Executive Summary

Tech companies have built businesses around offering users “free” services in exchange for collecting extensive user data that they then monetize, primarily through behavioral advertising. Users do not pay a monetary fee for using these services, but this expansive data collection comes with privacy intrusions. This business model may increase efficiency and profit, but the perils of behavioral advertising are obvious and commonplace: Users are paying with their privacy.

Federal privacy legislation could disrupt these privacy-intrusive business models and incentivize companies to come up with new models that protect and respect users’ privacy. Efforts to pass this type of legislation began in the wake of several privacy scandals, as policymakers realized how individuals can be harmed by behavioral advertising and other problematic data practices. As the ongoing debate highlights, legislation could effectively outlaw certain revenue sources by banning online behavioral advertising or precluding companies from charging users for exercising their right to privacy.

Behavioral advertising is one of the most dominant online business models, and it has enabled a new mode of online marketing that capitalizes on data to target ads toward users in unprecedented ways. While the behavioral advertising business model provides some benefits, it also encourages extensive and intrusive data collection that threatens privacy.

Although consumers do not pay any monetary fees, ad-supported products and services are not free. Behaviorally targeted advertising relies on non-consensual data collection at a massive scale, which requires users to pay with their privacy. Individuals face further harm from potential data breaches, unanticipated secondary uses of their data, and an increase in behaviorally targeted advertising that users find “creepy” and “annoying.”

For many years, online businesses have largely operated under the assumption that the behavioral advertising business model is superior to the contextual advertising business model, but this belief is not necessarily true. Privacy-protective online business models exist, allowing companies to make a profit without monetizing user data to sell targeted ads. Contextual advertising business models—in which ads are served solely based on a website’s content rather than detailed behavioral profiles of individual users—are profitable. Further, if legislation were to curtail behavioral advertising, it could spur the development of privacy-protecting business models, including those based on contextual advertising.

On the other hand, privacy legislation with laborious compliance requirements could hurt online businesses that lack relevant expertise and adequate resources. This consideration is not to suggest, however, that small businesses should be exempt from privacy protections—small businesses can intrude on privacy just as much as large companies can. The key variable is not the size of the business, but the amount of personal data the business collects and how it uses that data.

Further, legislation can prevent companies from charging users a higher price to protect their privacy, which is not strictly a good or bad policy. Privacy should not be a luxury good, but prohibiting companies from charging a subscription fee when a user opts out of behavioral advertising could theoretically hinder a company’s viability. Additionally, any legislation with pay-for-privacy protections will have to address enforcement issues, particularly those presented by the existing language in the California Consumer Protection Act.

The issues discussed in this report do not have clear answers, but are important for Congress to consider as it debates comprehensive privacy legislation.