The Privacy Project: What's your data worth? Congress wants to know

Too bad the plan is doomed.

View in Browser | Add nytdirect@nytimes.com to your address book.

Tuesday, June 25, 2019

The Privacy Project »

Christopher Lee for The New York Times

Charlie Warzel

Opinion writer at large

This week, Senators Mark Warner and Josh Hawley introduced a bipartisan privacy bill with a clear demand for Big Tech: It's time to disclose what our user data is worth.

The idea is simple. Platforms gobble up our personal information in countless ways. We know it's valuable because these companies make obscene amounts of money from it. And so it's time they fess up and put a price tag on our precious morsels of information.

Data valuation sounds empowering. But any effort to assign a dollar value to our millions of data points scattered across the internet is inherently flawed. It's also a concerning admission that lawmakers are still struggling to understand the complex inner workings of the digital economy.

The bill appears to ignore the way most users approach privacy trade-offs. According to Kim Hart at Axios, "the point of the bill is to help consumers understand what they may be giving up when they click on 'I agree.'" But the problem isn't that most of us don't care about our privacy; it's that we don't always act in our own interests when it comes to our data. We'll even forgo monetary rewards to avoid thinking about privacy.

And even if giving our digital detritus a dollar amount did increase our ability to resist privacy policies, there's no consensus on how to calculate value. Given the convoluted nature of the digital ad world, where data is transferred and acquired frequently, it's not clear how companies would value shared information between parties. As a former Facebook advertising manager, Antonio Garcia Martinez, argued on Twitter recently, "Data's value is also a function of that company's ability to monetize it. My address and purchase history is worth a lot to an e-commerce company, nothing to a health care company."

Perhaps bleakest of all is the notion that our data isn't worth very much when it stands alone. Back-of-the-envelope math by one blogger put the yearly value of an internet user's data at "approximately $240 per capita" using advertising industry statistics from 2016. That's not nothing, but it's also slightly distressing that the sum of our digital lives is worth roughly half of a yearly subscription to the Cheese of the Month club.

The well-intentioned bipartisan bill seems to ignore the architecture of the modern internet economy. For many companies, the data is valuable only in the aggregate, where it can inform machine-learning systems that feed users recommendations, power the applications and inform internal strategy for the future. In the world of digital marketing, where more than 7,000 companies slice, track, retarget and bid on your information, the value of your data for one tech conglomerate can change based on the data that other companies have collected. As one ad industry veteran put it to me recently, "the ecosystem that deals in our data is so convoluted that almost nobody can see the whole thing and nobody understands it all." How do you begin to assign value to that?

To be fair, the proposed legislation does include some meaningful steps toward transparency such as requiring companies with over 100 million users to "disclose types of data collected." It's possible that a truly comprehensive list of every piece of data captured about you from every entity would meaningfully alter how we see and use online services. But good luck prying that information from every shady app and data broker.

While part of me feels foolish for criticizing any earnest effort to advance our national privacy discussion, the legislation strikes me as largely theoretical, even ceremonial. It does little to address the root causes of the online ad ecosystem that is powered by user information. At best, it puts an onus on the consumer to evaluate privacy trade-offs (and let's be honest, you can't really opt out) rather than forcing those who play fast and loose with our information to adapt to less exploitative business models. Just as an individual's data pales in comparison with the aggregate, focusing on individual privacy consent does little to dismantle a system that's clearly broken.

From the Archives: 'Face to Anti-Face'

NYT archives

This week's pick goes back to a 2013 piece looking at a project from the Brooklyn-based artist Adam Harvey. Harvey's CV Dazzle project explored the then-new trend of facial recognition and explored ways in which fashion could be used to thwart identification in public. It's obviously an avant-garde take (it's likely that tonal makeup inversions and unconventional hairstylings won't work for everyone), but underneath Harvey's concept are a few interesting ideas about how facial-recognition algorithms can be bested:

"Since facial-recognition algorithms rely on the identification and spatial relationship of key facial features, like symmetry and tonal contours, one can block detection by creating an 'anti-face.'"

Tip of the Week: How to Thwart Facial Recognition

Twitter screenshot

Our archive pick brings up an interesting question: How could one beat facial recognition? The answer is extra relevant as protesters in Hong Kong attempt to demonstrate freely.

Two important caveats. Facial-recognition tech is constantly evolving and improving, so it's good to remember that almost nothing is foolproof. Second, when it comes to law enforcement, certain masking rules may or may not apply. It's generally legal to cover one's face in public, but there are exceptions. Under California Penal Code Section 185, for example, "it is unlawful to wear a mask or disguise in order to evade the police." So please do your homework and know the risks!

Since facial recognition works by mapping the geometry of your face, the more of it you can obscure, the harder it will be for algorithms to map and match with certainty. While they're not foolproof, the combination of long bangs, a hat with a brim and sunglasses may obscure your face enough to confuse the computers.

There are a few products that the truly privacy-minded could shell out for, including a $120 pair of Reflectacles frames, which bounce back the emitted IR beams to confuse the algorithms (bonus: They're good for night bike riding, too). Depending on your fashion tastes, you could also opt to purchase an "anti-surveillance" T-shirt, which has a design pattern that tricks some algorithms into seeing hidden faces.

And then there are the theoretical solutions, which seem to be fast approaching. In China, researchers have experimented with LED lights on baseball caps to create infrared signals that confuse facial-recognition technology. Similarly, there's a research paper circulating with designs for nonreflective eyeglasses that might reliably foil face detection in the future.

Lastly, there's the Juggalo route. As Adam Harvey illustrated in our archive pick, using makeup to create asymmetry is still an effective method of masking one's face. As some have noticed, Juggalos, the name for devotees of the cult rap group Insane Clown Posse — who routinely paint their faces with elaborate black-and-white patterns — make life quite difficult for face trackers that rely on light and symmetry. So if you're in the market for a new hobby with external privacy benefits, you may want to open up Spotify and give it a whirl.

I want to hear from you

Send me your pressing questions about tech and privacy. Each week, I'll select one to answer here. And if you're enjoying what you're reading, please consider recommending it to friends. They can sign up here.