregoing concerns, PDE companies could consistently
prescreen third parties interested in participating in their marketplaces to
determine whether such companies are data brokers. Companies interested in
accessing or obtaining consumer PDE data could be explicitly prohibited from
engaging in PDE marketplaces if they are unwilling to refrain from
subsequently monetizing, transferring, or disclosing consumer data or are not
amenable to negotiating data access and disclosure terms with consumers. This,
of course, assumes that consumers will become more educated about datatransfer terms and the risks and benefits associated with monetizing their data.
In some instances, PDE companies duplicate data that are generated from
a user’s interaction with companies that adopt a data-as-payment model.341
These non-PDE companies will continue to have access to the duplicated
streams of consumer-generated data held by PDE companies, may assert
ownership of specific rights in such data, and could use them in whatever
manner they choose, even if a PDE company provides users with more control
over this data once the consumer uses the PDE company’s platforms. Questions
about data ownership or rights in data are increasingly complex as various
entities (as well as consumers) may claim an interest in consumer-generated
data. PDE companies’ ability to provide consumers with adequate control over
this data may be limited to the service and products they provide. Stated
differently, consumers may have more privacy and control over their data when
interacting with certain PDE companies, but these benefits may not be
available when the consumer interacts with other companies that do not adopt a
PDE approach. As noted earlier, a similar problem also arises in the PFPsubscription setting, as the activities of other companies may undermine the
effectiveness of the data and privacy protection service offered by a VPN
company.
The long-term success of existing pro-consumer PDE companies and the
ability of these companies to effectuate true change across the data market
depend in part on the willingness of other established companies to either adopt
an approach to consumer privacy and data collection that facilitates the goals of
PDE companies or at the very least ensure that their activities do not undermine
the efforts of companies using consumer-friendly PDE models. Regulatory and
legislative responses may influence this result.

341. See Firth, The Digi.me Story, supra note 121.

Electronic copy available at: https://ssrn.com/abstract=3058835

1440

COLUMBIA LAW REVIEW

[Vol. 117:1369

With respect to data that are not duplicative of information that is already
held by non-PDE companies, PDE companies can serve as data vaults that
provide limited access to data on consumers’ terms. However, consumer
consent should not be used to validate PDE data transfers and disclosures that
are detrimental to consumer interests. PDE companies must recognize the
failure of the notice-and-choice model and implement effective mechanisms to
avoid the pitfalls associated with relying primarily on disclosures in their terms
and conditions and privacy policies and consumer consent to justify data
disclosures and transfers to third parties in PDE marketplaces.
Additionally, regardless of the activities of non-PDE companies, one must
consider that, even though some PDE companies may offer consumers more
monetization and data-control options when compared to conventional
companies,342 as new PDE companies enter the market the policies of these
companies may not always provide consumers with sufficient control over their
data. This, of course, means that consumers would not truly have the ability to
protect their own privacy even when interacting with PDE companies.
Other explanations scholars offer for the failure of earlier entities that have
attempted to provide consumers with control over their data must also be
considered.343 For example, Professor Peter Swire contends that two of the
biggest obstacles “infomediaries” historically face include a lack of consumer
trust and an inability to provide sufficient value to users.344 Thus, the choices
consumers make can also impact whether changes will be seen across the data
industry. PDE companies must convince consumers to trust them with their
information. Additional concerns related to trust and security could also arise if
PDE companies permit consumers to store PDE data in unaffiliated cloud
platforms offered by other companies.345
The rise of the IOT and the prevalence of data-leak scandals may foster
consumer interest in PDE offerings and consumer distrust in established
companies. One could posit that data volume and variety have increased
consistently over several decades. Yet this persistent rise in the quantity of data
has not led to significant changes in data practices or consumer interest in data
and privacy-related issues. Following that line of argument, consumer apathy
342. See Meeco, Homepage, supra note 235 (explaining that Meeco provides users with a
“personal web to browse . . . without leaving a data trail or being tracked by cookies”).
343. See, e,g., Goldman, Coasean Analysis, supra note 128, at 1198–99.
344. Peter P. Swire, Trustwrap: The Importance of Legal Rules to Electronic Commerce and
Internet Privacy, 54 Hastings L.J. 847, 859–60 (2003) (“[W]hy should consumers trust one
company to manage all their personal information when the business model is based on consumer
distrust of how companies handle their data? . . . Infomediaries and the many dot-bombs have
failed the market test when they did not offer enough value to consumers.”).
345. See Sync, Privacy White Paper 1 (2015), http://www.sync.com/pdf/sync-privacy.pdf
[http://perma.cc/D2WU-KHZK] (discussing Dropbox and Google Drive privacy policies);
Digi.me, Security, supra note 128 (discussing storing user data on Dropbox, Google, Drive and
other platforms); see also Nilay Patel, Is Google Drive Worse for Privacy than iCloud, Skydrive, and
Dropbox?,
Verge
(Apr.
25,
2012),
http://
www.theverge.com/2012/4/25/2973849/google-drive-terms-privacy-data-skydrive-dropbox-icloud
[http://perma.cc/8G78-GSLM].

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1441

and existing data practices will likely continue in the IOT setting. However, for
the first time, routine daily activities will be transformed into online activity by
the IOT. The Pew Research Center reports that leading experts have
acknowledged that “[u]nplugging [from the Internet] is nearly impossible now
[but with the IOT] by 2026 it will be even tougher.”346 Even those that would
like to refrain from using IOT devices may not have the “will or means to
disconnect.”347
Further, recall that results from various studies and surveys indicate that
increasingly more consumers are concerned about their data and privacy.348 A
survey conducted by Consumer Reports in April 2017 of 1,007 adults found
that seventy percent of respondents “lack confidence that their personal data is
private and safe from distribution without their knowledge.”349 The survey
found a five percentage-point increase in the percent of consumers that are
concerned about their data when compared to a similar survey conducted by
Consumer Reports in January 2017.350 The widespread attention given to the
implications of the repeal of the FCC Rules, combined with a political setting
in which parties in power have publicly expressed their goal of dismantling
various consumer-friendly regulations, may also lead consumers to view PDE
companies as attractive alternatives. Consider that ninety-two percent of
respondents to the Consumer Reports survey mentioned above believe that
“consumers should have the right to request a complete list of the data an
internet service provider or website has collected about them.”351
In this environment, it is entirely possible that PDE companies will
succeed where earlier generations of similar entities have failed. The FTC has
recommended that legislation be adopted to obligate data brokers to “provide
consumers with access to their data” and “allow consumers to suppress the use
of [their] information.”352 A 2017 report on consumer attitudes in several
countries (including the United States) found that when consumers were asked
“what they wanted in exchange for their personal data . . . the response that
most people gave was that personal information could be returned or deleted at
a time of their choosing . . . .”353 The report found that consumers valued
“personal data privacy-protection and access to their data” more than “financial
rewards” and “discounts.”354 As more companies begin providing users with

346. Rainie & Anderson, IOT Connectivity Binge, supra note 187, at 7.
347. Id. at 4.
348. See supra Part I.
349. Bree Fowler, Americans Want More Say in the Privacy of Personal Data, Consumer
Reports (May 18, 2017), http://www.consumerreports.org/privacy/americans-want-more-say-inprivacy-of-personal-data/ [http://perma.cc/7H2V-4RQH].
350. Id.
351. Id.
352. FTC Data Broker Report, supra note 143, at 50–53.
353. MEF 2017 Consumer Report, supra note 63, at 28.
354. Emma Firth, MEF Global Consumer Trust Study 2017: All Hail the Rise of the Savvy
User, Digi.me: Blog (June 29, 2017), http://blog.digi.me/2017/06/29/mef-global-consumer-trust-

Electronic copy available at: https://ssrn.com/abstract=3058835

1442

COLUMBIA LAW REVIEW

[Vol. 117:1369

copies of their data, consumers will need platforms to store and understand
these data. PDE companies could fulfill this growing demand, and they can
provide products for consumers to easily compile, access, and obtain insights
from all of their data, thereby generating value for consumers. Consider that
recent updates to Twitter’s privacy policy allow users to request and receive an
email containing all data linked to their account.355
Other initiatives and projects aimed at providing consumers with easy
access to their data or information about themselves that may be generated by
others could also contribute to an environment in which consumers expect to
view and receive copies of their data and information connected to them. The
OpenNotes initiative, which allows patients to access their doctors’ visits notes
and has millions of participants, is one such example.356
The European General Data Protection Regulation (GDPR) may also
create conditions favorable to the success of PDE companies.357 The GDPR
provides individuals with a “right to be forgotten” and a “right to data
portability.”358 The “right to data portability” allows individuals to obtain data
they have provided to a company “in a structured, commonly used and
machine-readable . . . format” and to transfer their data to third parties.359
Companies could amend their privacy policies and data practices not only to
ensure GDPR compliance when dealing with European users but also to
provide similar portability options to American users. PDE companies could
also begin coordinating with non-PDE companies (on behalf of consumers)
regarding the use and transfer of user data.

study-2017-all-hail-the-rise-of-the-savvy-user/ [http://perma.cc/C3KQ-GDQ3]; see also MEF 2017
Consumer Report, supra note 63, at 8.
355. Jon Fingas, Twitter Gives You More Control over How It Uses Your Data, Engadget
(May 17, 2017), http://www.engadget.com/2017/05/17/twitter-gives-more-control-over-your-data/
[http://perma.cc/7WVS-QXBY] (noting that the updates to Twitter’s privacy policy are likely a
result of expansions in how the company uses and shares user data). The updates coincide with
revisions to the company’s privacy policy that permit the company to retain user data for a longer
period, among other things. See id.; Ian Paul, Twitter Rolls Out New Privacy Tools as It Ditches
Do Not Track and Expands Data Sharing, PC World (May 18, 2017),
http://www.pcworld.com/article/3197343/
internet/twitter-rolls-out-new-privacy-tools-as-it-ditches-do-not-track-and-expands-data-sharing.html
[http://perma.cc/L28K-YTNM]; Twitter Privacy Policy, Twitter, http://twitter.com/en/
privacy [http://perma.cc/BY5Y-6ZBU] (last visited July 28, 2017).
356. Notes & You, Open Notes, http://www.opennotes.org/notes-you/ [http://
perma.cc/RL3A-ZEVP] (last visited July 28, 2017).
357. Commission Regulation 2016/679, 2016 O.J. (L 119) 1, 60–62.
358. Id. arts. 17, 20.
359. Id. art. 20; see also Linda V. Priebe, How EU Data Privacy Reform Will Impact U.S.
Telecoms,
Law360
(Mar.
21,
2017),
http://www.law360.com/articles/903685
[http://perma.cc/AN7B-U9HQ] (“The portability right includes two separate rights: For data
subjects to get their data back; and to transfer their data to another service provider.”). But see
Peter Swire & Yianni Lagos, Why the Right to Data Portability Likely Reduces Consumer
Welfare: Antitrust and Privacy Critique, 72 Md. L. Rev. 335, 338 (2013) (contending that data
portability “is a bad fit with U.S. antitrust and E.U. competition law”).

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1443

The continued expansion and seeming success of existing PDE companies
may also encourage movement toward consumer use of PDE products.360
Digi.me reportedly has more than “400,000 users in 140 countries,” and,
through its local partners, the company is working with the government of
Iceland to provide citizens with copies of their health data.361 Additionally,
Digi.me recently merged with Personal—an American company that “focuse[s]
on secure, collaborative creation and management of reusable data.”362 Meeco
has launched a “global expansion” of its offerings.363 These companies are
indicative of the market-wide growth that may attract consumer use of PDE
products.
B.

Restrictions on PFP Discount Programs

To the extent that PFP discount programs permit a company to collect,
mine, disclose, sell, transfer, or provide third-party companies with access to
consumer data, such programs could be prohibited in industries that provide
products necessary to ensure full participation of citizens in the digital
economy.364 The broadband industry is one such example. Although AT&T
ceased offering its PFP plan, ISPs may begin to widely offer such plans, as
suggested by their staunch defense of PFP plans in response to the FCC

360. Natasha Lomas, Digi.me Bags $6.1M to Put Users in the Driving Seat for Sharing
Personal Data, TechCrunch (June 30, 2016), http://techcrunch.com/2016/06/30/digi-me-bags-61m-to-put-users-in-the-driving-seat-for-sharing-personal-data/
[http://perma.cc/
9VNC-J76H] (discussing investments in Digi.me).
361. Emma Firth, Digi.me Allowing Icelandic Citizens to Download Their Own Health Data
in World First, Digi.me: Blog (May 31, 2017), http://blog.digi.me/2017/05/31/digi-me-allowingicelandic-citizens-to-download-their-own-health-data-in-world-first/
[http://perma.cc/
F5NM-6C5S]; Emma Firth, Digi.me Raises £4.2M ($6.1M) in Series A Funding Round, Digi.Me:
Blog (Jun. 30, 2016), http://blog.digi.me/2016/06/30/digi-me-raises-4-2m-6-1m-in-series-afunding-round/ [http://perma.cc/EP5T-TAMR]; see also MEF White Paper, supra note 23, at 12.
362. Emma Firth, Digi.me Merges with Personal to Create Global Personal Data Control
Powerhouse, Digi.Me: Blog (Aug. 17, 2017), http://blog.digi.me/2017/08/17/digi-me-merges-withpersonal-to-create-global-personal-data-control-powerhouse/ [http://perma.cc/7NGC-LJXF].
363. David Swan, Start-Up Meeco in Global Push, The Australian (Mar. 31, 2016),
http://www.theaustralian.com.au/business/technology/startup-meeco-in-global-push/newsstory/e4ae320082fd15407980340a2f9168e9 (on file with the Columbia Law Review) (discussing
Meeco’s European and American expansion).
364. Supporters of a prohibition on such programs in the broadband context have also made
similar arguments and highlighted possible dangers for low-income consumers. Brake, supra note
169, at 6 (“[C]ritics of these sorts of deals argue that broadband is special, because it is an
‘essential service’ . . . .”). Opponents of the FCC Rules have also contended that the restrictions
imposed by the rules implicate free speech concerns, as “[t]he creation, analysis, and transfer of
consumer data for marketing purposes constitute speech.” Petition for Reconsideration at 9,
Protecting the Privacy of Broadband & Other Telecomms. Servs., WC Docket No. 16-106, (FCC
filed
Jan.
3,
2017),
http://ecfsapi.fcc.gov/file/1010300614650/Petition%20for%20Reconsideration%201.3.2017_2.pdf
[http://perma.cc/B3Q6-3WCL] (citing U.S. West, Inc. v. FCC, 182 F.3d 1224, 1232 (10th Cir.
1999)). However, a detailed discussion of these issues is beyond the scope of this Article and is
left to future scholarship.

Electronic copy available at: https://ssrn.com/abstract=3058835

1444

COLUMBIA LAW REVIEW

[Vol. 117:1369

Rules.365 In fact, Forrester, a research and consulting company, predicts that the
repeal of the FCC Rules will spell a “return of ‘pay-for-privacy.’”366
Consumers should be provided with basic privacy protections to secure their
data and privacy in such industries. Admittedly, in light of the current political
climate, it is unlikely that proposals to reinstate the FCC Rules—or for that
matter the prohibitions on PFP plans proposed herein—will be implemented.
However, given the crucial role ISPs play, this Article joins previous calls for
prohibiting these programs.367
A possible critique of this approach is that some consumers may not be
opposed to paying more for privacy options, and that such a prohibition
requires BIAS companies to provide the same level of privacy to everyone
even if certain consumers may demand more privacy. One potential response to
this critique is that restricting the use of discount plans in certain settings does
not automatically prevent companies from offering additional privacy options
to consumers that are willing to pay for them while simultaneously providing a
baseline level of privacy to all consumers that does not depend on a trade-off
between privacy and a discount. Of course, such an approach by a company
may generate concerns about unequal access to privacy, particularly if adopted
baseline privacy levels are inadequate.
Another related objection is that consumers willingly accept discounts and
rewards in other settings in which companies use discounts to collect
information about users.368 A Pew Research Center survey on store loyalty
cards found that thirty-two percent of respondents objected to a “free loyalty
365. Jack Derricourt, Five Things to Know About the ISP Privacy Decision in the Senate,
Digital J. (Mar. 24, 2017), http://www.digitaljournal.com/internet/five-things-to-know-about-the-ispprivacy-decision-in-the-senate/article/488725 [http://perma.cc/7LWN-LEPZ] (discussing AT&T’s PFP
plan and stating “we could see similar pay for privacy plans rolling out from other service providers
in the near future”); Jeff Dunn, Trump Just Killed Obama’s Internet-Privacy Rules—Here’s What
that Means for You, Bus. Insider (Apr. 4, 2017), http://www.businessinsider.com/trump-fccprivacy-rules-repeal-explained-2017-4/#-27 [http://perma.cc/L8W6-Z7YV] (noting that AT&T no
longer offers its PFP discount plan but the “lack of clear legal barriers” prohibiting such plans
opens the door for the future adoption of similar plans by ISPs); see also Letter from Francis M.
Buono, Senior VP, Comcast Corp., to Marlene H. Dortch, Sec’y, FCC (Aug. 1, 2016),
http://ecfsapi.fcc.gov/
file/10802205606782/Comcast%20Ex%20Parte%20–%20WC%20Dkt%20No%2016-106%20–%20728%20WCB%20Meeting.pdf [http://perma.cc/Y6FC-2H62] (“We also urged that the Commission
allow business models offering discounts or other value to consumers in exchange for allowing
ISPs to use their data. As Comcast and others have argued, the FCC has no authority to prohibit or
limit these types of programs.”); Verizon Comments, supra note 169, at 6–23.
366. Dunn, supra note 365 (discussing communications with a principal analyst at Forrester).
367. Brake, supra note 169, at 5–7 (describing proposals to prohibit the use of PFP discount
plans in the broadband setting); EPIC Comments, supra note 173; Fulton, supra note 176; see also
Letter from Senators Edward Markey, Richard Blumenthal, Al Franken, Elizabeth Warren, Patrick
Leahy, Bernie Sanders, Tammy Baldwin, to Tom Wheeler, Chairman, FCC 2 (July 7, 2016),
http://www.dslreports.com/r0/download/
2276489~9c8eadeef46a724ca4d98bd97565ce17/Letter%20–%20FCC%20Privacy%20%207-716.pdf [http://perma.cc/3CAC-JDX3] (urging the FCC to prohibit ISP use of PFP plans given
potential harms to “low-income consumers, the elderly and other vulnerable populations”).
368. Brake, supra note 169, at 3–4.

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1445

card” that allowed a company to monitor user shopping habits and sell the data
to unaffiliated parties, but fifty-six percent of low-income respondents
indicated that the practice “would be acceptable.”369 The willingness of
respondents in low-income households to accept such programs highlights
concerns about unequal access to privacy. The survey also found that even
users who currently use discount cards are worried “about how and under what
circumstances their data are passed along to third parties.”370 These concerns
included fears about data security, anonymization, telemarketers, and a lack of
control over subsequent interactions with companies.371 Scholars and
commentators have highlighted various consumer concerns related to the use of
loyalty cards in the retail and supermarket context.372 In some instances, a user
may be required to sign up for or use a rewards card in order to view or receive
discounted prices.373 The fact that companies in other settings have used
discount programs to collect information about users does not mean that
consumers have received adequate privacy and data-control protections, and it
certainly should not automatically mean that such practices should be
permissible in the broadband context. Consumers may not limit their in-store
shopping activities to a single store or use discount cards during every
purchase. In contrast, many consumers access the Internet daily, which may
provide more opportunities to track the activities of users. To adequately
address the concerns noted in this Article, restrictions on discount programs in
other online settings may also need to be implemented.
C.

The FTC as the Main Regulator

The FTC’s regulatory authority “covers nearly any for-profit entity that
handles personal data.”374 However, broadband has been classified as a

369. Maeve Duggan & Lee Rainie, Privacy and Information Sharing, Pew Research Ctr. (Jan
14.
2016),
http://www.pewinternet.org/2016/01/14/scenario-consumer-loyalty-cards-and-profiling/
[http://perma.cc/E7E2-DMLG].
370. Id.
371. Id.
372. Alessandro Acquisti, Leslie K. John & George Loewenstein, What Is Privacy Worth?, 42
J. Legal Stud. 249, 259 (2013) (stating that users are “typically given binary choices, including
take-it-or-leave it options” like “choosing to use a grocery loyalty card (which tracks individual
purchases but offers a discount the consumers cannot negotiate) or not”); Katherine Albrecht,
Supermarket Cards: The Tip of the Retail Surveillance Iceberg, 79 Denv. U. L. Rev. 534, 536–39
(2002) (discussing privacy concerns associated with supermarket rewards cards); Van Loo, supra
note 267, at 1331 (discussing the use of “loyalty card data” and “pricing practices”).
373. Robert H. Flashman & Alex Lesueur, Univ. of Ky. Coll. of Agric., Privacy: A Balancing
Act
1
(2009),
http://fcs-hes.ca.uky.edu/sites/fcs-hes.ca.uky.edu/files/frm-rhf-130.pdf
[http://perma.cc/RJF5-L9K4] (“[M]any supermarket chains now require their customers to get
special cards in order to receive sale prices on certain items. As part of the sign-up process,
consumers are asked for personal information, including their name, address, phone number, and
Social Security number.”).
374. Hartzog & Solove, FTC Data Protection, supra note 280, at 2236.

Electronic copy available at: https://ssrn.com/abstract=3058835

1446

COLUMBIA LAW REVIEW

[Vol. 117:1369

common carrier service.375 The FTC’s jurisdictional authority over broadband
companies is questionable.376 Professor Hoofnagle suggests that the FTC
“cannot police privacy on its own” and that other agencies, such as the FCC
and the Consumer Financial Protection Bureau (CFPB), are also suited to
address privacy concerns in specific industries.377 The FCC and the CFPB must
also play a critical role in protecting consumers. However, the recent repeal of
the FCC Rules calls into question the ability of the FCC to effectively protect
consumers.378 Moreover, parties currently wielding political power have
expressed an intent to accelerate the undoing of various existing regulatory
frameworks (including the classification of “broadband as a common-carrier
service”).379 The FTC and the FCC have indicated that they will attempt to
375. Protecting and Promoting the Open Internet, 30 FCC Rcd. 5601 (2015) (reclassifying
broadband Internet service providers as common carriers under Title II of the Communications
Act).
376. See Terrell McSweeny, Comm’r, FTC, The Future of Broadband Privacy and the Open Internet:
Who Will Protect Consumers? 2 (Apr. 17, 2017) [hereinafter McSweeny Remarks],
http://www.ftc.gov/system/files/documents/public_statements/1210663/mcsweeny__new_americas_open_technology_institute_4-17-17.pdf [http://perma.cc/J8ML-JSFN] (“[The FTC]
does not currently have jurisdiction over the security and privacy practices of broadband, cable
and wireless carriers.”); Ohlhausen Remarks, supra note 171 (“[T]he FCC’s action in 2015 to
reclassify broadband shoved the FTC out because [the FTC’s] statute exempts common carriers
from [its] general jurisdiction.”); supra section IV.A (discussing the potential for jurisdictional
gaps in existing privacy regulatory frameworks).
377. Hoofnagle, FTC Privacy Law and Policy, supra note 201, at 337. The CFPB also has
some regulatory oversight of these privacy issues to the extent that they arise in transactions and
companies within the agency’s jurisdiction. See, e.g., Press Release, CFPB, CFPB Takes Action
Against Dwolla for Misrepresenting Data Security Practices (Mar. 2, 2016),
http://www.consumerfinance.gov/about-us/newsroom/cfpb-takes-action-against-dwolla-formisrepresenting-data-security-practices/ [http://perma.cc/6QH8-P6VM] (describing a CFPB enforcement
action against a company for ineffective data security practices).
378. See David Shepardson, Trump Signs Repeal of U.S. Broadband Privacy Rules, Reuters (Apr.
3,
2017),
http://www.reuters.com/article/us-usa-internet-trump-idUSKBN1752PR
[http://perma.cc/9NN3-5QGH] (describing the narrow passage of the repeal of the FCC Rules
over “strong objections of privacy advocates”); Stephens, supra note 265 (arguing that the
“negative security implications of the repeal of the FCC rules are far-reaching and have longlasting implications for personal privacy and national security”).
379. Jenna Ebersole, FCC Will Undo Obama-Era Open Internet Framework, Pai Says,
Law360 (Apr. 26, 2017), http://www.law360.com/articles/917465/fcc-will-undo-obama-era-openinternet-framework-pai-says
[http://perma.cc/VA3B-H3PY]
(reporting
on
the
FCC
Commissioner’s remarks pledging to undo “the reclassification of broadband as a common carrier
service” in 2017); Kelcee Griffis, FCC to Move Forward on Net Neutrality Rollback, Law360
(May 18, 2017), http://www.law360.com/articles/925438/fcc-to-move-forward-on-net-neutralityrollback [http://perma.cc/6NAC-9D7G] (“FCC commissioners voted 2-1 Thursday to move
forward with a process that would reverse Title II broadband classification, the legal footing for
the commission’s 2015 net neutrality rules.”); see also Restoring Internet Freedom, 82 Fed. Reg.
25,568, 25,577 (proposed June 2, 2017) (to be codified at 47 C.F.R. pts. 8, 20) (proposing “to
respect the jurisdictional lines drawn by Congress whereby the FTC oversees Internet service
providers’ privacy practices”). But see McSweeny & Clyburn Joint Statement, supra note 281, at
12 (contending that reversal of the Open Internet rules would permit broadband providers to
“shape the future of internet content, mine and sell sensitive personal information, and limit
consumer access to the internet in whatever manner they think will bring them the most profit”);
McSweeny Remarks, supra note 376, at 6 (suggesting that the FTC lacks expertise in “network

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1447

collaborate and harmonize their approaches to related privacy and data-security
issues.380 As other commentators have noted, it “isn’t so simple to create
mirrored regulations at the FCC and FTC given their different frameworks,
underscoring the complexity of the various agency jurisdictions on privacy
protections that the public broadly supports.”381
Questions about the FTC’s jurisdiction and the privacy and data-protection
guidelines applicable to specific industries must be resolved. The FTC has
recently announced work on a project that will provide clarification on the
types of substantial consumer injuries that are actionable for “privacy and datasecurity claims.”382 The FTC’s regulatory approach must effectively address
the concerns discussed in Part III, including considering intangible harms to
consumers.383 If necessary, congressional intervention should enable this
process, although there may be practical obstacles and significant challenges in
the current political environment.
The use of consumer information by existing data brokers may be
beneficial to consumers in certain instances, such as the creation of “riskmitigation products” to avoid fraud and identity theft.384 However, the FTC has
acknowledged that this process also generates serious risks for consumers.
These concerns include making “sensitive inferences” about consumers’
lives385 and creating cybersecurity risks.386 Similar concerns abound in the PDE
setting.

engineering” in contrast to the FCC and that it may be best to “continue to rely on” the FCC’s
expertise in this area); Gregory Roberts, Republican Threat to CFPB Rules May Mean
Enforcement Boost, BNA (May 12, 2017), http://www.bna.com/republican-threat-cfpbn73014450852/ [http://perma.cc/9MYJ-5R58] (discussing threats to dismantle CFPB rules).
380. See Ebersole, FCC’s Halt of Privacy Rules, supra note 327 (reporting that the FTC Chair
and the FCC Chairman “promised to ‘work together’ to harmonize FCC rules with FTC
standards”).
381. Id.
382. See Allison Grande, FTC Head Says Privacy Harm Lines Will Soon Be Clearer, Law360
(Apr. 19, 2017), http://www.law360.com/articles/914825/ftc-head-says-privacy-harm-lines-willsoon-be-clearer [http://perma.cc/S859-DAU5] (noting that the FTC will complete a project to
determine which “types of consumer injuries are sufficient to support privacy and security claims”
by the end of 2017); see also Bryan Koenig, FTC’s Definition of Cyber Injury Getting Broader,
Chief Says, Law360 (May 17, 2017), http://www.law360.com/articles/925071/ftc-s-definition-ofcyber-injury-getting-broader-chief-says [http://perma.cc/4K3X-RNUZ] (noting that acting FTC
Chair Maureen K. Ohlhausen has stated that the “[d]isclosure of sensitive medical information”
and “health and safety risks” could both be considered “substantial injur[ies]” to consumers
(internal quotation marks omitted)).
383. Hoofnagle, FTC Privacy Law and Policy, supra note 201, at 344–45 (suggesting that the
FTC’s “harms-based approach” is a “historical red herring” and that harm should not be limited to
“physical and economic injuries”).
384. FTC Data Broker Report, supra note 143, at v (noting that data brokers use consumer
information to generate “people-search products,” “risk-mitigation products,” and “marketing
products”).
385. Id. at iv–v.
386. Id. at vi.

Electronic copy available at: https://ssrn.com/abstract=3058835

1448

COLUMBIA LAW REVIEW

[Vol. 117:1369

As discussed in section III.B above, some PDE companies may arguably
be data brokers even though they interact extensively and directly with
consumers. The result is that new data brokers are entering a market that is
notoriously opaque about which data aggregators hold consumer data, how
consumer data are collected, and how the data are used.387 PDE companies
have the potential to mitigate some of these concerns. For example, these
companies may clearly identify to whom the company will transfer or give
access to consumer data and provide consumers with access to their own data.
PDE companies have a direct relationship with consumers and are potentially
accountable to consumers, unlike regular data brokers. However, as previously
noted, it is possible that PDE data buyers and PDE companies may use
aggregated or de-identified consumer data in the same manner as existing data
brokers and other companies.388 Thus, new developments call for increased
regulatory scrutiny of PDE companies and existing data brokers. While some
companies provide information about their relationships with data brokers,389
consumers need more clarity with respect to what established data brokers and
new PDE data companies are doing with their data. Given the FTC’s previous
calls for legislation to oversee data brokers,390 these new changes to the data
market reflect a growing need for further legislative intervention in this area.
Laws that require companies to provide information to consumers about the
type of information they collect, disclose, and transfer, the identity of the
specific parties to whom such data are provided, and when such transfers are
made could mitigate transparency concerns.391 However, in imposing such
requirements, consideration must be given to the limitations and failures of the
notice- and-choice model.
There may also be concerns about adequate compensation for data sales,
disclosures, and access to consumer data. Currently, the terms of some PDE
arrangements and the price for consumer data appear to be determined solely
by PDE companies; thus, it is questionable whether consumers will have the
opportunity to negotiate compensation terms for their data or terms regarding
subsequent disclosures of their data.392 If the consumer is the party directly
supplying the product in the PDE marketplace, should the consumer not be the
one to establish the initial price? Consumers who offer goods for sale on eBay

387. Id.
388. See supra notes 214–234 and accompanying text.
389. See, e.g., Appended & Matched Data, Yahoo!, http://policies.yahoo.com/us/
en/yahoo/privacy/topics/appenddata/index.htm [http://perma.cc/S7Z8-DPDE] (last visited July 28,
2017) (stating that Yahoo! may obtain information from a list of various data brokers and combine
that information with data provided by customers who use their services).
390. See FTC Data Broker Report, supra note 143, at 49–56.
391. A statute giving consumers similar rights was proposed in Illinois. See Hannah Meisel,
Data-Selling ‘Right to Know’ Bill Clears Hurdle in Ill., Law360 (Mar. 14, 2017),
http://www.law360.com/articles/901936 [http://perma.cc/7HZ4-RBDG] (describing the proposed
Right to Know Act).
392. See supra section II.C.

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1449

frequently determine the price of the products that they intend to sell.393 At
least one PDE-like company touts that it permits users to determine the price
for third parties to contact them.394 Of course, one could contend that
consumers are not in the best position to determine the value of their data, or
alternatively that, as in other consumer transactions, form contracts with preestablished prices and terms are more efficient. In either case, given the
expected growth in the variety and volume of data generated by consumers’ use
of IOT devices, there should be increased governmental oversight of PDE
markets and consumer complaints related to unauthorized use of their data.
To the extent that it is authorized to do so, the FTC must rigorously pursue
PDE companies that fail to live up to their promises of providing consumers
with increased privacy or control over their data and information about
potential data buyers. If PDE companies commit to imposing restrictions on
subsequent monetizations by third-party companies that access consumer data
via PDE marketplaces, these promises should be kept and enforced.
Nevertheless, a company’s failure to meet express and implied promises is not
the only concern in the PDE context. The FTC must move away from an
overreliance on misrepresentations made by companies and its deception
authority and begin to more widely use its unfairness authority.395 In fact, the
FTC has recognized the limits of self-regulation.396 To the extent that the FTC’s
unfairness or deception authority is inadequate to effectively address the
concerns noted in this Article, a legislative response may be necessary. The
possible development of new monetization schemes, such as the use of
consumer data for financing purposes as discussed in section III.C, must also
be actively monitored given related concerns.

393. See Create Effective eBay Listings, eBay, http://pages.ebay.com/seller-center/
listing/create-effective-listings.html [http://perma.cc/AW3U-7A57] (last visited Aug. 19, 2017).
394. See About Nextio, Nextio, http://www.nextio.com/n/about [http://perma.cc/
LK8J-37EU] [hereinafter Nextio, About Nextio] (last visited July 28, 2017) (“As Nextio
members, you establish the guidelines for who you’re open to being contacted by, what you’re
open to being contacted about, and how much it will cost anyone else to contact you about
anything else.”). Companies adopting an attention payment model provide users with a venue to
be compensated for their attention. For instance, Nextio describes consumer attention as “the new
currency.”
Nextio,
http://www.nextio.com/
[http://
perma.cc/GNJ8-PSM7] (last visited July 28, 2017). Nextio’s website states, “It’s Your Data, You
can take it with you at any time.” About Nextio, supra. This model is similar to the compensated
telemarketing scenario Professor Ian Ayres and Matthew Funk proposed. See Ayres & Funk, supra
note 30, at 80 (“Households should be allowed to decide how much they will be compensated for
receiving telemarketing calls.”). But see Goldman, Coasean Analysis, supra note 128, at 1195–96
(contending that while a small number of companies “have carved out small niches . . . attention
markets collectively play a negligible role in marketer-consumer matchmaking” in part because
“consumer response to attempted attention markets has been underwhelming”). See generally Tim
Wu, The Attention Merchants: The Epic Scramble to Get Inside Our Heads 3–7 (2016) (discussing
the rise of the attention industry).
395. Hoofnagle, FTC Privacy Law and Policy, supra note 201, at 345–47.
396. FTC Rapid Change Report, supra note 283.

Electronic copy available at: https://ssrn.com/abstract=3058835

1450
D.

COLUMBIA LAW REVIEW

[Vol. 117:1369

Monetization Restrictions

Legislation has long been used to impose use constraints on certain types
of information, and these restrictions “rest on a social judgment that even if
transacting parties both wish to reveal and use a particular piece of information,
its use should be forbidden because of some social harm . . . that is greater than
the social benefits.”397
The harms associated with the potential monetization of child data in the
PDE marketplace likely exceed the resulting benefits, and existing or new
regulation must effectively account for this development. Consideration must
be given to whether the ability of parents to monetize child data, as well as
potential monetizations by children over the age of thirteen in the PDE context,
should be permissible.
One could contend that the level of privacy afforded to minors should
always be left to parents, who can be trusted to consistently act in the best
interests of their children. However, as noted in Part III, parents are likely not
immune from techniques used by companies to shape consumer perceptions,
and parents—like most consumers—may not always review or understand the
implications of a company’s terms and conditions and privacy policy. Parental
consent to data monetization should not be used to justify data collection and
monetization practices that are harmful to the long-term interests of children.
Another potential objection to imposing restrictions on child data is that it
is unlikely that parents will intentionally engage in PDE marketplaces using
their children’s data. Parental monetization of the experiences and activities of
children is already taking place in some venues.398 The plethora of family vlogs
documenting the lives of children on YouTube is one such example. Parents
can earn significant funds from the monetization of these videos.399 It is not
beyond the realm of possibility that child data may be used in PDE
marketplaces.
The early age at which children begin accessing the Internet and leaving
digital footprints, as well as the expected proliferation of IOT devices, may
warrant a new approach to protecting child data and amendments to COPPA.
Data analytics could provide insights about children that companies could use
to shape the long-term (including adulthood) preferences of minors. As noted
previously, PDE companies could attempt to address this concern by imposing
contractual restrictions on the subsequent use of data as well as adopting
mechanisms to minimize the use of child data in PDE marketplaces, but issues
related to the supply side of the data must also be addressed.
Another possible critique of imposing explicit restrictions is that in some
instances it may be difficult for parents who would like to monetize their
397. Peppet, The Unraveling of Privacy, supra note 30, at 1200.
398. Rachel Bertsche, How This Family Made More than $1 Million from YouTube Videos of Their
Kids Playing with Toys, Yahoo! (Mar. 16, 2015), http://www.yahoo.com/news/how-this-family-mademore-than-1-million-from-113525464417.html [http://perma.cc/S3QN-PHU4].
399. Id. A more thorough analysis of whether restrictions on the monetization of child data
should be imposed in other settings is left to future scholarship.

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1451

household data to separate adult data from child data. Despite these concerns,
when it is possible to clearly identify child data or IOT data generated from the
use of IOT toys, monetization schemes using such data may need to be
restricted to adequately protect children.
To the extent that child data are monetized or provided, minors could be
provided with a right to delete that permits them to request that PDE companies
erase their data regardless of who provided the data, whether consent or
consideration was received, and whether the company targets minors or is
aware that the data of minors are being provided.400 Consideration must also be
given to the age at which any such right should be triggered.401 PDE companies
must implement mechanisms to address child data that may be collected from
shared family devices and accounts.
Monetizations by landlords of data generated by renters must also be
adequately regulated. Additional legislation could be widely adopted to
expressly prohibit landlords from requiring tenants to consent to providing
access to data exchange accounts as a condition of tenancy. Any such
legislation must be broadly drafted to ensure that it is not limited to social
media accounts and will also cover PDE consumer arrangements, PDE insights,
and data generated by IOT devices.
Although addressing the issues associated with renters and children is an
important goal, remedying these issues without more is unlikely to be sufficient
to resolve all concerns associated with PDE and PFP models, particularly for
individuals who do not fall within these categories. Comprehensive responses
to the issues detailed in this Article are necessary.
E.

Structuring PDE Arrangements

Guidance on the most effective ways to structure arrangements between
PDE companies and consumers may be necessary to ensure sufficient
400. See, e.g., Cal. Bus. & Prof. Code § 22581 (2015) (providing minors with the ability to
request that their information be deleted subject to certain exceptions). The statute gives limited
protection for minors. For instance, one section provides that “an operator or a third party is not
required to erase or otherwise eliminate, or to enable erasure or elimination of, content or
information [in certain instances including when] the minor has received compensation or other
consideration for providing the content.” Id.; see also Michael J. Kelley & David Satola, The
Right to Be Forgotten, 2017 U. Ill. L. Rev. 1, 44 (2017) (contending the California statute “gives
minors who are registered users of an operator’s Internet website the right ‘to remove or, if the
operator prefers, to request and obtain removal of, content or information posted on the operator’s
Internet websites, online service, online application, or mobile application by the user’” (quoting
Cal. Bus. & Prof. Code § 22581(a)(1))). A right to delete or a right to be forgotten may also
implicate freedom of expression concerns that may need to be considered. Jeffrey Rosen, The Right
to Be Forgotten, 64 Stan. L. Rev. Online 88, 91 (2012), http://www.stanfordlawreview.org/
online/privacy-paradox-the-right-to-be-forgotten/ [http://perma.cc/7SLR-7AZM] (suggesting that if a
third party posts content about an individual, a right to delete “raises the most serious concerns
about free expression”).
401. Basic contract law principles relating to minors who enter into agreements may also be
relevant. See E. Allen Farnsworth, Contracts 221–24 (4th ed. 2004) (discussing contracts voidable
at the option of the minor and applicable state statutes).

Electronic copy available at: https://ssrn.com/abstract=3058835

1452

COLUMBIA LAW REVIEW

[Vol. 117:1369

protection for consumers. Courts, legislators, and entities that produce
influential sources of law may play an important role in this process. Existing
legal frameworks may need to be adjusted to ensure adequate consumer
protection.
With respect to data-trade agreements, one scholar has proposed a “hybrid
inalienability regime” in which individuals may transfer their data as long as
they are provided with an opportunity to limit subsequent transfers of their data
to unaffiliated entities.402 Consumer interests may be more adequately
protected if any proposed right to limit certain types of subsequent disclosures,
transfers, and uses extends to both affiliated and unaffiliated entities.
Another potential option is a licensing approach to consumer PDE
agreements. Existing frameworks applicable to software and computer
information transactions, such as the American Law Institute’s (ALI) Principles
of the Law of Software Contracts and the Uniform Computer Information
Transactions Act (UCITA), may be useful models.403 Although UCITA contains
specific provisions applicable to mass-market license transactions, such as rules
related to the adoption of contract terms, consumer-protection advocates have
criticized the uniform law.404 To the extent that these frameworks are used as a
model, they must be adapted to ensure that the interests of consumers are
sufficiently protected.
Guidance on structuring PDE agreements must also consider whether such
arrangements should be exclusive, which may impact the ability of consumers
to simultaneously monetize their data with other PDE companies. PDE
consumer agreements should also be revocable at the option of the consumer.405
Overly broad, perpetual, royalty-free, transferable-rights provisions and
402. Schwartz, Property, Privacy, and Personal Data, supra note 30, at 2060 (suggesting a
hybrid inalienability regime that “permit[s] an initial transfer of personal data from the individual,
but only if the concerned individual is granted an opportunity to block further transfers or uses by
unaffiliated entities”).
403. Nancy S. Kim, Expanding the Scope of the Principles of the Law of Software Contracts
to Include Digital Content, 84 Tul. L. Rev. 1595, 1595 (2010) (discussing the ALI’s Software
Principles and contending that it excludes digital content); Samuelson, supra note 29, at 1129
(discussing alternative legal regimes for protecting personal information).
404. Unif. Comput. Info. Transactions Act § 209(a) (Nat’l Conference of Comm’rs on Unif.
State Laws 2002); Robert L. Oakley, Fairness in Electronic Contracting: Minimum Standards for
Non-Negotiated Contracts, 42 Hous. L. Rev. 1041, 1072–73 (2005) (discussing criticisms of
UCITA and contending that the uniform law has not been widely adopted); see also Brian D.
McDonald, The Uniform Computer Information Transactions Act, 16 Berkeley Tech. L.J. 461,
470–74 (2001) (discussing Maryland’s version of UCITA); Juliet M. Moringiello & William L.
Reynolds, What’s Software Got to Do with It? The ALI Principles of the Law of Software
Contracts, 84 Tul. L. Rev. 1541, 1542 (2010) (discussing “bomb-shelter” provisions adopted by
states to prevent application of UCITA and stating that UCITA is “dead in the water”).
Additionally, even in states that have adopted UCITA, revisions have been made to the statute.
Compare Md. Code Ann., Com. Law § 22-209 (LexisNexis 2013), with Va. Code Ann. § 59.1502.9 (2014), and Unif. Comput. Info. Transactions Act § 209(a).
405. Professor Paul Schwartz has suggested that “[c]onsent to data trade should imply not
only an initial opportunity to refuse trade, but also a later chance to exit from an agreement to
trade.” Schwartz, Property, Privacy, and Personal Data, supra note 30, at 2106.

Electronic copy available at: https://ssrn.com/abstract=3058835

2017]

PAYING FOR PRIVACY

1453

authorizations that permit a PDE company to use consumer data in ways that
go beyond what is generally required to provide the products offered should not
be encouraged. Provisions that are common to form consumer contracts, which
negatively impact consumers’ remedies or ability to sue in the event of a
breach, should not be widely used in PDE agreements.406
Issues surrounding the validity of privacy notices as contracts may also be
relevant as may other sources of contract law applicable to consumers.407 The
ALI has announced work on the Restatement of the Law of Consumer
Contracts (ALI Restatement).408 If finalized and adopted, the ALI Restatement
could provide guidance on the contract status of privacy policies and shed light
on related case law trends, as well as other consumer contracting issues that
may be relevant to structuring PDE agreements.409
CONCLUSION
PFP programs and the PDE marketplace are innovative offerings that have
been provided to meet and exploit the growing demand for privacy and data
controls and the ever-increasing variety and quantity of consumer data.
However, these models present significant privacy and data-protection
challenges, some of which are similar to the issues raised by earlier generations
of data business models. PFP and PDE models generate substantial concerns
for consumers, including the potential for exacerbating preexisting inequalities
and unequal access to privacy. In some instances, consumers may be more
adequately protected when the use of such programs is prohibited or when
monetization is restricted. Guidance is also needed to evaluate pressing issues,
406. See, e.g., Datacoup, Terms of Service, supra note 185 (discussing an “agreement to
arbitrate,” class action waiver, and users’ ability to opt out). A thorough discussion of the potential
consumer causes of action and remedies for breach of PDE agreements is left to future
scholarship.
407. Although one may argue that Article 2 of the UCC could apply to PDE-data trade
agreements as a consumer’s data could be viewed as a good under Article 2 to the extent that it is
“movable at the time of identification to the contract for sale,” there are several problems with
such an argument. First, there may be challenges associated with labeling consumer data as
“goods” under Article 2’s current definition of goods. U.C.C. § 2-105 (Am. Law Inst. & Nat’l
Conference of Comm’rs on Unif. State Laws 2014) (“‘Goods’ means all things (including
specially manufactured goods) which are movable at the time of identification to the contract for
sale other than the money in which the price is to be paid, investment securities (Article 8) and
things in action.”). At least one court has distinguished goods from data. See Burrows v.
Purchasing Power, LLC, No. 1:12-cv-22800-UU, 2012 WL 9391827, at *3 (S.D. Fla. Oct. 18,
2012) (“Personal data does not have an apparent monetary value that fluctuates like the price of
goods or services.”). Section 2-102 provides that “[u]nless the context otherwise requires, this
Article applies to transactions in goods.” U.C.C. § 2-102. One might contend that a transaction
involving consumer data is a context in which Article 2 should not apply by arguing that data
associated with PDE agreements are more akin to general intangibles.
408. See Restatement of the Law, Consumer Contracts, ALI, http://www.ali.org/
projects/show/consumer-contracts/ [http://perma.cc/X85D-LZ5F] (last visited Sept. 25, 2017).
409. See Project Feature, Restatement of the Law, Consumer Contracts, The ALI Advisor,
http://www.thealiadviser.org/consumer-contracts/ [http://perma.cc/8A8M-CDV8] (last visited Sept.
25, 2017) (listing topics the potential Restatement may address).

Electronic copy available at: https://ssrn.com/abstract=3058835

1454

COLUMBIA LAW REVIEW

[Vol. 117:1369

such as how best to structure PDE agreements, and legal frameworks may need
to be adjusted to account for new monetization schemes. Increased regulatory
guidance and oversight of existing data aggregators and PDE companies are
needed and jurisdictional ambiguities must be resolved. Despite the foregoing,
if the concerns noted herein are effectively addressed, PDE companies may
have the ability to influence how consumers and established companies view
and use consumer data. New developments, such as the GDPR, may facilitate
this process. Regulation in this area must meet the difficult goal of promoting
innovation while simultaneously protecting consumer interests.

Electronic copy available at: https://ssrn.com/abstract=3058835


Targeted advertising and advertising avoidance
Author(s): Justin P. Johnson
Source: The RAND Journal of Economics, Vol. 44, No. 1 (Spring 2013), pp. 128-144
Published by: Wiley on behalf of RAND Corporation
Stable URL: http://www.jstor.org/stable/43186411
Accessed: 22-10-2016 11:48 UTC
JSTOR is a not-for-profit service that helps scholars, researchers, and students discover, use, and build upon a wide range of content in a trusted
digital archive. We use information technology and tools to increase productivity and facilitate new forms of scholarship. For more information about
JSTOR, please contact support@jstor.org.

Your use of the JSTOR archive indicates your acceptance of the Terms & Conditions of Use, available at
http://about.jstor.org/terms

RAND Corporation, Wiley are collaborating with JSTOR to digitize, preserve and extend access to The
RAND Journal of Economics

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms

RAND Journal of Economics

Vol. 44, No. 1, Spring 2013

pp. 128-144

Targeted advertising and advertising
avoidance

Justin P. Johnson*

I examine how the increasing ability of firms to target their ads influences market outcomes when

consumers have access to advertising-avoidance tools. Although firms generally benefit from
improved targeting, consumers need not. I also show that there may be too little blocking of ads

in equilibrium and consider the role of targeted advertising when niche firms compete against
mass-market firms.

1. Introduction
■ Today firms possess an unprecedented and rapidly improving ability to discover

about individuals and reach them with advertising based on this information. For instan
individual's web browsing may be tracked via information stored in his browser. Even n
technology allows Internet service providers to target ads by directly tracking which web
consumers visit. 1 Similarly, advances allow cable television operators to deliver highly cust
ads to viewers.2 Social networking sites such as Facebook and MySpace, and email service
as those of Yahoo and Google, allow ads to be served based on consumer-generated data (su
the contents of email). Dunkin' Donuts is testing new technology that will change the ad dis

at the counter based on the appearance of the customer.3 Supermarkets and other retail outlet

beginning to offer coupons to consumers at checkout based on their previously recorded sh
habits.4 There are many more examples.

Although firms may relish additional information about consumers, some consu
consider advertising annoying on average and see increased targeting as a further violation of

privacy. Consequently, a variety of techniques exist that allow consumers to avoid adverti
from the time-tested ignoring of ads or changing of the channel during commercials to r
innovations such as skipping past ads (while watching content stored on a digital video rec
DVR), blocking online ads, filtering email, or subscribing to do-not-call, do-not-mail, or d
track programs.
"Cornell University; <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>.

I thank Nuffield College, Oxford University, for graciously allowing me to visit; part of this article was written

I also thank participants at various seminars, including Simon Anderson and Heski Bar-Isaac, two anonymous ref
and Ben Hermalin.

1
2
3
4

"Watching What You See on the Web," Wall Street Journal , December 6, 2007.
"Cable TV Puts New Spin on Ads," Wall Street Journal, May 16, 2007.
"The Ad Changes with the Shopper in Front of It," Wall Street Journal, August 21, 2008.
"Personalized Store Ads Take Off," Wall Street Journal, October 23, 2008.

128

Copyright

©

20

1

3,

RAND.

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms

JOHNSON / 129

In this article, I analyze targeted advertising by firms, advertising avoidance by

and whether niche firms especially benefit from improved targeting (the so-called lo
Internet).

Among my findings is that improved targeting raises the profits of all firms. This is

despite the fact that consumers endogenously adjust their advertising-avoidance decisions
and that (in the second model I consider) competition may increase for some available ad
space.

Consumers do not fare as well. Although they may gain by witnessing more-relevant ads,
there are two negative consequences of improved targeting. One is that the number of ads received

may increase, which is bad for consumers because, in equilibrium, they tend to disdain marginal
ads although they may appreciate inframarginal ones. The other is that, rather counterintuitively,
improved information accuracy may lead consumers to receive ads that they prefer less than those
that they receive when targeting is less precise.
A second main finding is that consumers may underutilize advertising-avoidance technologies from a (second-best) social standpoint. This is somewhat unexpected as there is also a force
pushing for overuse of such technologies, which is that consumers ignore firms' gains from trade.

Underblocking may occur because consumers do not take into account that their decision to block
may discourage marginal advertising, which may benefit other consumers who do not block. This
externality implies that, even if ad revenues pay for content, there is no a priori reason that such

technologies cause social harm.
A third main finding is that allowing for gradations in information quality (as opposed
to assuming either perfect secrecy or complete lack of secrecy over consumer information)
provides useful insights. For instance, consumers may not have monotone preferences for
increased targeting; their utility is quasiconvex (or "U shaped") in the accuracy of targeting. The
explanation builds on the trade-off between the improved relevance of inframarginal ads and the
potential for increased volume of ads mentioned above, and how this trade-off changes as accuracy
does.

That utility may be quasiconvex highlights the intriguing possibility that consumer attitudes

toward advertising might change dramatically as technology advances. In particular, when
targeting is not very good, incremental improvements in it may only further frustrate consumers,

encouraging them to block ads or withhold information that could be used to target them.
However, as targeting improves sufficiently, consumers may welcome it and improvements in
it, and see advertising as less of a nuisance (or even as something to be appreciated). Because
rapid advancements are currently being made in targeting technologies, this theoretical point is
of immediate relevance.

2. A model of targeted advertising and advertising avoidance
■ There is a unit mass of consumers and a unit mass of firms. For each consumer-firm pair
there is some independently realized probability q , distributed according to F, that a match
between the consumer and the firm's product exists. F is continuously differentiate with strictly
positive density / on [0, 1]. A match means that, were the consumer aware of the product, he and
the firm would engage in trade, generating surplus vB for the consumer (buyer) and vs for the
firm (seller). Lack of a match means no gains are generated from trade. There is no competition
among firms.
Consumers become aware of a firm's product only if they receive an ad from that firm. Firms

decide which consumers to target with ads. A firm receives, for each consumer, a signal q about
whether there is a match between its product and that consumer. The signal is accurate with
probability a e (0, 1), but otherwise it is pure noise; if the consumer receives an ad from this
firm, then the probability of trade is aq + (1 - a)q , where q = E q. All signals are conditionally
independent across the different consumer-firm pairs. Further, there is a probability ß that an
ad that is sent is not actually observed by the consumer, but instead is blocked. Sending an ad,
©RAND 2013.

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms

130 / THE RAND JOURNAL OF ECONOMICS

regardless of whether it is received or not, costs the firm cs > 0 (this assumption is dis
extensively at the end of Section 3).5

A firm optimally advertises to a consumer of signal q if and only if

Cs < (1 -ß)vs[aq + ( 1 -a)q].
If q is the smallest signal that is advertised to by this firm, total expected profits are6

-cs( 1 - F(q )) + (1 - ß)vs 'a jí qdF{q) + q(l - a)(l - F(q)) .
Note that it is equivalent, and somewhat easier for the analysis, to assume that a firm chooses
the number or mass ß of ads, where it is understood these are sent to the consumers exhibiting the

highest signals. Defining q(ß) = F_1(l - ß) to be the signal of the marginal consumer receiving
an ad, total firm profits are

tí = -csß + (' ~ß)vs
'a [ qdF(q) + (l -a)qß . (1)
L Jq(ß)
The profit-maximizing /¿, if an interior solution, satisfies cs = (1 - ß)vs[aq(ß) + (1 - a)q'.7
Consider the demand side. Supposing that no ads are avoided, the independence assumptions

imposed above ensure that all consumers receive the same number of ads. Each ad causes a
nuisance, summarized by the cost cB > 0, so that the expected utility of a consumer receiving ß
ads is

U = -cBß + vB'a f qdF(q ) + (1 - a)qß' . (2)
L

Jq(ß)

J

As discussed previously, there are m
ads. I suppose that avoiding ads is a ze
avoid all or to receive all ads. A consu

0

<

0,

where

strictly

0

is

increasing

channels

(and

technologies,

distributed
function.

remembering
subscribing

to

on

Thus,

to

[-

o

there

come

b

do-not-cal

emails.

Taking the advertising volume ß as given, consumers choose to receive either U or 0, where
U is as in equation (2). Hence, the proportion of consumers who block is

ß = Pr[Block] = 1 - G(U) < 1.
Consumers and firms simultaneously choose whether to block and the level of advertising,
respectively, given what the other side of the market is doing. Note that because the objective
functions of firms look the same, and because these functions have a unique maximizer given
ß , all firms choose the same advertising level ß. Hence, an equilibrium is composed of a pair

{ß'^'

5 One interpretation of this model is that there is a demographic associated wit

example, a magazine, TV show, or website) that responds positively with probabil
decide which channels to target. Another interpretation is that the firm is able to

consumers from a variety of sources, and then target them directly, for example by u

buying an online ad that will be delivered to a specific consumer.

6 See Uhlig (1996) for a demonstration that the law of large numbers does indee

variables, subject to judicious selection of the underlying norm, thereby ensuring t
can be written as a deterministic one.

7 It is useful for later work to note that q'(l i) = - [f(q(ß))] ' which follows because q{ļi) = F '(1 - /x) by
definition.
©RAND 2013.

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms

JOHNSON / 131

Proposition 1 (Existence and uniqueness). There exists a unique Nash equilibrium of th

which each firm chooses an advertising volume /z and consumers simultaneously dec
to block ads.

I will refer to the equilibrium ( ß *, /z*) whose existence is guaranteed by Proposition 1 as the

"decentralized equilibrium."
One might question the assumption that consumers utilize "all-or-nothing" blocking of ads.
However, the assumption that all ads are blocked is unimportant to my analysis; it is sufficient
that blocking causes some fraction of ads not to be received.
One might also question the assumption that a firm pays some cost cs even for ads that are
not received. However, the key implication of this assumption is that advertising is less appealing
for firms when more consumers block ads, and this is likely to be true more generally. The
reason is that advertising campaigns typically involve fixed costs, for example those associated
with creating the ad content, determining the correct ad channels, and developing supporting
promotional and marketing elements. Because the overall returns to developing such campaigns
decrease when more consumers block ads, fewer campaigns will be developed and hence fewer
firms will advertise when consumers block more.

In terms of specific examples to which the model above might apply, direct mail campaigns
and DVRs (which allow for ad skipping) stand out. But perhaps the simplest example of an adblocking "technology" is the intentional ignoring of ads by consumers; this technology is likely
present in nearly all advertising markets. Indeed, the importance of consumers simply ignoring
ads likely accounts for the perceived importance of developing "catchy" ads that will indeed be
seen, watched, or heard.

3. Externalities and welfare when targeting is fixed
■ In this section, I consider the relevant externalities and their effect on welfare. I show
that there may be too little advertising avoidance by consumers from a second-best perspective,
although there is always too much from a first-best perspective. Assume the information accuracy
parameter, a , is fixed.

Consumers impose direct externalities on firms when they block ads, and similarly firms

impose direct externalities on consumers when they advertise. Consumers also indirectly
impose externalities on other consumers, and likewise firms indirectly impose externalities

on other firms. The reason is that when consumers block ads, they change the incentives
of firms to advertise, which then influences other consumers. Similarly, when firms adver-

tise, they change the incentives of consumers to block ads, which then influences other
firms.

However, consumer actions have no direct impact on other consumers, and firm actions have
no direct effect on other firms. Ultimately, then, there are four externalities present.

□ First-best analysis. In the first best, 'i and ß are chosen to maximize the sum of producer and
consumer surplus. For notational simplicity, denote the expected volume of trade per consumer
who does not avoid ads by

w(ß) = a qdF{q) + (' -a)qß,
Jq(ß)

and recall that ß = 1 - G (6), where 0 < 0 is the marginal consumer blocking. The first-best
objective function is

S(ß, p) = -csß + (1 - ß)vsw(p) + (1 - ß)U(ß) + f 6dG(6).
Je
The first two terms represent firm profits and the last two represent consumer utility.
©RAND 2013.

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms

132 / THE RAND JOURNAL OF ECONOMICS

Proposition 2. In the first-best outcome, no consumers block ads (ß = 0).

The intuition for Proposition 2 is as follows. Social welfare cannot be negative, b

barring both advertising (/x = 0) and blocking (ß = 0 = 0) leads to a social welfare level
If social welfare is positive for some /x, then decreasing ß (and, thus, increasing 0) raise

implying that ß = 0 = 0 is also optimal in this case.

Although there is no blocking in the first-best outcome, advertising levels a

recognition of the costs that consumers bear from ads.8 Because firms do not interna
costs in the decentralized equilibrium, Proposition 2 does not imply that barring ad blo
letting firms advertise as they please would lead to an efficient outcome.

Proposition 2 implies that the equilibrium level of blocking (at least weakly) exceeds th

best level, and one might wonder whether there is a corresponding result concerning a
levels - is /z* either always lower or always higher than the first-best level?

It turns out that /x* can be either higher or lower than the first-best level of adv

To see this, first suppose that both cB and vB are very small, but that these paramete
distribution of 0 are such that many consumers block in equilibrium. If it is also the case

large, then from the social planner's perspective firm profits are "more important" than c

utility, and the planner would prevent consumers from blocking and increase advertisi

advantage of the improved ability of firms to reach consumers. Thus, in this case the
outcome would exhibit more advertising than the decentralized equilibrium.

Now suppose instead that the cost and value parameters of the firms and consume

the same order of magnitude, but that the distribution of 9 is such that blocking is ve

Indeed, suppose that in equilibrium consumer utility is negative but the costs of block

high that no consumers block. Then, because firms do not account for consumer utility w
select their ad levels, the social planner would prefer to lower the advertising level in the
so as to raise utility.

□ Second-best advertising levels. Here I consider how equilibrium advertising le

pare to what a social planner would choose, given that consumers are free to block ads
both regimes.
Both here and in later analysis, the ratios cB/vB and cs/vs play a prominent role. T
the ratios between the cost of advertising (either of receiving an ad or sending one) and
of trade. For convenience, I will refer to these ratios as (consumer or firm) "cost-value

Proposition 3. Suppose that ¡jl * e (0, 1). Then, beginning from the decentralized equili
small (industry-wide) decrease in ¡i raises social welfare if and only if the consumer co
ratio exceeds the firm cost-value ratio (that is, if cB/vB > cs/vs). Furthermore, if the
cost-value ratio exceeds the firm cost- value ratio, then the payoffs to consumers and f
increase.

The intuition for this result builds on the fact that the benefit from the marginal ad to either a

firm or a consumer is proportional to the marginal probability of trade aq{ļi) + (1 - a)q ; there is
disagreement only over the benefit of trade and the costs, where this disagreement is summarized
by differences between the consumer and firm cost- value ratios. Because firms are indifferent to

placing the marginal ad, the overall welfare effect of such an increase is determined by whether
consumers undervalue ads relative to firms or not.9

Although Proposition 3 is stated in terms of a local change in advertising levels, it implies
a more general result about second-best advertising levels.
8 Nonetheless, this proposition does not ensure that consumers receive positive utility - it is perfectly possible that

in the first-best outcome consumers receive negative utility. For example, this would tend to be the case if vs were quite

large and vB were quite small compared to cB.
9 This is loose because it ignores the change in ß that occurs, but as made clear in the proof that effect actually
works to raise firm profits.
©RAND 2013.

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms

JOHNSON / 133
FIGURE 1

INDUSTRY PROFITS, UTILITY U, AND BLOCKING ß AS FUNCTIONS OF fi

Parameters are cB = cs = 1, vs = 2, vB = 1.5, and a = 0.5, with g ~ ř/[0, 1] and 0 ~ U[- 1, 0].

Corollary 1. The second-best advertising level is smaller than the equilibrium level if and only
if the consumer cost- value ratio exceeds the firm cost- value ratio.

Proposition 3 also indicates that, when social welfare increases from a reduction in /x,
both consumers and firms benefit. Firms benefit because a forced decrease in ¡jl ameliorates the
externality they impose on one another in the form of advertising "clutter." More specifically,
each firm ignores the impact of its advertising on consumer advertising-avoidance decisions.

Because (when cB/vB > cs/vs) higher advertising levels cause more consumers to block ads,
thereby reducing the profits of all firms, this externality is a negative one.
This externality is very closely related to one identified in Van Zandt (2004) and Anderson and

de Palma (2009). In their models, firms may send too many messages to consumers, which lowers

social welfare because some higher-value messages are crowded out by lower-value ones. This
important observation suggests that intervention in the market for advertising may benefit firms.

Although my end result is identical, the logic differs somewhat. In particular, in my analysis
the benefit to firms from a reduction in ¡i is that consumers respond by avoiding fewer ads consumer response is the crucial element of my result. This is not the case in Van Zandt (2004)
and Anderson and de Palma (2009). 10
For a case in which the firm cost-value ratio is smaller than the consumer cost-value ratio,
Figure 1 illustrates industry profits, U , and ß , all for a range of /x and assuming that consumers

choose ß in response to /z. From this figure, several facts are apparent.

First, consumers do value advertising: U is increasing at fi - 0 and is positive in a range
of ļi , and in that range no consumers choose to block. However, because firms ignore the
10 Some additional similarities and differences between my work and Van Zandt (2004) and Anderson and de Palma

(2009) are as follows. Van Zandt does not consider consumer avoidance of advertising nor the question of how changes

in advertising accuracy influence equilibrium (an issue I take up in Section 4). In Anderson and de Palma 's analysis,
consumers choose how many messages to receive, which is similar to the blocking that I consider. However, they do not
focus on either targeting of ads or accuracy of information about consumers.
©RAND 2013.

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms

134 / THE RAND JOURNAL OF ECONOMICS

disutility of ads imposed on consumers, they advertise beyond this range so that in equilibr
the value of advertising to consumers is fully dissipated - U is negative and decreasing in
ß*. Consequently, in equilibrium there is blocking (by about 2.5% of consumers).
Additionally, it can be seen that industry profits are not maximized in equilibrium. Th
profits are decreasing at the equilibrium value /jl*. Thus, both consumers and firms wou
better off if ß were smaller than ß*.

□ Second-best advertising avoidance. Here I consider the second best in which advertising

avoidance levels are set by a planner but firms choose their privately optimal advertising lev
show that consumers may avoid too few ads.

Suppressing the dependence of ß and 0 on ß, the social planner's objective function is

S(ß) = -CsH + (1 - ß)vswQi ) + (1 - ß)U(n) + ļ ëdG(ë).
Observe that

S'(ß) = -Vsw(ß) + (1 - ß)^lß'(ß)
+ (0- U(ß)).
aß
The final term (0 - U(ß)) represents an internalized change in consumer utility (which is

equal to zero at the decentralized equilibrium) as more consumers block ads, and the other term
highlight two competing externalities. The first is a negative one imposed on firms by consumers,

equaling the lost surplus when ads are not viewed, vsw(ß). The second is imposed by consumers
on other consumers and is a positive externality. Namely, when an additional consumer block
ads, all consumers who do not block ads benefit from the resulting decrease in ad volume. The
reason ad volume falls is that the cost effectiveness of advertising falls as more consumers block
This reduction in ads is beneficial to consumers because consumers always dislike marginal ads.1

Whether there is too much or too little blocking on the margin depends on the balance of thes
two forces.12

Denote the social planner's choice of ß as ß**. The following proposition provides sufficient
conditions under which there is too little avoidance in equilibrium. Note that in this result cB,vB,
and the firm cost- value ratio are fixed, which ensures that ß* and ß* are fixed.13

Proposition 4. Suppose that the decentralized equilibrium exhibits ß* e (0, 1) and ß* > 0, and
fix cBl vB , and the firm cost-value ratio. Then ß** > ß* if vs is sufficiently small.

Conceptually, when vs is small (and cs is as well, because the firm cost- value ratio is fixed),
the utility of consumers is more important than firm profits and it is important to curb the

overadvertising of firms. This can be accomplished by setting ß** > ß*.
The opposite result would emerge if consumer values and costs were small compared to
those of firms. In that case, consumers might wish to block ads, but the social planner would
prefer that they not.

□ Discussion. Anderson and Gans (201 1) provide an analysis of the impact of ad blocking
on content, an issue absent from my analysis. They demonstrate that the adoption of ad-blocking

technologies may discourage investment in content quality, or skew content toward the "mass
market" rather than niche tastes. Additionally, they argue that ad blocking may increase the
volume of advertising directed at those who do not block; Hann et al. (2008) make a related point.
11 Marginal ads are always of negative utility for consumers so long as cB/vB > cs/vs, which must be the case if

ß* > 0.
12 Recognizing these competing forces also explains why Proposition 3 does not imply that ß* is always too low in

equilibrium. That is, because an increase in ß lowers advertising, and because Proposition 3 shows that welfare improves
with a small decrease in advertising from the equilibrium levels, it might seem that a small increase in ß would raise
welfare. However, this argument ignores the fact that such a marginal decrease in advertising is only achieved at the cost
of reducing the ability of inframarginal (and not just marginal) ads to reach consumers.
13 This can be seen by noting that n as given in equation (1) is proportional to an expression involving only vs/cs
but neither vs nor cs independently.
©RAND 2013.

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms

JOHNSON / 135

Falkinger (2008) considers a model in which there exist multiple equilibria, some

exhibit too much advertising that causes higher-value messages to be crowded out f

reason as in Anderson and de Palma (2009). Regulating a minimal level of ad blockin
that the most-efficient equilibrium is selected.

There is an analogy to Lojack, a system installed on cars that allows them to be trac

they be stolen. There are two important features of Lojack. First, such systems are

to potential thieves, and second, the presence of Lojack-equipped cars in the popu
lower the expected returns to theft because the cars are more likely to be recovered.
would seem to be a positive externality imposed on other consumers (car owners) by
adopt Lojack, suggesting that there may be suboptimally low adoption. Indeed, this i
and Levitt (1998) find in their empirical analysis.
An important caveat is that the logic of underblocking requires that the cost effe
advertising declines as more consumers block ads. This is a good assumption whenev
ad avoidance is a mental decision to ignore ads, or when consumers use automated b
such as those that skip over television ads or block email. In other cases, this may n
a good assumption. For example, for some online advertising, firms pay only whe
click their ads.

However, even in the case where payment is on a per-click basis, increased

avoidance technologies may still reduce the incentives of firms to engage in adver
reason is that there are often fixed costs associated with advertising campaigns, s
fewer consumers will see ads it may be less profitable to create ads.

4. Improvements in targeting

■ So far, the accuracy of firms' information about consumers, given by a, has been
as discussed in the Introduction, improvements in consumer targeting constitute a

development. Accordingly, here I analyze the effect of changes in information accur

□ Equilibrium effects of increased accuracy. Although both sides of the mark

as a increases when all else is fixed, there are equilibrium tensions. For example, i
that an increase in a raises the incentives of firms to advertise sufficiently much th
equilibrium response is to block more.14 Higher levels of ß are, of course, bad for fi
Despite this possibility, firms always prefer improved targeting opportunities.

Proposition 5. An increase in information accuracy raises the equilibrium profits of

Proposition 5 is unambiguous and consistent with the advertising industry's emp
benefits of targeted advertising. The intuition, specifically for why profits increase

ß * increases as well, is as follows. If ß * has increased following a rise in accuracy, it

firms are advertising more. This requires that the marginal return to advertising at th

of /X* - but at the new accuracy and blocking levels - has increased. But this turns
that inframarginal ads are more valuable at the higher accuracy level, contradicting
decrease in firm profits.

In other words, although ß * may indeed increase with a , it cannot increase so
firms are worse off. Otherwise, firms would reduce their advertising.

Consumers face two effects (and a potential tradeoff) from an increase in a. Firs
"mix effect," meaning that the relevance of the existing volume of ads increases. S

14 When does an increase in a encourage more advertising? Recall that the marginal ad satisfi
ß)vs[aq(ß) + (1 - a)q], so that for fixed ß an increase in a influences the marginal incentives to advert

(1 - ß)vs [q(p) - q] > 0 q(ß) > q.

In this partial equilibrium setting, firms wish to increase advertising only if the current level is such that the m

is more effective than a response from a random consumer, and otherwise to decrease their advertising.
©RAND 2013.

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms

136 / THE RAND JOURNAL OF ECONOMICS

is a "volume effect," meaning that ad levels change. The mix effect is positive for consum

whereas the volume effect is negative whenever the volume is increasing and cB/vB > cs/vs

The end result of higher a can be either higher or instead lower consumer utility. For exam
in a region where firms reduce their advertising as a increases, both the volume effect and
mix effect work to benefit consumers. In many cases, however, the mix effect and volume e
work against each other.15

To go further, I impose an assumption on firms' reaction functions, which I denote (
slight abuse of notation) by ß(ß, a). This function gives the optimal level of ads given wh
consumers are doing and the accuracy of advertising.16 When the advertising level of firm
concave in a , all else fixed, an intriguing result emerges.17

Proposition 6. Suppose that the consumer cost- value ratio exceeds the firm cost- value ratio,

that firms' optimal advertising is concave in advertising accuracy (everything else fixed). T
equilibrium utility U is quasiconvex in advertising accuracy (and ß* is quasiconcave).

Proposition 6 shows that, in equilibrium, consumers prefer either extremely inaccurate
extremely accurate targeting, that is, argmaxa U e {0, l}.18

Figure 2 provides a graphical illustration of Proposition 6 and other results, detai

equilibrium levels of consumer utility, blocking, and ads as a function of accuracy a. It can be

that firms are just willing to advertise as a rises from zero but, because the consumer cost-v

ratio exceeds the firm cost-value ratios in this example, consumers dislike this advertising
so initially exhibit negative utility levels. Advertising levels continue to increase as a rises,
consumers become even worse off.

However, advertising levels are concave in a and so eventually U begins to rise, because
the (positive) mix effect of ads becomes stronger than the (negative) volume effect. Eventually,
utility becomes positive, and so consumers stop blocking ads. Further improvements in accuracy
continue to benefit them.

□ Discussion. In the real world, firms favor targeted advertising whereas consumers are more
ambiguous. These facts are reflected in Propositions 5 and 6.
A key implication of Proposition 6 is that consumer attitude toward targeted advertising may

hinge on the state of targeting technology. For example, suppose the set of feasible technologies is

indexed by Ā, meaning that accuracy is constrained to [0, ã'. Then, unless a is sufficiently large,
consumers will always oppose improved targeting. In contrast, if ã is very large, so that potential
targeting is very precise, consumer utility may be in the region where it increases with targeting,

causing consumers to favor further improvements.

For similar reasons, Proposition 6 also suggests that consumer attitude toward sharing
information about themselves may change as technology improves. In particular, it is reasonable
to assume that the ability to target is a function of several factors, one of which is how much
additional information consumers choose to share about themselves. When the underlying ability
to target is not very high, consumers may hesitate to share additional information, but happily
share it if the underlying ability to target is sufficiently high.
15 Consider the volume effect. If q(ii*) > q, then an increase in a leads firms to advertise more, even when
consumers adjust their actions. Similarly, if cs/vs > q, then ß is nondecreasing for any a e (0, 1). To prove the first
claim, note that if an increase in a lowered ¡jl when q(ļi*) > q , then it must be that ß rose, which is impossible if a
increased and ß fell. On the other hand, it can be shown that when the firm cost-value ratio is sufficiently small, ad levels

are always decreasing with a; indeed, U is also increasing with a in this case.
16 The curvature of this function can be deduced by noting that, from equation (1), the optimal level of advertising

satisfies cs = (1 - ß)vs[aq{1ji) + (1 - a)q ], and then taking the obvious steps.
17 In fact, the key assumption here is somewhat weaker: firms' reaction functions need only be concave in a at the
equilibrium level of /x*.
18 It is worth noting that this result also holds if consumer advertising-avoidance decisions are fixed. So, if consumers

either do not have access to blocking technologies or for some reason do not adjust their usage levels in response to
changes in a, their utility nonetheless is quasiconvex.
©RAND 2013.

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms

JOHNSON / 137
FIGURE 2

EQUILIBRIUM ADVERTISING /z*, UTILITY U, AND BLOCKING ß* AS FUNCTIONS OF ACCURACY

Parameters are cB = cs = 1, vs = 2, and vB = 1.5, with q ~ (/[0, 1] and 6 ~ U[- 1, 0]. The advertising level is scaled
down by a factor of 10 for clarity of the graph.

Bergemann and Bonatti (201 1) also explore the impact of improved targeting technology.
Their focus is on markets for advertising, and in understanding how the price of advertising
changes with such improvements. They show, in a model in which consumers bear no costs to
view ads, that improved targeting always raises social welfare but may lower the price of ads. The
reason is that targeting improvements rotate rather than shift the demand curve for advertising,
in a manner similar to how consumer demand curves are rotated by improved information in
Johnson and Myatt (2006). 19

Hermalin and Katz (2006) also emphasize the importance of considering gradations in
information in their investigation of the economics of privacy.20 They demonstrate the existence of
cases in which a perfect ability to recognize consumer types leads to efficiency but an intermediate

ability can lower social welfare compared to the case where no information is shared. My results
in this section, and also in Section 5 below, strongly support the key takeaway from their analysis,
albeit in a very different setting.

The idea that granting firms additional information need not help consumers also exists in
other contexts. For example, Hirshleifer ( 1 97 1 ) observes that parties may overinvest in information

acquisition, where such information serves no socially productive role but instead redistributes
wealth. Although Hirshleifer emphasizes circumstances of individuals or firms predicting future

states of nature for private gain, the basic idea applies to firms seeking information regarding
consumers so as to more profitably price discriminate, which may be purely redistributive.21
19 See Meurer and Stahl (1994), Moscarini and Ottaviani (2001), and Johnson (2005) for related work dealing with
how information influences perceived product differentiation and hence competition.
20 See Hui and Png (2006) for an in-depth discussion of the literature on the economics of privacy.
21 A number of articles have explored price targeting in either monopolistic or oligopolistic settings, such as Bester

and Petrakis (1996), Fudenberg and Tiróle (2000), Taylor (2004), and Acquisti and Varían (2005). The advertising
literature has long focused on the idea that price competition is influenced by advertising, beginning with Butters (1977)
and Grossman and Shapiro ( 1 984), an idea extended in a number of recent articles that look at targeted advertising; see
©RAND 2013.

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms

138 / THE RAND JOURNAL OF ECONOMICS

5. "The long tail of the internet"
■ Here I consider a new model in which "niche" firms vie with "mainstream" firms for the

attention of consumers. Thus, I consider the so-called long tail of the Internet.22

□ Model details. There are two firms and two types or groups of consumers, indexed by
/ = 1,2. The mass of consumer group i is m' > 0. A consumer of group i has a match with firm

i with probability qH and with firm j ± i with probability qL < qH. The existence of a match
between a consumer of either group and firm j means that if this consumer has viewed an ad
from y, then trade occurs, generating surplus vB and vJs for the buyer and seller, respectively.

It is uncertain which consumer is in which group. For each customer, a signal a e {1,2}
is realized that both firms observe. The accuracy of the signal (that is, the probability that a
consumer of type i generates signal a = i) is given by a e [0.5, 1].
An important new element is that each consumer views only one ad in total. Which ad is
viewed by a consumer is determined by a second-price auction: each firm simultaneously bids
for the right to advertise to a given consumer, with the high bidder placing the ad and paying the
lower bid.

On the consumer side, I ignore advertising avoidance, so all consumers view exactly one ad.
As such, it is without further loss to ignore nuisance costs, so that consumer utility from viewing
an ad of firm j is vjB if there is a match with that firm, and zero otherwise.
The timing is as follows. First, for each consumer, a single signal is generated, and both firms

observe it. Second, for each consumer, firms simultaneously place bids for the right to advertise.

Third, the winner for any given consumer pays the second-highest bid and places an ad to that
consumer.23 Fourth, the existence of a match is realized, and if a match exists then trade occurs.
Let rij denote the profits excluding advertising costs that firm i would gain if its ads were
viewed by consumers exhibiting signal a = j .

□ Analysis. It is intuitive that in the symmetric case where w1 = m2 = m, vls = v2s = vs , and
vlB = v2B = vB, both firms and consumers are better off with improved accuracy. For example,
an increase in accuracy increases the probability that a consumer in group i receives an ad from
firm /, which is good for that consumer because it raises the probability of a match and because
a match with either firm is equally valuable.
When there is asymmetry, however, the situation changes. To investigate, I impose three
parametric assumptions that in essence make firm 1 a niche firm.
Assumption 1 (Firm 1 is a niche firm). The following hold.

(i) vls(mlqH + m2qL) < v2s(m2q„ + /»V),
(ii) v2sqH > v'qL, and
(iii) vlsqH > v'qL .
Assumption 1 means that firm 1 is a niche firm that only advertises when accuracy is
sufficiently high, so that for low values of accuracy, firm 2 advertises to both groups.

Proposition 7. Suppose that Assumption 1 holds. Then there exists an a * e (0.5, 1) such that
for a < a *, firm 2 advertises to all consumers (and so firm 1 does not advertise), whereas for
a > fl*,firm 1 advertises to consumers exhibiting signal a = 1 and firm 2 advertises to consumers

Akçura and Srinivasan (2005), Iyer, Soberman, and Villas-Boas (2005), Gai-Or et al. (2006), Esteban and Hernandez
(2007), and Galeotti and Moraga-González (2008).
22 The primary source is Anderson (2006), but also see, for example, Brynjolfsson, Hu, and Simester (201 1) for
further discussion and references.

23 See Chen and He (201 1) and Athey and Ellison (201 1) for analyses of position auctions for ads that appear on
online search engines.
©RAND 2013.

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms

JOHNSON / 139

exhibiting signal o = 2. Furthermore, the profits of both firms are nondecreasing i
strictly increasing for a e [ a *, 1].

Proposition 7 shows that increased targeting may benefit all firms, even those
firms that reach fewer consumers with their advertising. The reason the mainstream

off is that the niche firm starts bidding less for consumers exhibiting signal 2, ev
bidding more for other consumers. That is, improved accuracy softens the biddin
the two firms sufficiently much that firm 2 is better off despite the fact that it
consumers with its ads.

Consumers need not be better off with improved accuracy. At the broadest level, the reason
is that advertising decisions are driven by firm profits, and the preferences of firms need not align

with those of consumers when the firms are asymmetric.

There are three cases of relevance. In one case, each consumer group / prefers (ex ante) to
receive an ad from firm i. Because a given consumer group i prefers to receive firm /' s ad if and

only if q h Vß > qLvjB <==3> qtilqi > v^/vĻ where j ^ i represents the other firm, this case is
operative when

K vV'

- > max -f , -j .

<1l lvzB , -j vlBj

Another case occurs where each consumer group prefers to receive an ad from firm 1 . This
happens when

ü! > ii > ül

vi qL vļ '

The remaining case occurs where each consumer group prefers to receive an ad from firm
This happens when

üi. > il > ü»

I >B <1L V2b '

Proposition 8. Suppose that Assumption 1 holds.
(i) If each consumer group i prefers to receive an ad from firm /, then an increase in accuracy

from a value beneath a* to a value above a* (but strictly less than 1) raises the utility of
group 1 consumers and strictly lowers that of group 2 consumers.
(ii) If each consumer group prefers to receive an ad from firm 1 (the niche firm), then an increase

in accuracy from a value beneath a* to a value above a* (but strictly less than 1) strictly
raises the utility of all consumers.
(iii) If each consumer group prefers to receive an ad from firm 2 (the mainstream firm), then an

increase in accuracy from a value beneath a* to a value above a * (but strictly less than 1)
strictly lowers the utility of all consumers.

As a moves from a value less than a * to a value above it (but still less than 1), the niche firm
starts advertising to consumers exhibiting signal 1, instead of allowing the mainstream firm to
send all the ads. Because the signal remains imperfect, the set of consumers reached by the niche
firm contains individuals from both groups. This basic observation, combined with the specific
details of the three cases, implies the proposition.
For example, in case (i), each consumer in group i prefers to receive an ad from firm i.
Because consumers in group 1 now sometimes receive the niche firm's ad, they benefit from
24 These three cases exhaust all possible (non-knife-edge) parameter configurations, so that the characterization
provided by Proposition 8 is complete. It cannot be the case that group 1 prefers to receive firm 2 's ad, and group 2 prefers
ť1 V2

to receive firm 1 's ad. The reason is
that ^ < max[-f , -f ], because qH /qL > 1 and one of the other two terms must be
qi. Vg Vg
less than 1 .

©RAND 2013.

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms

140 / THE RAND JOURNAL OF ECONOMICS

heightened accuracy. In contrast, group 2 consumers are worse off because, although all of t

would prefer to receive the mainstream firm's ad (as they do when a < a *), some of them re
an ad from the niche firm.25

□ Discussion. Consistent with earlier analysis, improved targeting increases profits for al
firms, where here the mechanism involves the strategic interaction between firms in th
competition for available ad space. This is related to the results of Bergemann and Bonatt
(201 1), who show that the price of advertising may decline with improved targeting.26
Also consistent with earlier analysis, consumers can but need not be made better off
improved targeting. Counterintuitively, such improvements may cause consumers not to re
their preferred ads. For example, in case (i) of Proposition 8, some mainstream consumer

worse off with improved targeting because they receive ads from the niche firm but would pre
an ad from the mainstream firm.

Consistent with Proposition 6, and reminiscent of Hermalin and Katz (2006), consume

utility may be nonmonotone in a. For instance, case (i) of Proposition 8 represents a situatio
which all consumers prefer perfect targeting (a = 1 ) to any other level of targeting. However,

absence the emergence of new advertisers makes mainstream consumers worse off. Similarl

cases (i) and (iii), mainstream consumers have changing attitudes about small increases in a. W

a < a*, these consumers are indifferent to small changes, but once a > a*, they are receiving

that are "irrelevant" to them (that is, ads from firm 1 that have a low match probability). At

stage, increases in a are preferred, because this reduces the likelihood of irrelevant ads. In o
words, in cases (i) and (iii), mainstream consumer utility is quasiconvex in a.21

A final point is that different consumer groups may feel differently about improved target

For example, as case (i) of Proposition 8 makes clear, mainstream consumers may be wors
whereas niche consumers are better off.

6. Conclusion
■ In this article, I consider targeted advertising, advertising avoidance, and the

the Internet. I show that improved targeting benefits firms but that such improveme

consumers worse off. I also show that, from a social perspective, consumers may
ad-avoidance technologies.
One important assumption that I have maintained throughout much of my ana
consumers are homogeneous in the sense that, conditional on having a positive v
given product, they share a common valuation. Although this is a useful abstractio
more general consumer heterogeneity would be more realistic and worthy of future
least, doing so would introduce a more complex pricing decision for firms and exp
that targeting might play. In particular, one role of targeting may be to pull in co
higher valuations for the product.

Appendix
The proofs of Propositions 2 and 8 are in the text. The other proofs are here.

Proof of Proposition 7. In a slight abuse of notation, let ß(ß) € [0, 1] be the (uniquely defined) best re

given a level of blocking ß and let ß(ß) G [0, 1] be the (uniquely defined) proportion of consumers who

ads given /¿. Define h(jï) = /¿[ß(£)] - A- Then (ß*, ļi*) is an equilibrium if and only if h{¡i*) = 0 an

25 Further increases in a from a" are valued positively by both groups. However, group 2 consumer
off than when a < a*.

26 Athey, Caivano, and Gans (201 1) investigate a related issue, which is why advertising prices may have declined
with the emergence of the Internet. They argue the nature of consumer activity on the Internet, in particular frequent

switching across websites by consumers, increases the probability that advertising impressions will be duplicated and
hence wasted; lower prices are the result.
27 Actually, niche consumer utility is also quasiconvex in cases (i), (ii), and (iii). In case (ii), mainstream consumers
have quasiconcave utility.
©RAND 2013.

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms

JOHNSON / 141

It is straightforward to show that h is continuous, and because h(0) > 0 and A(l) < 0, there must

ß* such that h{ß*) = 0. Defining ß* = ß(ß*) therefore ensures that ( ß *, ß *) is an equilibrium; that is, th
equilibrium.

To verify uniqueness, first note that ß(ß) is nondecreasing. This follows from the fact that U(ß) is c

(7(0) = 0, and that ß{ß) > Owith ß(ß) > 0 if and only if U{ß) < 0. Now, suppose that both (ß*, ß*)and(ß1

libria, with ß* < /¿2 (if ß* = MÍ' equilibria coincide because ß{ß) is a function). It must be that ß$ > ß

is nondecreasing, and if it were the case that ß* = ß1, then it would also be the case that ß' = ß*2. But bec

increasing, ß1 > ß* implies ß2 < (i', a contradiction. Q.E.D.
Proof of Proposition 3. Firm optimization implies

Cs =aq(ß') + ('-a)q. (Al)

(1 - ß*)v s
The utility effect from the marginal ad is

-cB + vB[aq(/x*) + (' -a)q' > 0 - < aq(ß*) + (1 - a)q = C* . (A2)
vB

The

final

Now,
Then

equality

suppose

by

follows

that

equation

(l-ß*)vs

from

cB/vB

(A2),

>

equation

cs/vs

consumers

.

(A

1

Then

would

i

re

But then I would have

Cj_ < Cs _ £s < C_B_

vB - [(1 - ß*)vs] vs VB'

a contradiction. Hence, as claimed, cB/vB > cs/[{ 1 - ß*)vs], so that by equation (A2) the marginal return to ads from
a consumer's perspective is negative. It follows that a local decrease in ¡jl from /x* raises the payoffs to consumers. But,

because firms are (privately) indifferent to placing the marginal ad or not, and because ß(ß) is increasing, a decrease in
ß lowers ß and raises the payoffs of firms, too.

The remainder of the proof involves the case where cB/vB < cs/vs. Using arguments similar to those above, this
implies that consumers always place positive value on the marginal ads, and hence that U > 0 and ß = 0. Hence, a small
increase in the volume of ads has no effect on ß, but increases consumer surplus and hence raises total welfare. Q.E.D.

Proof of Corollary 1. Suppose cB/vB > cs/vs. For any ß' > ß *, consumers must be worse off than at /¿*, because
Proposition 3 ensures that a small increase in ß from ß * is harmful to them and because U is concave in ß. If follows that

at ß! the actual level of blocking ß' is such that ß' > ß*. Because optimized firm profits must decrease in ß , firms must
be worse off at ß' . Hence, both consumers and firms are worse off for any such ß', and so it must be that the second-best

ß is less than ß* in this case.

Now suppose cB/vB < cs/vs. Then consumers prefer more advertising on the margin and none of them are
blocking ads; this follows from the concavity of U in ß and the proof of Proposition 3. Hence, a reduction in advertising

from ß* hurts consumers and has no effect on the level of blocking (which remains at zero). Hence, firms are also
worse off being forced to set ß < ß*, and it follows that the second-best level of advertising exceeds ß * in this

case.

Q.E.D.

Proof

of

neither

To

ß

Prop

ß

*

prove

<

ß*.

Recall

S'ß)
öß
Because

turn

nor

the

=

(6

is bounded strictly away from zero on [0, ß*]. (Note that this term must be positive in this range, for otherwise, because

U(ß) is concave, consumers would put positive value on marginal ads at ß *, which would imply that U(ß*) > 0,
contradicting the assumption that ß * > 0.)
©RAND 2013.

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms

t

-V
-

U(

sufficient

3ß

p

(A3)

t

142 / THE RAND JOURNAL OF ECONOMICS

To demonstrate the strict bound, first consider, for ß in the region [0, ß *],

dU}^ = c g + vBw'(ß) = -cB + vB(aq(ß) -f (1 - a)q )
dß

< -cB + vB(aq(ß*) + (1 - a)q) < 0.

The first inequality follows from the fact that ß is decreasing in ß, so that q{ß) is increasing in ß, and that ß = ß*
at ß = ß*. The second inequality follows from the fact that consumers strictly dislike marginal ads at ß*. This shows that

dU(ß)/dß is bounded away from zero.
Next consider, keeping in mind that q' < 0,

w'(ii) a(q(u) w 7 + (1 - a)q) (1 - a)q
(1

1

-

ß)u(ß)

PmyP)

=

=

w

7

(1 1 - PmyP) ß)u(ß) = = aq'iji

where the final inequality follows from the fact that a e (0, 1) and that q'ß
/ > 0 on [0, 1] by assumption) and continuous and hence bounded on [0, 1].

smaller (and negative) than a term that does not depend on ß or ß - a strict bou

It follows that the expression in (A3) is strictly bounded away f

Proof of Proposition 5. Let a' and a" > a' denote two values of accuracy,

corresponding equilibrium values. Suppose that equilibrium profits are lower a

turn requires that ß" > fi' . The reason is that consumer utility and firm profit

A firm's marginal value of an ad ß is higher at (a", ß") than at (ď, ß') if and

-cs + (1 - ß")vs(a"q(ß) + (1 - a")q) > -cs + (1 - ß')vs(a'q(ß) +
This is equivalent to

q(ji)[( 1 - ß")a" - (1 - ß')a'] > q[( 1 - ß')(' - a') - (1 - ß"){' - a ")]. (A4)

Because a' < a" and/0' < ß",(' - ß')(' - a') - { 1 - ß")(' - a") > 0, ensuring that the right-hand side of equation (A4
is positive. Hence, if equation (A4) holds at /¿, then the left-hand side of it is also positive. Because q(ß) is decreasing
and because the right-hand side is invariant to /¿, equation (A4) also holds for all ad levels less than /x, if it holds at ß .

Now, the fact that ß" > ß' implies that a firm's marginal value for ad ß! is strictly positive at (a", ß "), whereas it
is zero at (ď, ß') - equation (A4) holds at ß'. Ergo, a firm facing (a", ß") that set ß - ß! would earn strictly higher than

its equilibrium profits at a'. This is a contradiction. Q.E.D.
Proof of Proposition 6. I will show that U is quasiconvex in a by showing that, for ß* >
that is also a critical point of a.

= V" [/ ~~ 4ß"~' + t-Cs + M*«« + (1 - a)i)] •
It follows that

d2U dß* dß* r - du* "I

rfõ7 = VB~d^^ß Hā ' }~q - +
d2ß*

+ -^-[-cß -1- vB(aq(ß*) + (1 - a)q)].
Noting that dU /da = 0 implies dß* /da = 0 (because ß = 1 - G(U) by definition), and using partial derivative notation
to represent changes in the best-response function of firms, gives

dß * _ dß dßdß* _ dß _ ( q(ß*)-q )
da da dß da da aq'(ß*)
where the final equality follows from using the implicit function theorem

(1 - ß)vs[aq{ß) + (1 - a)q]. This allows me to write

d2U -vB[q(ß*)-qf d V r ,
=
da1
aq'ß*) da¿

TT

For the sake of contradiction, suppose that d2U /da1 < 0. As

portion of the second term in brackets is negative (by the assum

this requires d2ß* /da2 > 0. Keeping in mind that dß* /da = 0 at

d2ß* d2ß dß d2ß*
da2 da2 dß da2

Because it is always true that dß/dß < 0 and (by assumption) d2ß/da2 < 0, this expression ca
if d2ß* ¡da2 < 0. However, using the identity ß* = 1 - G(U ), it follows that d2ß* /da2 = -g(U)d

dU /da = 0 at this point). For this to be negative requires that d2U /da2 > 0 - but this contradicts th

d2U

/da2

<

0.

Q.E.D.

©RAND 2013.

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms

JOHNSON / 143

Proof of Proposition 7. Observe that, for j ^ /,

r" = + (1 - a)mjqL ] and r'j = i^[(l - a)m'qH + amj qL ].
Using these, at a = 0.5,

r22 _r.2 =r2l _rU = +m2?i) > 0,

where the inequality follows from part (i) of Assumption 1 . This says that firm 2 advertises to all co

On the other hand, at a = 1 ,

r22 - rn = m2 [v2sqH - v]sqL ] > 0 and r2] - r" = m] [v2sqL - v'qH ] < 0,
where the inequalities follow from parts (ii) and (iii), respectively. Together, these say that firm

exhibiting signal / when a = 1 .
By the linearity of the rij in a, the first part of the proposition follows, and all that remains is

change with a.

That firm l's profits increase past a* follows from what has already been shown, including l
consider firm 2, which has profits of

max [0, r2X - r11] + max [0, r22 - r12].

These are continuous, and for a < a* given by

(r21 - r11) + {r22 - rn) = (r21 + r22) - (r11 + r12)

(A7)

= vļ (mxqL + m2qH) - uļ (m[qH + m2qL) ,
which is invariant to a. Hence, firm 2's profits do not depend on a for a < a*. Note that the threshold result (already
proven) concerning a* implies that r21 - r11 is decreasing. Hence, the fact that equation (A7) is invariant to a implies
that r22 - r 12 must be increasing. Because, for a > a *, the profits for firm 2 are r22 - r 12, the result follows. Q.E.D.

References

Acquisti, A. and Varían, H. "Conditioning Prices on Purchase History." Marketing Science, Vol. 24 (2005), pp.
367-381.

Akçura, M.T. and Srinivasan, K. "Research Note: Customer Intimacy and Cross-Selling Strategy." Management
Science, Vol. 51 (2005), pp. 1007-1012.
Anderson, C. The Long Tail: Why the Future of Business Is Selling Less of More. New York: Hyperion, 2006.

Anderson, S.P. and de Palma, A. "Information Congestion." RAND Journal of Economics, Vol. 40 (2009),
pp. 688-709.
Microeconomics, Vol. 3 (201 1), pp. 1-34.

Athey, S. and Ellison, G. "Position Auctions with Consumer Search." Q

pp. 1213-1270.
Paper, Harvard University, 2011.

Ayres, I. and Levitt, S.D. "Measuring Positive Externalities from Unobse
Analysis of Lojack." Quarterly Journal of Economics, Vol. 1 13 (1998),
Bergemann, D. and Bonatti, A. "Targeting in Advertising Markets: Impl
RAND Journal of Economics, Vol. 42 (201 1), pp. 417-443.
Bester, H. and Petrakis, E. "Coupons and Oligopolistic Price Discriminati
Organization, Vol. 14 (1996), pp. 227-242.
Brynjolfsson, E., Hu, Y., and Simester, D. "Goodbye Pareto Principle, Hell
the Concentration of Product Sales." Management Science, Vol. 57 (201
Butters, G.R. "Equilibrium Distribution of Sales and Advertising Prices." R
pp. 465-491.
Chen, Y. and He, C. "Paid Placement: Advertising and Search on the Internet." Economic Journal, Vol. 121 (201 1), pp.
309-328.

Esteban, L. and Hernandez, J.M. "Strategic Targeted Advertising and Market Fragmentation." Economics Bulletin, Vol.

12 (2007), pp. 1-12.
Falkinger, J. "A Welfare Analysis of 'Junk' Information and Spam Filters." Working Paper no. 081 1, University of
Zurich Socioeconomic Institute, 2008.
Fudenberg, D. and Tiróle, J. "Customer Poaching and Brand Switching." RAND Journal of Economics, Vol. 31 (2000),

pp. 634-657.
©RAND 2013.

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms

144 / THE RAND JOURNAL OF ECONOMICS

Galeotti, A. and Moraga-González, XL. "Segmentation, Advertising and Prices." International Journal
Organization, Vol. 26 (2008), pp. 1 106-1 1 19.

Gal-Or, E., Gal-Or, M., May, J.H., and Spangler, W.E. "Targeted Advertising Strategies on Television." M
Science, Vol. 52 (2006), pp. 713-725.

Grossman, G.M. and Shapiro, C. "Informative Advertising with Differentiated Products." Review of Econom

Vol.51 (1984), pp. 63-81.

Hann, I., Hui, K., Lee, S.T., and Png, I.P.L. "Consumer Privacy and Marketing Avoidance: A Static Model." M

Science, Vol. 54 (2008), pp. 1094-1 103.
Hermalin, B.E. and Katz, M.L. "Privacy, Property Rights and Efficiency: The Economics of Privacy as
Quantitative Marketing and Economics, Vol. 4 (2006), pp. 209-239.

Hirshleifer, J. "The Private and Social Value of Information and the Reward to Inventive Activity." Americ

Review, Vol. 61 (1971), pp. 561-574.

Hui, K. and Png, I.P.L. "The Economics of Privacy." In T. Hendershott, ed., Handbooks in Information Syste
Amsterdam: Elsevier, 2006.

Iyer, G., Soberman, D., and Villas-Boas, J.M. "The Targeting of Advertising." Marketing Science, Vol.
pp. 461^476.
Johnson, J.P. "Entry-Level Products with Consumer Learning." Contributions to Economic Analysis & Policy, Vol. 4
(2005), Article 9.
Review, Vol. 96 (2006), pp. 756-784.

Meurer, M. and Stahl, D. "Informative Advertising and Product Match

Organization, Vol. 12 (1994), pp. 1-19.
Moscarini, G. and Ottaviani, M. "Price Competition for an Informed Buyer

(2001), pp. 457-493.

Taylor, C.R. "Consumer Privacy and the Market for Consumer Information

(2004), pp. 631-650.

Uhlig, H. "A Law of Large Numbers for Large Economies." Economic Theor
Van Zandt, T. "Information Overload in a Network of Targeted Communic

35 (2004), pp. 542-560.

©RAND 2013.

This content downloaded from 141.117.125.76 on Sat, 22 Oct 2016 11:48:08 UTC
All use subject to http://about.jstor.org/terms


Jan H. Schumann, Florian von Wangenheim, & Nicole Groene

Targeted Online Advertising: Using
Reciprocity Appeals to Increase
Acceptance Among Users of Free
Web Services

The Internet is dominated by free web services that depend on advertising revenues and powerful marketing tools
to support their business models. Targeted online advertising enables websites to increase their advertising
revenues by selectively displaying advertisements according to users’ browsing behavior, sociodemographics, and
interests. Yet targeting also creates negative consumer reactions, and websites confront increasing regulatory
pressures to inform consumers about their practices. It is critical for such advertising-supported websites to
address those challenges proactively. In one scenario experiment and two field studies, the authors show that a
normative reciprocity argument is generally more effective than the current industry practice of using a utilitarian
argument related to advertising relevance to increase acceptance of targeted online advertising. However, in some
cases, this dominance switches depending on specific website characteristics such as website utility and level of
user-generated content. Managers of free websites should remind their users of the free services they enjoy when
asking permission to target them online or to use their personal information.
Keywords: free web services, targeting, advertising, privacy concerns, reciprocity
Online Supplement: http://dx.doi.org/10.1509/jm.11.0316

T

information from preference surveys, and geographic information. Because of its positive effect on revenues, targeted
online advertising has emerged as a major marketing trend;
overall spending should surpass US$2.6 billion by 2014
(Hallerman 2010).
However, consumers remain highly skeptical of targeted
online advertising. Two-thirds of U.S. adults reject behavioral targeting based on their prior search and browsing
behavior (Turow et al. 2010), and more than half of online
users believe that online tracking should be illegal (Alreck
and Settle 2007). Although some studies have investigated
users’ privacy concerns (e.g., Alreck and Settle 2007; Goldfarb and Tucker 2011, 2012), there is a surprising lack of
research into how websites might address these concerns.
Such research is particularly necessary in light of recent
regulatory initiatives in the United States (Federal Trade
Commission 2010) and Europe (European Union 2009) that
propose the inclusion of an opt-out tool to help users restrict
the collection of information about their web browsing
behavior. If websites cannot increase users’ acceptance of
targeted advertising, they also are likely to suffer from dramatic decreases in advertising revenues.
To increase acceptance of targeted advertising, virtually
all global players in this market pursue the dominant strategy of highlighting how targeting increases the relevance of
the advertisements people see (e.g., “By bringing content
and advertising to you that is relevant and tailored to your
interests, Yahoo! provides a more compelling online experi-

“Personal data is the new oil of the Internet and the new
currency of the digital world.”
—Meglena Kuneva, EU Commissioner for Consumer
Protection (Kuneva 2009)

he Internet is dominated by free websites that depend
on advertising revenues to survive (Anderson 2009).
Through targeted advertising, these websites can
increase their advertising relevance and effectiveness and,
thus, their revenues (Iyer, Soberman, and Villas-Boas
2005). Targeted online advertising refers to any form of
online advertising that is based on information the advertiser has about the advertising recipient, such as demographics, current or past browsing or purchase behavior,

Jan H. Schumann is Professor of Marketing and Innovation, Universität
Passau (e-mail: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>). Florian von Wangenheim
is Professor of Technology Marketing, Department of Management, Technology, and Economics, ETH Zürich (e-mail: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>).
Nicole Groene is a project manager with an international management
consulting firm and a former doctoral student of TUM School of Management, Technische Universität München (e-mail: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>). This
article is partly based on Nicole Groene’s doctoral dissertation. The
authors thank the three unknown JM reviewers for their help in developing
the article. In addition, they acknowledge the insightful input of Katherine
Lemon, Catherine Tucker, and Dirk Totzek on earlier drafts. The authors
also thank the German Federal Ministry of Education and Research and
the German National Aeronautics and Space Research Centre for funding
and supporting this work as part of the Fre(E)S project (FKZ 01FL10038).
Leigh McAlister served as area editor on this article.

© 2014, American Marketing Association
ISSN: 0022-2429 (print), 1547-7185 (electronic)

59

Journal of Marketing
Vol. 78 (January 2014), 59–75

ence”; Yahoo 2013). We refer to this approach as a relevance argument. In this negotiated social exchange, the
website promises the user more relevant advertising in
return for the user’s provision of personal data. However,
such a utilitarian argument (sometimes referred to as a
“benefit appeal”; White and Simpson 2013) might be relatively less effective, because utilitarian benefits have weak
effects on users’ willingness to disclose personal information online if the sensitivity of this information is high
(Mothersbaugh et al. 2012). High information sensitivity
also characterizes the context of targeted online advertising,
which requires the disclosure of intimate personal behavioral or attitudinal data.
A utilitarian approach also ignores that consumers can
be motivated by fairness and reciprocity considerations
(e.g., Kim, Natter, and Spann 2009); for example, free web
services might appeal effectively to users’ normative preferences for distributive justice (e.g., “Your support is
required! Our service is free of charge for you—targeted
advertisements help us fund it.”). We refer to such a strategy as a reciprocity appeal approach, defined as a social
exchange in which the website highlights its free service
provision to elicit users’ need to reciprocate by providing
personal data for targeting purposes that help the provider
finance its free offer. Despite broad evidence of the effectiveness of reciprocity appeals, prior findings have tended
to derive from settings in which the two involved parties
engage in a direct exchange (e.g., Gneezy et al. 2010; Goldstein, Griskevicius, and Cialdini 2011). Early evidence has
suggested that reciprocal behavior might increase considerably if people can observe others reciprocating or if the
behavior takes place in front of the solicitor rather than in
private (e.g., Alpizar, Carlsson, and Johansson-Stenman
2008). Thus, reciprocal behavior might be less prominent in
a web browsing situation. In addition, the “free mentality”
(e.g., Dou 2004) on the Internet might further reduce consumers’ felt need to reciprocate. Even with these potential
obstacles, we posit that the reciprocity argument works in
the elusive context of targeted online advertising and can
even outperform the utilitarian relevance argument.
Such a proposition not only challenges current industry
practices but also contributes to the ongoing debate about
normative appeals, fairness, and reciprocity in the marketing, economics, and psychology literature streams (e.g.,
Alpizar, Carlsson, and Johansson-Stenman 2008; Cialdini
and Trost 1998; White and Simpson 2013). However, studies
that directly compare benefit appeals with normative appeals
are scarce, and the few that have done so focus mainly on
descriptive norms (i.e., what others are doing) rather than
reciprocity appeals (i.e., norms for reciprocating received
benefits; Nolan et al. 2008; White and Simpson 2013).
With a scenario experiment (Study 1) and a field study
(Study 2), we show that the normative reciprocity appeal
works online. These studies also suggest possible moderating effects of website characteristics, such as advertising
informativeness or level of user-generated content. In
another large-scale field study (Study 3) featuring 31 free
websites, we uncover evidence for such moderating effects.
We also identify the relatively rare conditions in which the
60 / Journal of Marketing, January 2014

relevance argument is more effective. It is only through a
combination of several website characteristics that such a
switch in effectiveness occurs.
Accordingly, the results of this research are highly relevant for marketing practitioners. We show that, in general,
appealing to reciprocity outperforms the current industry
practice of promising more relevant advertising. Simply
changing the argument enables firms to increase consumers’ finisher rates by 70%, costlessly. By doing so, websites can establish fewer invitation layers and sell more
advertising space, which is significant for this rapidly growing, multibillion-dollar business. Simultaneously, the use of
transparent, honest reciprocity arguments can help firms
increase users’ acceptance of targeted online advertising
and reduce regulatory attention.
Our findings make several theoretical contributions.
First, we enhance understanding of reciprocity in marketing
exchanges by showing that this norm works even in anonymous, online settings. Prior reciprocity research instead has
highlighted the importance of social goals, such as conformity or social status, as motivations for reciprocal behavior
(Alpizar, Carlsson, and Johansson-Stenman 2008). Our
findings show that the reciprocity norm is so strong and
deeply rooted that appeals to reciprocity work even in the
absence of social control. Users disclose personal information as a form of currency to reward providers of free services, in line with Bagozzi’s (1975) broader perspective on
marketing exchanges but in contrast with the notion of an
overwhelming “free mentality” (Dou 2004) on the Internet.
Second, by showing that reciprocity can increase users’
willingness to disclose personal information, we extend
research on information provision online (Mothersbaugh et
al. 2012; Wirtz and Lwin 2009). Prior research has focused
on utilitarian arguments and control and has tended to neglect
the normative reciprocity argument as an effective driver.
Third, our findings extend compliance research that has
assumed the dominance of reciprocity appeals over negotiated exchanges (Goldstein, Griskevicius, and Cialdini 2011;
James and Bolstein 1992). We identify contingency factors
that influence the effectiveness of both negotiated exchange
(i.e., relevance argument) and appeals to reciprocity. In the
context of free web services, several website characteristics
determine how effective the relevance argument and
appeals to reciprocity will be. Those contingency factors
also reveal that in certain conditions, a negotiated exchange
can outperform the reciprocity argument.
Fourth, we contribute to research on value cocreation
(Vargo and Lusch 2004, 2008), customer coproduction
(Bendapudi and Leone 2003; Chan, Yim, and Lam 2010),
and customer engagement (Van Doorn et al. 2010) by showing that consumers are aware of the complex exchange processes that underlie the provision of free web services. Most
previous research has ignored consumers’ perceptions of
their own nonmonetary value contributions in value creation networks (Achrol and Kotler 1999). Our findings show
that consumers differentiate the value provided by a free
service provider and the value that they and other consumers provide by coproducing the free web service and
consider this distinction in their willingness to pay (with

personal data). Consumers feel indebted to and reward websites only for the value that the websites create; they react
less to reciprocity appeals if the value is generated to a large
extent by websites’ users instead.

Theoretical Background for
Targeted Advertising Acceptance

Advertising Relevance

In line with Laczniak and Muehling (1993), we define relevant advertising as that which is interesting, relevant, and
useful to users such that consumers consider it worthy of
their attention. A relevance argument thus frames the provision of personal information as a social exchange between a
free website and its users: users contribute personal information and accept targeted advertising, and the website
offers more relevant advertising. This approach reflects
social exchange theory (e.g., Thibaut and Kelley 1959),
according to which people evaluate social exchanges in
terms of costs and rewards. This subjective evaluation
guides subsequent behaviors, so people participate in social
exchanges only if their expected rewards outweigh, or at
least compensate for, the costs of participating. Accordingly, consumers should accept targeted online advertising
if they perceive benefits that are greater than the corresponding cost to their privacy.
Direct mail research has shown that consumers engage
in a “privacy calculus” when considering whether to provide personal information; the promise of increased advertising relevance can increase their willingness to provide
personal information (e.g., Culnan 1995; Milne 1997).
Milne and Gordon (1993) specify that respondents prefer
less volume but more targeted mail; Alreck and Settle
(2007) emphasize the advantages of targeting as a means to
reduce irrelevant advertisements. Therefore, the promise of
greater advertising relevance should help websites increase
users’ acceptance of targeted online advertising.

Reciprocity

Another way to motivate consumers to accept targeted
online advertising is to exploit their need for reciprocity, a
universal social norm that requires people to return some
benefits for any benefits they receive (Gouldner 1960;
Leakey and Lewin 1978). This normative argument frames
users’ acceptance of targeted advertising as a quid pro quo
that they accept in return for the website’s free service. The
norm of reciprocity is clearly motivational; it provokes a
person’s innate desire to repay a favor, typically driven by a
feeling of indebtedness (Greenberg 1980). Firms already
make use of the need for reciprocity, such as when charity
organizations increase donations by including small presents (e.g., greeting cards) in their solicitations (e.g., Cialdini and Trost 1998; Falk 2007). Research on pay-whatyou-want pricing further shows that customers usually
expend significantly more than zero cost for a free service
(Gneezy et al. 2010; Kim, Natter, and Spann 2009). People
are motivated to reciprocate for various reasons, such as to
conform to social norms, maintain a positive self-image,
and bolster others’ views of them (Alpizar, Carlsson, and

Johansson-Stenman 2008). Accordingly, people may tend to
act less altruistically if they do not observe others’ reciprocal behavior and remain anonymous and unobserved. However, we argue that the motivational force of maintaining a
positive self-image is strong enough that reciprocity arguments should increase users’ acceptance of targeted online
advertising, even in the anonymous setting of browsing the
Internet.

Why Reciprocity Is the Superior
Argument

The relevance argument and the reciprocity argument are
two distinct approaches, both designed to motivate users
to accept targeted advertisements. Theoretically, both
approaches can support this goal, but research on cooperative behavior suggests that the reciprocity argument may be
more effective in the context of free websites for three reasons. First, the most critical determinant of cooperative
behavior is the extent to which a party has already benefited
from a counterpart (Greenberg, Block, and Silverman 1971;
Zhang and Epely 2009). Because the reciprocity argument
highlights the free service that users already enjoy, it effectively frames clear benefits that customers can evaluate. In
contrast, the relevance argument refers to potential future
gains (i.e., better advertising), which customers cannot
evaluate in advance; therefore, the related benefits are
uncertain.
Second, in terms of perceived costs for both parties
(Ames, Flynn, and Weber 2004), in social exchanges, both
outputs and inputs undergo evaluation to determine whether
the exchange is fair (Adams 1965; Aggarwal 2004). The
reciprocity argument again seems more effective in that it
refers to the website’s core service. Users should perceive
that providing this service creates high costs for the website, especially compared with the seemingly incremental
costs of providing better advertising.
Third, people are much more motivated to cooperate if a
strategy is based on a reciprocal rather than a negotiated
exchange, even if the reward from the negotiated exchange
is greater (Goldstein, Griskevicius, and Cialdini 2011). As
James and Bolstein (1992) show, people are more likely to
participate in a long survey if they first receive a noncontingent gift of $5 instead of a $50 reward contingent on completing the survey. This stronger compliance in the reciprocal exchange condition occurs because of people’s sense of
indebtedness and obligation to achieve distributive justice
(Wirtz and Lwin 2009). In contrast, people in contingent
reward conditions base their decision on how favorable
they consider the offer to be (Heyman and Ariely 2004). If
consumers are asked to provide sensitive, personal information online, they do not regard a utilitarian promise of customization benefits sufficient (Mothersbaugh et al. 2012).
In combination, these findings suggest that the normative
reciprocity argument should be more effective than the
utilitarian relevance argument. We propose the following:

H1: A reciprocity argument has a stronger effect on users’
acceptance of targeted advertising than does a relevance
argument.

Targeted Online Advertising / 61

Studies 1 and 2: Superiority of
Reciprocity over Relevance
Arguments

To test H1, we conducted two studies in which we used different dependent variables. Our research context features
both behavioral targeting and predictive behavioral targeting. Behavioral targeting refers to targeting based on users’
own search and browsing behavior, typically tracked by
placing cookies on users’ web browsers. “Predictive behavioral targeting,” in contrast, refers to extended versions of
these behavioral profiles that include users’ sociodemographics, interests, and self-reported behaviors, gathered
through online surveys. We consider users’ acceptance of
both types. In Study 1, we test for users’ opt-in decisions
related to behavioral targeting on a website that provides
free content, using a scenario experiment and a survey. We
measure users’ willingness to opt in together with the
effects of relevance and reciprocity arguments on the cognitions and attitudes that motivate that behavior. In Study 2, a
large-scale field experiment, we adopt users’ participation
in a predictive behavioral targeting survey and their provision of personal information for targeting purposes as the
dependent variable. In doing so, we test for external validity
and establish the managerial relevance of the proposed
effect. Web Appendix W1 offers an overview of the
research designs of both studies.
Study 1

Study design and sample. We employed a 2 (relevance
vs. neutral) ¥ 2 (reciprocity vs. neutral) ¥ 2 (high control vs.
low control) between-subjects experimental design and
administered an online study with a scenario technique and
a subsequent online survey. The high–low control condition
accounted for the influence of this relevant covariate
(Mothersbaugh et al. 2012). In January and February 2010,
we recruited respondents with the help of a professional
market research firm. To qualify for the survey, potential
respondents answered a set of demographic questions,
which enabled us to recruit a representative sample of German website users. The respondents were randomly
assigned to one of eight experimental conditions and ultiConstructs
Reciprocity
Relevance
Control

mately provided 408 data points (8 manipulations ¥ 51
completed surveys).
The study began by exposing the respondents to a real
screenshot of a popular German news website (similar to
www.cnn.com) and instructions to imagine that they were
browsing this website. The screenshots varied between culture and finance topics and featured real advertisements. In
addition, they were recent, so both the content and the
advertising supported the realism of the scenario. Next, the
participants were exposed to the experimental treatment, in
which they saw a flash layer that overlapped parts of the
news website and contained a text message with a short
greeting (“Dear visitor…”) as well as additional text that
varied in each experimental condition. Table 1 provides the
text from the eight conditions; all paragraphs were short,
required only minimal reading ability, and had been
pretested for comprehensibility. Finally, all flash layer messages concluded with the phrase “We would like to hear
your opinion on this. Please click ‘continue’” (for detailed
manipulation checks, see Web Appendix W2). All respondents also accessed a survey that included a question about
their willingness to opt in to behavioral targeting, assessed
control variables, and tested user cognitions as potential
mediators.

Measures. The Appendix lists the items, their origins,
and the criteria we used to assess the scale constructs. We
operationalized acceptance of behavioral targeting as voluntary, informed consent to opt in to behavioral targeting
(Malhotra, Kim, and Agarwal 2004). For the tests of user
cognitions as potential mediators, we measured participants’ anticipations of advertising relevance and need for
distributive justice. The relevance anticipation measure
came from Laczniak and Muehling’s (1993) scale. We followed Wirtz and Lwin (2009) to operationalize the need for
distributive justice but adapted the measure to pertain to
website output. To assess perceived procedural justice (i.e.,
fairness of procedures and how they are enacted; Thibaut
and Walker 1975), we used a scale adapted from Wirtz and
Lwin (2009). As covariates, we assessed Internet affinity
(Neelamegham and Jain 1999), general concern for privacy
(Dinev and Hart 2006), general attitude toward advertising

TABLE 1
Description of Study 1 Treatments

Treatment

We are happy to offer you the latest news and
articles for free. That is possible because we show
you advertisements in exchange. Only this way can
we keep our offering free of charge.
We would like you to view advertisements you are
interested in. For example, if you read a lot about
travel, you will see more advertisements on vacations
offerings and fewer advertisements on other topics.
In order to do so, we evaluate your surfing behavior
based on unidentifiable information. We do not draw
any conclusions regarding your identity. [How does
this work?] [Privacy Policy]. You can see, edit or
delete the information stored on you at any time at
My Information.

62 / Journal of Marketing, January 2014

Neutral Condition

We are happy that you are visiting our website. Here,
we offer the latest news and articles to you. Besides,
we display advertisements to you.

We would like to give our advertisers the possibility to
reach their target group. Those visitors who read a lot
about travel should see more advertisements on vacation offerings and fewer advertisements on other topics.
In order to do so, we evaluate your surfing behavior
based on unidentifiable information. [How does this
work?] We assure you that we do not draw any
conclusions regarding your identity. [Privacy Policy]

(Pollay and Mittal 1993), and satisfaction with the website
(Chen and Wells 1999). All the items used seven-point Likert scales (1 = “strongly disagree,” and 7 = “strongly
agree”). Finally, we collected data about the respondents’
education, gender, and age. The original scales were in
English, but the questionnaire was in German, so we used
back-translation to ensure equivalence (Brislin 1970). The
correlations between the constructs were acceptable, and all
scales achieved discriminant validity according to Fornell
and Larcker’s (1981) criterion (see Web Appendix W3).
The composite reliability scores were greater than the recommended level of .60.

Hypothesis tests. We tested the hypothesis with the
MEDIATE procedure proposed by Preacher and Hayes
(2008), which can test all individual direct and indirect
effects in a multiple mediator model. Our overall model
used acceptance of behavioral targeting as the dependent
variable. The independent variables were the three manipulated conditions—relevance, reciprocity, and control—as
well as the covariates: website topic, Internet affinity, general concern for privacy, general attitude toward advertising, age, gender, education, and satisfaction with the website. We included relevance anticipation, need for
distributive justice, and perceived procedural justice as
additional potential mediating variables that the manipulations should have aroused (Table 2). The dependent variable
model (Model 1) showed that the relevance argument had
no significant effect (b = .02, n.s.), whereas the reciprocity
argument had a strong positive effect (b = .51, p < .001) on
participants’ acceptance of behavioral targeting. The difference was statistically significant (t(406) = 2.25, p < .05), in
support of H1. In the mediator models, we also found that
relevance did not exert a significant impact on relevance
anticipation (b = .01, n.s.; Model 2), so there could be no
indirect effect of relevance on the acceptance of behavioral
targeting through this route (effect = –.04, lower-level confidence interval [LLCI] = –.125, upper-level confidence
interval [ULCI] = .021; Model 5). The relevance argument
even exerted a negative effect on perceived procedural justice (b = –.28, p < .05; Model 4), which fully mediated the
subsequent significant negative effect on users’ acceptance
of behavioral targeting (effect = –.05, LLCI = –.128, ULCI =
–.004; Model 7). The reciprocity argument led to a higher
predicted need for distributive justice (b = .45, p < .01;
Model 3). The indirect positive effect on acceptance of
behavioral targeting was partially mediated by users’ need
for distributive justice (effect = .10, LLCI = .024, ULCI =
.201; Model 6).

Study 2

Research design and sample. To test for the external
validity of H1 and confirm it in relation to actual information provision behavior, we conducted a between-subjects
field experiment. In cooperation with a large German advertising network, we tested user responses to relevance versus
reciprocity arguments (for the design, see Web Appendix
W1). This study featured two free websites: a renowned
news website (similar to www.cnn.com) and a peer-to-peer
query community (similar to www.ask.com) on which users

ask and answer questions. As part of the field experiment,
we included our survey in a regular, predictive behavioral
targeting survey. In May 2010, the two websites displayed
to 119,301 random visitors invitations to participate in a predictive behavioral targeting survey, in a small flash layer (3
¥ 3 inches) as an experimental treatment. The teaser text
appeared immediately after visitors entered the website.
The manipulation showed one of two teasers (i.e., the
treatment) focused on either relevance or reciprocity. In the
relevance condition, we used an existing teaser from our
industry partner: “Make advertising more individual! You
will see more interesting and less irrelevant advertisements
in the future. Answer a couple of questions on your interests
and your media usage (Duration: 5 minutes).” For the reciprocity condition, we developed new text that was similar
in length and complexity but instead read, “Your support is
required! Our service is free of charge for you—targeted
advertisements help us fund it. Answer a couple of questions on your interests and your media usage (Duration: 5
minutes)” (for the manipulation checks, see Web Appendix
W2). Users who clicked on the flash layer were directed to
a page that explained how their information would be used
for targeting purposes. The manipulated flash layers were
displayed to relatively equally sized groups of randomly
chosen visitors on each website (news: Nrelevance = 19,566,
Nreciprocity = 19,721; query: Nrelevance = 40,114, Nreciprocity =
39,900). Of these potential participants, 1,102 users clicked
on the survey instead of closing the flash layer, reflecting a
click rate of .92%. As is common in predictive behavioral
targeting surveys, we asked respondents for information
about their interests in specific products, shopping habits,
media usage, and sociodemographic information but not
about personally identifiable data. In total, 261 participants
completed the survey without any missing values, indicating a dropout rate of 76.32%. According to our research
partner, the completed surveys came from respondents
whose sociodemographic variables were representative of
both websites. We tested H1 using both the percentage of
users who clicked on the flash layer and the percentage of
users who completed the survey.
Click rates. On both websites, the click rates in the
reciprocity condition were significantly higher than those in
the relevance condition (news: c2(1) = 99.52, p < .001;
query: c2(1) = 43.53, p < .001). On the news website, the
click rate of .88% with the relevance teaser increased to
2.10% with the reciprocity teaser. In the query community, it
increased from .46% to .83%. Thus, in support of H1, users in
the reciprocity condition were 2.39 (news) and 1.80 (query)
times more likely to participate in the predictive behavioral
targeting survey than were those in the relevance condition.

Finisher rates. A higher click rate only provides more
profiles if the positive effect of reciprocity arguments on the
click rate is not offset by a decrease in people who finish the
survey. The reciprocity effect increased significantly after
the clicks (news: c2(1) = 21.39, p < .001; query: c2(1) =
16.49, p < .001). On the news website, the finisher rate rose
from 19.76% in the relevance condition to 39.61% in the
reciprocity condition. Users who clicked on the flash layer
containing the reciprocity argument were 2.01 times more
Targeted Online Advertising / 63

TABLE 2
Analysis of Mediating Effects in Study 1

A: Model 1: Dependent Variable Model
(Acceptance of Behavioral Targeting)
Constant
Relevance
Reciprocity
Control

B

–.25
.02
.51
.37

Covariates
Relevance anticipation .38
Need for distributive
.22
justice
Procedural justice
.18
Topic of website
.11
(0 = finance,
1 = culture)
Internet affinity
.08
General privacy
–.27
concerns
Attitude toward
.02
advertising
Gender
–.21
(0 = female,
1 = male)
Age
.09
Education
–.28
(0 = lower,
1 = higher)
Satisfaction with website .11
R-square
F
d.f.1/d.f.2
p-value

SE

.70
.16
.15
.15

.06
.06

.07
.15

t-Value p-Value
–.36
.11
3.31
2.40

6.08
3.69

2.50
.70

.717
.910
.001
.017

.000
.000

.013
.481

.08
.06

1.12
–4.61

.263
.000

.16

–1.32

.188

.06
.17

1.45
–1.67

.148
.096

.05

2.02

.044

.06

.37

.38
17.51
14/393
.001

.714

Constant
Relevance
Reciprocity
Control

1.29
.01
.13
.03

Covariates
(Omitted from table for brevity)
R-square
F
d.f.1/d.f.2
p-value

aStandard

SE

.59
.14
.13
.13

t-Value p-Value
2.19
.10
.94
.22

B

Constant
1.13
Relevance
–.19
Reciprocity
.45
Control
.02
Covariates
(Omitted from table for brevity)
R-square
F
d.f.1/d.f.2
p-value

.029
.924
.349
.828

.25
11.85
11/396
.001

SE

.65
.15
.15
.15

t-Value p-Value
1.74
–1.27
3.07
.15

.083
.205
.002
.879

.21
9.39
11/396
.001

D: Model 4: Mediator Variable Model (Procedural Justice)
B

Constant
2.71
Relevance
–.28
Reciprocity
.18
Control
.31
Covariates
(Omitted from table for brevity)
R-square
F
d.f.1/d.f.2
p-value

SE

.50
.11
.11
.11

t-Value p-Value
5.43
–2.48
1.57
2.72

.000
.014
.117
.007

.21
9.80
11/396
.001

E: Model 5: Indirect Effects Through Relevance
Anticipation

Relevance
Reciprocity
Control

B: Model 2: Mediator Variable Model
(Relevance Anticipation)
B

C: Model 3: Mediator Variable Model
(Need for Distributive Justice)

Effect
.01
.05
.01

SEa
.05
.05
.05

LLCI

–.095
–.048
–.089

ULCI
.108
.160
.115

F: Model 6: Indirect Effects Through Need for
Distributive Justice

Relevance
Reciprocity
Control

Effect
–.04
.10
.01

SEa
.04
.04
.03

LLCI

–.125
.024
–.064

ULCI
.021
.201
.072

G: Model 7: Indirect Effects Through Procedural Justice

Relevance
Reciprocity
Control

Effect
–.05
.03
.06

SEa
.03
.03
.03

LLCI

ULCI

–.128 –.004
–.007 .096
.006 .140

errors from the mean result of the bootstrapping procedure.
Notes: N = 408; number of bootstrap resamples = 5,000; LLCI = lower-level confidence interval; ULCI = upper-level confidence interval.

likely to complete the survey than those who clicked on the
relevance argument. For the query community, the parallel
finisher rate rose from 4.35% to 16.57%, implying an odds
ratio of 3.81. This finding again confirmed H1.
Discussion

The findings of Studies 1 and 2 provide strong support for
our claim that in the context of free web services, a reci64 / Journal of Marketing, January 2014

procity argument outperforms an argument based on the
promise of relevant advertising as a means to increase
users’ acceptance of targeted online advertising. The reciprocity argument increased the likelihood both to opt in for
behavioral targeting and to disclose personal information
for predictive behavioral targeting purposes.
Although these findings consistently support our
hypothesis, they also imply some surprising aspects. In

Study 1, we found that the relevance argument did not lead
to higher relevance expectations or to greater acceptance of
behavioral targeting. These results suggest that the participants did not believe that opting in for behavioral targeting
would increase the relevance of advertising they received in
the future. This skepticism might have arisen because the
focal website was a popular news website; its strong traffic
and large customer base led mostly large, popular brands to
advertise on the site. Skepticism toward the relevance claim
also had negative effects on users’ perceptions of the website’s procedural justice and an indirect negative effect on
their acceptance of behavioral targeting.
Study 2 also supported the notion that website characteristics might moderate the effect of the different arguments on users’ acceptance of targeted advertising; we
found that the reciprocity argument was significantly more
effective in the context of the news website than in the
query website (Dclick rate = 59%; Dc2(1) = 4.90, p < .001).
In the query community, users coproduce the core service
through user-generated content (i.e., asking and answering
questions), which may make the reciprocity argument less
effective for creating a feeling of indebtedness, especially
compared with the news website, which provides professional, high-quality content. Therefore, we conducted
another study to investigate the potential contingency
effects for both arguments and identify the boundary conditions of the reciprocity argument through a major field
experiment.

Contingency Factors for the
Effectiveness of Both Arguments

To elucidate the potential reasons for differences in the
effectiveness of relevance and reciprocity arguments, we
consider their functioning in relation to a free website in
more detail. By highlighting that users receive a benefit
from better advertising, the relevance argument primarily
pertains to the advertisements, so its effectiveness should be
based on advertising characteristics. The reciprocity argument instead pertains to the exchange between the website
and the user. From the user’s point of view, the website
comprises content (the reason to visit the website) and
advertisements. Therefore, the effectiveness of the reciprocity argument should be based on both advertising and website characteristics. The hypotheses that follow reflect this
difference; that is, we do not hypothesize moderating
effects of website characteristics on the effectiveness of the
relevance argument.

Advertising Characteristics: Clutter and
Informativeness

As we outlined previously, the relevance argument reflects
the notion that the benefits of seeing more relevant advertising compensate users for their costs of providing personal
data. However, the attractiveness of this conditional
exchange, and thus the likelihood that users agree, depends
on how favorable users consider this offer (Heyman and
Ariely 2004). A factor that can influence the attractiveness
of the relevance argument is the level of advertising clutter,

which we define as “the presence of a large amount of noneditorial content in an editorial medium” (Ha and McCann
2008, p. 570). According to overload theory, greater advertising clutter makes advertising less effective because consumers have limited information-processing capacities (Ha
and McCann 2008; Malhotra, Jain, and Lagakos 1982).
They try to focus their limited capacities on their core
object of interest, the editorial content, rather than on the
advertising around it (Smith and Buchholz 1991). With this
limited attention, users simply are less aware of advertising
content (Cialdini, Petty, and Cacioppo 1981; Petty and
Cacioppo 1986) such that their relevance perceptions
should be lower as well. Consequently, users of a website
with greater advertising clutter should observe more room
for enhanced relevance and be more responsive to this
promise than are users of websites with less advertising
clutter.
In contrast, the reciprocity argument assumes that the
exchange is more attractive to users when the benefits
received from the exchange partner are high. We thus propose a generally negative effect of advertising clutter on the
effectiveness of the reciprocity argument. Advertising distracts users from their original browsing intentions (Cho
2004), so they should perceive high levels of advertising
clutter as costs. The more advertising users see and the
higher the impediment costs, the less users may feel obliged
to participate in the exchange by completing a predictive
behavioral targeting survey or providing personal data.
Advertising clutter also can have negative effects on perceptions of editorial quality (Ha and Litman 1997), which
should reduce users’ willingness to reciprocate. Therefore,
we predict the following:

H2a: Advertising clutter moderates the effect of the relevance
argument on users’ acceptance of targeted advertising
such that websites with more advertising clutter provoke
more acceptance of targeted advertising than websites
with less advertising clutter.
H2b: Advertising clutter moderates the effect of the reciprocity
argument on users’ acceptance of targeted advertising
such that websites with more advertising clutter provoke
less acceptance of targeted advertising than websites with
less advertising clutter.

Another factor may relate directly to the effectiveness
of the relevance argument: perceived advertising informativeness, or the extent to which users consider the advertising currently displayed on the website interesting (Ducoffe
1996). Advertising informativeness is one aspect of the perceived overall value that people derive from advertising
(Ducoffe 1995), and it depends on the type of information
communicated (Soley and Reid 1983) as well as editorial–
advertisement congruence (Edwards, Li, and Lee 2002).
Perceived advertising informativeness reduces users’ perceptions of intrusiveness and avoidance behavior (Edwards,
Li, and Lee 2002); it also exerts a strong effect on overall
attitudes toward advertising in general and Internet advertising in particular (Schlosser, Shavitt, and Kanfer 1999).
Advertising informativeness relates conceptually to the
promise of more relevant advertising, in that users should
perceive more informative advertising as more relevant.
Therefore, websites with high levels of informative adverTargeted Online Advertising / 65

tising should induce less responsiveness to the relevance
argument, because consumers likely find little room for
improvement and consider the argument for more relevant
advertising unconvincing. In contrast, consumers viewing
websites with uninformative advertising should imagine
greater benefits of more relevant advertising and be more
likely to react to this claim.
For the reciprocity argument, we predict a contrary
effect: on websites characterized by high advertising informativeness, consumers should consider the advertising
valuable (Schlosser, Shavitt, and Kanfer 1999), which in
turn increases the benefits received from the website
(Ducoffe 1995, 1996). Thus, high levels of informative
advertising should increase consumers’ need for reciprocity,
because the website provides more benefits than does a
website with noninformative advertising (Greenberg,
Block, and Silverman 1971; Zhang and Epely 2009). In
contrast, if advertising informativeness is low, it should
lessen consumers’ feelings of indebtedness toward the website. Thus:

H3a: Advertising informativeness moderates the effect of the
relevance argument on users’ acceptance of targeted advertising such that websites with greater advertising informativeness provoke less acceptance of targeted advertising than websites with lesser advertising informativeness.
H3b: Advertising informativeness moderates the effect of
the reciprocity argument on users’ acceptance of
targeted advertising such that websites with greater
advertising informativeness provoke more acceptance of
targeted advertising than websites with lesser advertising
informativeness.

Website Characteristics: Utility, Quality, and Level
of User-Generated Content

The reciprocity argument posits that users benefit from free
services and thus are motivated to collaborate (Greenberg
1980). However, these feelings and the resulting need to
provide quid pro quo arise only if users believe they have
benefited from the service (Greenberg, Block, and Silverman 1971; Zhang and Epely 2009). In the context of web
services, elements that determine the level of perceived
benefits, and thus the need for reciprocity, include the website’s perceived utility (Chen and Wells 1999; Sutcliffe
2002) and perceived quality (Lee and Kozar 2006; Ngai
2003). The perceived utility of the website is the extent to
which the website content matches users’ needs and wants
(Sutcliffe 2002). According to the uses-and-gratifications
approach, consumers seek specific forms of mass communication to meet their specific needs and return to a channel
only if it satisfies their needs (Hausman and Siepke 2009;
Katz, Gurevitch, and Haas 1973). Following Zeithaml
(1988), we define the overall perceived quality of the website
as users’ assessments of the overall excellence or superiority of the website’s service provision, encompassing perceptions of its design, content, or technical adequacy (Aladwani and Palvia 2002; Kim and Niehm 2009). Because
website utility and quality represent benefits that users
receive for free, they should increase the effectiveness of
the reciprocity argument for targeting acceptance. That is:
66 / Journal of Marketing, January 2014

H4: Website utility moderates the effect of the reciprocity
argument on users’ acceptance of targeted advertising
such that websites with greater utility provoke greater
acceptance of targeted advertising than websites with
lesser utility.
H5: Website quality moderates the effect of the reciprocity
argument on users’ acceptance of targeted advertising
such that websites with higher quality provoke greater
acceptance of targeted advertising than websites with
lower quality.

Consumers’ feelings of indebtedness and obligation also
depend on their perception of the costs to the website of
providing free service (Ames, Flynn, and Weber 2004). In
line with consumer value research (Bolton and Drew 1991;
Zeithaml 1988), we argue that users form general opinions
about free websites’ costs, which influence their perceptions
of the value they derive from their services. These value
perceptions likely depend on the extent to which users
cocreate the websites’ offerings.
Recent research on value cocreation (Vargo and Lusch
2004, 2008), customer coproduction (Bendapudi and Leone
2003; Chan, Yim, and Lam 2010), and customer engagement (Van Doorn et al. 2010) has acknowledged that customers willingly contribute to firms’ offerings in various
ways. Free websites that rely on user-generated content
constitute value creation networks, in which both the website and its users coproduce the overall service experience
(Achrol and Kotler 1999; Lusch and Vargo 2006). Usergenerated content consists of opinions, experiences, or
advice in the form of text, videos, or podcasts, among others (Krishnamurthy and Dou 2008). Websites vary substantially in the extent to which they engage users in service
coproduction. For example, news websites mainly feature
content produced by professional journalists, but social networks and peer-to-peer communities include substantial
amounts of user-generated content for which users serve as
“partial employees” (Mills and Morris 1986). We therefore
define level of user-generated content as the extent to which
users contribute content and cocreate the value that they and
other users can derive from the free website. We predict that
users differentiate the sources of the overall value they enjoy
and consider these distinct sources when they evaluate the
costs to the website of providing its free service. Users of
websites with more user-generated content likely understand that the value they derive depends on not just the
website provider but also its users’ contributions; thus, they
should feel less indebtedness toward the website and react
less favorably to reciprocity arguments than users of a website with low levels of user-generated content. Formally:

H6: The level of user-generated content on a website moderates
the effect of the reciprocity argument on users’ acceptance
of targeted advertising such that websites with more usergenerated content provoke lower acceptance of targeted
advertising than websites with less user-generated content.

Boundary Conditions of the Superiority of the
Reciprocity Argument

Prior compliance research (Goldstein, Griskevicius, and
Cialdini 2011; James and Bolstein 1992) has suggested that
reciprocity always outperforms a negotiated exchange (i.e.,

the relevance argument). This finding derives from situations in which people receive monetary payments or donations with constant difference between these benefits. We
instead compare the perceived value derived from free services with the promise of more relevant advertising. The
findings from Studies 1 and 2 furthermore suggest that
website characteristics influence the perceived value of the
free services, as well as the perceived attractiveness of the
promise of more relevant advertising, such that they also
might influence the effectiveness of the reciprocity and
relevance arguments. If we can affirm the contingency factors detailed in H2–H6, we also must predict that in some
cases, website characteristics support the relevance argument and counteract the reciprocity argument such that the
former is more effective than the latter. Thus:

H7: The relevance argument is more effective than the reciprocity argument on websites characterized by (a) less
attractive advertising, (b) more advertising clutter, (c)
higher website utility, (d) higher website quality, and (e)
less user-generated content.

Study 3

Study context and design. To test our hypotheses, we
conducted an extensive between-subjects field study in
cooperation with two publisher networks and a provider of
targeted online advertising solutions in Germany. The study,
conducted in March 2012, included 31 free websites that
spanned a variety of topics, including news, sports, music,
fashion, health, television, and computers, as well as specific
formats, such as video channels, social communities, query
communities, or other information sites (see Web Appendix
W4). Moreover, the 31 websites targeted specific age
groups and featured gender-specific topics. In a setup similar to Study 2 (see Web Appendix W1), this investigation
was part of a regular, predictive behavioral targeting survey.
The experimental manipulation involved two flash layer
invitations, which used either the relevance or the reciprocity argument. Across the 31 websites, 5,117,741 randomly
chosen, distinct users were invited to participate, spread
relatively equally across the two experimental conditions
(Nrelevance = 2,610,672; Nreciprocity = 2,507,069). The relevance manipulation read, “We are interested in your opinion! Make advertising more interesting for you!” The reciprocity manipulation instead indicated, “Help us to keep
our service free of charge! Our service is free of charge for
you—targeted advertising helps us to better finance it!”
Both manipulations concluded, “We would be happy if you
could invest some minutes of your time to answer some
simple questions. Of course all information will be treated
confidentially and analyzed anonymously. Thank you very
much!” The wording of the manipulations differed slightly
from the teasers in Study 2 because we adjusted them to
reflect the relevance teaser that our collaboration partner
used and meet its preferences regarding the wording of the
reciprocity teaser (for manipulation checks, see Web
Appendix W2). As in our previous studies, we began by
obtaining respondents’ sociodemographic information. Subsequent scales measured consumers’ attitudes and perceptions of the websites, so we could test the moderation

hypotheses. For the dependent variable, acceptance of predictive behavioral targeting, we used the number of users
who clicked the flash layer and completed the survey.

Pretests. We developed many of the scales we used to
assess the contingency factors specifically for this study;
we used pretests to confirm their reliability and validity. We
translated and back-translated the scales adapted from other
studies (Brislin 1970). Knowledgeable researchers assessed
all scales, evaluating how well the items matched the constructs. Next, we asked 30 randomly selected users to indicate any items they found ambiguous or difficult to understand. Only minor modifications were necessary. Finally,
we pretested the scales with a sample of 71 users in a field
pretest. The scales provided satisfactory results in terms of
reliability and discriminant validity and required no further
modifications. The assessments of the measures in the final
sample confirmed these findings.

Measures. The Appendix provides an overview of the
items, their origins, and the quality criteria. We operationalized advertising clutter with a self-developed, single-item
measure1 of the relative level of advertising in comparison
with other websites, because it is a relative rather than an
absolute phenomenon (Ha and Litman 1997). We used a selfdeveloped item to measure advertising informativeness. For
website utility, we used a three-item scale from Chen and
Wells (1999), which we extended and adapted to the context
of targeted advertising. For website quality and the level of
user-generated content, we used self-developed three-item
scales. “Website quality” refers to the content and design of
the site, together with an overall assessment. Finally, the
level of user-generated content measure determined the
extent to which users were actively involved in the production of websites’ content as well as their value for the user.
The descriptive statistics of the key constructs revealed that
the correlations were acceptable (see Web Appendix W5);
we also confirmed the discriminant validity of all the scales.

Data set and sample. Analogous to Study 2, the data set
consists of different levels. For the number of overall
impressions (N = 5,117,741), we lacked information about
the sociodemographic characteristics or attitudes of the
respondents. On the level of the click-through rates for each
condition, we determined that 23,594 visitors clicked on the
invitation teaser, representing an overall response rate of
.46%. Compared with Study 2 (which took place two years
earlier), this substantially lower rate reflects reports of
declines in users’ online information provision (Goldfarb
and Tucker 2011). Of these 23,594 visitors, 5,015 finished
the survey with no missing values, for an overall dropout

1We recognize the ongoing debate surrounding the use of singleversus multi-item measures in marketing research, especially for
major constructs. However, because our field study was embedded
in a regular, predictive behavioral targeting survey, we aimed to
minimize defection rates by keeping the research-relevant questions as concise as possible. Rossiter (2002) suggests that a singleitem measure is appropriate if the object being rated is simple and
unambiguous, as is the attribute on which the object is being rated,
for all raters. We believe that advertising clutter and advertising
informativeness are both relatively simple and unambiguous constructs for consumers to judge.

Targeted Online Advertising / 67

rate of 78.75%, similar to that of Study 2. Our sample represents the overall German Internet population well; we
find little evidence of a response bias (see Web Appendix
W6). Our sample includes slightly more male and more
educated users than the average Internet population, likely
due to the websites’ characteristics.
The data pertaining to the contingency factors were
gathered from the respondents in our experimental design,
which implies a potential bias. Although our sample was
representative of the German online population, we also
conducted further analyses. With a subsample of 14 websites, we compared the experimental contingency factor
data with data from a survey that was not part of the
research design. Overall, we obtained information from
9,193 users with characteristics similar to those of our
experimental sample. For both the experimental sample and
the participants in the unrelated survey, we calculated the
means of the five contingency factors for each website.
Using these means, we then calculated Spearman’s r for
each contingency factor. The Spearman’s rs of all contingency factors were greater than .85 and significant at the
.001 level, which indicates high consistency in the ratings
of websites across groups. This finding supports the external validity of the website ratings. For more information,
see Web Appendix W4.

Hypothesis tests. We tested whether H1 holds in this
much larger data set. The click-through rates were significantly higher in the reciprocity condition (.55%) than in the
relevance condition (.39%; c2(1) = 676.09, p < .001). Participants in the reciprocity condition were 1.41 times more
likely to participate in the predictive behavioral targeting
survey than those who viewed the relevance argument. In
the finisher rates, the difference between the two conditions
increased. The reciprocity condition (22.00%) led to 1.13
times as many finishers as the relevance condition (19.49%;
c2(1) = 22.28, p < .001). These results thus support H1 and
show that the reciprocity argument tends to outperform the
relevance argument for increasing users’ acceptance of predictive behavioral targeting.
To test our contingency hypotheses, we conducted
extreme group comparisons. That is, we identified eight
websites with particularly high or low (upper and lower
quartile) rates of responses to the reciprocity or relevance
arguments and then compared the associated levels for the
contingency factors in these groups. To test H2a and H3a, we
identified eight websites with the highest (Mhigh = .007, SD =
.002) and lowest (Mlow = .002, SD = .001; t(14) = –7.80,
p < .001) click-through rates for the relevance teasers and
compared the means of the proposed contingency factors.
The t-test results in Table 3 show that websites with higher

TABLE 3
Tests on Contingency Factors and Boundary Conditions

A: Relevance Argument: Between-Groups Differences in Website Characteristics
Between High and Low Response Groups

H2a
H3a

Advertising clutter
Advertising informativeness
Website utility
Website quality
Level of user-generated content

High ClickThrough Rate

M
2.90
2.12
3.23
3.22
2.70

SD
1.10
1.06
1.11
1.08
1.02

Low ClickThrough Rate

M
2.66
2.36
3.16
3.29
2.84

SD
.99
1.03
1.05
1.02
.99

t-Value
8.58
–8.47
–1.26
–2.46
–5.76

d.f.
6,353
6,356
7,936
7,207
7,710

p-Value
.000
.000
.207
.014
.000

t-Value
1.07
3.91
9.41
7.78
–12.27

d.f.
5,876
5,887
7,354
6,664
7,137

p-Value
.283
.000
.000
.000
.000

t-Value
8.01
–1.55
16.19
15.48
–10.17

d.f.
15,600
15,591
18,964
17,406
18,419

p-Value
.000
.122
.000
.000
.000

B: Reciprocity Argument: Between-Groups Differences in Website Characteristics
Between High and Low Response Groups

H2b
H3b
H4
H5
H6

Advertising clutter
Advertising informativeness
Website utility
Website quality
Level of user-generated content

High ClickThrough Rate

M
2.88
2.25
3.24
3.24
2.64

SD
1.05
1.06
1.10
1.04
1.02

Low ClickThrough Rate

M
2.85
2.13
2.99
3.03
2.96

SD
1.10
1.10
1.07
1.07
1.03

C: Between-Groups Differences in Website Characteristics Between Relevance- and Reciprocity-Dominant Groups

H7a
H7b
H7c
H7d
H7e

Advertising informativeness
Advertising clutter
Website utility
Website quality
Level of user-generated content

68 / Journal of Marketing, January 2014

RelevanceDominant

M
1.95
2.92
2.95
2.95
2.94

SD
1.06
1.14
1.07
1.06
1.00

ReciprocityDominant

M
2.20
2.87
3.42
3.39
2.67

SD
1.05
1.06
1.09
1.04
1.02

click-through rates for the relevance teasers were associated
with higher levels of advertising clutter and lower levels of
advertising informativeness, in support of H2a and H3a. In
addition, we tested for differences in website characteristics. Although we found no differences in website utility
perceptions between the high and low relevance reaction
groups, websites that prompted higher click-through rates
for the relevance teasers were associated with lower website quality and lower levels of user-generated content.
In further extreme group comparisons, we tested H2b,
H3b, H4, H5, and H6 for the reciprocity argument. We compared the websites with the highest (Mhigh = .009, SD =
.002) and lowest (Mlow = .002, SD = .001; t(14) = –9.95,
p < .001) click-through rates for reciprocity. The results of
the t-tests indicated no difference in advertising clutter
between websites with high and low click-through rates for
the reciprocity argument (Table 3); thus, our data did not
support H2b. However, in support of H3b, websites with
higher click-through rates in response to the reciprocity
argument were associated with greater advertising informativeness. In line with H4, H5, and H6, websites with higher
click-through rates for the reciprocity arguments were associated with higher website utility, higher website quality,
and less user-generated content than were the sites that
invoked lower click-through rates in response to the reciprocity arguments.
To test H7, we divided the 31 websites into 27 that supported the superiority of reciprocity and 4 that indicated the
dominance of the relevance argument. As we show in Table 3,
users of the 4 websites with higher click-through rates for the
relevance argument viewed less attractive advertising, lower
utility, lower quality, and higher levels of user-generated
content than did the users of the 27 websites with higher
click-through rates for the reciprocity argument, in support
of H7a, H7c, H7d, and H7e. However, we found no significant difference in advertising clutter, so we must reject H7b.
Discussion

The results of Study 3 again support our hypothesis that, in
general, the reciprocity argument outperforms the relevance
argument. We confirm that the effectiveness of the two
arguments is contingent on certain website characteristics;
in relatively rare conditions, the relevance argument can
outperform the reciprocity argument. We also obtained
some surprising results. Although we did not expect a relationship between website characteristics and the relevance
argument, we found that high response rates to the relevance argument were associated with low website quality.
Users did not strictly differentiate website content and
advertising, so they reacted positively to the promise of
more relevant advertising when website quality was low,
because they perceived room for improvement throughout
the website. Advertising informativeness is just one aspect
of overall website quality, and the individual-level correlation between these aspects is low (r = .23); yet our data
showed that consumers were motivated and used the opportunity to improve the website. In addition, we did not expect
a relationship between the relevance argument and the level
of user-generated content, but high response rates to the

relevance argument emerged at low levels of user-generated
content. Regardless of the argument, consumers thus seem
less willing to cooperate with a website whose content is
mainly generated by its users. We also were surprised to
find no relationship between advertising clutter and the
effectiveness of the reciprocity argument. Nor did advertising clutter differ between reciprocity- versus relevancedominant websites. Although consumers might perceive
advertising as informative or entertaining (Edwards, Li, and
Lee 2002), we asserted that high levels of advertising generally constitute a cost that users must “pay” to receive free
e-services. Our data did not support this claim. However,
further analyses showed that when we controlled for informativeness, higher effectiveness of the reciprocity argument was significantly associated with less advertising clutter. Thus, even on websites with high levels of advertising,
consumers can be motivated by the reciprocity argument—
as long as they perceive the advertising as informative.

Discussion

Theoretical Implications

The results of this research contribute to marketing theory
in four ways. First, we provide evidence that the reciprocity
argument works in an anonymous relationship between
users and websites. Our findings suggest that users consider
acceptance of targeted advertising an alternative form of
“online currency” that they can use voluntarily to repay a
website for the benefits they have received, which aligns
with a broader perspective on marketing exchanges
(Bagozzi 1975). This result is particularly noteworthy for
general reciprocity research, because important motivational forces for reciprocal behavior—namely, observing
others doing so and being observed by others—are absent
(Alpizar, Carlsson, and Johansson-Stenman 2008). Previous
reciprocity research has suggested that altruistic, prosocial
behavior is motivated particularly by a desire for status and
social acceptance (e.g., Greenberg 1980; Griskevicius,
Tybur, and Van den Bergh 2010), but these motivations do
not exist when accepting targeted advertising in an anonymous online context. In the online context, users’ motivation to preserve a positive self-perception sufficed to cause
them to accept targeted advertising. This motivation could
be activated by a simple, short text, and this finding is informative for research on the power of priming social norms
(Nolan et al. 2008; White and Simpson 2013). Our findings
likely apply to other free online services that rely on advertising revenues, such as free music downloads or apps,
which are in a similar situation. Users can enjoy free content and should feel as motivated to reciprocate this service
by providing data for targeted advertising as they did in the
case of the websites in our study. Whereas we focus on indirect, nonmonetary “payments” in the form of personal data,
the findings could transfer to direct revenue sources as well,
such as donations or pay-what-you-want pricing (Gneezy et
al. 2010; Kim, Natter, and Spann 2009).
Second, we extend research on online information disclosures (e.g., Mothersbaugh et al. 2012; Wirtz and Lwin
2009) by demonstrating the motivational power of the reciTargeted Online Advertising / 69

procity argument for the disclosure of personal information,
a previously neglected point. Prior research has focused on
control and utilitarian customization benefits as drivers of
information disclosures (Mothersbaugh et al. 2012). When
information is sensitive, information control is more relevant,
whereas utilitarian arguments for customization benefits are
not. Our findings reinforce the importance of control and
the irrelevance of a utilitarian (i.e., relevance) argument for
encouraging the disclosure of highly sensitive information,
such as browsing behavior or sociodemographic data and
preferences. Furthermore, we show that in a free e-services
context, the normative reciprocity argument can drive the
disclosure of sensitive, personal information, even after we
account for the positive effect of control. Because free services are the dominant business model on the Internet
(Anderson 2009), normative reciprocity appeals should
have broad applicability. Our finding that reciprocity outperforms relevance in most cases also implies that the perceived costs of information sensitivity influence the effectiveness of the normative reciprocity argument much less
than they do that of the utilitarian relevance argument.
Users are willing to provide even sensitive information in
return for the benefits they receive from free services. However, in circumstances that increase the utilitarian benefits
consumers derive from advertising relevance, customization benefits can have a strong impact on information disclosures. That is, an increase in utilitarian benefits can outweigh the negative impact of information sensitivity on the
effectiveness of utilitarian arguments.
Third, we extend compliance research (Goldstein,
Griskevicius, and Cialdini 2011; James and Bolstein 1992)
by introducing contingency factors and identifying boundary conditions for the superiority of the reciprocity argument. In contrast with prior studies, we assert that the reciprocity argument is not universally superior to a negotiated
exchange (i.e., the relevance argument). Rather, this superiority depends on consumers’ perceived obligation to reciprocate. It only works if the website’s offering is attractive,
with high utility and quality. Otherwise, if the website characteristics support the relevance argument, the reciprocity
argument may be less effective. This finding adds to
research by White and Simpson (2013), who show that
social identity influences the effectiveness of normative and
benefit appeals. We even demonstrate that a negotiated
exchange based on the relevance argument can have negative
effects. If users do not believe in the promise, a negotiated
exchange mitigates their compliance behavior. Prior research
has not incorporated this important finding, which might
influence consumers’ more positive reactions to smaller but
certain gains compared with larger but uncertain rewards.
Fourth, our findings about the moderating effect of usergenerated content contribute to reciprocity research by linking it to the service-dominant logic of marketing (Vargo and
Lusch 2004, 2008), customer coproduction (Bendapudi and
Leone 2003; Chan, Yim, and Lam 2010), and customer
engagement (Van Doorn et al. 2010). All these approaches
imply that active consumers play an important role in value
creation networks (Achrol and Kotler 1999) and can be
valuable for firms even beyond direct revenues, for example, by acting as comarketers or sharing knowledge (Kumar
70 / Journal of Marketing, January 2014

et al. 2010). Yet little research has considered how consumers perceive the value that their behavior has for the
firm. A notable exception is a study by Tsai et al. (2011) that
involves consumers’ willingness to pay for their privacy
and implies consumers’ understanding of the monetary value
of their data. Our work contributes to this research stream
by showing that consumers understand very well who creates which part of the overall value in a value creation network such as a free website. Depending on the service
provider’s input, consumers’ feelings of reciprocity change,
as do the resources they are willing to contribute (e.g., their
time and personal information). When the value derived
from user-generated content is greater than the value users
obtain from the website, they are less moved by appeals to
reciprocity. Therefore, reciprocity research in complex
value networks, whether on- or offline, should account for
consumers’ perceptions of the source of the value.
Managerial Implications

Web networks and associated service providers have
invested heavily to improve their targeting mechanisms,
and many believe that targeted advertising is the key to
advertising success on the Internet (Forrester Research
2013). However, targeting acceptance rates tend to be low
and are decreasing (Beales 2011). Our research offers a
strategy for increasing acceptance of targeted online advertising by appealing to reciprocity rather than relevance.
Websites that pursue targeted advertising thus can immediately benefit from our findings: they should apply reciprocity arguments when asking for users’ consent to collect
information, which will enable them to offer more efficient
targeting. For example, in Study 3, we find that the average
number of finishers in the predictive behavioral targeting
survey that featured the reciprocity argument was 70%
higher than that associated with the relevance argument. By
using a reciprocity argument, a website can invest less time
and effort but obtain the same number of profiles. It should
also experience a financial gain because it can sell advertising space rather than using it to issue invitations to participate in predictive behavioral targeting surveys. Imagine, for
example, an advertising network that aims to collect 10,000
user profiles. Our data show that it would need to issue
13,698,630 invitations if it used a relevance argument but
only 8,064,516 invitations using the reciprocity argument.
Assuming a cost per mille of US$15, the advertising space
saved by 5,634,114 fewer invitations could be sold for
approximately US$84,511.71—at no additional cost or
effort other than changing the text.
Beyond this immediate financial impact, reciprocity is
generally preferable because the relevance argument can
have negative consequences on targeting acceptance if its
promise is not convincing. The relevance argument only
outperforms the reciprocity argument if the website characteristics favor the former (i.e., uninformative advertising)
and conflict with the latter (i.e., low utility and quality and
high levels of user-generated content). The observation that
the relevance argument sometimes outperforms the reciprocity argument may be worrisome for managers of such websites and requires careful analyses of the underlying reasons.
Because the level of user-generated content is not necessar-

ily negative or easily changed, website managers should
aim primarily to improve the service of their websites.
Finally, these findings are important in light of current
policy initiatives to increase consumers’ privacy, which
likely will have tremendous effects on the business models
of free websites. The concept of a “Do Not Track” tool is
still preliminary, but the U.S. Federal Trade Commission
has indicated its intention to push for such legislation if the
industry’s self-regulatory efforts fail. Our research provides
information to help free content websites ensure the success
of these efforts by increasing users’ acceptance of targeted
advertising and the likelihood that they will opt in voluntarily. In the European Union, member states are already
implementing the e-Privacy Directive 2009/136/EC (European Union 2009), which requires consumers to opt in
before websites may employ third-party tracking technology (e.g., cookies by advertising networks). The current
practice is to obtain this opt-in from users’ browser settings,
but the regulation demands that users must be informed
clearly and comprehensively about targeting practices to
facilitate their informed consent. As our research shows, if
free websites use the reciprocity argument and educate consumers truthfully, they can achieve more acceptance of targeted advertising, which could reduce regulatory attention
and minimize the likelihood of tighter privacy laws. For
example, the free German news portal www.golem.de
asked users to support it by switching off their browsers’ ad
blocker to help it finance its services. The campaign
resulted in a 25% reduction in the use of ad blockers, in
accordance with our findings. For policy makers, our
results indicate that enforcing current regulations will not
necessarily harm the online industry. The reciprocity argument performs particularly well for high-utility and highquality websites, so it ultimately could benefit the industry
by increasing competition and improving quality standards.

Limitations and Outlook

Several limitations of our study suggest avenues for further
research. First, our studies were conducted in Germany, and
privacy concerns, which relate to cultural values, likely vary
across countries (Milberg, Smith, and Burke 2000). Germans’ average privacy concerns tend to be high (Interactive
Advertising Bureau 2012), so our participants’ objections to
targeted advertising might be high as well. However, these
level differences do not necessarily challenge our results,
because we investigate relative differences in the effectiveness of relevance and reciprocity arguments, not absolute
acceptance levels. Because reciprocity is a universal norm
(Gouldner 1960; Leakey and Lewin 1978) and studies in
countries such as the United States have suggested that it is
more effective than a negotiated exchange (Goldstein,
Griskevicius, and Cialdini 2011; James and Bolstein 1992),
our findings seem likely to transfer across cultures.
Second, we tested the reciprocity argument with a flash
layer appearing on a website, which sometimes led to click
rates of less than 1%. Although such low reaction rates are
standard for flash-based advertising, there may be more
effective ways to use reciprocity in the context of advertisingsupported content. For example, websites might use reciprocity arguments in newsletters or website content.

Broader, industrywide information campaigns also might
induce greater acceptance of targeted advertising as a
means to finance free content. Future studies should test
these predictions.
Third, we focused on acceptance of targeted online
advertising rather than its effectiveness. In a large-scale
study of targeting and the obtrusiveness of display advertisements, Goldfarb and Tucker (2011) find that privacy
concerns can reduce advertising effectiveness. Subsequent
research has stressed the importance of research into the
cognitive mechanisms underlying privacy concerns and
advertising effectiveness (Goldfarb and Tucker 2011;
Lodish and Reed 2011). Goldfarb and Tucker’s (2011)
study refers to contextual targeting (i.e., matching an advertisement to the website context), but cognitive mechanisms
could be even more relevant for the more intrusive practice
of predictive behavioral targeting. We hope research continues to test the applicability of our findings for increasing
the effectiveness of targeted advertising.
Fourth, we studied the short-term effects of the reciprocity argument. Additional research should consider its midand long-term effects to provide insights into how regularly
consumers need to be reminded of their obligation to reciprocate free websites by accepting targeted advertising.
Researchers also might examine the effects of repeated
exposures to reciprocity arguments across several websites
in an advertiser network. Do their effects diminish as consumers become more familiar with, and thus indifferent to,
reciprocity arguments? Or do repeated arguments instead
increase awareness of the challenges that free content websites face? Free business models are also increasing in offline
environments (Bryce, Dyer, and Hatch 2011), so activating
the norm of reciprocity could be a broadly useful principle.
Further research should investigate the effect of a social
presence on the overall effectiveness of reciprocity arguments.
Fifth, we believe our results should apply to mobile
marketing applications for which users must agree to show
their geographical location. Further research should investigate how and when the reciprocity argument should be presented and framed in this context.

Appendix: Measurement Items and
Validity Assessment for Constructs
in Studies 1 and 3

Respondents indicated their responses to the items on a
seven-point Likert scale (1 = “strongly disagree,” and 7 =
“strongly agree”).

Acceptance of Behavioral Targeting (Study 1;
Malhotra, Kim, and Agarwal 2004)

(Cronbach’s a = .96, composite reliability [CR] = .96, average variance extracted [AVE] = .88, highest squared correlation with other constructs [HSC] = .24)
Given this hypothetical scenario…

1. I would probably allow the website to evaluate my surfing
behavior.
2. It is likely that I would consent to an analysis of my surfing
behavior.

Targeted Online Advertising / 71

3. I would be willing to agree to an evaluation of my surfing
behavior.

Relevance Anticipation (Study 1; Laczniak and
Muehling 1993)

(Cronbach’s a = .94, CR = .94, AVE = .70, HSC = .24)
If I allow the website to evaluate my nonpersonally
identifiable surfing information…
1. I will see online ads that are relevant to me.
2. I will receive useful information through online ads.
3. Online advertisements will be interesting to me.
4. Online advertisements will be worth paying attention to.

Need for Distributive Justice (Study 1; Wirtz and
Lwin 2009)
(Cronbach’s a = .92, CR = .92, AVE = .79, HSC = .24)

1. It is fair to reward the website for providing its content to
me.
2. It is okay that the website asks for a favor in exchange for
free content.
3. Providing the website a benefit in return for its content is fair.

Procedural Justice (Study 1; Wirtz and Lwin 2009)
(Cronbach’s a = .89, CR = .89, AVE = .58, HSC = .04)

1. The way the website provides information explaining its
information-handling procedures is fair.
2. The website is honest to its visitors.
3. The way I can influence how the website handles my information is fair.
4. With regard to its advertising and privacy practices the
website employs fair procedures.

Internet Affinity (Study 1; Neelamegham and Jain
1999)
(Cronbach’s a = .85, CR = .86, AVE = .62, HSC = .20)
1. I use the Internet more often than other people do.
2. I am interested in the Internet.
3. I am experienced in using the Internet.
4. In general, the Internet is important for me.

General Concern for Privacy (Study 1; Dinev and
Hart 2006)
(Cronbach’s a = .91, CR = .92, AVE = .73, HSC = .07)

1. In general, I am concerned about my privacy when using
the Internet. (Study 3)

REFERENCES

Achrol, Ravi S. and Philip Kotler (1999), “Marketing in the Network
Economy,” Journal of Marketing, 63 (Special Issue), 146–63.
Adams, John S. (1965), “Inequity in Social Exchange,” in
Advances in Experimental Social Psychology, Vol. 2, Leonard
Berkowitz, ed. New York: Academic Press, 267–99.
Aggarwal, Pankaj (2004), “The Effects of Brand Relationship
Norms on Consumer Attitudes and Behavior,” Journal of Consumer Research, 31 (1), 87–101.

72 / Journal of Marketing, January 2014

2. I am concerned that information I submit on the Internet
could be misused.
3. I am concerned that a person can find private information
about me on the Internet.
4. I am concerned about submitting information on the Internet,
because they could be used in a way that I cannot foresee.

Attitude Toward Advertising (Study 1; Pollay and
Mittal 1993)
(Cronbach’s a = .94, CR = .94, AVE = .85, HSC = .23)
1. Overall, I consider advertising a good thing.
2. My general opinion of advertising is favorable.
3. Overall, I like advertising.

Satisfaction with the Website (Study 1; Chen and
Wells 1999)
I am satisfied with the content of this website.
Advertising Clutter (Study 3)

In comparison with other websites, this website has a significantly higher level of advertising.
Advertising Informativeness (Study 3)

I find the advertising that I currently usually see on this
website very interesting.

Utility of the Website (Study 3; adapted from
Chen and Wells [1999])

(Cronbach’s a = .83, CR = .85, AVE = .66, HSC = .44)
1. The content of this website is useful to me.
2. I am satisfied with the content of this website.
3. I would like to visit this website frequently.

Quality of the Website (Study 3)

(Cronbach’s a = .91, CR = .92, AVE = .79, HSC = .44)

1. The content of this website has high quality.
2. The design of this website seems very professional to me.
3. Overall, this website is of high quality.

Level of User-Generated Content (Study 3)

(Cronbach’s a = .89, CR = .90, AVE = .74, HSC = .12)

1. The content of this website is created to a large extent by its
users.
2. The users of this website contribute significantly to the
value I derive from the website.
3. This website profits a lot from the contributions of its users.

Aladwani, Adel M. and Prashant C. Palvia (2002), “Developing
and Validating an Instrument for Measuring User-Perceived
Web Quality,” Information and Management, 39 (6), 467–76.
Alpizar, Francisco, Fredrik Carlsson, and Olof Johansson-Stenman
(2008), “Anonymity, Reciprocity, and Conformity: Evidence
from Voluntary Contributions to a National Park in Costa
Rica,” Journal of Public Economics, 92 (5/6), 1047–60.

Alreck, Pamela L. and Robert B. Settle (2007), “Consumer Reactions to Online Behavioural Tracking and Targeting,” Journal
of Database Marketing & Customer Strategy Management, 15
(1), 11–23.
Ames, Daniel R., Francis J. Flynn, and Elke U. Weber (2004), “It’s
the Thought That Counts: On Perceiving How Helpers Decide
to Lend a Hand,” Personality and Social Psychology Bulletin,
30 (4), 461–74.
Anderson, Chris (2009), Free: The Future of a Radical Price. New
York: Hyperion.
Bagozzi, Richard P. (1975), “Marketing as Exchange,” Journal of
Marketing, 39 (October), 32–39.
Beales, Howard (2011), “The Value of Behavioral Targeting,”
research report, Network Advertising Initiative, (accessed September 20, 2013), [available at http://www.networkadvertising.
org/pdfs/Beales_NAI_Study.pdf].
Bendapudi, Neeli and Robert P. Leone (2003), “Psychological
Implications of Customer Participation in Co-Production,”
Journal of Marketing, 67 (January), 14–28.
Bolton, Ruth N. and James H. Drew (1991), “A Multistage Model
of Customers’ Assessments of Service Quality and Value,”
Journal of Consumer Research, 17 (4), 375–84.
Brislin, Richard W. (1970), “Back-Translation for Cross-Cultural
Research,” Journal of Cross-Cultural Psychology, 1 (3), 185–
216.
Bryce, David J., Jeffrey H. Dyer, and Nile W. Hatch (2011), “Free
Offerings Are Rapidly Spreading Beyond Online Markets to
the Physical World. Here’s How Incumbents Can Fight Back,”
Harvard Business Review, 89 (6), 104–111.
Chan, Kimmy Wa, Chi Kin (Bennett) Yim, and Simon S.K. Lam
(2010), “Is Customer Participation in Value Creation a DoubleEdged Sword? Evidence from Professional Financial Services
Across Cultures,” Journal of Marketing, 74 (May), 48–64.
Chen, Qimei and William D. Wells (1999), “Attitude Toward the
Site,” Journal of Advertising Research, 39 (5), 27–37.
Cho, Chang-Hoan (2004), “Why Do People Avoid Advertising on
the Internet?” Journal of Advertising, 33 (4), 89–97.
Cialdini, Robert B., Richard E. Petty, and John T. Cacioppo
(1981), “Attitude and Attitude Change,” Annual Review of Psychology, 32, 357–404.
——— and Melanie R. Trost (1998), “Social Influence: Social
Norms, Conformity, and Compliance,” in The Handbook of
Social Psychology, Vol. 2, Daniel T. Gilbert, Susan T. Fiske,
and Lindzey Gardener, eds. Boston: McGraw-Hill.
Culnan, Mary J. (1995), “Consumer Awareness of Name Removal
Procedures: Implications for Direct Marketing,” Journal of
Direct Marketing, 9 (2), 10–19.
Dinev, Tamara and Paul Hart (2006), “An Extended Privacy Calculus Model for E-Commerce Transactions,” Information Systems Research, 17 (1), 61–80.
Dou, Wenyu (2004), “Will Internet Users Pay for Online Content?” Journal of Advertising Research, 44 (4), 349–59.
Ducoffe, Robert H. (1995), “How Consumers Assess the Value of
Advertising,” Journal of Current Issues and Research in
Advertising, 17 (1), 1–18.
——— (1996), “Advertising Value and Advertising on the Web,”
Journal of Advertising Research, 36 (5), 21–35.
Edwards, Steven M., Hairong Li, and Joo-Hyun Lee (2002),
“Forced Exposure and Psychological Reactance: Antecedents
and Consequences of the Perceived Intrusiveness of Pop-Up
Ads,” Journal of Advertising, 31 (3), 83–95.
European Union (2009), “Directive 2009/136/EC of the European
Parliament and the Council,” (accessed September 20, 2013),
[available at http://eur-lex.europa.eu/LexUriServ/LexUriServ.
do?uri=OJ:L:2009:337:0011:0036:en:PDF].
Falk, Armin (2007), “Gift Exchange in the Field,” Econometrica,
75 (5), 1501–1511.

Federal Trade Commission (2010), “Privacy Online: Report to
Congress,” (accessed September 20, 2013), [available at http://
www.ftc.gov/reports/privacy3/priv-23a.pdf%5D].
Fornell, Claes and David F. Larcker (1981), “Evaluating Structural
Equation Models with Unobservable Variables and Measurement Error,” Journal of Marketing Research, 18 (February),
39–50.
Forrester Research (2013), “Interactive Marketing Predictions,”
(accessed September 20, 2013), [available at http://www.
forrester. com/2013+Interactive+Marketing+Predictions/
fulltext/-/E-RES90761].
Gneezy, Ayelet, Uri Gneezy, Leif D. Nelson, and Amber Brown
(2010), “Shared Social Responsibility: A Field Experiment in
Pay-What-You-Want Pricing and Charitable Giving,” Science,
329 (5989), 325–27.
Goldfarb, Avi and Catherine Tucker (2011), “Online Display
Advertising: Targeting and Obtrusiveness,” Marketing Science,
30 (3), 389–404.
——— and ——— (2012), “Shifts in Privacy Concerns,” American
Economic Review, 102 (3), 349–53.
Goldstein, Noah J., Vladas Griskevicius, and Robert B. Cialdini
(2011), “Reciprocity by Proxy: A Novel Influence Strategy for
Stimulating Cooperation,” Administrative Science Quarterly,
56 (3), 441–73.
Gouldner, Alvin W. (1960), “The Norm of Reciprocity: A Preliminary Statement,” American Sociological Review, 25 (2), 161–
78.
Greenberg, Martin S. (1980), “A Theory of Indebtedness,” in
Social Exchange: New Advances in Theory and Research, Kenneth J. Gergen, Martin S. Greenberg, and Richard H. Willis,
eds. New York: Plenum Press, 3–23.
———, M.W. Block, and M.A. Silverman (1971), “Determinants
of Helping Behavior: Person’s Rewards Versus Other’s Costs,”
Journal of Personality and Social Psychology, 39 (1), 79–93.
Griskevicius, Vladas, Joshua M. Tybur, and Bram van den Bergh
(2010), “Going Green to Be Seen: Status, Reputation, and Conspicuous Conservation,” Journal of Personality and Social
Psychology, 98 (3), 392–404.
Ha, Louisa and Barry R. Litman (1997), “Does Advertising Clutter
Have Diminishing and Negative Returns?” Journal of Advertising, 26 (1), 31–42.
——— and Kim McCann (2008), “An Integrated Model of Advertising Clutter in Offline and Online Media,” International
Journal of Advertising, 27 (4), 569–92.
Hallerman, David (2010), “Audience Ad Targeting: Data and Privacy Issues,” eMarketer.com, (February 16), (accessed September 20, 2013), [available at http://www.emarketer.com/
Article/How-Should-Marketers-Address-Concerns-About-AdTargeting/1007514].
Hausman, Angela V. and Jeffrey S. Siepke (2009), “The Effect of
Web Interface Features on Consumer Online Purchase Intentions,” Journal of Business Research, 62 (1), 5–13.
Heyman, James and Dan Ariely (2004), “Effort for Payment: A
Tale of Two Markets,” Psychological Science, 15 (11), 787–93.
Interactive Advertising Bureau (2012), “Consumers Driving the
Digital Uptake: The Economic Value of Online AdvertisingBased Services for Consumers,” (accessed September 20, 2013),
[available at http://www.iab.net/insights_research/industry_
data_and_landscape/consumers_driving_digital_uptake].
Iyer, Ganesh, David Soberman, and J.M. Villas-Boas (2005), “The
Targeting of Advertising,” Marketing Science, 24 (3), 461–76.
James, J.M. and R. Bolstein (1992), “Large Monetary Incentives
and Their Effect on Mail Survey Response Rates,” Public
Opinion Quarterly, 56 (4), 442–53.
Katz, Elihu, Michael Gurevich, and Hadassah Haas (1973), “On
the Use of the Mass Media for Important Things,” American
Sociological Review, 38 (2), 164–81.

Targeted Online Advertising / 73

Kim, Hyejong and Linda S. Niehm (2009), “The Impact of Website Quality on Information Quality, Value, and Loyalty Intentions in Apparel Retailing,” Journal of Interactive Marketing,
23 (3), 221–33.
Kim, Ju-Young, Martin Natter, and Martin Spann (2009), “Pay
What You Want: A New Participative Pricing Mechanism,”
Journal of Marketing, 73 (January), 44–58.
Krishnamurthy, Sandeep and Wenyu Dou (2008), “Note from Special Issue Editors: Advertising with User-Generated Content: A
Framework and Research Agenda,” Journal of Interactive
Advertising, 8 (2), 1–4.
Kumar, V., Lerzan Aksoy, Bas Donkers, Rajkumar Venkatesan,
Thorsten Wiesel, and Sebastian Tillmanns (2010), “Undervalued or Overvalued Customers: Capturing Total Customer
Engagement Value,” Journal of Service Research, 13 (3), 297–
310.
Kuneva, Meglena (2009), “Keynote Speech,” delivered at the
Roundtable on Online Data Collection, Targeting and Profiling,
Brussels (March 31), (accessed September 20, 2013),
[available at http://europa.eu/rapid/press-release_SPEECH-09156_en.htm].
Laczniak, Russell N. and Darrel D. Muehling (1993), “The Relationship Between Experimental Manipulations and Tests of
Theory in an Advertising Message Involvement Context,”
Journal of Advertising Research, 22 (3), 59–74.
Leakey, Richard and Roger Lewin (1978), People of the Lake:
Mankind & Its Beginnings. New York: Anchor Press/Doubleday.
Lee, Younghwa and Kenneth A. Kozar (2006), “Investigating the
Effect of Website Quality on e-Business Success: An Analytic
Hierarchy Process (AHP) Approach,” Decision Support Systems, 42 (3), 1383–401.
Lodish, Leonard M. and Americus Reed II (2011), “Commentary:
When Is Less More, and How Much More? Thoughts on the
Psychological and Economic Implications of Online Targeting
and Obtrusiveness,” Marketing Science, 30 (3), 405–408.
Lusch, Robert F. and Stephen L. Vargo (2006), “Service-Dominant
Logic: Reactions, Reflections, and Refinements,” Marketing
Theory, 6 (3), 281–88.
Malhotra, Naresh K., Arun K. Jain, and Stephen Lagakos (1982),
“The Information Overload Controversy: An Alternative Viewpoint,” Journal of Marketing, 46 (Spring), 27–37.
———, Sung S. Kim, and James Agarwai (2004), “Internet Users’
Information Privacy Concerns (IUIPC): The Construct, the
Scale, and a Causal Model,” Information Systems Research, 15
(4), 336–55.
Milberg, Sandra J., H.J. Smith, and Sandra J. Burke (2000),
“Information Privacy: Corporate Management and National
Regulation,” Organization Science, 11 (1), 35–57.
Mills, Peter K. and James H. Morris (1986), “Clients as ‘Partial’
Employees of Service Organizations: Role Development in
Client Participation,” Academy of Management Review, 11 (4),
726–35.
Milne, George R. (1997), “Consumer Participation in Mailing
Lists: A Field Experiment,” Journal of Public Policy & Marketing, 16 (Fall), 298–309.
——— and Mary E. Gordon (1993), “Direct Mail Privacy-Efficiency
Trade-Offs Within an Implied Social Contract Framework,”
Journal of Public Policy & Marketing, 12 (Fall), 206–215.
Mothersbaugh, David L., William K. Foxx II, Sharon E. Beatty,
and Sijun Wang (2012), “Disclosure Antecedents in an Online
Service Context: The Role of Sensitivity of Information,” Journal of Service Research, 15 (1), 76–98.
Neelamegham, Ramya and Dipak Jain (1999), “Consumer Choice
Process for Experience Goods: An Econometric Model and
Analysis,” Journal of Marketing Research, 36 (August), 373–
86.

74 / Journal of Marketing, January 2014

Ngai, E.W.T. (2003), “Selection of Web Sites for Online Advertising Using the AHP,” Information and Management, 40 (4),
233–42.
Nolan, Jessica M., P. Wesley Schultz, Robert B. Cialdini, Noah J.
Goldstein, and Vladas Griskevicius (2008), “Normative Social
Influence Is Underdetected,” Personality and Social Psychology Bulletin, 34 (7), 913–23.
Petty, Richard E. and John T. Cacioppo (1986), Communication
and Persuasion: Central and Peripheral Routes to Attitude
Change. New York: Springer.
Pollay, Richard W. and Banwari Mittal (1993), “Here’s the Beef:
Factors, Determinants, and Segments in Consumer Criticism of
Advertising,” Journal of Marketing, 57 (July), 99–114.
Preacher, Kristopher J. and Andrew F. Hayes (2008), “Asymptotic
and Resampling Strategies for Assessing and Comparing Indirect Effects in Multiple Mediator Models,” Behavior Research
Methods, 40 (3), 879–91.
Rossitter, John R. (2002), “The C-OAR-SE Procedure for Scale
Development in Marketing,” International Journal of Research
in Marketing, 19 (4), 305–335.
Schlosser, Ann E., Sharon Shavitt, and Alaina Kanfer (1999),
“Survey of Internet Users’ Attitudes Toward Internet Advertising,” Journal of Interactive Marketing, 13 (3), 34–54.
Smith, Robert E. and Laura M. Buchholz (1991), “Multiple
Resource Theory and Consumer Processing of Broadcast
Advertisements: An Involvement Perspective,” Journal of
Advertising, 20 (3), 1–8.
Soley, Laurence C. and Leonard N. Reid (1983), “Is the Perception of Informativeness Determined by the Quantity or the
Type of Information in Advertising?” Current Issues and
Research in Advertising, 6 (1), 241–51.
Sutcliffe, Alistair (2002), “Assessing the Reliability of Heuristic
Evaluation for Website Attractiveness and Usability,” in Proceedings of the 35th Hawaii International Conference on System Sciences. Washington, DC: Institute of Electrical and Electronics Engineers, 1838–47.
Thibaut, John W. and Harold H. Kelley (1959), The Social Psychology of Groups. New York: John Wiley & Sons.
——— and Laurance Walker (1975), Procedural Justice: A Psychological Analysis. Hillsdale, NJ: Lawrence Erlbaum Associates.
Tsai, Janice Y., Serge Egelman, Lorrie Cranor, and Alessandro
Acquisti (2011), “The Effect of Online Privacy Information on
Purchasing Behavior,” Information Systems Research, 22 (2),
254–68.
Turow, Joseph, Jennifer King, Chris J. Hoofnagle, Amy Bleakley,
and Michael Hennessy (2010), “Americans Reject Tailored
Advertising and Three Activities That Enable It,” working
paper, Annenberg School of Communication, University of
Pennsylvania.
Van Doorn, Jenny, Katherine N. Lemon, Vikas Mittal, Stephan
Nass, and Doreén Pick (2010), “Customer Engagement Behavior: Theoretical Foundations and Research Directions,” Journal of Service Research, 13 (3), 253–66.
Vargo, Stephen L. and Robert F. Lusch (2004), “Evolving to a
New Dominant Logic for Marketing,” Journal of Marketing,
68 (January), 1–17.
——— and ——— (2008), “Service-Dominant Logic: Continuing
the Evolution,” Journal of the Academy of Marketing Science,
36 (1), 1–10.
White, Katherine and Bonnie Simpson (2013), “When Do (and
Don’t) Normative Appeals Influence Sustainable Consumer
Behaviors?” Journal of Marketing, 77 (March), 78–95.
Wirtz, Jochen and May O. Lwin (2009), “Regulatory Focus
Theory, Trust, and Privacy Concern,” Journal of Service
Research, 12 (2), 1–18.

Yahoo (2013), “Yahoo Ad Interest Manager FAQ,” (accessed September 20, 2013), [available at http://info.yahoo.com/privacy/
us/yahoo/opt-outfaq].
Zeithaml, Valerie A. (1988), “Consumer Perceptions of Price,
Quality, and Value: A Means-End Model and Synthesis of Evidence,” Journal of Marketing, 52 (July), 2–22.

Zhang, Yan and Nicholas Epely (2009), “Self-Centered Social
Exchange: Differential Use of Costs Versus Benefits in Prosocial Reciprocity,” Journal of Personality and Social Psychology, 97 (5), 796–810.

Targeted Online Advertising / 75



previous work

Developing a Thesis Statement




Issue: Artificial Intelligence


Broad question: Does artificial intelligence pose a threat to our society?




Level of concern (Circle all that apply.): local, state, national, international
	Your Initial Answer


The development of artificial intelligence will continue to improve many facets of modern life. 
	





Issue:Advertising


Broad question: Is Targeted Advertising bad for the consumer?




Level of concern (Circle all that apply.): local, state, national, international
	Your Initial Answer
The amount of ads being put into every day things on the internet is worsening the experience of the internet.
	

Next you will narrow your focus. Write down one to three focused questions about the topic, and choose the one that you find the most interesting. You will need to do further research about your general topic to see what you are able to focus on. This focus has to be based on quantifiable factual data/research. This is not meant to be speculative.


(Example) Initial Broad Question: Does artificial intelligence pose a threat to our society?


Focused Questions:
How has artificial intelligence improved air travel?


How has artificial intelligence affected medical research and development of treatments and cures for diseases?


How will the development of self-driving vehicles affect highway safety?


Now, write your focused question(s) below:
How does targeted advertising mine user data


How does user data become a product for sale to the highest bidder.


How does this affect users actions upon seeing a target Ad








Please go to page 2:


Now that you have narrowed your focus question, you need to find a minimum of two peer reviewed sources from the library databases (SIRS Researcher, Gale Opposing Viewpoints) Please ask me if you need help getting to the databases. These sources need to directly pertain to your focused question of choice. Link the sources below:


Johnson, Justin P. “Targeted Advertising and Advertising Avoidance.” The RAND Journal of Economics, vol. 44, no. 1, 2013, pp. 128–44. JSTOR, http://www.jstor.org/stable/43186411. Accessed 11 Sept. 2024.




Schumann, Jan H., et al. “Targeted Online Advertising: Using Reciprocity Appeals to Increase Acceptance Among Users of Free Web Services.” Journal of Marketing, vol. 78, no. 1, 2014, pp. 59–75. JSTOR, http://www.jstor.org/stable/43784346. Accessed 11 Sept. 2024.




Elvy, Stacy-Ann. “PAYING FOR PRIVACY AND THE PERSONAL DATA ECONOMY.” Columbia Law Review, vol. 117, no. 6, 2017, pp. 1369–459. JSTOR, http://www.jstor.org/stable/44392955. Accessed 11 Sept. 2024.










After reviewing your sources, please answer your focused question below based on your research.




Issue: Is Targeted Advertising bad for the consumer?


Focused question: How does user data become a product for sale to the highest bidder.




Level of concern (Circle all that apply.): local, state, national, international
	Your Answer
User data becomes a product for sale through massive amounts of datamining information of people from online activities. Companies build up this data to create detailed user profiles for every single person, which are then put up for sale advertisers or data brokers.
	







Creating Your Thesis Statement:


Now it is time to create your thesis statement. Your thesis statement needs to be focused and concise, based on your research you have done and your answer to your focused question about the topic. 


Example: 


Thesis statement: The increasing use of artificial intelligence in transportation will provide citizens with greater levels of safety and reliability.






Write Your Thesis Statement Below:






The commercialization of user data through targeted ads raises massive privacy issues, turning personal information into a product sold to companies, without users knowing and most importantly agreeing.

De Guelle 1
Evan De Guelle
Mr. McGoldrick
English III
27 September 2024
Targeted Ads: A Threat To Your Privacy


Every day, we use the internet, leaving bits of our information behind. Websites and apps collect this data without us knowing, building profiles based on our habits and preferences. Companies then buy and sell this information, using it to show us targeted ads. This not only invades our privacy but also allows businesses to influence our choices without our consent. The commercialization of user data through targeted ads raises massive privacy issues, turning personal information into a product sold to companies, without users knowing and most importantly agreeing.

Research Essay Outline Brainstorming Assignment


The pre-writing process for research based essay is just as important as the actual writing yourself. Please go through the prompted sections below, and create an outline for the essay that you will be creating.




Introduction - The introduction is arguably the most important part of your essay. This is where you will introduce your topic, your thesis, and the reasons that support your thesis that you will write about in your body paragraphs. In the box below, please copy and paste your thesis statement:




The commercialization of user data through targeted ads raises massive privacy issues, turning personal information into a product sold to companies, without users knowing and most importantly agreeing.
	



Body Paragraph 1 - This is where you will introduce your first piece of supporting evidence that backs up your thesis. Considering that this is an expository essay about an issue, you will be writing about the causes and effects of the issue. I would personally recommend that you talk about the cause(s) of the issue in this first body paragraph. In the box below, I want you to loosely say in one sentence, what it is that you will be writing about in this paragraph. Then I want you to copy and paste the quote and the link for the quote that you will use in this paragraph below. Then in one more sentence, explain how this quote supports your thesis:




This paragraph explains how targeted advertising collect the data of users’ without  awareness or consent.


Quote: “Companies can monitor a consumer’s habits, including Internet browsing on third-party websites, not only from the consumer’s direct use of the product but also by using cookies and other mechanisms that enable data collection and tracking even when the product is not in use.”


Link: Elvy, Stacy-Ann. “PAYING FOR PRIVACY AND THE PERSONAL DATA ECONOMY.” Columbia Law Review, vol. 117, no. 6, 2017, pp. 1369–459. JSTOR, http://www.jstor.org/stable/44392955. Accessed 11 Sept. 2024.
	



Body Paragraph 2 - In this paragraph, you can write about an effect that your issue has on a place, a population, etc. You will need a new example of supporting evidence for each body paragraph. In the box below, I want you to loosely say in one sentence, what it is that you will be writing about in this paragraph. Then I want you to copy and paste the quote and the link for the quote that you will use in this paragraph below. Then, in one more sentence, explain how this quote supports your thesis:




This paragraph will show commercialization of user data through targeted advertising adds to the growing privacy issue based on the gap between rich and poor people.


Quote: “To the extent that financially disadvantaged consumers cannot afford the prices of companies that adopt a privacy-as-a-luxury model charge, use of this model is likely to contribute to the divide between those that can afford privacy and those that cannot.”


Link: Elvy, Stacy-Ann. “PAYING FOR PRIVACY AND THE PERSONAL DATA ECONOMY.” Columbia Law Review, vol. 117, no. 6, 2017, pp. 1369–459. JSTOR, http://www.jstor.org/stable/44392955. Accessed 11 Sept. 2024.


Explanation: This quote shows how targeted advertising can make already existing inequalities even worse, as people who can afford to pay for privacy-focused services will be better protected, while people who can't are left exposed and their data is further exploited.
	



Body Paragraph 3 - In this paragraph, you can write about an effect that your issue has on a place, a population, etc. You will need a new example of supporting evidence for each body paragraph. In the box below, I want you to loosely say in one sentence, what it is that you will be writing about in this paragraph. Then I want you to copy and paste the quote and the link for the quote that you will use in this paragraph below. Then, in one more sentence, explain how this quote supports your thesis:




This paragraph will show how making user’s data into a product risks individuals to being targeted to manipulation and exploitation from companies who want to influence their behavior.


Quote: “Companies that obtain consumer data through this model can deploy ‘predictive data devices to discriminate against consumers they deem less valuable or too risky.’”


Link: Elvy, Stacy-Ann. “PAYING FOR PRIVACY AND THE PERSONAL DATA ECONOMY.” Columbia Law Review, vol. 117, no. 6, 2017, pp. 1369–459. JSTOR, http://www.jstor.org/stable/44392955. Accessed 11 Sept. 2024.


Explanation: This quote shows how the collected user data give the companies power to categorize and target individuals with manipulative advertising strategies, further showing the lack of control users have over their own information and how it’s manipulated and used against them.
	



Conclusion - For this paragraph, we will talk about this more once we get to it in the writing process.

Paragraph 1: Introduction
* Introduce your topic with a “hook”. This can mean several things. Usually you’ll want to write a general statement/introduction to your topic. To write a good hook it is recommended that you write enough information for the reader to have an understanding of what your essay is about, but leave out enough detail for them to want to keep reading.
* The following sentences between your hook and your thesis statement is generally recommended to both give context to your thesis statement, and to introduce subtopics/supporting reasons(minimum of two) that you will write about in your body paragraphs. It’s important to keep your body paragraphs focused and concise so you’ll need to start planning them out now so it will be organized and will flow properly.
* The last sentence in your paragraph should be your thesis statement. This allows for your audience to have been given context to what your essay is going to be and how you as the writer think about the particular topic in an organized and efficient manner. 


Paragraph 2: Body Paragraph 1


* This is where you will write your first reason/subtopic that supports your thesis statement. The role of every body paragraph is to support/back up your thesis statement. Each body paragraph needs to flow properly, be organized, and build off of one another. The best way to do this, is to keep your body paragraph focused to one reason/subtopic that supports your thesis. You do not want to jump around from reason to reason. Keep it clear and concise.
* The information in this paragraph and every paragraph has to be backed by a peer reviewed source. To maintain your credibility/authority on the topic, you will want to use at least one quote data driven fact that you have found in your research. This quote has to directly pertain to your specific reason in your paragraph.
* Remember to “Sandwich” you quotes. This means that you have to:
1. Give context(who wrote it and what does it pertain to?) to your quote.
2. Put the quote itself into your essay.
3. Then explain how this quote backs up your thesis statement.


*    Remember to properly cite your quote using an in-text citation. This can look like several different things based on the type of source that you are referencing. Please refer to the OWL Purdue guide to in-text MLA citations, and choose the type of source it is(internet periodical, a book, etc.) “That’s cool”  (McGoldrick 14)


Paragraph 3: Body Paragraph 2


* This is where you will write your second reason/subtopic that supports your thesis statement. The role of every body paragraph is to support/back up your thesis statement. Each body paragraph needs to flow properly, be organized, and build off of one another. The best way to do this, is to keep your body paragraph focused to one reason/subtopic that supports your thesis. You do not want to jump around from reason to reason. Keep it clear and concise.
* The information in this paragraph and every paragraph has to be backed by a peer reviewed source. To maintain your credibility/authority on the topic, you will want to use at least one quote data driven fact that you have found in your research. This quote has to directly pertain to your specific reason in your paragraph.
* Remember to “Sandwich” you quotes. This means that you have to:
4. Give context(who wrote it and what does it pertain to?) to your quote.
5. Put the quote itself into your essay.
6. Then explain how this quote backs up your thesis statement.


*    Remember to properly cite your quote using an in-text citation. This can look like several different things based on the type of source that you are referencing. Please refer to the OWL Purdue guide to in-text MLA citations, and choose the type of source it is(internet periodical, a book, etc.) “That’s cool”  (McGoldrick 14)


Paragraph 3: Body Paragraph 3


* This is where you will write your third reason/subtopic that supports your thesis statement. The role of every body paragraph is to support/back up your thesis statement. Each body paragraph needs to flow properly, be organized, and build off of one another. The best way to do this, is to keep your body paragraph focused to one reason/subtopic that supports your thesis. You do not want to jump around from reason to reason. Keep it clear and concise.
* The information in this paragraph and every paragraph has to be backed by a peer reviewed source. To maintain your credibility/authority on the topic, you will want to use at least one quote data driven fact that you have found in your research. This quote has to directly pertain to your specific reason in your paragraph.
* Remember to “Sandwich” you quotes. This means that you have to:
7. Give context(who wrote it and what does it pertain to?) to your quote.
8. Put the quote itself into your essay.
9. Then explain how this quote backs up your thesis statement.


*    Remember to properly cite your quote using an in-text citation. This can look like several different things based on the type of source that you are referencing. Please refer to the OWL Purdue guide to in-text MLA citations, and choose the type of source it is(internet periodical, a book, etc.) “That’s cool”  (McGoldrick 14)






Paragraph 5: Conclusion


* The first sentence in your concluding paragraph should be a restating of your thesis. Remember, the meaning of your thesis should not change, but the words need to.
* Next, follow this by restating your reason(s)that support your thesis.
* You should end the paragraph/essay with a concise and finite statement.