> They likely don’t understand the cost. Personally or systemically.
How would you explain the cost to someone? Most of the discourse seems to boil down to some mix of "it's creepy" and "it could be used for a nefarious purpose", which is not super convincing.
For most commercial surveillance, I can't. Provable harm from the Equifax breach remains unquantified. We're only beginning to discuss those data for e.g. Facebook and teenagers. To give analogy, we're in the 1960s on the smoking-regulation timeline [1].
It is very difficult. In most cases people aren't affected. Those that might understand the need for privacy are those that lost their jobs because of posting on social media or being naked in the wrong place. Currently the data that is shared between ad networks is rarely public, but embarrassing information could be found everywhere and what is considered as such might change with time. Is isn't just the access log of your head of state to youporn or something like that, it is also the info about trivial consumption choices that can come back at you.
Legislators made it far worse because they demanded additional data to be saved for "security purposes". So not even here people are informed about the problem. On the contrary, we regularly have old farts making everything much worse.
Frankly, those that believe they can save some bucks when they share their data probably aren't the best to understand the larger picture. The data is valuable for different purposes but it is also difficult to put a price tag on it.
What was the cost of the Cambridge Analytica scandal to the average user?
There were a lot of people in the data set, certainly, but how many can quantify damages?
If anything the Cambridge Analytica scandal was (disturbing) "win" for privacy loss: a lot of the Cambridge Analytica demographics markers were baked into the Facebook ad platform and became standard ad demographics soon after. The Cambridge Analytica scandal as played out looked like Facebook was stamping out bad privacy practices using its platform, but the real message was Facebook eliminating a competitor to their ad business by eliminating their access to Facebook's data. Lucky for Facebook the PR mostly stuck with the face value of "stamping out bad privacy practices", but even a lot of the people that saw/realized it was simply Facebook eliminating a competitor have mostly shrugged and continued to use Facebook (though Facebook did add some opt-outs at that much more modest uproar, versus all the loud thundering noise Cambridge Analytica got).
It may have influenced the result of the 2016 US presidential election.
IIRC, the Trump used that data set to send targeted ads to ~90M independent and republican voters. Independents got ads attacking Clinton and emphasizing prominent Trump supporters. Republicans got turnout-oriented ads.
Provided he won by less than 100k votes (and lost the popular vote), the cost to the median US citizen was likely quite large.
I didn’t know the same demographic markers had been baked into the platform. This is very concerning.
Cambridge Analytica had no way to buy Facebook ads, which were the primary platform of these micro-targeted ads during the campaign, specific to people in the gathered data they had without Facebook platform support. Facebook ads never had an API that you could just give it user IDs or emails and target them specifically (and one would hope that Facebook would eye any such ad campaign with suspicion even before scandals like Cambridge Analytica). Cambridge Analytica had to encourage Facebook to add most of its same demographic markers into the platform to pull that off. That's definitely one of those "it takes two to Tango" sort of things where if it wasn't in Facebook's platform, how did they target those ads in 2016?
Certainly they cross-compiled that data with other ad systems and phone lists and who knows what else, but given the scandal with respect to that specific campaign was primarily about their micro-targeted Facebook ad buys, Facebook is still left culpable as the platform owner at the end of the day.
But I'm of the belief that micro-targeted ads should be illegal in general, and all of the micro-targeting enabling ad platforms seriously questioned for what they've enabled in the last decade or so. The fact that they are generally acceptable and multi-billion dollar revenue generators is its own reminder of what this thread is about that the average person doesn't seem to care about all of these invasive data privacy issues.
I didn't know FB had been actively involved in the process, I thought they had just been criminally negligent regarding the amount of data third parties were allowed to gather.
> the average person doesn't seem to care about all of these invasive data privacy issues.
I know, anecdotally, I became half a pariah in my family for refusing to register and share pics of my kids on WhatsApp. That was after the FB purchase, but before they changed the terms of service. I didn't trust FB, and was ultimately proven right.
Semi-related to that, when Facebook did finally roll out it's opt out from certain ad demographics tools in I want to say 2018-ish they included a view of your own demographics (if you could find your way through Facebook's maze of Privacy Settings with many corridors all alike), a Slack I was in at the time and I went through all of our personal demographics and one lasting result of that conversation was renaming one of the channels to #friendsofexpats because "Friend of Expats" was the creepiest, almost threatening sounding demographic tag that we all seemed to share (among other creepy, almost threatening demographic tags that don't actually sound useful to non-evil advertising). Because that was memorialized in a channel name that one has stuck with me since.
How would you explain the cost to someone? Most of the discourse seems to boil down to some mix of "it's creepy" and "it could be used for a nefarious purpose", which is not super convincing.