One of the most tiring memes that float around free services is that if you are not paying for them you must be the product, as in you are ‘sold’ to advertisers.
Being ‘sold’ to advertisers is not unique to free online services - insofar as this actually happens. There are companies that specialize in selling your ‘profile’, these are called credit bureaus and direct marketing bureaus. Most online services do not operate like that (though, for sure some of them do).
The more likely scenario is that you are shown advertising tailored to what the advertisers think you might want to spend money on based on page content and attributes assigned to you. After all, a profile by itself is without any value, someone somewhere at some point will have to pay for something in order for the advertisers to continue to spend their money in turn.
So instead of the simplistic ‘you are the product’ view it is much more complicated. It is more along the lines of:
- you use a free service
- that service may contain advertising
- this advertising will be tailored to you by the service itself because they will
place that particular ad only on pages with visitors matching an advertisers request
- you have the option (definitely not an obligation) of responding to this advertising
(maybe it is simply based on clickthroughs, maybe more complicated performance/rev share)
- you then - possibly - buy some product
- the company advertising now made some money, presumably more than they spent on advertising
- so they decide to advertise some more
- which gives the company that offered you the service some money to run their operation
Whether or not your profile got ‘sold’ to the advertiser or not is not knowable from the outside, it very well may be the case but there are plenty of companies that guard their user profiles very carefully. Many countries have strict laws on what you can do in this respect as well. So you are most likely not ‘sold’ with your detailed information available to the advertisers. The much more likely scenario is that an advertiser requests that their ad will be shown only to visitors of the website that are single, female between 20 and 40 with an income level of ‘x’. There is plenty to comment on just based on that but this scenario is entirely possible without the advertiser ever getting so much as a glimpse of your profile.
To give you an idea how complicated the advertising market really is, have a look at this image: (courtesy of Improve Digital: Advertising Market Map (pdf). The sheer number of parties involved and their various interactions means that simply ‘selling your profile to an advertiser’ is an act that would make that profile almost instant public knowledge because of the chain it would have to traverse to reach the advertiser.
A much more likely scenario is that instead of your profile being sold directly you are being tracked by any number of these parties independently where each and every move you make on the web ends up in a table somewhere to augment that instance of your profile with that particular party. So you do not just have profiles on those sites that you visit, you have profiles in many places associated with those sites that have the ability to reconcile this data across different websites. There are many mechanisms that facilitate this, such as web-bugs, like buttons, widgets and so on. Arguably that is a much more serious problem than someone having access to your facebook graph and your ‘wall’. In other words, you could leave facebook tomorrow, but your profile would live on with many parties that you are probably not even aware of!
Of course facebook (or google, or any other big company) holds a much more extensive profile on you besides just basic demographic information. One Austrian man by the name of Max Schrems asked for his complete facebook profile and to his surprise received a cd with 1122 pages of information listing his moves over the last 3 years (Europe vs facebook). I highly doubt even facebook (which has a long history of blatant privacy violations and a total lack of ethics in this respect) would be so dumb as to sell that profile outright. For one it would get them in instant trouble with the law, second it is much more profitable to sell access to their users rather than their users profiles.
Then there is another problem with the ‘if you’re not paying you are the product’ meme: Nothing stops a company where you are paying for the use of the service from compiling an extensive profile on you and possibly selling that to other companies.
You’d have to be an insider to know about it. The chances of this happening are probably lower than with free services, especially when they’re supported by advertising but you simply can not rule it out and with things like this it is better to err on the side of caution.
Yet another way in which your profile can get sold even when you are paying for a service is when the service is acquired by a bigger fish. Suddenly some party that you have no prior arrangement with and that you may actually not want to have insight into your data has access to all of it, and moreover they can merge it with whatever they already had on you.
The next big mistake that the incessant promotors of this meme make is that it is very well possible to have free services with or without advertising that do not treat their users profile in such a cavalier manner and that do not work with advertising networks.
For instance, some companies arrange all of their advertising in-house. Google is a good example of a company like this, even if they tailor their ads as good as possible to you as a person they don’t sell - as far as I know - any profile information to advertisers. You simply make your ad, set some demographic requirements and google will then match that ad to the visitors on their properties.
Another possibility for free services without any direct involvement of advertisers with any of your data is the freemium model, where a relatively small portion of the users (sometimes < 1%) pays for the entirety of the service with room to spare.
In that case, even though the service is completely free for those who can not or do not wish to pay there are no profiles, no tracking and you are definitely not ‘the product’.
Finally, there are companies that only do ‘display’ ads, where there is no targeting other than that of selecting on which websites the advertising will run.
In each of those cases you are not being ‘sold’, and the product is 100% free.
If you are worried about your online privacy (and you probably should be) then you can guard yourself easily depending on your level of discomfort about this.
- use an adblocker (for instance: http://adblockplus.org/en/)
- install a web bug blocker (for instance: http://www.ghostery.com/)
- use a browser that is not tied to a company
(I recommend firefox: http://www.mozilla.org/)
- do not install any toolbars or other add-ons that may compromise your privacy
- if you must use a service that you suspect is not treating your privacy in a
good way use them as sparingly as possible
- do not use services that do not state clearly in their terms of service what
their uses of your data are
I think the ‘you are not the user, you are the product’ meme should die. It does a dis-service to the complexity of the situation and it masks some much more serious issues with online monetization models, and online privacy in general.