Internalization of Privacy Externalities through Negotiation: Social costs of third-party web-analytic tools and the limits of the legal data protection framework
April 2022
Pages 525 - 533
Abstract
Tools for web-analytics such as Google Analytics are implemented across the majority websites. For most cases, the usage is free of charge for the website-owners. However, to use those tools to their full potential, it is necessary to share the collected personal data of the users with the tool-provider. This paper examines if this constellation of data collection and sharing can be interpreted as an externality of consumption in the sense of welfare economic theory. As it is shown that this is the case, the further analysis examines if the current technical and legal framework allows for an internalization of this externality through means of negotiation. It is illustrated that an internalization through negotiation is highly unlikely to succeed, because of the existence of information asymmetries, transaction cost and improper means for the enforcement of rights of disposal. It is further argued that even if some of those issues are addressed by data protection laws, the legal framework does not ensure a market situation necessary for a successful internalization. As a result, the externalities caused by the data collection through third-party web-analytic tools continue to exist. This leads to an inefficient high usage of third-party tools for web-analytics by website-owners.
References
[1]
Serge Abiteboul, Benjamin André, and Daniel Kaplan. 2015. Managing your digital life. Commun. ACM 58, 5 (May 2015), 32–35.
[2]
Alessandro Acquisti, Curtis Taylor and Liad Wagman. 2016. The economics of privacy. Journal of economic Literature 54, 2(2016), 442-492.
[3]
Alessandro Acquisti and Hal Varian. 2004. Conditioning Prices on Purchase History. Marketing Science 24, 2 (February 2004), 367-381.
[4]
Alphabet. 2021. Google Code of Conduct. (September 2020). Retrieved February 3, 2022 from https://abc.xyz/investor/other/google-code-of-conduct/
[5]
Ryan Amos, Gunes Acar, Elena Lucherini, Mihir Kshirsagar, Arvind Narayanan, and Jonathan Mayer. 2021. Privacy Policies over Time: Curation and Analysis of a Million-Document Dataset. Proceedings of the Web Conference 2021. Association for Computing Machinery, New York, NY, USA, 2165–2176.
[6]
Art. 29 Data Protection Working Party. 2012. Opinion 04/2012 on Cookie Consent Exemption. Retrieved Ferbruary 7, 2022 from https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf
[7]
Andy H. Barnett. 1980. The Pigouvian tax rule under monopoly. The American Economic Review 70, 5 (1980), 1037-1041.
[8]
Mathias Brandt. 2017. Sie wissen, was du letzten Sommer geklickt hast [Digitales Bild]. (December 2017). Retrieved 27. Januar 27, 2022 from https://de.statista.com/infografik/12252/tracking-reichweite-von-internet-unternehmen/
[9]
Bundesgerichtshof, Judgement I ZR 7/16, 28.05.2020.
[10]
Corina Cara, Lorena Florentina Dumitrașciuc and Alexandru Ioan Cuza. 2021. GDPR consent pop-ups. How are we thinking about them? An Elaboration Likelihood perspective. Journal of International Business and Management 4, 1 (2021), 01-10.
[11]
Adam S. Chilton and Omri Ben-Shahar. Simplification of Privacy Disclosures: An Experimental Test. Coase-Sandor Working Paper Series in Law and Economics 737, (2016).
[12]
Ronald Harry Coase. 1960. The Problem of Social Cost. The Journal of Law & Economics 56, 4 (November 2013), 837-877.
[13]
Court of Justice of the European Union, Judgment ECLI:EU:C:2020:559I, 16.07.2020.
[14]
Court of Justice of the European Union, Judgment ECLI:EU:C:2019:801, 01.10.2019.
[15]
Deloitte. 2020. Cookie Benchmark study. (April 2020). Retrieved February 7 from https://www2.deloitte.com/content/dam/Deloitte/nl/Documents/risk/deloitte-nl-risk-cookie-benchmark-study.pdf
[16]
Econsultancy. 2012. Online Measurement and Strategy Report 2012 (Juli 2012). Retrieved February 3, 2022 from https://de.statista.com/statistik/daten/studie/235496/umfrage/anteil-der-premium-nutzer-von-google-analytics/
[17]
The European Parliament and the Council of the European Union. 2002. Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector. Official Journal of the European Communities.
[18]
The European Parliament and the Council of the European Union. 2016. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). Official Journal of the European Union, L 119/1.
[19]
The European Parliament and the Council of the European Union. 1995. Directive 95/46/EC (General Data Protection Regulation). Official Journal of the European Communities.
[20]
Eric Engle. 2009. The Third Party Effect of Fundamental Rights (Drittwirkung). Hanse Law Review 5, 2 (2009) 165-173.
[21]
Michael Fritsch. 2011. Marktversagen und Wirtschaftspolitik (8th. ed.). Franz Vahlen, München München.
[22]
Nina Gerber, Paul Gerber an Melanie Volkamer. 2018. Explaining the privacy paradox: A systematic review of literature investigating privacy attitude and behavior. Computers & Security 77, (August 2018), 226-261 https://doi.org/10.1016/j.cose.2018.04.002
[23]
Google. About Analytics. Retrieved February 3, 2022 from https://marketingplatform.google.com/intl/de/about/analytics/
[24]
Google. About Analytic s- Features. Retrieved February 3, 2022 from https://marketingplatform.google.com/intl/de/about/analytics/features/
[25]
Google. Google Analytics Cookie Usage on Websites. Retrieved February 3, 2022 from https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage
[26]
Google. Create and manage Custom Reports. Retrieved February 3, 2022 from https://support.google.com/analytics/answer/1151300?hl=en#zippy=%2Cin-this-article
[27]
Google. Data sharing settings. Retrieved February 3, 2022 from https://support.google.com/analytics/answer/1011397?hl=en#zippy=%2Cthemen-in-diesem-artikel%2Cin-this-article
[28]
Google. Demografische Merkmale und Interessen. Retrieved February 3, 2022 from https://support.google.com/analytics/answer/2799357?hl=de#zippy=%2Cthemen-in-diesem-artikel
[29]
Google. Universal Tracking Events. Retrieved February 3, 2022 from https://support.google.com/tagmanager/answer/6106716?hl=en
[30]
Google. [GA4] Set up and manage conversion events. Retrieved February 3, 2022 from https://support.google.com/analytics/answer/9267568?hl=en#zippy=%2Cin-this-article
[31]
Google. 2021. Datenverarbeitungsbedingungen für Google Ads. (September 2021). Retrieved February 3, 2022 from https://business.safety.google/adsprocessorterms/
[32]
Google. 2021. Google Analytics Terms of Service. (June 2019). Retrieved February 3, 2022 from https://marketingplatform.google.com/about/analytics/terms/us/
[33]
N. Gregory Mankiw and Mark P.Taylor. 2021. Grundzüge der Volkswirtschaftslehre (8th. ed.). Schäffer-Poeschel, Stuttgart.
[34]
Paul Graß, Hanna Schraffenberger, Frederik Zuiderveen Borgesius and Moniek Buijzen. 2021. Dark and bright patterns in cookie-consent requests. Journal of Digital Social Research 3, (February 2021), 1-38.
[35]
Joerg Heidrich and Michael Koch. 2020. Die Nutzer im Netz zwischen Einfluss und Ohnmacht. MMR 9 (September 2020), 581-586.
[36]
Philip Hausner and Michael Gertz 2021. Dark Patterns in the Interaction with Cookie Banners. arXiv preprint arXiv:2103.14956. Retrieved from https://arxiv.org/abs/2103.14956
[37]
Jean-François Hennart. 1986. What Is Internalization? Weltwirtschaftliches Archiv 122, 4 (1986), 791–804.
[38]
Maximilian Hils, Daniel W Woods and Rainer Böhme, Rainer. 2021. Privacy Preference Signals: Past, Present and Future. Proceedings on Privacy Enhancing Technologies. 2021. 249-269.
[39]
Thomas Hoeren and Philip Bitter. 2019 (Re)Strucutring Data Law: Approaches to Data Property. [2019] Bergener/Räckers/Stein (Ed.), The Art of Structuring. Springer, Berlin. 297-305.
[40]
Kai-Lung Hui and IPL Png. 2006. The Economics of Privacy. Terrence Hendershott (Ed.), Handbook in Information Systems, Vol. 1, Elsevier, B.V.
[41]
Tim Jülicher. 2015. Daten in der Cloud im Insolvenzfall – Ein internationaler Überblick. Kommunikation und Recht (K&R) 8 (August 2015), 448-452.
[42]
Irene Kamara, Eleni Kosta, Do Not Track initiatives: regaining the lost user control, International Data Privacy Law 6, 4 (April 2016), 276-290.
[43]
M. R. Leiser and Mirelle M. Cuarana. 2021. Dark Patterns: Light tob e Found in Europes Consumer Protection Regime. EuCML 6 (2021) 237-252.
[44]
Duncan McCann, Will Stronge and Phil Jones. 2021. The Future of online Advertising – Exploring the impacts of surveillance-based advertising, current trends in adtech and the challenges and opportunities oft a total ban on the use of personal data. (October 2021). Retrieved February 7, 2022 from https://digitalcourage.de/sites/default/files/2021-10/McCann%2C%20Stronge%2C%20Jones%20%282021%29%20-%20The%20Future%20of%20Online%20Advertising.pdf
[45]
Aleecia McDonald and Jon M. Peha. 2011. Track Gap: Policy Implications of User Expectations for the 'Do Not Track' Internet Privacy Feature. (September 25, 2011). TPRC, (September 2011).
[46]
Eli M. Noam and Everett C. Parker. 1994. Privacy in Telecommunications: Markets, Rights and Regulations. Office of Communication, United Church of Christ.
[47]
Noyb. 2021. noyb setzt dem Cookie-Banner-Wahnsinn ein Ende. (May 31, 2021). Retrieved February 7, 2022 from https://noyb.eu/de/noyb-setzt-dem-cookie-banner-wahnsinn-ein-ende
[48]
Boris P. Paal and Moritz Hennemann. 2018. Big Data as an Asset. Retrieved February 3, 2022 from https://www.abida.de/sites/default/files/Gutachten_ABIDA_Big_Data_as_an_Asset.pdf.
[49]
Emmanouil Papadogiannakis, Panagiotis Papadopoulos, Nicolas Kourtellis, and Evangelos P. Markatos. 2021. User Tracking in the Post-cookie Era: How Websites Bypass GDPR Consent to Track Users. Proceedings of the Web Conference 2021. Association for Computing Machinery, New York, NY, USA, 2130–2141.
[50]
David J Park. 2017. Individualization, information asymmetry, and exploitation in the advertiser-driven digital era. The Political Economy of Communication 5, 2(2017), 22-44.
[51]
Paul A. Pavlou. 2011. State of the information privacy literature: where are we now and where should we go? MIS Quarterly 35, 4 (December 2011), 977-988.
[52]
Denise Quintel and Robert Wilson. 2020. Analytics and privacy. Information Technology and Libraries 39, 3 (2020).
[53]
Eric A. Posner. 2008. Human welfare, not human rights. Columbia. Law Review 108, (2008), 1758-1801.
[54]
Sunita Rai. 2019. Matomo vs. Google Analytics – Which is a Better Web Analytics Tool? (September 2019). Retrieved February 7, 2022 from https://www.monsterinsights.com/matomo-vs-google-analytics/
[55]
Allen Randall. 1983. The Problem of Market Failure. Natural Resources Journal 23, 1 (1983): 131–48.
[56]
Christoph Reich. 2018. Überblick über Betroffenenrechte nach der Datenschutz-Grundverordnung und dem Bundesdatenschutzgesetz (neu). Verbraucher und Recht, 8 (August 2018), 293-297.
[57]
Barbara Sandfuchs. 2021. The Future of Data Transfers to Third Countries in Light of the CJEU's Judgment C-311/18 – Schrems II. GRUR Int. 70, 3 (March 2021), 245-249.
[58]
Joseph Savirimuthu. 2021 Lawfulness of Pre-formulated Declarations of Consent. EuCML, 4 (2021), 169-172.
[59]
Pascal Schumacher, Lennart Sydow and Max von Schönfeld. 2021. Cookie Compliance, quo vadis? MMR, 8 (August 2021), 603-609.
[60]
Rolf Schwartmann und Lucia Burkhardt. 2021. Schrems II“ als Sackgasse für die Datenwirtschaft? Zeitschrift für Datenschutz, 5(May 2021), 235-257.
[61]
Jen Slemp. 2019. Is Google Analytics 360 Worth the Price Tag?. Retrieved February 7, 2022 from https://www.thirdandgrove.com/insights/is-google-analytics-360-worth-price-tag/
[62]
H. Jeff Smith, Tamara Dinev, Heng Xu. 2011. Information Priviacy Research: an interdisciplinary review. MIS Quarterly 35, 4 (December 2011), 989-1015.
[63]
Christine Utz, Martin Degeling, Sascha Fahl, Florian Schaub, and Thorsten Holz. 2019. (Un)informed Consent: Studying GDPR Consent Notices in the Field. In 2019 ACM SIGSAC Conference on Computer and Communications Security (CCS ’19), November 11–15, 2019, London, United Kingdom. ACM, New York, NY, USA, 18 pages. https://doi.org/10.1145/3319535.3354212
[64]
Peter J. van de Waerdt. 2020. Information asymmetries: recognizing the limits of the GDPR on the data-driven market. Computer Law & Security Review 38, (September 2020).
[65]
Arild Vatn and Daniel W. Bromley. 1997. Externalities — A market model failure. Environmental and Resource Economics 9, 2 (1997), 135–151. https://doi.org/10.1007/BF02441375
[66]
Sandra Wachter. 2021. Affinity Profiling and Discrimination by Association in Online Behavioural Advertising. Berkeley Technology Law Journal 35, 2 (2021), 369–430.
[67]
Julian Wagner. 2018. The transfer of personal data to third countries under the GDPR: when does a recipient country provide an adequate level of protection? International Data Privacy Law.
[68]
Web Technology Surveys. Usage statistics and market share of Google Analytics for websites Retrieved February 3,2022 from https://w3techs.com/technologies/details/ta-googleanalytics
Index Terms
- Internalization of Privacy Externalities through Negotiation: Social costs of third-party web-analytic tools and the limits of the legal data protection framework
Recommendations
Freely Given Consent?: Studying Consent Notice of Third-Party Tracking and Its Violations of GDPR in Android Apps
CCS '22: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications SecurityAdopted in May 2018, the European Union's General Data Protection Regulation (GDPR) requires the consent for processing users' personal data to be freely given, specific, informed, and unambiguous. While prior work has shown that this often is not given ...
Popular, but hardly used: Has Google Analytics been to the detriment of Web Analytics?
WebSci '23: Proceedings of the 15th ACM Web Science Conference 2023Since 2005, Google has been offering a free version of Google Analytics, allowing website owners to access detailed user behavior data. However, while more and more features and tools have been added to the Google measurement suite since then, it is ...
Opening Privacy Sensitive Microdata Sets in Light of GDPR
dg.o '19: Proceedings of the 20th Annual International Conference on Digital Government ResearchTo enhance the transparency, accountability and efficiency of the Dutch Ministry of Justice and Security, the ministry has set up an open data program to proactively stimulate sharing its (publicly funded) data sets with the public. Disclosure of ...
Comments
Information & Contributors
Information
Published In
April 2022
1338 pages
ISBN:9781450391306
DOI:10.1145/3487553
Copyright © 2022 ACM.
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].
Sponsors
Publisher
Association for Computing Machinery
New York, NY, United States
Publication History
Published: 16 August 2022
Check for updates
Author Tags
Qualifiers
- Research-article
- Research
- Refereed limited
Conference
WWW '22
Sponsor:
Acceptance Rates
Overall Acceptance Rate 1,899 of 8,196 submissions, 23%
Contributors
Other Metrics
Bibliometrics & Citations
Bibliometrics
Article Metrics
- 0Total Citations
- 82Total Downloads
- Downloads (Last 12 months)39
- Downloads (Last 6 weeks)1
Other Metrics
Citations
View Options
Get Access
Login options
Check if you have access through your login credentials or your institution to get full access on this article.
Sign inFull Access
View options
View or Download as a PDF file.
PDFeReader
View online with eReader.
eReaderHTML Format
View this article in HTML Format.
HTML Format