“If you’re not paying, you’re the product!” People love to repeat this complaint:
We pay, for example, for the awesomeness of Google’s free array of services by helping Google build an enormous database filled with our billions of searches and personal information. … This week as you scour the internet and stores for holiday deals, keep in mind that when you’re not paying with cash you’re paying with your personal information.
What it means is that if a website is spending its time and resources to deliver content to you without asking for anything in return, then they are probably selling information about you to others to make money.
free services usually make money by extracting lots of data from users — and then selling that data, or using it for targeted availability of those users for advertising, to advertisers.
if you’re not paying to use a service, you can expect that your data will be used to make money in some way.
To be honest, I think much of this fretting about privacy is misdirected.
Yes, there are plenty of groups that should be worried about protecting their or their users’ privacy—say, reporters, dissidents, Equifax, or companies operating in authoritarian political regimes. In these cases the path from non-privacy to harm is relatively obvious. But many privacy activists treat it as self-evident that any compromise of privacy is a deal with the devil. The results are uninspiring.
It’s silly, for instance, when Richard Stallman suggests that people swap Charlie Cards to fool MBTA tracking, or when people worry about who knows their browsing history, or fret about software with opt-out telemetry, or when the EU makes every single website give you an annoying pop-up about how you’re opting into cookies,1 or when Mozilla warns every Firefox user that “today’s gifts don’t come with *privacy not included”.
(Does GDPR fall into the “silly” category? I’m mostly suspending judgment. I’m worried because I think it had the same questionable motivations as the above, but I could easily imagine changing my mind.)
None of these examples cited any reasons why the privacy violations were worth worrying about. The blog post explaining Mozilla’s “privacy not included” campaign did claim that their reviewers asked the question “what could happen if something goes wrong”—but I couldn’t find any reviews that actually answered this question! Probably because they had some trouble coming up with a plausible story of someone nefariously abusing Adidas’s smart soccer ball telemetry.2 In these cases, it’s not worth worrying much about whether you’re the product.
However, there’s a much worse sense in which “if you’re not paying, you’re the product” is true. People have started worrying more about it recently, but still not nearly enough.
The problem isn’t just that GoogFace let advertisers know what you’re interested in. The problem is that this is their only job, as in, the only thing that makes them money. Any way in which GoogFace make you happy, solve your problems, or improve your life is more or less accidental.
In a well-functioning world, this wouldn’t be true, or at least wouldn’t be important. If Facebook didn’t make its users happy, they could leave and go use better products, and then the advertisers would leave and then Facebook would make less money. In fact, our world used to be closer to this situation, because Facebook didn’t know how to keep people using it except by making something they actually liked.
But then Facebook hired a bunch of psychologists and the psychologists taught them about Skinner boxes. Or maybe their userbase stopped growing and they started having to wring more usage from old users to keep the charts going up. Or maybe they realized they had enough of a network effect lock-in that they could start abusing their position. Anyway, they discovered a slew of ways to get more usage without actually having a better product.
For instance, you can pad the news feed with worse stories. People have to scroll past these stories to find the ones they actually want to see, so this increases engagement. It also creates what’s known in psychology as a variable-reward schedule—basically, the action you take (scrolling down in the feed) is sometimes randomly rewarded and sometimes not. Variable-reward schedules lead to much more compulsive behavior, perhaps because they make the reward seem scarcer.
(If you Google “variable reward schedule” the top result is an article by a “growth hacker” and its literal title is: “Want to Hook Users? Drive Them Crazy”)
Or you can send people lots of notifications that aren’t actually important. If they ignore the notifications, no big deal; if they click on them, then you get more traffic and serve more ads. Or you can make the notification icon bright red so it’s impossible for people to ignore their notifications.
Up to a point, when you try to optimize for “what keeps users on my site,” the answer you’ll get is “make them happier.” But that’s just a correlation, and at the extremes, the correlation breaks down. Once you’ve plucked all the low-hanging fruit of actually solving people’s problems, the only thing left is dark patterns.
Most people don’t notice how deeply things like Facebook have been compromised by their allegiance to advertisers, because they’re not in the habit of noticing when products they use could be better. I only started paying attention to this recently, because I started working on user experience at my job. But once I started looking for advertising-induced brokenness, it was everywhere.
Off the top of my head, here are a few examples that are obviously terrible for users but great for time-spent-on-site and great for advertisers. (My examples are from Facebook because it’s the ad-supported product I’ve used most recently. Other ones, except perhaps for Google search, seem equally bad but are less fresh in my mind.)
The news feed somehow fails to filter out random photos from people I friended four years ago and have never interacted with since.
It even fails to filter out text-only posts in languages I don’t understand (this was true before they had inline translations too).
The “see less of this type of post” news feed option simply doesn’t work—you can ask to see less of random photos as many times as you like with no results.
The news feed is often randomly reordered if you refresh, so that you lose your place and can’t tell when you’ve scrolled down far enough that you won’t see anything new anymore.
Despite knowing exactly where I am at all times, Facebook still notifies me about parties that are happening 3,000 miles away.
They frequently add new notification types with aggressive defaults that can’t be globally adjusted. (The most recent offender was fundraisers.)
If you’re logged out and you visit facebook.com, it still displays your notification badge over your profile photo in the “recent logins” section. (Just to make sure you don’t miss any of those very important parties on the other coast!)
You might plead Hanlon’s Razor—that these decisions are incompetence, not malice, and Facebook just had some bad product managers. But you can see that’s not true by how Facebook behaves when its own users try to fix these problems themselves: it responds by banning them—and censoring links to discussion of the ban. The crap in your news feed is sacred crap, and if you question it you will be excommunicated.
OK, so what? Plenty of companies do things that aren’t in their customers’ best interests. Facebook’s Skinner box certainly isn’t comparable to the things, say, cigarette companies have done!
Except… is that actually true? Suppose that time spent on Facebook is, on average, wasted, as if that time just disappeared. (Obviously, some time on Facebook isn’t wasted—say, if you find an interesting article or learn that one of your friends just got engaged—but some of it is also worse than wasted, say if you get sucked into an argument with a troll that just makes you angry.) The average Facebook user spends 50 minutes a day on Facebook properties—multiply by 2 billion active users for a total of 100 billion minutes lost per day.
On the other hand, the world smokes 16 billion cigarettes per day; each one shortens the lifespan by 11 minutes for a total of 176 billion minutes lost. So on the back of the envelope, Facebook could be on the same order of badness as the global cigarette industry.
Of course, the back of the envelope comparison is obviously hyperbolic. In particular, Facebook time is probably somewhat valuable on net. (Then again, cigarettes aren’t pure negative either!)
How valuable? It’s hard to say. If people are voluntarily doing something, we should generally presume that they value it. But my point is that Facebook is sufficiently coercive and manipulative that they don’t deserve (as much of) that presumption. At least some of Facebook’s users came for the event-invite monopoly and stayed for the dark patterns. Those users would be better off if Facebook didn’t exist.
How many of those users are there? I have no idea, but probably a lot more than have been materially harmed by Facebook’s cavalier treatment of data privacy. Don’t get me wrong, it’s great that people are finally starting to worry about privacy. But we should focus our spleen where the actual harm is: in ad funding that incentivizes addictiveness and user-hostile design.
Did you know you can block these notices with uBlock Origin? I learned this while writing this and it made me a lot happier! Now if only I could block them on mobile, where they take up half my screen… ↩︎
Sure, it could happen, but it’s not high on my list of “things worth launching awareness campaigns over.” ↩︎
Comments
Nitpick on one example: A lot of people use facebook to stay in touch with those people we friended 4 years ago - in fact I only reluctantly joined facebook after many of my friends who used it brought up this use case, and I don’t often even consider that people would use on purpose it for much else besides events - so that example stands out to me as a demonstration that facebook has many different use cases and kinds of users and it has failed to meet every single person’s needs or be sufficiently configurable or something, rather than an “obviously terrible” in itself.
(I’ve actually considered building an interface that filters out newsfeed items for people I have recently had an interaction with, because my newsfeed was almost exclusively showing me content from people who I had had an interaction with recently, which is a waste of networking resources; but this would have been way too much work so I just unfollowed everyone instead.)
Agreed, monopoly + data extraction = (potentially) bad for consumers.
I guess the example I have in mind of this (I’m an economist) is a little more traditional. You go to your local supermarket, and you notice your total is super high - $100, say, but it used to be $50. The cashier says, “we’ve instituted a new rule - show us your tax return for fabulous savings!” – and so they refund you somewhere from $20 to $70, depending on your income. Why? Well they’re trying to charge you what you’re willing to pay, of course! Notice that customers on the whole might be better off if the government banned supermarkets from doing this, or if all the customers just took the change really badly and refused to participate.
To me, this is basically what data-harvesting (via customer rewards programs, etc.) lets companies do – and why we should be worried about it (not, as you say, for abstract privacy reasons). Companies will take your data, and figure out how much you’d be willing to pay. And notice that you can’t just “opt out”! If everyone else is showing the cashier their tax statement, what choice do you have? Pay $100? So the concern with data harvesting in this setting is something like: prices go way up, and then companies issue a bunch of personalized coupons or whatever to people who willfully give up their data.
This story also offers a solution to a privacy “puzzle” I’ve seen discussed elsewhere: why do people claim to care about privacy “so much,” but then sell it for “so cheap” (for example, participating in customer rewards programs for miniscule savings). Well, if companies are going to implement price discrimination by raising prices and then doling out personalized discounts, my problem isn’t really that they have data on me, my problem is that they have data on everyone. In the supermarket example, it’s not a contradiction to say “privacy is valuable” (i.e., I would really like it if stores couldn’t charge prices based on peoples’ tax brackets), but also “my personal privacy isn’t that valuable” (I’m willing to disclose my info to the store once the program’s going, and I’d be willing to sell it to them for $5 beforehand, cause them getting that info isn’t going to make or break the whole scheme).
Huh, interesting! It’s an attractive theory but I think it’s weak as an explanation for the puzzle you cited.
If people cared about privacy for price discrimination reasons, I’d expect to see relatively widespread complaints about data harvesting enabling price discrimination, and I don’t. Compare this to e.g. college tuition, where you can find more people complaining about price discrimination, and almost no one frames it as a privacy complaint. Do you have any examples of people worrying about price discrimination?
Also, I’m actually arguing that the data extraction isn’t really that important relative to the monopoly part (hence “the real problem isn’t privacy”). I’d guess the current magnitude of price discrimination problems is small enough that this is still true, though I’d be interested in citations/estimates, and it’s certainly true that if it became pervasive it could be worse.
Haha yes this is a bit of a “people know what’s good for them but haven’t been able to put words to it” theory (which I don’t blame you for finding suspicious). I don’t really think that price discrimination per se is something people are generally thinking about, just more “some pernicious thing companies can do once they have a bunch of data” (which, I claim, price discrimination is an example of, although most people may not have this specific example in mind).
I do think that if you asked people “is it a big problem for me if companies have access to everyone’s data” vs “is it a big problem for me if companies have access to my data,” people would on average have the intuition that the first one is scarier - which is enough to explain the puzzle without reference to price discrimination. (Price discrimination just says, “here’s a way people’s intuitive responses were kind of right.”)
I share your intuition on that specific phrasing, but I think that’s obvious because “companies have access to everyone’s data” is a superset of “companies have access to my data.” Here are my intuitions about some related questions:
“Is it worse for me if a company has my data, or if they have everyone else’s data but not mine?” Worse for me if they have my data.
“How bad is it for me if companies have access to everyone else’s data, but not mine?” Not very bad.
In other words, I still think the “zeitgeist” is that people are worried about their own data, and I don’t think your thought experiment is much evidence to the contrary.