�鶹������ý

Though the behavioral advertising business model may provide some benefits to consumers, it is a myth that the ad-supported products and services are entirely “free”—users pay by giving up their privacy and submitting themselves to potential privacy harm. As Maréchal said, “The cornerstone of this business model is non-consensual data collection at a massive scale. That, in and of itself, is a privacy violation, and it’s really a testament to how embedded these business models are into our society, and how readily we’ve accepted Silicon Valley’s narrative that many people don’t see that as a harm.”¹ And as Rejouis pointed out, “the exchange isn’t mutual. [Companies are using] algorithms [to collect] data in undetected ways,” using proxies to infer information about users that they do not directly provide companies.² Gray added that the large tech companies

need that data more for their current business models than they need to show you the ad. Because … [that] data is then used to maybe not show you an ad, but to show so many millions of other people an ad, and every pipeline they can get to feed into the big data machine that helps them determine what is going to be the most manipulative content to show you so that you click on the ad.³

Thus, the true price of these services is exposure to increased privacy risks.

The behavioral advertising business model contributes to a number of additional harms. First, any collected data is vulnerable to breaches if the company stores it, and as mentioned above, companies often collect a lot of data even when it is not necessary. One Gartner executive disclosed that over 70 percent of data collected and retained by companies remains “dark,” or unused, but nonetheless is kept for the possibility that they might eventually be able to monetize it.⁴ The data that companies collect can be stolen, and these breaches can lead to significant consumer harms, particularly if the data is financial or health related.⁵

Second, the non-consensual, secondary use of data for purposes beyond those for which it was collected can harm users. While OTI’s prior panel on civil rights and privacy addressed secondary use of data with regard to discrimination,⁶ it remains an issue in other areas as well, including when companies sell data to data brokers, which then sell it to other organizations that use that data to inform decisions about employment or credit. For instance, in Spokeo, Inc. v. Robins, plaintiff Thomas Robins argued that his employment prospects had been harmed by data broker Spokeo’s listing of factually inaccurate information. Spokeo’s database misrepresented Robins by stating that he “was in his 50s, … married, … employed in a professional or technical field, and … has children” and “that he has a graduate degree, that his economic health is ‘Very Strong[,]’ and that his wealth level [is in] the ‘Top 10%.’”⁷ This inaccurate data made Robins seem “overqualified for jobs he might have gained, expectant of a higher salary than employers would be willing to pay, and less mobile because of family responsibilities.”⁸ Any potential employer consulting the Spokeo database on Robins would have had incorrect information about him, which could have led the potential employer to unfairly reject his application. Thus, by encouraging vast data collection (whether accurate or not), the behavioral advertising business model creates further risks of unanticipated and potentially harmful secondary uses.

Third, even the appearance of companies tracking and following users around the internet can be viewed as harmful. In fact, “[a] wide variety of studies show that people find online ads intrusive, [and] annoying. … These unsolicited, even somewhat aggressive (and occasionally offensive) ads are unwanted interruptions.”⁹ Other surveys have shown that people find behavioral advertising “too aggressive” and “creepy.”¹⁰ Consumers may even be more likely to engage with ads if the advertiser is not using “creepy” tactics.¹¹ These descriptors show that users experience a privacy harm even if they cannot identify it with precision. Much like in the physical world, consumers want and expect a certain amount of privacy, yet behavioral advertising violates those expectations.