It Is Unclear Whether Preventing Online Companies from Charging a Higher Price to Protect Privacy Is Beneficial Overall

Preventing companies from charging users a higher price to protect their privacy is not clearly a good or bad policy. As a general matter, privacy should not be a luxury good; people should be able to protect their privacy regardless of their income level. And some pay-for-privacy regimes effectively coerce users—especially low-income consumers—into giving up their privacy if the discount is so disproportionate that users essentially have no choice. For example, AT&T at one point offered broadband customers an option to participate in an “Internet Preferences” program that would have tracked their online activity, and provided them the lowest available rate if they had enrolled.¹ Alternatively, customers could have elected to pay an additional $29 per month for standalone broadband access that did not track their online activity.² As Duarte pointed out, pay-for-privacy models can be coercive to users “who may not feel like they can make the tradeoff in cost, and pay a higher price or forgo a discount.”³

People should be able to protect their privacy regardless of their income level.

However, prohibiting companies from charging a subscription fee when a user opts out of behavioral tracking could hurt a company’s viability. If a user decides to opt out of being tracked, the company would not generate behaviorally targeted ad revenue from that user. If the company cannot charge a subscription fee to make up for that lack of revenue, then it is effectively forced to provide a truly free service. If enough users opt out of being tracked, and the company could not charge fees, the business may not succeed for lack of revenue. While users may not be concerned about this threat for big tech companies and social media giants, prohibiting both tracking and subscription fees could threaten news organizations that rely on behavioral advertising and third-party tracking.⁴

Even if legislation includes a ban on pay-for-privacy regimes, it might be difficult to enforce. The California Consumer Protection Act (CCPA), for instance, includes a provision precluding pay-for-privacy regimes, but with certain exceptions. The CCPA allows companies to charge consumers different prices or offer different levels of service if the difference is “reasonably related to the value provided to the consumer by the consumer’s data.”⁵ The CCPA also allows companies to offer financial incentives—including compensation to consumers for collecting, selling, or deleting their personal information—under a notice-and-consent approach if the programs are not “unjust, unreasonable, coercive, or usurious in nature.”⁶ However, as Tien pointed out,

we don’t have any good metrics for [those standards] right now, and there isn’t even a good theoretical metric for how you do that. In many of these areas, we’re watching innovations in the law that are going to be followed by innovations in enforcement and compliance, where folks like the California [Attorney General] are going to have to figure out how they are going to exercise their enforcement discretion and compliance in terms of judging something as coercive or not.⁷

In the near future, the California Attorney General will have to determine how to enforce this provision, and other privacy enforcers should pay attention.