Privacy or Profit - Why Not Both?

Transcript

Manoush Z.: Hey, it’s Manoush. And before we start this episode, I need to ask you for some feedback. The IRL team and I are wondering what specific issues, questions, or stories you have about privacy, security, and online life. Please find a link to a short survey on the podcast website. It’s in the show notes at irlpodcast.org. We don’t share any of your data with anyone else and your answers go directly to the humans who make IRL. Irlpodcast.org, find the survey, talk to us about all things IRL. Okay, thank you.

Lately, the big tech companies have been talking a big game about their commitment to privacy.

Mark Zuckerberg: Privacy gives us the freedom to be ourselves.

Manoush Z.: This is Facebook CEO, Mark Zuckerberg. He’s speaking in a developers conference this spring.

Mark Zuckerberg: As the world gets bigger and more connected, we need that sense of intimacy more than ever. That’s why I believe that the future is private.

Manoush Z.: Did you catch that? The world’s largest social media company is going private or so says it’s boss.

Mark Zuckerberg: Now, look, I get that a lot of people aren’t sure that we’re serious about this. I know that we don’t exactly have the strongest reputation on privacy right now to put it lightly.

Manoush Z.: Yeah. Facebook has been called out again and again for breaching the privacy of its users. So yes, he’s putting it lightly.

Mark Zuckerberg: But I’m committed to doing this well and to starting a new chapter for our products.

Manoush Z.: Not to be outdone, Google CEO, Sundar Pichai made clear this spring that they too are on board the privacy train.

Sundar Pichai: We strongly believe that privacy and security are for everyone, not just a few. This is why powerful privacy features and controls have always been built into Google services. But we know our work on privacy and security is never done and we want to do more to stay ahead of constantly evolving user expectations.

Manoush Z.: Then there’s Apple CEO, Tim Cook. He’s speaking out against tech companies and their data practices. Here he is giving a commencement speech at Stanford University in June.

Tim Cook: If we accept as normal and unavoidable that everything in our lives can be aggregated, sold, or even leaked in the event of a hack, then we lose so much more than data. We lose the freedom to be human. We deserve better. You deserve better.

Manoush Z.: It’s true. We do deserve better and we’re insisting we have rights to privacy and rights to understand how our data is used. And companies are finally maybe hearing us, or at least they say they are. This privacy messaging campaign certainly makes it feel like we’re getting somewhere, like we’ve been heard.

Tim Cook: In a world without digital privacy, you begin to censor yourself.

Manoush Z.: Yeah, and these companies say they’re pivoting.

Mark Zuckerberg: I believe that the future is private.

Manoush Z.: And they’re making sure that privacy is their business.

Sundar Pichai: Powerful privacy features and controls have always been built into Google services.

Manoush Z.: This messaging strategy makes it sound like momentum is shifting towards protecting user privacy. Companies that depend on our data to be profitable are telling us that they can balance the imperative to satisfy us, their users, with the imperative to satisfy their revenue targets. So, have they changed? Did they discover that privacy is not only worthwhile but it’s worth money?

I’m Manoush Zomorodi and this is IRL, an original podcast from Firefox.

For big tech, the push for private makes a great marketing campaign, but privacy has never been a PR move for Firefox. Firefox’s success has never depended on collecting your personal information. The company’s products are private by default. Your life is your business, not Firefox’s. Learn more at firefox.com/join. Facebook, Google and Apple are the biggest examples of how companies build privacy into their respective public images. But look past the marketing message and you start to see that the word privacy means something different to each of them.

Patrick Jackson: We always kind of knew that eventually privacy would pivot as a selling point.

Manoush Z.: Patrick Jackson is with a company called Disconnect.me and Patrick is skeptical about the promises these companies are making.

Patrick Jackson: Google, they’re also making this commitment to privacy that you have full control and you can see everything that’s happening, that they’re doing with their data, and things like that. You’re in control, you can delete it whenever.

Manoush Z.: That’s essentially Google’s promise. Privacy? Sure, but it’s up to the user to do the work. Patrick says it’s a distraction from what is really going on in Silicon Valley.

Patrick Jackson: They’re trying to reframe privacy into, “Hey, this is what we allow you to manage with your data.” But what about all Google’s ad networks that track you all over the internet. They do it to serve you relevant ads. How do I get access to that data? Is that data queryable? Can I see how many times I’ve sent my data to you in the past 24 hours? Can I look at the content? None of that is exposed to a user.

Manoush Z.: Patrick has the same problem with Facebook’s promise.

Patrick Jackson: Facebook, the things that they’re doing that are good is kind of doubling down on encrypted messaging. I don’t know if they’re doing anything else that I would applaud them for.

Manoush Z.: Facebook’s flavor of privacy centers on encrypting our chats, offering closed groups, making it easier for people to choose who sees the posts they share. It’s about what you do on the site. It does nothing to address the data collection concerns many of us actually have with Facebook.

Patrick Jackson: The things that I think are horrible about Facebook’s privacy is they don’t touch on all of the tracking that goes on outside of Facebook. They don’t tell you anything about data that they allow developers to send them.

Manoush Z.: As for Apple’s privacy promise, well, here Patrick sees a little more to like.

Patrick Jackson: Apple, their marketing is kind of the saying, “What happens on your iPhone stays in your iPhone.” They’ve done things that have helped privacy. If you use a iPhone with just the installed apps and you don’t install any third party apps, it’s an amazingly private and secure phone.

Manoush Z.: Apple’s products and services promise to keep data between you and your device. Except, Patrick says once you install a third party app that Apple doesn’t control, well, their privacy promise is moot.

Patrick Jackson: Once you start installing apps from the app store, that’s when you get into this whole wild wild West of data and all of these companies pulling data off your phone and they’re becoming very valuable companies because of this data.

Manoush Z.: Patrick actually tested this alongside Geoffrey Fowler, a columnist at the Washington Post. Over the course of a week, they counted the number of trackers that were sucking up data from his phone. They counted over 5,400 of them.

Patrick Jackson: The concern that people should have and that I have is, it’s your data and you don’t know the purpose of what that data is going to be used for. It’s like, “good luck finding out where this data is going to end up.”

Manoush Z.: So when Apple says, “What’s on your iPhone stays on your iPhone,” it leaves Patrick feeling misled.

Patrick Jackson: I had a lot more respect when they didn’t broadcast it on billboards as a selling feature of their phone. That really kind of puts a target on them to do better, which they should. They should all aspire to do better.

Manoush Z.: These companies are each broadcasting their own privacy message. None of them are entirely disingenuous. They each offer layers of control and ownership over our data that does help us manage our privacy, controls that we didn’t have before. Patrick says we need to keep in mind that this PR effort that we’re seeing and hearing, it’s all because they want to protect their power positions, the role that they have in our online lives.

Patrick Jackson: The heat is on them. If they don’t do it, they’re going to have competitors that will truly be about privacy.

Manoush Z.: 5,400 trackers on one newspaper columnist’s iPhone. It’s no wonder that the online personal data market is worth hundreds of billions of dollars. This market is serviced by thousands of data collection companies, ad companies, and data brokers. They don’t have privacy messages. They’d rather you not know they exist at all because many of these trackers work invisibly, unless you know where to look.

Jeremy Tillman: What’s interesting about these websites is that they’re really a living, breathing ecosystem of trackers. It’s not dissimilar to say your biome on your body, right? There’s thousands of bacteria that are living on you that sort of live and die every single day. You just don’t know that they’re there.

Manoush Z.: This is Jeremy Tillman from Ghostery. Ghostery is a piece of software for browsers that gives you control over ad trackers and other bits of code that follow you around on a website. Ghostery’s tool lets you see who’s spying on you and how massive this industry is because online, you are never alone.

Jeremy Tillman: Okay, so the first site I’m going to go to is tmz.com. One, because I guess in my weaker moments it’s fun to see the gossip that they have there. But it’s also a pretty terrible website when it comes to trackers and ads and all sorts of stuff. Right now I’m loading the website. It’s currently at 93 trackers and counting, 95.

Manoush Z.: 95 trackers are following Jeremy and he hasn’t even clicked on the first celebrity news story yet.

Jeremy Tillman: Google AdSense is probably one that most people would recognize. But there’s a lot of fairly obscure trackers that show up here. Something called SiteScout, something called Biddable, something called SpotXchange, something called Tribal Fusion. There’s a lot of really sort of esoteric ad trackers that show up. A lot of these trackers are actually… we call them piggyback trackers because they’re being invited to the website by other trackers. It’s almost like you throw a party in high school, you invite 10 friends, they invite 10 friends, and they invite 10 friends and pretty soon it’s out of control. Even as we’re talking, we’re now up to 131 trackers.

Manoush Z.: 131 trackers in a matter of minutes on a single website. While some of them are benign, a video player trigger, a comments section plugin, the ad-based ones are either trying to collect his data or deliver ads based on data it already has about him. These trackers are one reality of today’s internet, a network of tiny bits of code sniffing into every little bit of our personal information that might be worth a few cents, like panning for gold nuggets in a flowing river of data. The effort has made the fortunes of countless companies. Some of which we don’t even know the names of. But there are alternatives, companies who are doing more than making privacy promises are talking up a big game. They’ve built privacy into their company by design having known all along that protecting our data, or better yet not collecting it at all, is actually a profitable business idea on its own.

Gabriel W.: It’s hard to overstate how interested consumers and Americans are in particular in protecting their privacy. I know this because we run a lot of national surveys. For the last two years running, data privacy has been the most pressing issue on American’s minds.

Manoush Z.: Gabriel Weinberg is the CEO of DuckDuckGo, a small company outside of Philadelphia with about 65 employees. The company handles about 40 million searches a day, but it does so without collecting any data from its users.

Gabriel W.: We started off as a non-tracking search engine alternative to Google. We’ve been doing that for about a decade. But about a couple of years ago, we expanded to try to help people, protect them no matter where they go on the internet.

Manoush Z.: Can we go back to the original founding of DuckDuckGo? What was going on in your head or your life that you were like, “I want to devote myself to making sure that it’s possible for people to search the internet privately?”

Gabriel W.: What’s interesting about me and DuckDuckGo is I was not a privacy activist before DuckDuckGo. I actually started DuckDuckGo for a different reason, that I wanted to improve my own search results. Back in 2007, it’s really hard to remember back then, but search was not as good and it didn’t have things like instant answers and it had a lot of spam. So I actually started to solve those problems and not really thinking about sort of privacy as much, just thinking to improve the user experience. Search and privacy, as we talked about on the internet, was less of a harm at that time anyway. But after I started, I started to get some questions around search privacy and did my own investigation and found, lo and behold, two amazing things about the search market.

Gabriel W.: One is… this seems evident but it wasn’t obvious to me when I started, that search is literally the most private data on the internet because you just type in your most private thoughts into your search engine, your medical, financial, any kind of problem you have. Then the second, which is really interesting, is you actually don’t need to track people to make money in search because the ads are actually based just off the keywords you type in. They’re not based off as you as a person.

Manoush Z.: Hmm. How have you managed your partnerships with other tech companies? My understanding is you partner with Microsoft Bing and Apple Maps to run some of your search results. Do you talk about your sort of philosophies on privacy with them? Does it affect how you’re able to do business?

Gabriel W.: Yes. What we do is, when you load say on DuckDuckGo a search result, we’re getting that information from our own sources as well as many others. Like you mentioned, we actually partner with Apple for maps. For all of these partnerships, we proxy, so we effectively act as a VPN for you and call them on your behalf.

Manoush Z.: Aaah!

Gabriel W.: Yep. Then make the whole page anonymous to you. That has been challenging. We have to develop new technologies to do that in some cases and work with a partner closely, but it’s worth it.

Manoush Z.: How are you doing financially? How have you been able to stick with it as long as you have?

Gabriel W.: DuckDuckGo has thankfully been profitable since 2014. It’s this basis that advertising on the internet does not have to be anti-privacy. So DuckDuckGo is not anti-advertising. We make money also from advertising. It’s just this kind of contextual advertising that we’ve been talking about where it’s based on the content of the page and not you as a person. If you do that well, you can definitely be profitable online.

Manoush Z.: But what about people who are like, “Yeah, but behavioral advertising. Knowing that Manoush went to Whole Foods earlier today, that it was raining in New York,” all the other things, “She probably had to buy an umbrella.” I don’t know, whatever else that you might be able to glean from tracking me on my phone. Isn’t that more effective?

Gabriel W.: I don’t think it necessarily is more effective. There’s been some studies now that show… for example, a recent one came out that a publisher site only saw a 4% lift in revenue based on behavioral advertising. There was another survey that showed about a quarter of the advertisers polled or publishers polled saw actually a decrease in revenue using behavioral advertising versus contextual. That said, I take your point that not everybody is interested in completely getting rid of behavioral advertising. I think that’s okay as long as there is a choice for people who want to opt out to do so.

Manoush Z.: If you had told me two years ago that mainstream consumers would know anything about privacy, I would have laughed. Yet here we are where privacy is actually a selling point for companies. Do you feel like that is showing that there’s an opportunity here, not just to protect people’s data because it’s the right thing to do, but because it’s actually good for business?

Gabriel W.: Well, to this point about there being really good for business to be pro privacy, there’s a whole host of companies that are cropping up actively in like every single vertical that offer pretty compelling alternatives that are more private. There are some websites that list these. Well, a good one to go to is ethical.net which literally categorizes things across the board. So if you are a company that is trustworthy and you can convey that you have good privacy practices, you’re going to attract more consumers. Consumers are really looking to flock to companies that they can trust.

Manoush Z.: DuckDuckGo doesn’t need to know who uses their search engine. They just want the business. But the internet is still very much dominated by data hungry services that do need personal information and make a lot of money. There are those who think that there’s another way, that we can tackle this privacy problem by cutting out the middleman and simply selling our personal data ourselves.

Oli Frost: I’m Oli Frost. I guess I’m the guy who sold his personal data on eBay or at least tried to.

Manoush Z.: No, seriously, he really tried this. He logged into Facebook, downloaded a copy of his profile history and tried to sell it.

Oli Frost: That really contained everything since I was 16. So it’s back when I had a fringe and listened to Billy Talent and also a whole list of weird things that I’m interested in like gluten free diets, details on how many happy birthdays I get year-over-year. But it’s really good data. They’re some great chats in there, some great pictures of me. It should get a good price. I thought I’d put it on eBay starting at 99p, put it on a Sunday evening and just set off from there.

Manoush Z.: 99p. That’s 99 Pence, about a buck and a quarter in American money. The listing was called, All My Personal Facebook Data, and it offered Oli’s info mostly unconditionally.

Oli Frost: The only thing sort of permissions I put on this was that you’d get all of that data, you just weren’t allowed to steal my identity and open a sweatshop with it.

Manoush Z.: In case you’re wondering, yes, Oli was really willing to sell his information. But no, he wasn’t taking himself too seriously. Anyway, the listing kind of became a hot commodity.

Oli Frost: About a day after I posted it, suddenly I started getting bids on it and in a few hours it was at 20 pounds and then it was up to 80 pounds and then there were more and more people bidding on it. By the end, after about a day, it had got to 300 pounds with 50 different people bidding on it.

Manoush Z.: 300 pounds, about 375 US dollars. Clearly, Oli was on to something, even if it was just a bunch of people playing along with his privacy stunt, until the stunt was cut short.

Oli Frost: I got this email basically just to say that they were… it had been taken down by eBay. I called them up and they basically kind of came up with this reason that… they said it might violate Facebook’s terms and conditions, which is odd because it’s supposed to be my data going into Facebook.

Manoush Z.: Stunts like Oli’s aside, the argument to empower users to profit directly from their data is gaining some traction. Earlier this year, California’s governor Gavin Newsom suggested something called a data dividend for consumers, basically giving us a share of the profits from companies who make money off of our personal information. Beyond that, there is an emerging cottage industry of small companies experimenting with various ways that they might create a kind of consumer personal data exchange. One of the latest is called UBDI. Dana Budzyn is the CEO.

Dana Budzyn: UBDI stands for Universal Basic Data Income. The hope is that we can actually generate enough revenue so people can get a cash income. We’re aiming for $1,000 per month over time.

Manoush Z.: Dana admits that that is an ambitious goal that will take time to reach.

Dana Budzyn: But you have to show people that their data is actually worth something and you have to build that trust first.

Manoush Z.: Of course, the value of your data depends on whether or not anyone is actually interested in buying it. Online, you can find estimates of the worth of one person’s data ranging between half a cent to a few thousand dollars per person.

Dana Budzyn: People are being convinced that their data is not that valuable, that this payout is going to be so small that it’s not even worth their time to care.

Manoush Z.: So UBDI wants to rethink how the online ad industry works and connect the consumer directly with the companies looking for insights. To do that, UBDI is starting small.

Dana Budzyn: It’s why we’ve started with market research because it’s populations of less people.

Manoush Z.: Here’s how they’re trying to do it. Okay, so let’s say I signed up, installed the UBDI app. That would let me link my personal information from a number of sources.

Dana Budzyn: This could be Facebook, Fitbit, Spotify, a credit card, right?

Manoush Z.: Next, I’d be matched anonymously with a company looking to understand consumer behavior better. Now, I can choose how little or how much of my data to share or pass on the offer altogether. To be clear, UBDI doesn’t actually see your data, it doesn’t know who you are and it never can. It just connects you to the companies willing to pay for your data. The companies themselves also don’t know who you are. They get anonymized and aggregated data that’s tailored to what they want to know.

Dana Budzyn: The company would be asking a specific data query like how much was being spent on Starbucks in a particular area. If I’m comfortable with that, I can swipe my finger and the data will be sent to the back end and I’ll get cash which will transfer to my bank account and I can go spend it as I will.

Manoush Z.: And it’s a one time permission. If a new study is available, you decide again if you want to participate, swipe your finger to consent and the data is shared. Rinse, repeat and profit. UBDI’s website claims that once they’re up and running, a person could earn between five to $250 per research project.

Dana Budzyn: It’s just a matter of getting more and more people onto our platform and having companies willing to shift and pay their money directly to users instead of paying data brokers behind their backs.

Manoush Z.: If you want to learn more about UBDI, you’ll find a link in our episode show notes. UBDI is not the first to try and reimagine the relationship between consumers, companies, and private data. So far though, they’re all experiments kind of stuck in beta mode, because here’s the issue, as individuals, our data may not be worth that much. Companies make money from our information because they can collect millions of points of data from billions of us and they can slice all that data in infinite ways and sell it over and over again. Perhaps the only way to put a price tag on our privacy is collective. But look, privacy isn’t about bankrupting Google or Facebook, it’s about making sure we have the freedom to decide how we want our information to be used and shared.

It’s a growing conversation about the importance of civil liberties on the internet. It’s about how governments and social norms can ensure we live in communities and countries that grant us autonomy, the freedom to express ourselves, and live lives without fear of surveillance or judgment. As consumers, we also hold a lot of power. If we demand that privacy is baked into the services we use, companies will understand that privacy is a feature, not a bug. As we’ve been reporting on all season, tech workers can show us how we can fight for our values. Regulators are flexing their muscles and holding companies accountable and ethically-run businesses and organizations prove that it is possible to have a safer, more human and more private online life.

That’s a wrap on another season of this podcast. Thank you so much for listening. I’m Manoush Zomorodi and this is IRL. Online life is real life. An original podcast from Firefox.

Oli Frost: I mean, if anybody still wants to buy my data, it’s stored on this USB key. There’s a picture of my face on it and I’ll just consider your offer on a case-by-case basis.

Manoush Z.: Oh! Don’t forget, I want to hear from you. You can find our short listener survey at irlpodcast.org. Thank you.