“If you’re not paying, you’re the product!” People love to repeat this complaint:
We pay, for example, for the awesomeness of Google’s free array of services by helping Google build an enormous database filled with our billions of searches and personal information. … This week as you scour the internet and stores for holiday deals, keep in mind that when you’re not paying with cash you’re paying with your personal information.
What it means is that if a website is spending its time and resources to deliver content to you without asking for anything in return, then they are probably selling information about you to others to make money.
free services usually make money by extracting lots of data from users — and then selling that data, or using it for targeted availability of those users for advertising, to advertisers.
if you’re not paying to use a service, you can expect that your data will be used to make money in some way.
To be honest, I think much of this fretting about privacy is misdirected.
Yes, there are plenty of groups that should be worried about protecting their or their users’ privacy—say, reporters, dissidents, Equifax, or companies operating in authoritarian political regimes. In these cases the path from non-privacy to harm is relatively obvious. But many privacy activists treat it as self-evident that any compromise of privacy is a deal with the devil. The results are uninspiring.
It’s silly, for instance, when Richard Stallman suggests that people swap Charlie Cards to fool MBTA tracking, or when people worry about who knows their browsing history, or fret about software with opt-out telemetry, or when the EU makes every single website give you an annoying pop-up about how you’re opting into cookies, or when Mozilla warns every Firefox user that “today’s gifts don’t come with *privacy not included”.
(Does GDPR fall into the “silly” category? I’m mostly suspending judgment. I’m worried because I think it had the same questionable motivations as the above, but I could easily imagine changing my mind.)
None of these examples cited any reasons why the privacy violations were worth worrying about. The blog post explaining Mozilla’s “privacy not included” campaign did claim that their reviewers asked the question “what could happen if something goes wrong”—but I couldn’t find any reviews that actually answered this question! Probably because they had some trouble coming up with a plausible story of someone nefariously abusing Adidas’s smart soccer ball telemetry. In these cases, it’s not worth worrying much about whether you’re the product.
However, there’s a much worse sense in which “if you’re not paying, you’re the product” is true. People have started worrying more about it recently, but still not nearly enough.
The problem isn’t just that GoogFace let advertisers know what you’re interested in. The problem is that this is their only job, as in, the only thing that makes them money. Any way in which GoogFace make you happy, solve your problems, or improve your life is more or less accidental.
In a well-functioning world, this wouldn’t be true, or at least wouldn’t be important. If Facebook didn’t make its users happy, they could leave and go use better products, and then the advertisers would leave and then Facebook would make less money. In fact, our world used to be closer to this situation, because Facebook didn’t know how to keep people using it except by making something they actually liked.
But then Facebook hired a bunch of psychologists and the psychologists taught them about Skinner boxes. Or maybe their userbase stopped growing and they started having to wring more usage from old users to keep the charts going up. Or maybe they realized they had enough of a network effect lock-in that they could start abusing their position. Anyway, they discovered a slew of ways to get more usage without actually having a better product.
For instance, you can pad the news feed with worse stories. People have to scroll past these stories to find the ones they actually want to see, so this increases engagement. It also creates what’s known in psychology as a variable-reward schedule—basically, the action you take (scrolling down in the feed) is sometimes randomly rewarded and sometimes not. Variable-reward schedules lead to much more compulsive behavior, perhaps because they make the reward seem scarcer.
(If you Google “variable reward schedule” the top result is an article by a “growth hacker” and its literal title is: “Want to Hook Users? Drive Them Crazy”)
Or you can send people lots of notifications that aren’t actually important. If they ignore the notifications, no big deal; if they click on them, then you get more traffic and serve more ads. Or you can make the notification icon bright red so it’s impossible for people to ignore their notifications.
Up to a point, when you try to optimize for “what keeps users on my site,” the answer you’ll get is “make them happier.” But that’s just a correlation, and at the extremes, the correlation breaks down. Once you’ve plucked all the low-hanging fruit of actually solving people’s problems, the only thing left is dark patterns.
Most people don’t notice how deeply things like Facebook have been compromised by their allegiance to advertisers, because they’re not in the habit of noticing when products they use could be better. I only started paying attention to this recently, because I started working on user experience at my job. But once I started looking for advertising-induced brokenness, it was everywhere.
Off the top of my head, here are a few examples that are obviously terrible for users but great for time-spent-on-site and great for advertisers. (My examples are from Facebook because it’s the ad-supported product I’ve used most recently. Other ones, except perhaps for Google search, seem equally bad but are less fresh in my mind.)
The news feed somehow fails to filter out random photos from people I friended four years ago and have never interacted with since.
It even fails to filter out text-only posts in languages I don’t understand (this was true before they had inline translations too).
The “see less of this type of post” news feed option simply doesn’t work—you can ask to see less of random photos as many times as you like with no results.
The news feed is often randomly reordered if you refresh, so that you lose your place and can’t tell when you’ve scrolled down far enough that you won’t see anything new anymore.
Despite knowing exactly where I am at all times, Facebook still notifies me about parties that are happening 3,000 miles away.
They frequently add new notification types with aggressive defaults that can’t be globally adjusted. (The most recent offender was fundraisers.)
If you’re logged out and you visit facebook.com, it still displays your notification badge over your profile photo in the “recent logins” section. (Just to make sure you don’t miss any of those very important parties on the other coast!)
You might plead Hanlon’s Razor—that these decisions are incompetence, not malice, and Facebook just had some bad product managers. But you can see that’s not true by how Facebook behaves when its own users try to fix these problems themselves: it responds by banning them—and censoring links to discussion of the ban. The crap in your news feed is sacred crap, and if you question it you will be excommunicated.
OK, so what? Plenty of companies do things that aren’t in their customers’ best interests. Facebook’s Skinner box certainly isn’t comparable to the things, say, cigarette companies have done!
Except… is that actually true? Suppose that time spent on Facebook is, on average, wasted, as if that time just disappeared. (Obviously, some time on Facebook isn’t wasted—say, if you find an interesting article or learn that one of your friends just got engaged—but some of it is also worse than wasted, say if you get sucked into an argument with a troll that just makes you angry.) The average Facebook user spends 50 minutes a day on Facebook properties—multiply by 2 billion active users for a total of 100 billion minutes lost per day.
On the other hand, the world smokes 16 billion cigarettes per day; each one shortens the lifespan by 11 minutes for a total of 176 billion minutes lost. So on the back of the envelope, Facebook could be on the same order of badness as the global cigarette industry.
Of course, the back of the envelope comparison is obviously hyperbolic. In particular, Facebook time is probably somewhat valuable on net. (Then again, cigarettes aren’t pure negative either!)
How valuable? It’s hard to say. If people are voluntarily doing something, we should generally presume that they value it. But my point is that Facebook is sufficiently coercive and manipulative that they don’t deserve (as much of) that presumption. At least some of Facebook’s users came for the event-invite monopoly and stayed for the dark patterns. Those users would be better off if Facebook didn’t exist.
How many of those users are there? I have no idea, but probably a lot more than have been materially harmed by Facebook’s cavalier treatment of data privacy. Don’t get me wrong, it’s great that people are finally starting to worry about privacy. But we should focus our spleen where the actual harm is: in ad funding that incentivizes addictiveness and user-hostile design.