On March 17, 2018, the New York Times and the Guardian published simultaneous investigations revealing that a data analytics firm called Cambridge Analytica had harvested the personal data of approximately 87 million Facebook users without their knowledge or consent. The data had been obtained through a personality quiz app called "thisisyourdigitallife," created by the academic researcher Aleksandr Kogan, which collected not only the data of users who installed it but — exploiting a loophole in Facebook's API permissions — the data of all those users' Facebook friends as well. Cambridge Analytica had used this data to build psychographic profiles deployed in targeted political advertising, including for the 2016 US presidential campaign and the Brexit referendum.

The story landed with extraordinary force in public discourse. Facebook's stock lost roughly $100 billion in market capitalization within days. Mark Zuckerberg was summoned to testify before Congress. In hours of nationally broadcast testimony, the exchange that crystallized what many people were hearing for the first time came when Senator Orrin Hatch asked how Facebook sustained a business model in which users do not pay for the service. Zuckerberg paused, then said: "Senator, we run ads." The model — collect behavioral data, use it to sell targeted advertising — had been visible for fifteen years. But for millions of people, the Cambridge Analytica revelation was the first time that model felt threatening rather than merely convenient.

The legal scholar Daniel Solove had anticipated this reaction in his 2011 book Nothing to Hide: The False Tradeoff Between Privacy and Security. Solove's central argument was that the common dismissal of privacy concerns — "if you have nothing to hide, you have nothing to fear" — fundamentally misunderstands what privacy is and why it matters. Privacy is not primarily about concealing shameful secrets. It is about the distribution of power between individuals and institutions, and about the conditions under which people can make autonomous choices about their own lives. Cambridge Analytica was not threatening because it revealed secrets. It was threatening because it demonstrated that intimate knowledge of psychological vulnerabilities, combined with the targeting capabilities of digital advertising platforms, could be used to influence political behavior at scale — and that individuals had no meaningful knowledge that this was happening, let alone any ability to prevent it.

"Privacy is not about having something to hide. It is about the power to shape one's own narrative, to be free from surveillance, manipulation, and control." — Daniel Solove, Nothing to Hide: The False Tradeoff Between Privacy and Security (2011)

Key Definitions

Data privacy (also called information privacy) refers to the individual's right to control how their personal information is collected, stored, shared, and used. It encompasses both the legal frameworks that regulate data collection and the practical choices individuals make about what information they share with whom. Data privacy is conceptually distinct from data security (which concerns protecting data from unauthorized access) and from secrecy (which concerns keeping information hidden from specific parties); it is better understood as a form of contextual integrity — the principle, developed by philosopher Helen Nissenbaum, that information flows appropriately when they match the norms of the context in which information was originally shared.

Personal data (the term used in European law) or personally identifiable information (PII, the US term) refers to any data that can identify a specific individual, either directly (name, email address, national identification number) or indirectly through combination with other data. Modern data collection blurs this distinction: data that appears anonymous in isolation — browsing patterns, location data, purchase history — can frequently be de-anonymized by combining it with other data sets. Research by Latanya Sweeney at Harvard demonstrated that 87 percent of Americans could be uniquely identified using only three data points: zip code, date of birth, and sex.

Surveillance capitalism is the term coined by the social theorist Shoshana Zuboff in her 2019 book The Age of Surveillance Capitalism for the economic logic that governs the digital information economy. The term is defined and discussed in detail below.

How Data Is Collected: First-Party, Third-Party, and Inferred Data

The data ecosystem that exists around any individual digital user is substantially more extensive than most users appreciate. It can be organized into three broad categories.

First-party data is information that a user directly provides to a specific service: account registration details, forms, purchase histories, search queries on a given platform, content uploaded or posted, and messages sent. This data is collected with the user's explicit knowledge (though not necessarily with meaningful understanding of how it will be used), and it is governed by the platform's privacy policy, which most users do not read.

Third-party data is information collected by entities other than the platform the user is actively using, typically through tracking technologies embedded across the web. The most important of these is the tracking cookie — a small text file placed on a user's browser by an advertising network or analytics provider when they visit a website that has embedded that provider's code. Because the same advertising networks (Google, Meta, and their competitors) have embedded tracking code on millions of websites, they can observe a user's browsing behavior across enormous proportions of the web, building profiles of interest, intent, and behavior that no individual site could compile on its own. The extent of third-party tracking was dramatically illustrated by a 2016 study by Tim Libert of the University of Pennsylvania, which found that 90 percent of the websites he analyzed sent data to third-party domains, and that Google trackers were present on approximately 75 percent of the top million websites.

Location data collected by smartphone apps represents a particularly invasive category of third-party data. Apps that request location permissions can, if those permissions are granted continuously, build a detailed record of where a user goes throughout the day — home address, workplace, medical facilities visited, places of worship attended, political meetings attended. This data is typically sold to data brokers, who aggregate and resell it. The New York Times Privacy Project's 2019 analysis of a single location data file from a broker demonstrated that it contained the precise movements of over 12 million Americans, recorded with sufficient precision to identify individuals at specific addresses, including the homes of government officials and the locations of sensitive government facilities.

Inferred data is perhaps the most conceptually surprising category. Modern machine learning systems can infer attributes that users have never explicitly disclosed from the behavioral traces they leave. The most rigorous study of this capacity was published in 2013 in the Proceedings of the National Academy of Sciences by Michal Kosinski, David Stillwell, and Thore Graepel of Cambridge University. Using a dataset of 58,000 Facebook users who had voluntarily shared their Facebook "likes" and completed standard psychometric and personality assessments, the researchers trained models to predict user attributes from likes alone. The results were striking: from Facebook likes, the models could predict with statistically significant accuracy a user's gender (93 percent accuracy), sexual orientation (88 percent), political affiliation (85 percent), race (95 percent), religious affiliation (82 percent), and personality traits on the "Big Five" dimensions (correlations of 0.31-0.43 with self-reported scores). Users whose Facebook likes most strongly predicted sexual orientation had often liked pages with no apparent connection to sexuality — "No H8 Campaign," "Wicked the Musical," or "Britney Spears." The inferential power came not from any single signal but from the accumulated statistical patterns across thousands of users.

Surveillance Capitalism: Zuboff's Framework

Shoshana Zuboff's The Age of Surveillance Capitalism (2019) is the most comprehensive theoretical account of the economic logic driving the data privacy crisis. Zuboff argues that beginning in the early 2000s, primarily with Google's discovery that the behavioral data generated as a byproduct of search could be sold to advertisers, a new economic logic emerged that she calls surveillance capitalism.

The foundational move of surveillance capitalism, in Zuboff's account, is the appropriation of behavioral surplus — data generated by users' interactions with digital services that goes beyond what is necessary to improve those services for users, and is instead retained for prediction product manufacture. When Google uses a user's search history to display relevant search results, it is using behavioral data to improve the service. When it retains that search history, combines it with location data, email content, YouTube viewing patterns, and app usage, and uses the resulting behavioral profile to sell advertisers the ability to target that user with high precision, it is exploiting behavioral surplus. The user's behavior is the raw material; the advertiser's access to targeted influence is the product.

Zuboff extends this analysis to argue that the goal of surveillance capitalism is not merely to predict behavior but ultimately to modify it. Prediction is commercially valuable because advertisers want to know whether a given user is likely to click on an ad. But behavior modification is more valuable still: an advertising system that can not only predict which users are likely to buy a product but can nudge undecided users toward purchase through targeted messaging, interface design, and social proof is worth more to advertisers than one that merely identifies existing propensities. The behavioral manipulation experiments conducted by Facebook — most controversially, the 2012 "emotional contagion" experiment in which 689,000 users' news feeds were algorithmically modified to show more positive or negative content in order to study effects on the emotional valence of their own posts, published in the Proceedings of the National Academy of Sciences without users' knowledge or consent — illustrate the behavior-modification dimension of surveillance capitalism in practice.

Zuboff's analysis is compelling but not without critics. Some economists argue that she overstates both the effectiveness of behavioral advertising and the degree of consumer manipulation involved. Studies of digital advertising effectiveness show highly variable results, with some rigorous evaluations finding return on investment substantially below what advertising platform metrics suggest. The political scientist Nick Couldry and communications scholar Ulises Mejias, in The Costs of Connection (2019), extend and modify Zuboff's framework by situating surveillance capitalism within longer histories of colonial data extraction, arguing that the logic of claiming naturally occurring data as raw material has precedents in colonial resource extraction.

Legal Rights by Region: GDPR, CCPA, and the Sectoral US Approach

The legal landscape of data privacy is deeply uneven globally, with the European Union's General Data Protection Regulation (GDPR) representing the most comprehensive framework and the United States maintaining a fragmented, sector-specific approach.

The GDPR, which came into force on May 25, 2018, established a set of individual rights over personal data that apply to all individuals in the European Union and European Economic Area, and — crucially — to any organization worldwide that processes the data of EU residents. The key rights include: the right of access (to obtain a copy of data held about you); the right of rectification (to correct inaccurate data); the right of erasure ("right to be forgotten" — to request deletion of data in specified circumstances); the right to restriction of processing; the right to data portability (to receive your data in machine-readable format for transfer to another service); and the right to object to processing.

The GDPR specifies six lawful bases for processing personal data: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Consent, when used as the legal basis, must be freely given, specific, informed, and unambiguous — meaning that pre-ticked boxes, bundled consent, and consent obtained as a condition of service access do not meet the standard. The GDPR explicitly prohibits dark patterns — interface designs that manipulate users into consenting to data collection they would not otherwise agree to. A 2019 report by the Norwegian Consumer Council documented over 150 dark pattern techniques used by Facebook, Google, and Windows 10 to obtain consent, including hidden privacy-protective options, confusing language, and designs that made consent refusal substantially more difficult than consent grant.

In the United States, no comprehensive federal data privacy law existed as of the mid-2020s. Instead, data privacy is governed by a patchwork of sector-specific laws: the Health Insurance Portability and Accountability Act (HIPAA, 1996) for medical data; the Family Educational Rights and Privacy Act (FERPA, 1974) for student records; the Children's Online Privacy Protection Act (COPPA, 1998) for data collected from children under 13; the Gramm-Leach-Bliley Act (GLBA, 1999) for financial data. None of these laws covers the behavioral data collected by advertising-supported platforms — the data at the heart of surveillance capitalism.

The California Consumer Privacy Act (CCPA), which came into effect in January 2020 and was strengthened by the California Privacy Rights Act (CPRA) in January 2023, provides the most comprehensive US state-level privacy rights: the right to know what personal information is collected; the right to opt out of the sale of personal information; the right to non-discrimination for exercising privacy rights; and (under CPRA) the right to correct inaccurate personal information. The CPRA also created a dedicated California Privacy Protection Agency to enforce the law, closing the enforcement gap that had limited CCPA's effectiveness. Several other states have enacted similar legislation, but the lack of federal preemption means the US landscape remains a patchwork.

GDPR Enforcement: Fines and Structural Challenges

The GDPR's enforcement mechanism — fines of up to 4 percent of global annual revenue for the most serious violations — has produced a series of landmark penalties that demonstrate both the regulation's teeth and the limits of financial penalties as behavioral deterrents.

In May 2023, the Irish Data Protection Commission (DPC) issued a 1.2 billion euro fine against Meta Platforms for transferring the personal data of European users to the United States in ways that failed to adequately protect them from US government surveillance. The fine was the largest in GDPR history and followed a years-long enforcement saga stemming from a complaint filed by privacy activist Max Schrems in 2013, which had already invalidated two transatlantic data transfer frameworks (Safe Harbor in 2015 and Privacy Shield in 2020). In January 2022, France's Commission Nationale de l'Informatique et des Libertes (CNIL) fined Google 150 million euros and Facebook 60 million euros for making it more difficult to refuse cookies than to accept them — a clear dark pattern violation. In July 2021, Luxembourg's data protection authority fined Amazon 746 million euros for processing personal data in ways that did not comply with GDPR consent requirements.

These fines are substantial in absolute terms but modest relative to the revenues of the companies involved. Meta's 1.2 billion euro fine represented approximately 1 percent of its 2022 annual revenue. The deterrent effect of fines calibrated as percentages of revenue is theoretically well-designed — it scales punishment to the economic capacity of the violator — but in practice, data protection authorities have been reluctant to impose maximum penalties, enforcement has been concentrated in a small number of national authorities (particularly the Irish DPC, which regulates many US tech companies because of their European headquarters in Ireland), and the gap between the volume of complaints filed and enforcement actions taken remains large.

The structural challenges of GDPR enforcement in the era of artificial intelligence have become increasingly prominent. The GDPR's Article 22 provides individuals with rights regarding automated decision-making with significant effects — including the right not to be subject to solely automated decisions and the right to obtain an explanation of such decisions. As AI systems are increasingly used for decisions about credit, employment, insurance, and content moderation, the tension between these rights and the opacity of machine learning models (which typically cannot produce the kind of intelligible explanations GDPR contemplates) has become a major regulatory challenge. The EU's AI Act (2024) represents a legislative attempt to address this tension through risk-based regulation of AI systems, but its interaction with GDPR's data protection framework remains to be worked out in practice.

How to Protect Your Data: Individual Measures and Their Limits

The data privacy literature divides practitioners between those who emphasize individual protective measures and those who argue that individual action is structurally insufficient and that regulatory intervention is the necessary response. Both positions contain important truths.

At the individual level, meaningful privacy protection involves choices across multiple dimensions. Browser choice is foundational: Firefox (with uBlock Origin ad-blocking and Privacy Badger tracker-blocking extensions) and Brave (which blocks third-party trackers by default) provide substantially greater protection against third-party tracking than Chrome, whose business model depends on Google's advertising revenue. Search engine choice matters similarly: DuckDuckGo and Startpage do not build behavioral profiles linked to user identity. For messaging, Signal — which uses end-to-end encryption that prevents even Signal itself from reading messages, and does not retain metadata — provides substantially stronger privacy than SMS, iMessage (which retains unencrypted backups to iCloud by default), or WhatsApp (which shares metadata with Meta). Two-factor authentication protects against account compromise, which represents the most common and immediately consequential privacy failure most individuals face.

Location permissions deserve particular attention given the sensitivity and commercial value of location data. The permission model on both iOS and Android allows users to restrict location access to "while using app" or "ask every time" rather than granting continuous background access; for most apps, continuous background location access is not necessary for the app's stated function. Temporary email addresses (services like SimpleLogin or 10-minute email generators) protect against the harvesting of email addresses by services that users interact with only once. Under GDPR in Europe or CCPA in California, data subject access requests sent to data brokers can reveal the extent of profiling and can be followed by deletion requests — a cumbersome but meaningful exercise of legal rights.

The limits of individual action are, however, substantial and deserve emphasis. Network effects mean that privacy-protective choices come at social costs: Signal is more secure than WhatsApp, but it only protects communications with other Signal users, and most users' social networks remain on less secure platforms. The opacity of data collection means that users cannot meaningfully consent to what they cannot observe; even sophisticated users cannot determine what data is collected about them by which entities, how it is combined, and how it is used. The asymmetry of resources between individual users and large data-processing organizations means that individuals cannot realistically audit their data environment. And the necessity of participating in digital services for employment, social life, education, and civic participation means that exit from the data economy is not a realistic option for most people.

The structural limitation of individual action points toward the necessity of collective response through regulation. GDPR represents the most serious attempt to date to constrain surveillance capitalism through law, but its enforcement challenges, AI-related blind spots, and the political economy of regulatory capture in the tech sector mean that it provides at best a partial solution. The broader project — developing legal frameworks adequate to the power asymmetries of the surveillance economy — remains one of the central governance challenges of the twenty-first century.

For related analysis, see the companion piece at /culture/internet-digital-culture/what-is-surveillance, which examines state surveillance programs alongside corporate data collection, and the discussion at /culture/internet-digital-culture/what-is-social-media, which analyzes the platform business models that surveillance capitalism underwrites.

References

• Acemoglu, D., & Restrepo, P. (2019). Automation and new tasks: How technology displaces and reinstates labor. Journal of Economic Perspectives, 33(2), 3-30.
• Cadwalladr, C., & Graham-Harrison, E. (2018, March 17). Revealed: 50 million Facebook profiles harvested for Cambridge Analytica in major data breach. The Guardian.
• Couldry, N., & Mejias, U. A. (2019). The Costs of Connection: How Data Is Colonizing Human Life and Appropriating It for Capitalism. Stanford University Press.
• European Data Protection Board. (2021). Guidelines 07/2020 on the Concepts of Controller and Processor in the GDPR (version 2.0).
• Forbrukerradet (Norwegian Consumer Council). (2019). Deceived by Design: How Tech Companies Use Dark Patterns to Discourage Us from Exercising Our Rights to Privacy.
• Kosinski, M., Stillwell, D., & Graepel, T. (2013). Private traits and attributes are predictable from digital records of human behavior. Proceedings of the National Academy of Sciences, 110(15), 5802-5805. doi:10.1073/pnas.1218772110
• Kramer, A. D. I., Guillory, J. E., & Hancock, J. T. (2014). Experimental evidence of massive-scale emotional contagion through social networks. Proceedings of the National Academy of Sciences, 111(24), 8788-8790. doi:10.1073/pnas.1320040111
• Nissenbaum, H. (2010). Privacy in Context: Technology, Policy, and the Integrity of Social Life. Stanford University Press.
• Solove, D. J. (2011). Nothing to Hide: The False Tradeoff Between Privacy and Security. Yale University Press.
• Sweeney, L. (2000). Simple demographics often identify people uniquely. Carnegie Mellon University, Data Privacy Working Paper 3.
• Zuboff, S. (2019). The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power. PublicAffairs.
• Zuckerberg, M. (2018, April 10). Testimony before the United States Senate Committee on the Judiciary and the Senate Committee on Commerce, Science, and Transportation.