Web Policy

Critics of consumer privacy protections frequently invoke revealed preference as a justification for laissez-faire policy. If users really cared about their privacy, the argument goes, we should expect to see revolts against intrusive practices. A number of scholars have demonstrated pervasive information asymmetries¹ and bounded rationality² in consumer privacy choices; the decisions that users actually make about online privacy can hardly be expected to reflect their actual preferences.

But let’s suppose that consumers and online firms are fully informed and completely rational. The economic story that consumers value their privacy less than the marginal income from privacy intrusions is certainly consistent with market behavior.

We should not, however, conclude that the status quo is optimal. There is another congruent economic story, where privacy intrusions are inefficient but nevertheless result owing to transaction costs and competition barriers. This post relates the alternative economic story with two possible examples, then closes with policy implications.

Facebook and Instagram

Consider the recent kerfuffle over Instagram’s user agreement after Facebook acquired the company. An avid Instagram user may have significant concerns about how Facebook might use his or her likeness in advertising products to friends, and the value of those concerns to the user could well exceed the marginal value of new social advertising features to Facebook. The efficient (i.e. welfare-maximizing) outcome would be for Facebook to maintain the preexisting Instagram user agreement.

In a conventional Coasean analysis, Facebook would choose to respect user privacy and extract the welfare gain by charging for its service. From a traditional competition standpoint, if Facebook were to make an inefficient decision to invade consumer privacy, a pro-privacy competitor would spring up and pilfer the site’s users. But what if there are significant transaction costs and competition barriers?³ If Facebook cannot realistically charge its users,⁴ and competition is limited,⁵ then Facebook’s income-maximizing choice is to inefficiently invade consumer privacy. So long as users value social networking on Facebook more than the associated privacy risks, they will continue using the service.

Behavioral Advertising

Behavioral advertising is another possible example. Users may value privacy in their online activities more than the marginal value of tracking-based advertising.⁶ In the absence of transaction costs, online services might do away with behavioral advertising and charge consumers for the content that they access. If there were no competition barriers, services that rely on behavioral advertising might be forced under by free, pro-privacy competitors. Depending on the sector of the online economy, however, a service may have significant transaction costs and competition barriers. The alternative economic story has a measure of predictive power: In some markets with high transaction costs and high barriers to competition (e.g. web search), behavioral advertising is an ordinary practice. Meanwhile, in some markets with low transaction costs and low barriers to competition (e.g. paid mobile apps), behavioral advertising is a rarity.

Policy Implications

If consumer privacy practices are inefficient, then privacy protections could be viewed as mechanisms for correcting structural market failures. Contemporary economic analysis has several lenses to offer:

• Internalizing externalities. Online services visit negative privacy externalities upon users; privacy protections compel a service to internalize those externalities.
• Solving a collective action problem. If users could collectively negotiate, they would require online services to adopt pro-privacy practices. Users cannot, of course, realistically organize and bind themselves for bargaining at the scale of a mammoth online service. Privacy regulation solves this collective action problem.
• Simulating competition. Without competition barriers, online services would be compelled to adopt better privacy practices. Privacy protections stand in for absent effects of competition.
• Eliminating an inefficient and unnecessary subsidy. Privacy regulations nix an unjustified payout to online services.

Consumer privacy decision making might also be properly characterized by two choice architecture frames. In the stronger frame, the user is coerced: against a background of society where certain online services are a norm or requirement, the user has no real choice but to give up his or her privacy.⁷ In the weaker frame, the user is exploited: the user has no baseline statistical expectation or moral claim of using an online service, but the value substantially exceeds the privacy risks, and the service would willingly provide functionality without privacy intrusions. If these views are accurate, privacy regulation would constitute a legitimate prohibition against consumer coercion or exploitation.

Parting Thoughts

Privacy reform proponents are quick to cite information asymmetry and bounded rationality as justifications for policy intervention. And they should: the body of research evidence supporting those views is substantial. My aim with this piece is to demonstrate the availability of a second set of arguments, grounded in conventional economics of transaction costs and competition barriers, that would also justify privacy regulation.

If users care about their privacy, why don’t they act like it? Actually, it’s quite possible that they do.

Thanks to Ed Felten and Arvind Narayanan for comments on an early draft. All views and errors are solely my own.

1. For background on information asymmetry in consumer privacy choice, I recommend beginning with work by Lorrie Cranor and Aleecia McDonald.

2. I similarly recommend research by Alessandro Acquisti and Jens Grossklags for an introduction to bounded rationality in consumer privacy choice.

3. A more formal treatment of the two economic stories follows. Assume a user values an online service at S > 0 and his or her marginal privacy on that service at P > 0. An online service marginally values the privacy intrusion at I > 0 and has a baseline income from providing functionality of B. In the oft-invoked revealed preference story, I > P, and privacy regulation imposes a societal loss of I – P. In this alternative economic story, P > I, and lack of privacy regulation imposes a societal loss of P – I. Where there are transaction costs, a transfer is not possible; the only outcomes are (S + P, B) and (S, B + I). In the absence of competition, the service will select an outcome based solely on income maximization. A combination of transaction costs and competition barriers, then, will cause an online service to always invade privacy when I is positive—no matter the relative magnitude of P.

A brief side note: there are three other analytical scenarios worth mentioning.

• No transaction costs, no competition barriers. The user would transfer to the service between S + P (the user’s reservation price) and -B (the service’s reservation price). Owing to competitive pressure, the transfer should be closer to -B.
• No transaction costs, competition barriers. The user would transfer to the service between S + P (the user’s reservation price) and -B (the service’s reservation price). Since there is no competition, the transfer should be closer to S + P.
• Transaction costs, no competition barriers. We would expect an equilibrium respecting privacy where B > 0, and intruding upon privacy where 0 > B. Intuitively, if a pro-privacy competitor would be profitable, it would emerge and undercut the service.

4. There are a number of reasons why Facebook cannot, in practice, charge for its service. A few of the leading considerations:

• Network effects. A social network’s value is bound up in the size and engagement of its user base. While some users might pay for privacy, others would not or could not. If Facebook is unable to differentiate between the users it can and cannot charge, then it has to give away the service for free to preserve the value of the social network.
• Past promises. Facebook has frequently reaffirmed that its service will always be free. The current landing page, in fact, reads: “It’s free and always will be.” Violating past promises of free service could have significant legal and business implications.
• Transaction burdens. Beyond the immediate financial costs, consumers must also incur financial management costs associated with keeping up with a monthly service. From Facebook’s perspective, the firm would have to divert precious attention and resources to developing an unprecedented subscription billing capacity.

The consumer psychology of free vs. paid products is, to be sure, a dominant factor. For purposes of this post, however, set aside the bounded rationality limitation.

5. Many authors and investors have argued that Facebook holds something of a monopoly in social networking.

6. For a discussion of the economics of third-party behavioral advertising, see Part VI of “Third-Party Web Tracking: Policy and Technology.”

7. The notion of moral rights in online services is hotly contested. I do not mean to take a position on the issue here.