Unit 2: Digital Privacy & Consumer Protection

Objective of a profit-maximizing algorithm for an attention-based business model

Maximizing engagement (e.g. clicks, shares)

Why does false information spread faster than facts?

Novelty hypothesis – information is new and surprising and therefore more likely to be shared

Business model

The strategy a business enacts to make a profit that reflects how an organization creates, delivers and captures value

Key components of business models

• What products / services does the business sell?

• Who pays for these products / services?

• How does the business produce the products / services?

Software development production cost structure

• Cost depends on the complexity of the software, not on the number of people who use it

• Customer service in the tech industry is very minimal

• Cost of computing and data storage has dropped precipitously 

Social media “product”

Impressions

Social media “producers”

Social media platforms

Social media “consumers”

Businesses and other entities who pay for impressions on their content

Shaky assumptions for attention markets

• Consumers are rational and self-interested

• Consumers have fixed preferences

• There is perfect competition with no economies of scale and no barriers to entry

• Individuals have full, symmetric information

• Private and social costs and benefits are equal

Supply of attention

Increases as people’s times on the platform increases

What does a supply of attention create financial incentive for?

• Addictive platforms

• Rabbit hole content

• User data to tailor algorithm to increase engagement

Characteristics of information asymmetries for digital platforms

• Users of the platforms don’t know what information is being collected and how it’ll be used

• Opens up opportunities for exploitation

• Privacy policies are long and vague and don’t allow for fully informed consent to the exchange

Demand for attention

• Increases with more specific ad targeting and better predictions of buying habits

• Advertisers will pay more for “eyes on ads” if those eyes are from customers who are likely to buy

Natural monopoly

Market where the average cost of production declines as more output is produced

Natural monopoly classic example

Electricity utilities

Natural monopoly modern example

Digital platforms

Natural monopolies and economic welfare

Natural monopolies do not maximize “economic welfare” without regulation

Software development production cost structure

Cost depends on the complexity (and R&D) of the software, not (much) on the number of people who use it

Network effects

• The more users that are on a platform, the more valuable the platform is for users

• Demand-side economies of scale 

• Network effects reinforce the tendency of the market to move naturally to a monopoly

Data broker market regulation - state laws

• Vermont passed a law regarding data brokers in 2018, Oregon and Texas followed in 2023

• California has the most comprehensive data broker law (passed in 2023)

Data broker market regulation - federal laws

• U.S. Congress passed Protecting Americans’ Data from Foreign Adversaries Act in 2024 – prevents data brokers from selling data to foreign adversaries.

• U.S. Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB) were extending regulation and on data brokers in late 2024 and early 2025, but priorities have shifted.

Downsides of regulation

• Increases costs of doing business

• Creates barriers to entry (for new companies to enter the market)

• Can limit hiring

• Can reduce economic growth

Regulatory capture

• When a government agency, meant to serve the public's interest, starts acting in the interests of the industry it is supposed to regulate

• Can occur when businesses create close relationships with regulators through lobbyists, lawyers, and consultants

Revolving door

Tendency of policy experts to switch jobs between public service regulatory roles and policy positions in businesses

Regulation is unnecessary if:

• Consumers can easily assess and understand product / service quality

• Businesses are seeking repeat customers

• The market is competitive in the absence of regulations

How does competition affect regulation?

• It allows consumers to regulate business practices by patronizing businesses with the best practices

• Creates pressure on businesses to cater to consumer needs and avoid damaging their reputation with bad or unethical practices

Regulation of restaurants - what is the product?

Food

Regulation of restaurants - what are the (conflicting) market pressures?

• Pushes for stronger food safety practice to avoid food poisoning in customers

• Pushes for cutting corners that reduce cost, but also may reduce food safety

Regulation of data brokers - what is the product?

Personal data

Regulation of data brokers - what are the market pressures?

Pushes for less privacy and less individual control of data about them for both customers and data brokers

Market failures and regulation

• Markets with asymmetrical information

• Markets where people tend to make non-rational choices

• Markets with natural monopolies that prevent competition

• Markets with externalities that negatively impact people and entities who are neither the buyer, nor the seller

What causes asymmetrical information in data collection and use?

Lack of transparency in data collection and use

Carpenter vs United States

• Government argued that cellphone users voluntarily reveal their personal information so they cannot expect businesses to hide that information from the government

• Decision was made that law enforcement must get a search warrant to request location data from cellphone providers in 2018

Data broker loophole

The government does not need a search warrant to buy location (or other) data from data brokers

Types of data brokers

• Financial information brokers

• Risk mitigation brokers

• Marketing and advertising brokers

• People search brokers

• Personal health brokers

Financial information brokers

Credit reporting agencies (e.g. Experian Equifax, Transunion), many also sell purchasing data from credit cards

Risk mitigation brokers

Verify identities, look for fraudulent transactions, employment / tenant screening

Marketing and advertising brokers

Data for targeted marketing

People search brokers

Sells access to data about specific people to anyone who will pay for it

Personal health brokers

Sell consumers’ health data to pharmaceutical and health insurance companies

Sources of data

• Government sources

• Commercial sources

• Publicly available sources

• Web tracking

• Mobile tracking

Government sources examples

• US Postal Service

• Property records

• Court filings

• Criminal convictions

• Professional and recreational licenses

• Divorce records

• Birth certificates

• Bankruptcy records

• Voter registration information

• Vehicle registration records

Commercial sources examples

• Purchase history

• Warranty registration

• Credit information

• Loyalty card data

Publicly available sources examples

• Social media profiles

• Forum posts

• Media reports

• Business listings

• Telephone books

Web tracking examples

• Cookies

  • First-party cookies (tracking that allows the website to remember your past activity on its own site)

  • Third-party cookies (tracks your online activity for online ad networks and aggregators)

The right to privacy

• Published by Brandeis and Warren in the Harvard Law Review in 1890

• Response to invasive press and invention of photography

• Defines privacy as a “fundamental right” and calls for legal protections

Federal data privacy laws

• Fair Credit Reporting Act (FCRA)

• Family Educational Rights and Privacy Act (FERPA)

• Health Insurance Portability and Accountability Act (HIPAA)

• Children’s Online Privacy Act (COPPA)

• Gramm-Leach-Billey Act (GLBA)

• Protecting Americans’ Data from Foreign Adversaries Act (PADFAA)

• Electronic Communications Privacy Act (ECPA)

• Video Privacy Protection Act (VPPA)

• Unfair and Deceptive Acts and Practices (UDAP)

Fair Credit Reporting Act (FCRA)

• Established in 1970

• Specific to credit reports, has had substantial updates

Family Educational Rights and Privacy Act (FERPA)

• Established in 1974

• Protects students’ educational records

Health Insurance Portability and Accountability Act (HIPAA)

• Established in 1996

• Regulates how healthcare providers and insurers use, protect and share health data

• Does not cover health data held by non-covered entities (e.g. health apps)

Children’s Online Privacy Act (COPPA)

• Established in 2000

• Puts limits on data collection for children under 13

Gramm-Leach-Billey Act (GLBA)

• Established in 1999

• Financial service providers must explain how they use data

• Allows customers to opt out

Protecting Americans’ Data from Foreign Adversaries Act (PADFAA) 

• Established in 2024

• Prohibits data brokers from selling sensitive data to adversarial nations

Electronic Communications Privacy Act (ECPA)

• Established in 1986

• Rules for government wiretaps of phones

• Does not cover many new types of data

Video Privacy Protection Act (VPPA)

• Established in 1988

• No one can access your VHS rental history

• Does not cover streaming services

Areas of basic data privacy protections

• Data collection and sharing

• Consent (opt-in vs. opt-out)

• Right to access, correct, delete data

• Data minimization

• Non-discrimination

• Health data

• AI

EU GDPR

• General Data Protection Regulation

• EU law that protects personal data and gives individuals greater control over their data

EU GDPR data protection principles

• Lawfulness, fairness and transparency

• Purpose limitation

• Data minimization

• Accuracy

• Storage limitations

• Integrity and confidentiality

• Accountability 

Penalty for violating EU GDPR

Up to 20 million Euros, or 4% of previous year’s global annual turnover

Data brokers

Business / unit / units of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship

Synergies

Synergies in the problem imply synergies in the solution

Three generator functions of existential risk

1. Rivalrous dynamics

2. Degrading foundations (that which sustains us and enables us to solve problems)

3. Exponential technology

Private goods

• Rival and excludable

• Examples: Ice cream, cheese, houses, cars

Common resources

• Rival and non-excludable

• Examples: Fresh water, fish, timber, pasture

Club goods

• Non-rival and excludable

• Examples: Cable TV, cinemas, WiFi, tollroads

Public goods

• Non-rival and non-excludable

• Examples: Fresh air, knowledge, national defense

What does it mean when a good is excludable?

It is possible (and practical) to prevent people from using it if they haven't paid for it

What does it mean when a good is rival?

A product where use by one person prevents or impairs another person from using it

Rivalrous dynamics

• Situations characterized as conflicts that tend to produce a winner and a loser

• If you don’t want to lose, you have to pay to win

Tragedy of the Commons

If we don’t do it, someone else will

Arms race

Even if I would prefer not to escalate the conflict, if I don’t improve my offensive / defenses and my competitor does, then I will lose

Degrading foundations

Civilization depends on the natural world and the ability of humans to cooperate to solve problems

How does Daniel Schmachtenberger refer to degrading foundations?

“The subsuming of our substrate”

Which foundations are being degraded?

• Natural resources

• Human ingenuity

• Social trust

• Problem-solving

What degrades natural resources?

Open-loop economies

What degrades human ingenuity?

Mindless distractions and attention degradation

What degrades social trust?

Polarization

What degrades problem-solving?

Lack of a shared reality

Epistemology

How we know what we know

Examples of degrading epistemic capacity

• Polarized news sources

• Fake news

• Deepfakes

• AI chatbots that validate and reflect your own views

How is exponential technology a problem?

Technology develops at an exponential rate, while policy and regulation is linear (at best)

Attractor states

A “default pattern” that a system tends to fall into, even if it gets disturbed, as it’s where the system naturally wants to go or stay

Current direction of attractor states

• Oppression

• Chaos

Alternative attractor state

• Cooperative civil society

• Culture that has an emergent wisdom to manage new technology (“Cultural enlightenment”)

With rights and no responsibilities 

Tyranny and entitlement

With responsibilities and no rights

Servitude

With responsibilities and rights

Civil societies

No responsibilities and no rights

Chaos

What is the objective of a profit-maximizing algorithm for an attention-based business model?

Maximizing time-on-site and engagement

The meta-problem

Drivers of existential risk

Antidote to Tragedy of the Commons

Cooperative management

Evolutionary theory

The rapid evolution of humans over the past few millennia has occurred not in our genes, but in our culture

The Ted Lasso Effect

Cooperation on the group vs. on the individual level

Elinor Ostrom’s core design principles

1. A strong sense of identity and purpose and clear group boundaries 

2. What you get must be proportional to what you give

3. Fair and inclusive decision-making

4. Monitoring and accountability to enforce agreed upon behaviors

5. Rewards for good and punishments for bad behavior

6. Fast and fair conflict resolution

7. Local autonomy

8. Nested tiers of governance and appropriate relations with other groups that reflect the same core design principles

Solutions in progress

• General data protection

• New focus on data protection and digital regulation / governance in the US

• Cultural change