Reminiscently bops in the periphery of my contacts, begging me to check out its latest creation. I go to turn off its notifications, but, like always, I’m lured into the A/R overlay memory that’s titled “The Hammad Family’s First Days.” It has a 3D loop of Ayan and Tymeena dancing around me in our living room extracted from a video that none of us took. These overlays are usually constructed from our photos and videos, but now and then they pull in media from connected devices around our home. Devices that I forget are watching and listening, latently waiting to serve. I sigh to myself as I cave into the admittedly well laid trap and close my eyes. I open them when I hear the cheerful music blossom into my ears. Our heavily decorated home is covered up by the overlay of our empty living room just as the Tymeena unlocks our front door for the very first time. It was the second the security sensors all activated for the first time as well. The overlay focuses on Tymeena spinning into the room with a big smile. I appear behind her, sulking with apprehension. I hadn’t realized how visible my sulking was at the time and how out of place it must look on what should have been a joyous occasion. Our new home was beautiful, spacious and in a great neighborhood, with coveted schools. And it was a welcome escape from the cramped and noisy apartment we’d been staying in as we each finished graduate school. Yet I was sulking, because for the first time in six years, I no longer felt free. I know what you’re thinking – a first time parent, whining about having to settle down and take responsibility for this new family. And while there were aspects of the prior stage of life that still tugged at my heart, I was honestly more excited for what the next phase was bringing. No, what was weighing on me was the feeling of exposure. Like many people, during the late 2020s I carefully pulled as much data as I could off of almost every platform I used. I of course left some key bits of data up to keep some services functional. (I especially wanted my entertainment recommendations to stay fruitful). But I was no longer chased across platforms with highly targeted ads begging me to buy some random thing I’d searched weeks before, like that vacation to Fiji I’d always fantasize about instead of studying for exams. But once we decided to buy a house, it turned out that that data of mine I’d been hoarding was one of the few assets we had. We were both lucky enough to have fellowships pay our way through graduate school, but it didn’t leave us much of any savings. We were lucky for Tymeena’s professorship and I was thrilled to be starting my education policy work in a few weeks. But as excited as we were for our careers to be getting started, neither profession was exactly throwing money at us. Yet despite being low on assets, we truly wanted a place to call our own. Between school, work and family drama, we’d each been hopping from home to home for the last few decades. We were lucky to find each other in the midst of graduate school. Our love gave us a stability and calm in what was otherwise a hectic and nerve wrecking time where our futures were truly uncertain. And now we wanted to take that stability and turn it into a home. Doing so seemed entirely impossible, until Tymeena called me one day practically screaming, “THEY CAN DO IT!” “Who can do what?” I said, absolutely confused. “The University! They can get us into a housing union!” “A what?” “Look, I’ll explain how when I get home, but they’ll help us defer the down payment.” Tymeena could never wait to explain, so I immediately knew she was hiding something. When she returned home, Tymeena explained to me that the University was affiliated with a housing union known as UBitquity. They worked with universities around the world to protect the data of students, staff and faculty in a trust. She explained that in exchange for deferring a down payment, UBitquity would require committing to thirty years of submitting our household data into their trust. I felt the walls of my privacy crumble around me. UBitquity’s marketing of course assures their prospective members that the anonymity of their data will be paramount. That, despite how the data is used, it could never be tied back to you and your household personally. That they’re a self contained market that holds the data and provides “pre-packaged segments” of anonymized users for companies to market it to. And that your data would never leave the trust. They’ll also say that you can block specific companies from ever reaching you. But as I dug into the terms, it became clear that blocking only the first three companies was complementary. Each additional block costs you some fraction of your down payment. And the terms were littered with restrictions like this. Trust was an apt name for this kind arrangement. But it was our only chance to own a home and settle down. So I signed whatever I needed to, and grimaced my way through it all. Until the moment we took those first steps into the house and I could almost see the bright red excitement bursting from Tymeena’s dark brown skin. I returned her smile and embraced her. At that moment the overlay zooms into Tymeena’s pregnant belly and fades into a scene months later. The walls are now full of decor and new furniture. Ayan is leaning against our bright green sofa, bouncing his chubby knees as I egg him on from the orange armchair. “Ajao, ajao,” I say as he buzzes drool through his pursed lips. He watches me intently and lets go of the couch and squeals as he takes his first steps toward me. Tymeena and I squeal in response as we wrap him up in a family hug. It truly was a happy moment. But later that night, after I got Ayan to sleep, I slipped back into my armchair hoping to enjoy some V/R streaming. Yet, as I swiped into the app from my contacts, I was met with an ad-moment for toddler sneakers. Because of course I was now in UBitquity’s “parents with newly walking toddler” segment. I had the urge to tear my contacts out then and there, but took a moment to calm down before walking to the bathroom to put them into their charging case. Tymeena had a hobby for old murder-mystery paperbacks, so I grabbed one from her shelf and climbed into bed. But my mind kept morphing the words on the page into the image of the opulent toddler sneakers, so I slammed the book shut and went to bed feeling violated. The overlay blurs out and refocuses into the scene of Ayan dressed up with a backpack ready for his first day of school. He’s antsy and ready to head out the door, but Tymeena and I won’t let him go until we get enough pictures and hugs in. Months before this, anxiety hit me as I thought about having to search for a good pre-school that had openings. We’d heard horror stories from friends about needing to reserve a spot the moment we knew we were pregnant and so I was afraid to even sit down and look. But one day I got a customized list of schools nearby or in the path of either of our commutes delivered to me in my contacts. Not only that, it highlighted the ones that promoted values it thought our family would think are important. “Tymeena,” I said alarmed. “Did you request this?” “No…” she shrugged, “..but, UBitquity-” “Of course. UBitquity knows.” “It’s creepy, I know, but having this list is such a relief,” she said as she skimmed through it. And she was right. As uncomfortable as I was with feeling exposed, my anxiety around finding a school was quickly dissipating. We’d be able to handle this. The overlay takes me out of our living room and into a rendering of Ayan’s school auditorium. He’s skittishly walking out on stage in his multicolored tights and getting into position with his group. The lights flash on, but the overlay dims the other kids and focuses on Ayan’s dance moves. As the show goes on he grows more and more confident. Watching this now it’s no surprise that we started getting more and more ads about performing arts middle schools in the area. Even without the targeting though, we could see that his passion for performance was beyond just a hobby even at this age, so this time when we got the curated list of performing arts schools to apply to, we were much less perplexed. In fact, we dove right in without missing a beat. The overlay fades into Ayan’s dimly lit, heavily decorated middle school gym. Ayan and his friends stood awkwardly in a corner. Tymeena, standing with the other chaperones, kept making eyes at him to move to the dance floor, but he kept ignoring her. You’d think performing arts students would be going all out at this moment, but thirteen is a universally awkward age, no matter how great of a performer you are. For UBitquity, thirteen is an important age too. It’s the youngest age for which they’ll directly target ads to personal devices. So far Ayan’s devices had been off limits. And we were under no obligation to have data from his personal devices added to the trust. But for each additional household member you added to the trust, UBitquity would provide a modest monthly rebate toward your remaining loan balance. As Ayan’s thirteenth birthday approached, Tymeena and I stayed up late many nights debating whether or not to enroll him. Neither of us could decide, but Tymeena was the one who leaned against it. As much as it surprised me, I kept making arguments for putting him in. As we had seen, the targeting UBitquity sold ended up providing us with so much timely and relevant material, that I wondered if we’d be depriving Ayan of valuable information. But ultimately we decided to keep him out of the trust until he turned eighteen. From there, we’d let him decide if it was worthwhile. A call from Tymeena interrupts the overlay. “All packed?” she says as her face appears before me. “Yup.” The overlay is missing out on this next first: the Hameed family’s first trip to Fiji. I’m still in disbelief that we’re really doing this. We’ve been saving so carefully for the last seventeen years, barely traveling just to see relatives or go on weekend road trips. But, when we learned Ayan received a full scholarship to college, we suddenly realized we had to make new plans for the bulk of our savings. The most logical thing to do with the money was put it toward our down payment that UBitquity was still holding. Which meant we could potentially pull our data out of the trust (and out of all those marketing segments) a few years early. It was hardly surprising that before we could submit our payment, we began to get ads for special deals on big purchases we might have always fantasized about, but always put off for another day. Like this trip to Fiji. “I’m really glad we’re doing this,” I say to Tymeena. “We’ve earned it,” she says, blowing me a kiss. “I’ll see you and Ayan at the airport!” I suppose, through hard work and a sacrifice of privacy, somehow we have earned it. I do my best to assure myself of this as I grab our suitcases and head to the airport.
In response to ‘Home@Heart’
By Nicolo Zingales, Professor of Information Law and Regulation. Home@Heart is a sagacious illustration of how we could be convinced to monetize our data in the absence of strong privacy legislation. It tells the story of a young couple of academics who decide to finance their first house through an interest-free loan from a housing union (“Ubiquity”) open to university staff, faculty and students. In exchange, the union requires collection of data of the entire household for 30 years, or until whenever the loan is paid back. We also learn throughout the text that, while this data is processed to enable third party marketing, it never leaves the trust, and that technical measures are taken to prevent identification of specific union members within the targeted group. So far, so good — this may indeed be a sensible solution for individuals who wish to finance their housing by monetizing, in a privacy-preserving fashion, the data they continuously generate within their households. Except that it’s not. As part of the terms of Ubiquity, households can block specific companies from targeting them with ads, but they will have to pay a fraction of their down payment after the third block. From the story, we gather that the protagonist (the young father) only learns about this feature after the contract is signed, which suggests that this rule was somehow buried in the fine print. It thus seems that the legal system in 2030 still heavily relies on “the biggest lie on the Internet” (that is, “I have read the privacy policy and terms of service”), putting a significant burden on individuals in reading and understanding legalese, and not yet grappling with the coerced nature of consent in take-it-or-leave-it scenarios. This system allows data controllers (like Ubiquity) to extract permission to process personal data of household members in order to enable targeting with offers by an undefined list of companies, while also not granting an effective right to opt-out (given the likely budgetary constraints of those members). There are also other aspects of Ubiquity that may be problematic from a data privacy standpoint. For instance, it sends parents brochures of schools that align with their child’s predisposition and with the family’s values. This raises questions about how these choices were arrived at, particularly if they were the result of automated processing. What guarantees do households have that the profiling was not based on incorrect data or unreasonable inferences? Another disturbing element in this story is the looming presence of “always on” devices, which, in this not-too-dystopian future, are not merely tracking our location, but also constantly watching and recording. While the protagonist enjoys the video that is surfaced to him with a collection of family pictures, he also sighs at the inevitable disruption of attention that this entails. This sense of intrusion adds to his general disappointment with the “crumbling of privacy walls,” which comes out loud and clear in the narrative from the very moment he and his wife decide to join Ubiquity. But are these tradeoffs really necessary? In a bright future of data trusts, individuals would remain in control about both the collection and use of their data and the ways in which they are targeted. They would be put in the condition to adjust their revealed preferences to enable appropriate targeting, decide when they can be targeted, and understand why they are receiving any given offer. Furthermore, there would be lines that cannot be crossed in order to prevent the exploitation of consumer vulnerabilities. For instance, the governance rules of the trust could consider it unethical to push advertisements for long-desired big purchases (like that trip to Fiji) on the basis of a household’s apparent financial liquidity. Ultimately, the trust should act in the best interest of its members, enabling them as much as possible to behave rationally when it comes to making important financial decisions. The trust could also allow individual negotiation of its terms with authorized agents representing groups of households, for higher levels of protection in some of its features. What policy changes do we need to get to this bright future scenario?
Data privacy legislation that requires consent to be free and informed, and prevents data subjects from “selling their soul” by giving open-ended authorization to process their personal data without effective opt-out mechanisms (see e.g. art. 7 & recital 43 GDPR)Data privacy legislation that imposes minimum safeguards of transparency and contestability of automated decisions based on profiling, including a right to explanation and a right to request a human review (see e.g. art.22 GDPR)Consumer protection laws that prevent exploitation of vulnerabilities, including through subliminal techniques, leading consumers to make transactional decisions that they would not otherwise make (see e.g. art. 5 of EU’s Unfair Commercial Practice Directive, and art. 5(a) and (b) of the proposed EU Regulation on Artificial Intelligence). Data governance mechanisms that allow individuals to be represented by authorized and accredited agents in the exercise of their data subject rights (see e.g. section 999.301(c) of the California Consumer Privacy Act, and art. 9 of the proposed EU Data Governance Act).
