Prompt: “a field of many different kinds of people being harvested by machines and turned into bales of fertilizer.” Via Microsoft CoPilot | Designer.
This post is for the benefit of anyone wondering about, researching, or going into business on the proposition that selling one’s own personal data is a good idea. Here are some of my learnings from having studied this proposition myself for the last twenty years or more.
The business category harvesting the most personal data is adtech (aka ad tech and “programmatic”) advertising, which is the surveillance-based side of the advertising business. It is at the heart of what Shoshana Zuboff calls surveillance capitalism, and is now most of what advertising has become online. It’s roughly a trillion-dollar business. It is also nothing like advertising of the Mad Men kind. (Credit where due: old-fashioned advertising, aimed at whole populations, gave us nearly all the brand names known to the world). As I put it in Separating Advertising’s Wheat and Chaff, Madison Avenue fell asleep, direct response marketing ate its brain, and it woke up as an alien replica of itself.
Adtech pays nothing to people for their data or data about them. Not personally. Google may pay carriers for traffic data harvested from phones, and corporate customers of auctioned personal data may pay publishers for moments in which ads can be placed in front of tracked individuals’ ears or eyeballs. Still, none of that money has ever gone to individuals for any reason, including compensation for the insults and inconveniences the system requires. So there is little if any existing infrastructure on which paying people for personal data can be scaffolded up. Nor are there any policy motivations. In fact,
Regulations have done nothing to slow down the juggernaut of growth in the adtech industry. For Google, Facebook, and other adtech giants, paying huge fines for violations (of the GDPR, the CCPA, the DMA, or whatever) is just the cost of doing business. The GDPR compliance services business is also in the multi-$billion range, and growing fast. In fact,
Regulations have made the experience of using the Web worse for everyone. Thank the GDPR for all the consent notices subtracting value from every website you visit while adding cognitive overhead and other costs to site visitors and operators. In nearly every case, these notices are ways for site operators to obey the letter of the GDPR while violating its spirit. And, although all these agreements are contracts, you have no record of what you’ve agreed to. So they are worse than worthless.
Tracking people without their clear and conscious invitation or a court order is wrong on its face. Period. Full stop. That tracking is The Way Things Are Done online does not make it right, any more than driving drunk or smoking in crowded elevators was just fine in the 1950s. When the Digital Age matures, decades from now, we will look back on our current time as one thick with extreme moral compromises that were finally corrected after the downsides became clear and more ethically sound technologies and economies came along. One of those corrections will be increasing personal agency rather than just corporate capacities. In fact,
Increasing personal independence and agency will be good for markets, becausefree customers are more valuable than captive ones. Having ways to gather, keep, and make use of personal data is an essential first step toward that goal. We have made very little progress in that direction so far. (Yes, there are lots of good projects listed here, but there we still a long way to go.)
Businesses being “user-centric” will do nothing to increase customers’ value to themselves and the marketplace. First, as long as we remain mere “users” of others’ systems, we will be in a subordinate and dependent role. While there are lots of things we can do in that role, we will be able to do far more if we are free and independent agents. Because of that,
We need technologies that create and increase personal independence and agency. Personal data stores (aka warehouses, vaults, clouds, life management platforms, lockers, and pods) are one step toward doing that. Many have been around for a long time: ProjectVRM currently lists thirty-three under the Personal Data Stores heading. Some have been there a long time. The problem with all of them is that they are still too focused on what people do as social beings in the Web 2.0 world, rather than on what they can do for themselves, both to become more well-adjusted human beings and more valuable customers in the marketplace. For that,
It will help to have independent personal AIs. These are AI systems that work for us, exclusively. None exist yet. When they do, they will help us manage the personal data that fully matters:
Contacts—records and relationships
Calendars—where we’ve been, what we’ve done, with whom, where, and when
Health records and relationships with providers, going back all the way
Financial records and relationships, including past and present obligations
Property we have and where it is, including all the small stuff
Shopping—what we’ve bought, plan to buy, or might be thinking about,
Subscriptions—what we’re paying for, when they end or renew, what kind of deal we’re locked into, and what better ones might be out there.
Travel—Where we’ve been, what we’ve done, with whom, and when
Personal AIs are today where personal computers were fifty years ago. Nearly all the AI news today is about modern mainframe businesses: giants with massive data centers churning away on ingested data of all kinds. But some of these models are open sourced and can be made available to any of us for our own purposes, such as dealing with the abundance of data in our own lives that is mostly out of control. Some of it has never been digitized. With AI help it could be.
I’m in a time crunch right now. So, if you’re with me this far, read We can do better than selling our data, which I wrote in 2018 and remains as valid as ever. Or dig The Intention Economy: When Customers Take Charge (Harvard Business Review Press, 2012), which Tim Berners Lee says inspired Solid. I’m thinking about following it up. If you’re interested in seeing that happen, let me know.
Prompt: “A panopticon in which thousands of companies are spying on one woman alone in the center with nothing around her.” Via Microsoft Bing Image Creator
In her latestArs Technica story, Ashley Belanger reports that Patreon, the widely used and much-trusted monetization platform for creative folk, opposes the minimal personal privacy protections provided by a law you probably haven’t heard of until now: the Video Privacy Protection Act, or VPPA. Patreon, she writes, wants a judge to declare that law (which dates from the videotape rental age) unconstitutional because it inconveniences Patreon’s ability to share the personal data of its users with other parties.† Naturally, the EFF, the Center for Democracy & Technology, the ACLU of Northern California, and the ACLU itself all stand opposed to Patreon on this and have filed an amicus brief explaining why.
But I’m not here to talk about that. I’m here to bring up the inconvenient fact that Ars Technica is also in the surveillance business. A PageXray of Ashley’s story finds this—
But will Ashley, or any reporter, grab the third rail of their employer’s participation in the tracking-based advertising business? Or visit that business’s responsibility for what was already the biggest boycott in human history way back in 2015? The odds are against it. I’ve challenged many reporters to grab that third rail, just like I’m challenging Ashley here. In every case, nothing happened.
I never challenged Farhad Manjoo, but he did come through exposingThe New York Times (his employer’s) own participation in the privacy-opposed tracking-based adtech business, back in 2019. Here’s a PageXray of tracking via that piece today:
If you think regulations are going to protect your privacy, you’re wrong. In fact, they can make things worse, especially if they start with the assumption that your privacy is provided only by other parties, most of whom are incentivized to violate it.
Exhibit A for how much worse things can get is the EU’s GDPR (General Data Protection Regulation). As soon as the GDPR went into full effect in May 2018, damn near every corporate entity on the Web put up a “cookie notice” requiring acceptance of terms and privacy policies that allow them to continue violating your privacy by harvesting, sharing, auctioning off and otherwise using your data, and data about you.
For websites and services in that harvesting business (a population that rounds to the whole commercial web), these notices provide a one-click way to adhere to the letter of the GDPR while violating its spirit.
There’s also big business in the friction that it produces. To see how big, look up GDPR+compliance on Google. You’ll get 232 million results (give or take a few dozen million).
None of those results are for you, even though you are who the GDPR is supposed to protect. See, to the GDPR, you are a mere “data subject” and not an independent and fully functional participant in the technical, social, and economic ecosystem the Internet supports by design. All privacy protections around your data are the burden of other parties.
Or at least that’s the interpretation that nearly every lawmaker, regulatory bureaucrat, lawyer, and service provider goes by. (One exception is Elizabeth Renieris@hackylawyer. Her collection of postings is required reading on the GDPR and much else.) The same goes for those selling GDPR compliance services, comprising most of those 190 million GDPR+compliance search results.
The clients of those services include nearly every website and service on Earth that harvests personal data. These entities have no economic incentive to stop harvesting, sharing, and selling personal data the usual ways, beyond fear that the GDPR might actually be enforced, which so far (with fewexceptions), it hasn’t been. (See Without enforcement, the GDPR is a fail.)
Worse, the tools for “managing” your exposure to data harvesters are provided entirely by the websites you visit and the services you engage. The “choices” they provide (if they provide any at all) are between 1) acquiescence to them doing what they please and 2) a maze of menus full of checkboxes and toggle switches “controlling” your exposure to unknown threats from parties you’ve never heard of, with no way to record your choices or monitor effects.
So let’s explore just one site’s presentation, and then get down to what it means and why it matters.
Our example is https://www.mirror.co.uk. If you haven’t clicked on that site already, you’ll see a cookie notice that says,
We use cookies to help our site work, to understand how it is used, and to tailor the adverts presented on our site. By clicking “Accept” below, you agree to us doing so. You can read more in our cookie notice. Or, if you do not agree, you can click Manage below to access other choices.
They don’t mention that “tailor the adverts” really means something like this:
We open your browser to infestation by tracking beacons from countless parties in the online advertising business, plus who-knows-what-else that might be working with those parties (there is no way to tell, and if there was we wouldn’t provide it), so those parties and their “partners” can use those beacons to follow you like a marked animal everywhere you go and report your activities back to a vast marketplace where personal data about you is shared, bought and sold, much of it in real time, supposedly so your eyeballs can be hit with “relevant” or “interest-based” advertising as you travel from site to site and service to service. While we are sure there are bad collateral effects (fraud and malware, for example), we don’t care about those because it’s our business to get paid just for clicks or “impressions,” whether you’re impressed or not—and the odds that you won’t be impressed average to certain.
Okay, so now click on the “Manage” button.
Up will pop a rectangle where it says “Here you can control cookies, including those for advertising, using the buttons below. Even if you turn off the advertising-related cookies, you will still see adverts on our site, because they help us to fund it. However, those adverts will simply be less relevant to you. You can learn more about cookies in our Cookie Notice on the site.”
Under that text, in the left column, are six “Purposes of data collection”, all defaulted with little check marks to ON (though only five of them show, giving the impression that there are only those five). The right column is called “Our partners”, and it shows the first five of what turn out to be 259 companies, nearly all of which are not brands known to the world or to anybody outside the business (and probably not known widely within the business as well). All are marked ON by that little check mark. Here’s that list, just through the letter A:
If you bother to “manage” any of this, what record do you have of it—or of all the other collections of third parties who you’ve agreed to follow you around? Remember, there are a different collection of these at every website with third parties that track you, and different UIs, each provided by other third parties.
It might be easier to discover and manage parasites in your belly than cookies in your browser.
Think I exaggerate? The long list of cookies in just one of my browsers (which I had to dig deep to find) starts with this list:
I know what zoom.us is. The rest are a mystery to me.
To look at just that first one, 1rx.io, I have to dig way down in the basement of the preferences directory (in Chrome it’s chrome://settings/cookies/detail?site=1rx.io), where I find that its locally stored data is this:
_rxuuid
Name
_rxuuid
Content
%7B%22rx_uuid%22%3A%22RX-2b58f1b1-96a4-4e1d-9de8-3cb1ca4175b0%22%2C%22nxtrdr%22%3Afalse%7D
Domain
.1rx.io
Path
/
Send for
Any kind of connection
Accessible to script
No (HttpOnly)
Created
Wednesday, December 12, 2018 at 4:48:53 AM
Expires
Thursday, December 12, 2019 at 4:48:53 AM
I’m a somewhat technical guy, and at least half of that stuff means nothing to me.
As for “managing” those, my only choice on that page is to “Remove All”. Does that mean Remove everything on that page alone or Remove all cookies everywhere? And how can I remember what I’ve had removed?
Obviously, there is no way for anybody to “manage” this, in any meaningful sense of the word.
We also can’t fix it on the sites and services side, no matter how much those sites and services care (which most don’t) about the “customer journey”, the “customer experience” or any of the other bullshit they’re buying from marketers this week.
Even within the CRM (customer relationship management) world, the B2B customers of CRM companies use one cloud and one set of tools to create as many different “experiences” for users and customers as there are companies deploying those tools to manage customer relationships from their side. There are no corresponding tools on our side. (Though there is work going on. See here.)
So the digital world remains one where we have no common or standard way to scale our privacy and data usage tools, choices, or experiences across all sites and services. And that’s what we’ll need if we want real privacy online.
The simple place where we need to start is this: privacy is personal, meaning something we create for ourselves (which in the natural world we do with clothing and shelter, both of which lack equivalents in the digital world).
And we need to be clear that privacy is not a grace of privacy policies and terms of service that differ with every company and over which none of us have true control—especially when there is an entire industry devoted to making those companies untrustworthy, even if they are in full compliance with privacy laws.
Devon Loffreto (who coined the term self-sovereign identity and whose good work we’ll be visiting in an upcoming issue of Linux Journal) puts the issue in simple geek terms: we need root authority over our lives. Hashtag: #OwnRoot.
It is only by owning root that we can crank up agency on the individual’s side. We have a perfect base for that in the standards and protocols that gave us the Internet, the Web, email, and too little else. And we need it here too. Soon.
We (a few colleagues and I) created Customer Commons as a place for terms that individuals can proffer as first parties, just by pointing at them, much as licenses at Creative Commons can be pointed at. Sites and services can agree to those terms, and both can keep records and follow audit trails.
And there are some good signs that this will happen. For example, the IEEE approached Customer Commons last year with the suggestion that we stand up a working group for machine-readable personal privacy terms. It’s called P7012. If you’d like to join, please do.
Unless we #OwnRoot for our own lives online, privacy will remain an empty promise by a legion of violators.
One more thing. We can put the GDPR to our use if we like. That’s because Article 4 of the GDPR defines a data controller as “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data…” This means each of us can be our own data controller. Most lawyers dealing with the GDPR don’t agree with that. They think the individual data subject will always need a fiduciary or an intermediary of some kind: an agent of the individual, but not an individual with agency. Yet the simple fact is that we should have root authority over our lives online, and that means we should have some degree of control over our data exposures, and how our data, and data about us, is used—much as we do over how we control or moderate our privacy in the physical world. More about all that in upcoming posts.
† This is an example of what Cory Doctorow calls “enshittification” and Wikipedia (at that link) more politely calls “platform decay.” It’s a big trade-away of goodwill by Patreon. Says to me they must be making an enshitload of money in the adtech fecosystem.
Society is comprised of individuals, thick with practices and customs that respect individual needs. Privacy is one of those. Only people who live naked outdoors without clothing and shelter can do without privacy. The rest of us all have ways of expressing and guarding spaces we call “private” — and that others respect as well.
Private spaces are virtual as well as physical. Society would not exist without well-established norms for expressing and respecting each other’s boundaries. “Good fences make good neighbors,” says Robert Frost.
One would hardly ask to justify the need for privacy before the Internet came along; but it is a question now because the virtual world, like nature in the physical one, doesn’t come with privacy. By nature, we are naked in both. The difference is that we’ve had many millennia to work out privacy in the physical world, and approximately two decades to do the same in the virtual one. That’s not enough time.
In the physical world, we get privacy from clothing and shelter, plus respect for each others’ boundaries, which are established by mutual understandings of what’s private and what’s not. All of these are both complex and subtle. Clothing, for example, customarily covers what we (in English vernacular at least) call our “privates,” but also allows us selectively to expose parts of our bodies, in various ways and degrees, depending on social setting, weather and other conditions. Privacy in our sheltered spaces is also modulated by windows, doors, shutters, locks, blinds, and curtains. How these signal intentions differ by culture and setting, but within each the signals are well understood, and boundaries are respected. Some of these are expressed in law as well as custom. In sum, they comprise civilized life.
Yet life online is not yet civilized. We still lack sufficient means for expressing and guarding private spaces, for putting up boundaries, for signaling intentions to each other, and for signaling back respect for those signals. In the absence of those we also lack sufficient custom and law. Worse, laws created in the physical world do not all comprehend a virtual one in which all of us, everywhere in the world, are by design zero distance apart — and at costs that yearn toward zero as well. This is still very new to human experience.
In the absence of restricting customs and laws it is easy for those with the power to penetrate our private spaces (such as our browsers and email clients) to do so. This is why our private spaces online today are infected with tracking files that report our activities back to others we have never met and don’t know. These practices would never be sanctioned in the physical world, but in the uncivilized virtual world they are easy to rationalize: Hey, it’s easy to do, everybody does it, it’s normative now, transparency is a Good Thing, it helps fund “free” sites and services, nobody is really harmed, and so on.
But it’s not okay. Just because something can be done doesn’t mean it should be done, or that it’s the right thing to do. Nor is it right because it is, for now, normative, or because everybody seems to put up with it. The only reason people continue to put up with it is because they have little choice — so far.
Study after study shows that people are highly concerned about their privacy online, and vexed by their limited ability to do anything about its absence. For example —
Pew reports that “93% of adults say that being in control of who can get information about them is important,” that “90% say that controlling what information is collected about them is important,” that 93% “also value having the ability to share confidential matters with another trusted person,” that “88% say it is important that they not have someone watch or listen to them without their permission,” and that 63% “feel it is important to be able to “go around in public without always being identified.”
Ipsos, on behalf of TRUSTe, reports that “92% of U.S. Internet users worry about their privacy online,” that “91% of U.S. Internet users say they avoid companies that do not protect their privacy,” “22% don’t trust anyone to protect their online privacy,” that “45% think online privacy is more important than national security,” that 91% “avoid doing business with companies who I do not believe protect my privacy online,” that “77% have moderated their online activity in the last year due to privacy concerns,” and that, in sum, “Consumers want transparency, notice and choice in exchange for trust.”
Customer Commons reports that “A large percentage of individuals employ artful dodges to avoid giving out requested personal information online when they believe at least some of that information is not required.” Specifically, “Only 8.45% of respondents reported that they always accurately disclose personal information that is requested of them. The remaining 91.55% reported that they are less than fully disclosing.”
The Annenberg School for Communications at the University of Pennsylvania reports that “a majority of Americans are resigned to giving up their data—and that is why many appear to be engaging in tradeoffs.” Specifically, “91% disagree (77% of them strongly) that ‘If companies give me a discount, it is a fair exchange for them to collect information about me without my knowing.'” And “71% disagree (53% of them strongly) that ‘It’s fair for an online or physical store to monitor what I’m doing online when I’m there, in exchange for letting me use the store’s wireless internet, or Wi-Fi, without charge.'”
There are both policy and market responses to these findings. On the policy side, Europe has laws protecting personal data that go back to the Data Protection Directive of 1995. Australia has similar laws going back to 1988. On the market side, Apple now has a strong pro-privacy stance, posted Privacy – Apple, taking the form of an open letter to the world from CEO Tim Cook. One excerpt:
“Our business model is very straightforward: We sell great products. We don’t build a profile based on your email content or web browsing habits to sell to advertisers. We don’t ‘monetize’ the information you store on your iPhone or in iCloud. And we don’t read your email or your messages to get information to market to you. Our software and services are designed to make our devices better. Plain and simple.”
But we also need tools that serve us as personally as do our own clothes. And we’ll get them. The collection of developers listed here by ProjectVRM are all working on tools that give individuals ways of operating privately in the networked world. The most successful of those today are the ad and tracking blockers listed under Privacy Protection. According to the latest PageFair/Adobe study, the population of persons blocking ads online passed 200 million in June of 2015, with a 42% annual increase in the U.S. and an 82% rate in the U.K. alone.
These tools create and guard private spaces in our online lives by giving us ways to set boundaries and exclude unwanted intrusions. These are primitive systems, so far, but they do work and are sure to evolve. As they do, expect the online world to become as civilized as the offline one — eventually.
