Download this Commentary (PDF)
On June 24, 2019, Senators Mark Warner (D-VA) and Josh Hawley (R-MO) introduced the Designing Accounting Safeguards to Help Broaden Oversight and Regulations on Data (DASHBOARD) Act, which would impose several data-disclosure requirements on certain companies that monetize user data. This isn’t the first time either senator has reached across the aisle to address privacy concerns with data collection, proposing legislation to tackle ads targeting minors and the collection of phone and email contacts earlier this year. These developments fit the pattern of an increased bipartisan appetite for federal privacy legislation. Similar data privacy laws passed in states like California and Vermont have motivated Congress to create nationwide standards to avoid regulatory incongruence within the marketplace. Determining whether these proposed standards will be a net positive or negative requires a balanced evaluation of their benefits and costs.
Proposed Legislation
The DASHBOARD Act would apply to “commercial data operators,” defined by the legislation as companies that “generate a material amount of revenue” from monetizing the data of more than 100 million unique monthly visitors or users in the United States. The act requires that:
Every 90 days, companies must disclose to their users the types of data collected from them, how the data are used, and the data’s monetary value.
The Securities and Exchange Commission (SEC) must receive an annual report detailing the aggregate value of user data, third-party data collection, corresponding methods of revenue generation, and data protection measures.
Additionally, the SEC must develop a valuation methodology for calculating the value of user data for different uses, sectors, and business models.
Lastly, companies must allow users to delete all or part of their data.
These requirements somewhat mirror the European Union’s General Data Protection Regulation (GDPR), which includes a right to erasure and right to be informed. While the SEC would be charged with developing valuation models and receiving annual data reports, the Federal Trade Commission would continue enforcing consumer privacy protections. An entity failing to comply with DASHBOARD’s requirements could be found guilty of committing an “unfair or deceptive act or practice” as defined in the Federal Trade Commission Act. Understanding the impact of this legislation on the digital market first requires an understanding of the market itself.
The Digital Market Today
As RSC scholar Daniel Pérez notes, understanding how consumers value privacy is the first step in understanding how this legislation might affect the digital market. In digital markets, numerous actors—including users, content providers, and advertisers—interact with one another directly and indirectly. For instance, content providers exchange their own content for users’ personally identifiable information (PII) which is leveraged to allow advertisers to better target their products to potentially interested consumers. If content providers could not monetize user data, they would likely pursue a different business model—charging users for access to content. In this market, data acts as a medium of exchange between users and content providers in place of money.
A 2019 study sought to determine the median consumer’s willingness to pay to maintain data privacy on a monthly basis. It found that respondents were willing to pay $5 per month for the ability to delete their PII across all platforms. However, according to Facebook’s Q1 2019 report, the social media company averaged $9.89 per month in advertising revenue per user in the United States and Canada. Since users’ willingness to pay to delete their PII across all platforms is $5 per month, they would likely value the deletion of their PII at Facebook at less than $5. These differences in the valuation of PII might explain why Facebook does not charge for its services or provide an option to pay for privacy: if Facebook provided an opt-out option, it would be priced near the $9.89 they already make from user data. Few users would opt to pay this.
Facebook is able to generate this amount of revenue per user because of how much advertisers are willing to pay for packaged user data. According to a 2009 study, behaviorally targeted advertising—a strategy of using data to better match consumers with products and services based on their preferences—nearly doubles advertisers’ conversion rates, which is the rate at which a “click” results in a sale. This digital market of users, content providers, and advertisers is predicated on user data and dollars as mediums of exchange.
Benefits and Costs of the Digital Market
According to the same 2009 study, many of this market’s benefits stem from behaviorally targeted advertising, providing greater utility to consumers with relevant rather than irrelevant advertisements, boosting the monetary value of content providers’ ad spaces, and increasing conversion rates for advertisers. Additionally, the very nature of data—a non-rivalrous, excludable good (or, club good) inherent to every user—allows users to gain access to a variety of content from different providers without paying. Lastly, novel uses of seemingly useless data may not always be readily apparent in this market, but they serve as a valuable engine for innovation. For instance, Uber might not exist had it not leveraged other firms’ previously existing mapping data.
Proponents of intervention often assert that this market is subject to market failures such as information asymmetry. However, such arguments are rarely accompanied by evidence and often reflect a misunderstanding of what constitutes a market failure.
For information asymmetry to constitute a market failure, it must prevent mutually beneficial transactions from occurring; a savings account holder not knowing how much his or her bank profits from deposits would not constitute a market failure. People refusing to partake in the digital market because they do not know the value of their data could constitute a market failure due to information asymmetry, but this does not appear to be the case given estimates that a majority of people in the U.S. are on social media. Nevertheless, most policy proposals seek to address information asymmetry, with some scholars claiming that consumers are unaware of what PII is being collected or of the external risks associated with their PII being exchanged between data-using firms. Incomplete information about data collection could lead to consumers undervaluing their data. With these concerns entering mainstream political conversation, legislative action that attempts to rectify these concerns should not come as a surprise to anyone.
Potential Implications of the DASHBOARD Act
Broadly, the DASHBOARD Act seems to target information asymmetry in the digital market. In this respect, the user reports are likely meant to complement the data erasure portion of the legislation that would allow users to make specific deletion requests. Similarly, the industry-wide data valuation metric is an attempt to communicate the monetary value of PII to users, investors, other data firms, and the government. Overall, the act tries to provide consumers information on the value firms gain from PII but that could impose challenges on different portions of the digital market.
The act’s requirements inherently impose substantial compliance costs on commercial data operators. Recent analysis on GDPR-style regulations suggests that, by expanding compliance requirements, the DASHBOARD Act may increase IT costs of small businesses, decrease investments in the technology industry, and reduce overall trade. This legislation’s deferment to the user for data erasure could set up legal challenges due to ambiguities in data ownership. The erasure of these data will also be difficult to verify when dealing with third-party data collectors and with advertisers who have legally purchased individual or collective sets of user data.
In the case of data privacy, legislation that clearly recognizes data property rights and establishes liability between users and content providers could allow markets to work efficiently. In its current form, the DASHBOARD Act does not address these two issues and could be strengthened by amendments that do so. Legislators would be wise to step back and seek mechanisms suitable to address privacy issues in such a way that the benefits of intervention could justify its costs.