Chicago Booth Review Podcast Do Data-Privacy Laws Actually Hurt Consumers?

Jean-Pierre Dubé: And as our world becomes more and more digitized and the way we engage with society becomes more and more digitized, it's precisely those data desert inhabitants are going to become more and more marginalized.

Hal Weitzman: Companies have never known more about us than they do now. They track our every move on the internet and send us highly targeted ads that follow us around. Many people are concerned that their data is being used and misused without their permission, which has prompted a new set of data privacy regulations like the European Union's General Data Protection Regulation, a set of rules that have inspired 13 US states to enact their own comprehensive privacy laws. Are these rules really helping us and making us safer, or are they having other unintended consequences? Welcome to the Chicago Booth Review Podcast, where we bring you groundbreaking academic research in a clear and straightforward way. I'm Hal Weitzman, and today I'm talking with Chicago Booth Jean-Pierre Dubé, who wrote an opinion piece for Chicago Booth Review in April titled Data Privacy is for the Privileged. Dubé argues that data privacy comes with a cost, it can further marginalize low-income consumers and hurt small businesses. So have we gone too far down the data privacy path? Jean-Pierre Dubé, welcome back to the Chicago Booth Review Podcast.

Jean-Pierre Dubé: Thank you.

Hal Weitzman: Now, you wrote this wonderful piece for us entitled Data Privacy is for the Privileged, another one of your counterintuitive type pieces about essentially challenging the idea that we should want to have data privacy. Data privacy is necessarily a good thing, but so I guess my basic question is shouldn't we have a right to be in charge of our own data, a right to privacy with our data?

Jean-Pierre Dubé: Absolutely. I mean, at some point that's a multidisciplinary question, and my ability to answer that question is limited to the perspective of someone with an economics and quantitative marketing background because there's a lot of nuance, the civil right and the legal right, the divine right to our privacy. And I also want to clarify that my article wasn't meant to suggest we shouldn't have privacy, nor that we shouldn't want our privacy. It was more about the fact that the way that governments are trying to implement privacy policies have unintended consequences. There are pros and cons. And what I've been discovering is that there are quite a few cons, social costs, cost to consumers, cost to small businesses from the way we're trying to enforce privacy.

And worse that any attempt to have a balanced discussion about the costs and benefits is often met with resistance. That the mere term unintended consequence, or dare I say it, quote Milton Friedman, and the no free lunch hypothesis is viewed as a bias, normally in economics when we talk about pros and cons, that's exactly what we mean by balance. And that refusal to concede that there could be anything other than 100% pros to a policy would be unbalanced. But I've noticed it's very hard to have conversations about the costs of privacy and not just with public policy and regulators, but even with many academics.

Hal Weitzman: Okay, that's interesting. So we just assume that data privacy is something we all want more of, is that what you're saying?

Jean-Pierre Dubé: We certainly all want more of when we answer questions like the one you asked in the survey, when I'm asked. But what we spend a fair amount of detail on in the article is talking about some of the findings in psychology and the fact that human beings have a very hard time understanding how their data can be used and understanding all of the potentially unknowable things about who's going to use them, how they're going to use them. And I think people struggle to know whether or not in the given moment whether or not they should answer yes or no to a privacy inquiry because of this.

Hal Weitzman: So we can get into that a little bit, but you're suggesting that, so people will say generally in a generic sense, "Yeah, I want more data privacy." But when you ask them about what that means, they might actually answer something that requires them to have less data privacy.

Jean-Pierre Dubé: I think the problem is when we ask people something very basic and very unstructured like, "Do you want more data privacy?" And the answer is yes. We immediately jump to contexts where we experience really big harms such as fraud, identity theft, and then predation, stalking. And of course, when it comes to matters of security and personal health, we all want privacy. But unfortunately, most of the ways in which our data are being used in a day-to-day basis are more for basic things like marketing like, "Should I receive a discount coupon? Should I receive a communication from a company that I often shop with about new merchandise? Should I be made aware about the existence of a new business that sells things that are in my domain of interest?" And these are much more benign. They could be annoying communications or irrelevant offers, but that's not what we're thinking of when we unambiguously say, "I want more regulation on privacy."

Hal Weitzman: That's so interesting. So they'll think of, as you say, my financial data or my health data, those are the big things, absolutely. But they don't think of my cookies, my tracking going on Amazon or whatever. Actually, they want to be tracked there because they'll get coupons or special offers or whatever.

Jean-Pierre Dubé: Absolutely, our preferences for our privacy are very contextual. When I'm providing my medical information, I don't want that to be known. I mean, I might not want my employer to know that I have a heart condition, for example. That would be a case where I absolutely want privacy. On the other hand, I might be okay if the car company can access my credit report because by seeing my good credit, they might actually give me better terms in my financing for my car. So then I'm actually more than happy to part with my privacy.

Hal Weitzman: So this is what has been called the Privacy paradox.

Jean-Pierre Dubé: It's certainly related to what is I think a highly debated phenomenon, at least the term privacy paradox is debated because it's unclear whether it's a paradox or not.

Hal Weitzman: Okay. But explain to us what it is.

Jean-Pierre Dubé: Well, the privacy paradox is more of an observation that when people state their preference for privacy, such as a question, do you wish there was more privacy? Would you support more regulation? People tend to say yes at a very high rate. And the stated preference for privacy seems to imply that people have an incredibly high value from privacy. But then when we look at what people do day to day, they're routinely not just sharing their information, they're giving it away for free, like on a video game where I can't advance to the next screen without answering a survey question, I might tell somebody my age, I might state where I live.

On a website where I can sign up for free content, I might give my address, I might give an email, I might even answer socio-demographic questions about myself. So the stated preference looks high, but the revealed preference through our actions not only looks low, sometimes it looks pretty close to zero. And that is sometimes interpreted as a paradox that somehow there's a disparity between our actions and our intentions. But it also, I think it is hard to judge that as a paradox for the reasons I just said that the context matters tremendously for my preference for privacy.

Hal Weitzman: Okay. So I mean, this is a very real topic because 13 US states have got regulation on data privacy. There's a proposal to do the same at the federal level. And of course the European Union implemented a widespread data privacy measure in 2018, which we'll remember, the General Data Protection Regulation, GDPR, and lots of other countries have done the same. What has been the result? What are some of the consequences of that legislation?

Jean-Pierre Dubé: Well, I'm almost hesitant to answer that question because of the animosity I've experienced with those who are very pro GDPR, and they would argue that any scientific knowledge about the impact of GDPR is short-term. And we don't know the long-term implications. Totally agree. I totally agree with that, by the way. But in the limited amount of studies we've seen on short term, there seems to have been a lot of costs. One of the most striking aspects of GDPR is that in the, for example, the digital advertising space, Meta and Google's market share for digital advertising increased, and it increased a lot. And when you read some of the dialogues before GDPR was enacted, it was very clear that European regulators were largely focused on reining in big tech. So it almost feels ironic that big tech seems to have been one of the winners of GDPR, and there's a whole host of reasons how Meta and Google end up benefiting from GDPR when if anything, regulators thought it was going to curb their market power.

Hal Weitzman: What is the reason? Is it because smaller advertisers, it's too much for them to deal with, there's so much compliance?

Jean-Pierre Dubé: Yeah, in a nutshell. I mean, Meta really already has compliance. I mean, if in order to use someone's data and to track their behavior, you need compliance, I mean, people A have already largely complied with Meta and with Google. But more importantly, the cost, the administrative cost of setting up a platform so that you can elicit people's consent is much easier for a large business than for small businesses. And the consequence is that many small businesses that are in Europe or subject to GDPR are just paying penalties. They're paying fines. It's just impossible for them to administrate compliance.

Hal Weitzman: Okay. So in Europe at least it's had the effect of helping the big tech companies, harming smaller companies, reducing competition in digital advertising.

Jean-Pierre Dubé: And not just there. That's just one of the most striking ones. There's a wonderful study by a team of authors, one of whom is an MIT Sloan scholar, where they actually used, I can't remember which cloud computing company. It may have been Azure, where they had tens of thousands of company who were doing cloud computing with the service provider, some of which are outside of the GDPR zone, and some of which are GDPR-compliant or required to be GDPR-compliant. And so it creates for a really nice event study where you can see that before, after those that need to comply with GDPR, start storing considerably less data and start buying considerably less processing time on the cloud. And these are businesses of many different sizes, but the smallest businesses are the ones that seem to reduce data storage and data processing the most. And to the extent that the authors are then able to say something about productivity, it looks like these small GDPR-compliant businesses are productively really set back by the GDPR and all of its requirements.

Hal Weitzman: And so do you have any data about the US about what state level regulation has done here?

Jean-Pierre Dubé: Sort of. I mean, the US is funny, it's a bit of a hodgepodge. A lot of states have enacted policies, California probably being the most proactive, but some of these policies are rather confusing because any company that engages in interstate commerce is going to find it very difficult to be compliant in one state when it doesn't have to be in another. And of course, this is a case where we probably do need some kind of federal standardization of what firms must do and mustn't do not because I think the regulation is per se necessary, but at some point, small businesses are just going to have to stop serving certain states. And California has the luxury that it's such a big market that I can't see a small business wanting to walk away all those consumers. But it's a complete headache to have a whole different set of protocols for how you do basic e-commerce, consumer oriented e-commerce for instance, in California versus other states.

Hal Weitzman: So you talked about smaller companies not being able to compete with the big boys, the Googles and the Metas. Tell us about some of the costs of businesses then. What are the consequences of stricter controls on data privacy?

Jean-Pierre Dubé: Well, I still think that one of the most underappreciated aspects of e-commerce in the last 20, 25 years is really the rise of small entrepreneurs selling innovative new consumer goods. There's themes in the types of things we're seeing. They tend to be more artisanal because there's a growing preference, especially in the millennial generation and younger, for more natural, more sustainable, a backlash against the traditional large consumer packaged goods brand and mass production. People want things that are better for them and better for the community, but also niche, things that really serve a niche. And the reason we've seen this explosion of these new products is largely because of e-commerce and digital advertising. In my own research, I studied the persistence of dominance of large consumer brands and throughout the 20th century brands that launched sometimes in the late 1800s and became big, remain big all the way through till the early 2000s.

I mean, think Coca-Cola and Pepsi, Budweiser and Miller, Yoplait and Dannon Yogurt, Hellman's and Kraft Mayonnaise, all these brands have been around for a century and remain dominant in their categories. And if you look at the beer industry as an example, this is one I've also has done some studies on with the revolution of craft beers and their growth. Craft beers have been around since the late seventies, the deregulation of home brewing and eventually of commercially selling home brew beer in a way that bypassed the traditional three tier distribution system in the US means that craft beers have been around so why was the takeoff in 2005? And the answer is digital advertising. It suddenly became really cheap for a small brand to launch and build awareness using digital advertising. If you went on Meta, you could actually pre-screen and only show ads to people who you thought it would be relevant to.

And so now let's think where you would've been if this was the 1980s, I would've had to advertise in the mass media on TV. I would've had to spend millions of dollars. I mean, the cost of launching a new consumer brand and competing against the century old giants was so formidable that nobody even tried. That's why the dominance was sustained. But now for like $10,000, I can hand handpick who's going to see my ads and make sure these are highly relevant, highly qualified leads. And we're seeing dozens of consumer products, foods, household goods, apparel launching online is a direct to consumer. They get FedExed to your customer. And as they start to get big enough, it's actually the consumer who starts wanting to find them in the stores. And these brands are getting pulled through onto the shelves, and you're slowly starting to see more and more of these small brands on the shelves of big chains, big grocery stores, big department stores.

But they started on a shoestring budget. And what I worry about is that after 24 years or 25 years rather of really a revolution of new products, things that are really beneficial, things that are innovative, and they serve niche customers, that we're going to reverse that trend by axing targeted advertising. And going back to the world where an ad campaign has to be large-scale and uniform, which again, predominantly serves the interests of big intrans brands that can afford large media budgets and will crush this wave of innovation we've seen. And just to give you an idea again, of craft beers. Craft beers were about 3% of sales of total beer in the US in 2005, even in 2005, Pale Lager was the lion's share of the beer we bought in stores and took home to consume at home, off-premise. By 2023, the craft beer sales are well over 20% of the category. I mean, that is astronomical growth if you were to compare it to the non-existence of growth in the 20th century.

Hal Weitzman: If you're enjoying this podcast, there's another University of Chicago podcast network show that you should check out. It's called the Pie. Economists are always talking about the pie, how it grows and shrinks, how it's sliced, and who gets the biggest share. Join host Tess Vigeland as she talks with leading economists about their cutting-edge research and key events of the day, hear how the economic pie is at the heart of issues like the aftermath of a global pandemic, jobs, energy policy, and much more. So we talked about the cost to business and the cost to the entrepreneurial innovation system as a whole. What about the costs or the consequences for enhanced data privacy for consumers themselves? Because they're the ones, as we said at the beginning, who are often demanding or agreeing to enhance things, making more strict data privacy rules.

Jean-Pierre Dubé: At a high level, the obvious response is just the counterpoint to us seeing less entrepreneurs and less innovation means that consumers get less variety. And to the extent that there is variety, it's going to be less closely aligned with our heterogeneous needs. We're going to see less niche products, and so that's bad. We're just getting less value. We're going to be increasingly stuck again with the same brands that have been around for decades and haven't been making huge inroads in terms of being more innovative, being healthy or being more sustainable and so forth, being more meaningful. But I think there's another cost in all of this, and I think it tends to fly under the radar. And that's the problem of the So-called Data Desert. We forget that the people who are going to be the most in favor of privacy are going to be the people who perceive to have the most to lose, and who's going to perceive to have the most to lose from data privacy, somebody with a lot of disposable income who's worried that somehow prices are going to go up for them.

Or the kind of variety they're going to get is going to be more premium, but it's going to come at a cost. These are the kinds of folks who are going to be the most in favor of privacy. And actually that's panned out. There's literature that's tried to show that people who have the most instrumental reason to be afraid of privacy are the ones who tend to have the strongest preference. And ironically, or sadly, maybe it's folks at the bottom end of the income distribution and people who tend to be more marginalized that are the ones who have most to lose from privacy because they're going to be increasingly marginalized. So we have entire swaths of the consumer population that aren't on the digital radar. And privacy regulations of the type that are on the horizon or are already in place, are just going to make that worse.

I give you an example. I mean, most marketing authors that we get are based on a pre-screen. The marketer goes to a credit agency or some other scoring agency and takes a list of prospects they could contact, matches it up with the scoring agency, and that's what they do. They want to look at consumer scores. And anyone who has a good score is a viable lead, a good prospect, and they get the offer, everyone else is ignored. Well, unfortunately, these scoring services, these data providers like Experian for example, they don't have the census. And the folks who are the most likely to not be in their database are going to be people who don't have very high income and therefore probably don't have a credit card, hard to track. People with low incomes are more likely to change addresses a lot, which means contact information is going to be out of date.

They may not actually have an email address. So these are people who can't even be found. There's been evaluation studies that have done things like take a list of names from a credit agency and merge it with the North Carolina voting records, which is close, not identical, but close to a census of the adult population. And then they find that if you take a white and an African-American adult with very similar socioeconomic status, you're way more likely to find the white person's name matching on the credit agency's list. Similarly, if you compare a white person with a Hispanic person, which means people who are in ethnic minorities, especially when they're in lower income brackets, are less likely to be found than their white counterparts. So as we start intensifying data restrictions and data regulation, we're going to make those data deserts even more problematic. We're going to fragment up information, and ironically, we're going to get the exact opposite. Rather than protecting people, we're going to marginalize people who are already marginalized. We're just going to make it worse.

Hal Weitzman: And when you say data deserts, you were talking about what kind of information are they not getting it coupons, special offers, special treatment? What are they not receiving that Those of us who don't live in a data desert are receiving?

Jean-Pierre Dubé: The gambit I, the term data desert was selected very deliberately. This is a play on the food desert concept that people who live in low-income neighborhoods are less likely to have access to big supermarkets and therefore less access to nutritious food, especially non-prepackaged natural foods like in organic produce, for example. These are the same people who are less likely to appear in a database, which means regardless of whether a company wants to or doesn't want to contact them in any way for marketing purposes, they can't contact them. These people are literally non-existent. And as our world becomes more and more digitized and the way we engage with society becomes more and more digitized, it's precisely those data desert inhabitants are going to become more and more marginalized, and it feels like the current data regulations that are being debated or already implemented are going to exacerbate that problem.

Hal Weitzman: Okay. Now, you've argued in the piece for us and elsewhere that we keep raising the bar on data collection, it's only getting more and more strict, and as you've said earlier, it gets strict across the boards. There's not much discrimination between the kinds of context that data's being used. Do you think there's a way, what would you do if you're a wise policymaker, is there a way to enhance data privacy but minimize the costs?

Jean-Pierre Dubé: This may sound like a funny response, but in its own weird way, the fact that the United States has been a little more fragmented, the states have been more proactive than the Feds, and the fact that we haven't implemented anything remotely close to GDPR as of yet, might actually have benefited people because what we're seeing in the US is a lot of compliance by companies who, I guess have been incentivized to be proactive on their own. So instead of having a rule that just comes in and outright bans the collection of data, we've actually seen that the mere threat that such a ban could eventually materialize has actually activated Meta. It's activated Google, it's activated Apple. All three of these companies, and many others like them, have been extremely proactive on trying to come up with standards that won't completely eradicate digital marketing, but will nevertheless protect our PII, our personally identifiable information. And so it feels like in the US, the standard is the mere possibility of a ban can be self-policing.

Hal Weitzman: So Google, for example, has promised at least to stop using cookies.

Jean-Pierre Dubé: Well, they've delayed it several times. The so-called Privacy Sandbox, which is supposed to be an attempt at creating technological solutions, these privacy enhancing technologies that will allow companies to do marketing, but without knowing who you are individually. So it's protecting your individual identifiability without taking away the marketing knowledge, that was supposed to be the substitute for cookies. It's just, I guess I can only deduce from the delays that the privacy sandbox isn't where it needs to be yet.

Hal Weitzman: Okay. But you were saying earlier that companies are acting on their own in the absence of any federal guidelines, but there is a proposal at the federal level, and you said earlier that we should have some kind of standard, so what should that standard be?

Jean-Pierre Dubé: Well, I'm not sure that I believe we need bans, but I think that the only thing that's worse than a national ban, like a federal GDPR equivalent would be to have a hodgepodge across states, some of whom have bans, other of whom don't have bans, and then other states which have something in between. I think that kind of inconsistency-

Hal Weitzman: Because that just adds to the cost.

Jean-Pierre Dubé: Exactly, exactly. But I think in the United States, the fact that our elected officials are debating these laws has already in and of itself been a call to action. Apple implemented the Ask Not to Track. I mean, I think companies are taking it into their own hands and trying to come up with solutions that will be acceptable. It seems like Congress really liked Apple's Ask Not to Track app, and whichever recent update that was, Congress seemed to like that. So you can see that if the companies can find a middle ground, we'll let the companies figure out how to meet the needs of the regulator without having to deal with these costly bans. Because again, I'm not against privacy, what I'm worried about are these stringent bans that completely eradicate the data entirely.

Hal Weitzman: And so what would you do about data brokers? Data brokers troll the web looking for personal information, and then they sell our personal information. They piece it together from looking at all our different Facebook page and our LinkedIn profile, and that industry is basically unregulated. Should we scrutinize that industry more?

Jean-Pierre Dubé: Well, now we're getting to the best of GDPR combined with the worst of GDPR. Transparency is, I think, at the heart of most people's skepticism. I mean, again, notwithstanding that there are security and personal harms. In the world of just data and marketing I think a lot of consumers are weary of this idea that somebody knows something about them and they didn't realize it. It was never, my intention for Company X to know certain things about me is being used in their marketing, and I may be being prevented from certain benefits and services or being charged a high price for these benefits and services. At a minimum, I should be aware of this. Someone should let me know about this. And you'd think then, okay, well then transparency. That seems like a good starting point. And that was what GDPR was doing. I mean, this was the good part of GDPR was they wanted companies to have to be more transparent.

My right was that if I saw a company issuing me a digital offer, that I should be able to learn from the company exactly how they came up with that offer and why I was shown that offer, which means they could reverse engineer their algorithm. The reality and this is why it's also the worst of GDPR, is being compliant with that is virtually impossible. I mean, companies are using reinforcement learning algorithms. It is virtually impossible to reverse engineer the whole process, the history through which my billions of parameters in my algorithm ultimately came up with where they are today and came to the conclusion, you should see an ad or get a certain price.

So compliance is just so astronomical. But I'm a little worried that that answer sounds a little defeatist, that now it could be misconstrued that companies should be allowed to do what they want because it's too expensive to regulate them. That would be a very depressing conclusion, and I think that's a worry I have when I talk about unintended consequences, that those who hate regulation may be quick to think that that's what I'm arguing, we shouldn't have any, no, we need some kind of transparency. The problem is coming up with the solution that's manageable, and that's why I'm hopeful about privacy enhancing technologies. This is the proactive American business solution to the threat of a ban, which is to come up with something in between.

Hal Weitzman: Okay. I'll leave it on that helpful note. JP Dubé, thank you so much for coming back on the Chicago Booth Review podcast.

Jean-Pierre Dubé: Thank you.

Hal Weitzman: That's it for this episode of the Chicago Booth Review Podcast, part of the University of Chicago Podcast Network. For more research, analysis, and insights, visit our website at chicagobooth.edu/review. When you're there, sign up for our weekly newsletter so you never miss the latest in business-focused academic research. This episode was produced by Josh Stunkel. If you enjoyed it, please subscribe, and please do leave us a five-star review. Until next time, I'm Hal Weitzman. Thanks for listening.