Shoppers’ vast giveaways of data help cheapen personal privacy

Shawn Buckles made headlines in 2014 when he put his personal data up for auction online, trying to make a point about the intrusion of Big Tech into private space.

All his medical records, his location history, his emails and his social media content. The tech news company that won the auction paid about $500 for it.

Looking back, Mr. Buckles said he went too cheap.

“I sold out for way too little,” he told The Washington Times. “Data is very valuable on its own, but it isn’t data we’re talking about here. We’re talking about the right to having a private life. In my opinion, that’s invaluable, or even sacred in a way.”

To Big Tech, however, he’s worth far less.

For $500, an advertiser could “buy” access to a bundle of potentially hundreds of people like Mr. Buckles.

Mr. Buckles’ experiment was symbolic but telling. He wanted to highlight how quickly consumers are to turn over their data to technology companies and show just how thoroughly it has become a commodity.

It’s a pertinent warning at the end of another holiday season: Shoppers have spent time online searching for the perfect gifts and in the process have shared even more details of their lives.

That doesn’t even cover the new gadgets under the tree, including a smartwatch that can monitor sleeping habits and a phone that knows when you are sleeping and when you are awake based on use patterns.

“Basically, every product we’re using creates a profile of every customer, of every user that’s interacting with an app or service,” said Paulius Jurcys, a data privacy lawyer in San Francisco and co-founder of Prifina, a data technology company.

Companies use the data to make sure their websites work properly for each user or to provide previously unimaginable services. Think of a modern mapping program that suggests the fastest way to work each morning, Mr. Jurcys says.

The companies also use the data to target people.

The story is now legendary: a major retailer tracking buying patterns, deciphering a woman’s pregnancy based on her purchases of soap, washcloths and calcium supplements, and starting to fill her mailbox with offers for baby supplies.

That can be helpful for those who don’t mind that sort of profiling, but it sends others recoiling.

“Data is very valuable on its own, but it isn’t data we’re talking about here. We’re talking about the right to having a private life,” Mr. Buckles told The Washington Times in an email.

Like Mr. Buckles, others have tried to put a price on that.

In a survey this year of more than 3,500 online shoppers, CouponBirds found they would sell their personal data for an average of $1,452.25. Tennessee residents placed the lowest value on their data, with an average price of $623.04. Those living in Colorado prized their data the most, with an average asking price of $2,820.67.

To companies, though, it’s worth a tiny fraction of that.

It depends on how worth is calculated, but studies put the value of a single user’s full profile on Facebook as low as $2.

A 2020 study by MacKeeper took a different approach by trying to calculate whose data was most valuable.

It said men’s data is worth slightly more than women’s, ages 18-24 are most valued, and Middle Eastern users are the most expensive racial or ethnic classification.

The data of a Middle Eastern man in the 18-24 age range living in the Northeast with a household income of $120,000 to $150,000 would be worth $1.80. A Hispanic woman age 18-24 living in the West with a household income of more than $150,000 was valued at $1. A White man older than 55 living in the South with a household income of $30,000 to $40,000 was worth 60 cents.

It’s not just the big companies that collect the data.

On Dark Web, scammers can buy profiles for nefarious purposes. According to Privacy Affairs, a Walmart account with a credit card attached can be bought for an average of $10. That’s down $4 from 2021.

A cloned American Express with a PIN costs $25, down $10 from a year ago, and details of a credit card account with a balance of up to $1,000 can be bought for an average of $80, almost $50 less than last year.

Privacy Affairs said the price drops reflect a “robust supply.”

“Your data is valuable to cybercrooks, and it doesn’t cost much to steal your identity or otherwise exploit you,” the company said. “The sheer quantity of data available for purchase has created a bulk sales mentality for Dark Web customers.”

The difference in valuation between how people view their data and how others view it is a classic behavioral economics problem known as the endowment effect. That’s where someone has something — say concert tickets — and is unwilling to part with them for less than $500. If looking to buy, that same person might be unwilling to pay more than, say, $100.

Possession makes people value an item more than the market says it is worth.

Mr. Jurcys said the endowment effect gap on personal data is one of the highest in the literature.

Yet it doesn’t capture the true conundrum of data at this point, where it is both deeply personal and highly transactional. Mr. Jurcys said it’s time to figure out how to accommodate both sides of that equation with an environment where people corral their data but allow it to be unlocked.

“Instead of me giving my data of my last night’s sleep to some third-party application, we can think of an environment where applications actually come to the users and run on the user side. We are changing the environment of me giving away my data to every service provider. We make every service provider come to the user,” he said.

That doesn’t mean dethroning Google, Apple, Facebook and Amazon, the big players in personal data. That’s probably impossible.

It does mean trying to figure out ways to let other companies that might have good ideas access data, too.

“We need to think how can other companies that do not have this opportunity to benefit from data that is generated in society — we need to think about empowering them to build something of value for society,” Mr. Jurcys said.

Governments have tried to enforce solutions.

The European Union has the General Data Protection Regulation, or GDPR, which is one reason for the proliferation of alerts asking about preferences for handling website cookies.

In the U.S. there’s the California Consumer Privacy Act, similar to GDPR, which says consumers have a right to know what data is being collected and stored and allows a right to expunge the data.

Mr. Buckles, the man who sold his data, said the regulations turn out to be more an inconvenience than a solution.

“They are difficult to enforce, and implementation is symbolic at best. When ordering online, I now have to fill out more personal details (i.e., phone number) than 10 years ago. It feels like an expensive gesture, and it annoys me,” he said in an email.

Besides, the rules do nothing to control what he sees as the bigger threat: the governments themselves.

Nearly a decade after his auction, Mr. Buckles wants people to realize what they are giving away.

“Well, the point of my auction was not to make money but to show the raging bidding that’s going on behind the curtain, in order to provoke an intuitive response about people’s self-worth,” he told The Times. “I’ve received many stunned reactions, so I must have succeeded. Since then, we haven’t changed course, but doubled down on opening up people’s private lives instead.”