Surveillance Capitalism: What Each Position Is Protecting

A thirty-one-year-old graduate student in Chicago has never paid for a search engine, an email account, a social network, a navigation app, or a video platform. In exchange for this, her search history, her correspondence, her location at every hour of the past nine years, her purchasing patterns, her political interests, her health queries, her relationship status, her sleep schedule inferred from device activity, and her emotional valence inferred from the words she chooses have been collected, stored, and sold to parties she has never heard of. She agreed to this. She clicked the box. She knows, in a general way, what she agreed to, because the basic mechanics are no longer a secret. She keeps using the services because they work and because opting out of them would mean opting out of the infrastructure of modern life. She is not sure whether to call herself a consumer, a product, a subject, or just someone trying to get directions.

A product manager at a mid-sized advertising technology firm believes the arrangement is genuinely fair. The services his company's clients use to reach her are funded by her data, and the services she receives — navigation, communication, information retrieval, entertainment — are real and valuable. He knows they cost money to provide. He believes she knows she is paying with her attention and her data, and that she continues to choose the deal because the deal is good. He is not indifferent to privacy concerns. He would support reasonable consent requirements. He resists the framing that she is being exploited, because exploitation requires a victim who is harmed, and he does not see the harm. What he sees is a functional exchange that funds a digital ecosystem billions of people chose to participate in.

Shoshana Zuboff spent a decade studying the architecture that connects these two people. Her conclusion was that neither of their accounts is adequate to describe what is actually happening. The graduate student is not simply a consumer or a product. The product manager's company is not primarily in the advertising business. What is actually happening, Zuboff argues, is that human experience has become the raw material of a new economic logic — one that converts behavioral data into predictions about future behavior and sells those predictions to any buyer willing to pay. The graduate student does not know which buyers. She does not know what they are predicting. She cannot see the feedback loops between the predictions and the content she is shown next. The product manager's account of a fair exchange misses the part of the transaction she cannot observe.

These three people are not arguing about privacy in the ordinary sense. They are arguing about what kind of thing the data economy is, who owns the power it generates, and whether the existing legal and market frameworks are even asking the right questions.

What data rights advocates are protecting

The data rights position holds that individuals should have meaningful control over personal data — what is collected, how it is used, who it is shared with, and for how long it is retained. The European Union's General Data Protection Regulation, enacted in 2018, is the most consequential implementation of this framework: it establishes rights to access, correction, deletion, and portability; requires explicit and informed consent for data collection; restricts the purposes for which collected data can be used; and imposes significant penalties for violations. Data rights advocates are protecting several interconnected goods.

They are protecting meaningful consent as the foundation of legitimate exchange. Woodrow Hartzog's Privacy's Blueprint: The Battle to Control the Design of New Technologies (Harvard University Press, 2018) argues that the consent mechanisms through which people nominally agree to data collection are systematically designed to be ineffective — dark patterns, buried settings, cognitive overload from terms of service documents that would take hours to read, interface designs that make consent the easiest click and refusal the most cumbersome. Hartzog's argument is not that people should not be able to consent to data collection; it is that the current system produces a fiction of consent that insulates companies from accountability while providing users no meaningful protection. Data rights advocates are protecting the principle that consent should be substantive rather than performative — that clicking a box under conditions of manufactured confusion is not the same as genuine agreement.

They are protecting contextual integrity — the idea that information should flow in ways that match the norms of the context in which it was shared. Helen Nissenbaum's framework, developed in Privacy in Context (Stanford University Press, 2010), gives this intuition philosophical precision: the problem with surveillance capitalism is not that data flows at all but that it flows in ways that violate the expectations under which it was generated. Health data shared with a physician appropriately flows to other treating physicians. It does not appropriately flow to an insurer, an employer, or a political data broker. Location data shared with a navigation app to get driving directions does not appropriately flow to a law enforcement agency tracking a political protest. The harm is not disclosure per se but contextual betrayal — information weaponized against the person who generated it, in contexts she could not anticipate when she shared it.

They are protecting the practical consequences of de-identification failure. Paul Ohm's "Broken Promises of Privacy" (UCLA Law Review, 2010) documented the systematic failure of anonymization as a privacy technique: researchers have repeatedly demonstrated that supposedly anonymized datasets can be re-identified using external information, often with remarkably little data. The Netflix Prize dataset, "anonymized" for a public research competition, was re-identified by Narayanan and Shmatikoff using only two or three correlated movie ratings. Location data with identifying information stripped is re-identifiable from four spatio-temporal data points alone. Ohm's argument is that legal frameworks built on the promise that data can be safely anonymized are systematically undermined by the actual capabilities of re-identification — and that data rights protections (minimization, deletion) are the only reliable backstop against a harm that technical pseudonymization cannot prevent.

What market defenders are protecting

The market position holds that the data economy, while imperfect, represents a voluntary and broadly beneficial exchange: users receive services of genuine value in exchange for data that funds those services. Heavy-handed regulation, on this view, risks eliminating the exchange by making it legally or economically unworkable — which would either eliminate the services entirely or force users to pay for them directly, producing access barriers that would harm the least wealthy users most. The market position is not indifferent to privacy; it is skeptical that regulatory intervention will improve outcomes rather than creating new harms.

They are protecting the value of services that data-funded models make universally accessible. The search engine, the navigation tool, the communication platform, the email account, the video service — these have become fundamental infrastructure for employment, education, civic participation, and social life. Before digital advertising funded this infrastructure, equivalent services were either unavailable or available only to those who could pay for premium versions. Market defenders argue that the data-for-services exchange has democratized access to capabilities that would otherwise be stratified by income — and that regulation calibrated to protect users from hypothetical data harms risks producing a two-tiered system where premium users pay for privacy while everyone else gets worse services or no services at all.

They are protecting the self-correcting capacity of competitive markets. The argument is not that every data practice is benign but that market competition gives companies ongoing incentives to respond to user preferences about privacy. Users who feel mistreated will switch to competitors; companies that develop reputations for data abuse will lose market share; new entrants can compete on privacy as a feature. This mechanism is imperfect — switching costs are real, network effects create lock-in, many privacy harms are invisible — but market defenders argue that regulatory intervention, particularly at the hands of agencies that struggle to keep pace with technological change, tends to generate compliance theater rather than genuine protection. Regulation is also most easily absorbed by large incumbents with legal and compliance departments, meaning that stringent data regulation can paradoxically entrench the platforms it is ostensibly designed to constrain.

They are protecting personalization as a genuine good, not merely a technique for manipulation. Targeted advertising funds content that would not otherwise exist commercially; recommendation algorithms surface content that users actually want to see; personalized services improve over time as they learn user preferences. The market defender's argument is not that personalization cannot be misused — it can — but that critics of surveillance capitalism routinely conflate the misuse of personalization with personalization itself, and that a regulatory framework that treats all behavioral data use as suspect will eliminate genuinely valuable applications alongside genuinely harmful ones. The question is not whether to permit personalization but how to distinguish its legitimate from its manipulative forms — a distinction that requires precision rather than prohibition.

What behavioral modification critics are protecting

Shoshana Zuboff's The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power (PublicAffairs, 2019) introduces a critique that does not fit comfortably in either the data rights or the market framework. Zuboff's argument is that surveillance capitalism is not primarily about data collection — it is about what data collection enables: a new form of power, the power to predict and modify behavior at scale. The behavioral futures market sells not just predictions about what people will do but interventions that make those predictions come true. Data rights frameworks address the collection end; Zuboff's critique is aimed at the modification end, which data rights legislation largely leaves untouched.

They are protecting cognitive liberty — the right not to have one's choices shaped by invisible forces acting on information asymmetry. The asymmetry Zuboff documents is not just informational (the platform knows things about you that you do not know it knows) but operational: the platform can use that information to serve you content, shape your interface, and time its interventions to produce behavioral outcomes that you do not know you are being steered toward. This is not ordinary advertising, where the persuasive intent is visible and the audience can consciously accept or reject the pitch. It is behavioral modification at the level of choice architecture itself — manipulation of the conditions under which choices are made rather than of the choices directly. The data rights advocate's demand for consent addresses the collection; it does not touch the modification apparatus that operates on the other side of the collection.

They are protecting epistemic autonomy at the population scale. Frank Pasquale's The Black Box Society: The Secret Algorithms That Control Money and Information (Harvard University Press, 2015) traces what happens when opaque algorithmic systems control not just advertising but credit, employment, insurance, and the information people receive about the world. The opacity is not incidental — it is strategic: companies cannot be held accountable for systems no one can audit. The behavioral modification critic's position is that the harm is not primarily individual but collective: when the same invisible systems shape the information diets of hundreds of millions of people simultaneously, they shape what those people know, believe, and feel about the world. This is a political problem that individual data rights cannot address — because the modification happens at the population level, not the individual data record level.

They are protecting "the right to a future tense" — Zuboff's phrase for the condition in which one's future behavior is not already predicted, priced, and sold before one has acted. The behavioral futures market requires certainty: the product being sold to advertisers is a reliable prediction that user X will do action Y. Achieving that certainty requires eliminating the behavioral uncertainty that comes from genuine autonomy. Behavioral modification critics argue that surveillance capitalism is structurally incentivized to reduce human freedom — not because it wants to control people in a totalitarian sense but because prediction accuracy is its product and freedom is what makes prediction hard. The market defender's frame of "voluntary exchange" does not reach this level of the argument: the issue is not whether users consent to data collection but whether the economic logic of behavioral prediction is compatible with genuine individual freedom over time.

What structural reformers are protecting

The structural position holds that the problem with surveillance capitalism is not data practices per se but market structure: a handful of platforms have achieved dominance through network effects and data accumulation that has made genuine competition nearly impossible. The solution, on this view, is not primarily data rights legislation or behavioral modification restrictions but antitrust enforcement, interoperability mandates, data portability requirements, and the treatment of essential platforms as regulated utilities. The behavioral modification critic diagnoses a problem with what surveillance capitalism does to individuals; the structural reformer diagnoses a problem with the market conditions that allow it to happen without accountability.

They are protecting competitive markets as the precondition for accountability. Lina Khan's "Amazon's Antitrust Paradox" (Yale Law Journal, 2017) — written before her appointment as FTC chair — argued that antitrust law, built around the consumer welfare standard's focus on price and output, had systematically failed to address the new forms of market power that platform businesses accumulate. A platform that provides services below cost to foreclose competitors, or that uses its marketplace position to advantage its own products over third-party sellers, harms competition even if consumers observe no price increase. Khan's argument extends to data: a platform that accumulates proprietary behavioral data at scale has a competitive moat that new entrants cannot cross — not because their product is better but because they lack the data. Data accumulation as competitive foreclosure is an antitrust problem, not a privacy problem, and the regulatory tool that addresses it is not a consent requirement but structural intervention in market concentration.

They are protecting interoperability as the mechanism of genuine user choice. The market defender's argument that users can switch to better services rests on switching being practically possible. On social networks, the barrier to switching is not the service itself but the social graph: your friends are there, and moving means leaving them behind. Tim Wu's The Attention Merchants: The Epic Scramble to Get Inside Our Heads (Knopf, 2016) traces how the advertising business model has, throughout its history, created recurring cycles of audience capture followed by degradation followed by exodus — and argues that the current cycle is unusually difficult to break because network effects create lock-in that advertising-era magazines and television stations never had. Structural reformers argue that interoperability requirements — mandating that platforms allow users to communicate across networks, as email does — would restore the conditions for competition to function as a discipline on data practices. You could switch without leaving your social graph behind.

They are protecting democratic accountability over infrastructure that has become essential. Ari Ezra Waldman's Industry Unbound: The Inside Story of Privacy, Data, and Corporate Power (Cambridge University Press, 2021), drawing on interviews with privacy engineers and policy teams inside major technology companies, documents a systematic pattern: privacy compliance is treated as a legal risk to be managed rather than a user interest to be served; privacy teams operate under conditions that make genuine protection structurally difficult to achieve; and the gap between stated privacy commitments and actual practice is not primarily the result of bad intentions but of an economic model in which privacy protection conflicts with the core business. Waldman's argument is that the problem is structural — it cannot be solved by better corporate ethics or stronger consent requirements — and that the only durable solution is democratic oversight of essential infrastructure operating in the public interest, not primarily in the interest of shareholders whose returns depend on behavioral data extraction.

Where the real disagreement lives

The surveillance capitalism debate is structured by several genuine disagreements that procedural or regulatory solutions often fail to reach.

The consent fiction problem. All four positions agree that "click Accept on forty-three pages of terms of service" is not meaningful consent. They disagree about what follows. Data rights advocates conclude that better consent mechanisms — shorter disclosures, granular opt-outs, periodic renewal — can repair the fiction. Behavioral modification critics argue that consent is insufficient even when it is genuine: consenting to data collection does not consent to the behavioral modification apparatus that operates on the other side of it. Structural reformers argue that consent is the wrong frame entirely — because the structural conditions that make surveillance capitalism possible cannot be addressed at the individual transaction level. Market defenders argue that consent mechanisms, if simplified and meaningful, are adequate. The argument is not about whether consent matters; it is about what consent is capable of accomplishing in this context.

The product question. The four positions cannot fully agree on what surveillance capitalism is selling. Is the product the services users receive — search, navigation, communication — and the data collection is the cost? Is the product the user's attention, sold to advertisers? Is the product behavioral prediction futures, sold to anyone who will pay? Is the product market foreclosure — the accumulation of competitive advantages that make rivals unable to enter? Each answer leads to different diagnoses and different regulatory responses. Consent requirements are designed for a product-as-services frame. Behavioral modification restrictions address the product-as-prediction frame. Antitrust enforcement addresses the product-as-market-control frame. None of these responses addresses the others' diagnosis.

The level-of-analysis problem. Data rights operate at the individual level: your data, your consent, your access. Behavioral modification concerns operate at the population level: what happens when invisible systems shape the information diets of hundreds of millions of people simultaneously. Antitrust concerns operate at the market level: what happens to competition when data is a moat. These are not competing answers to the same question. They are answers to different questions operating at different levels of abstraction. A policy framework that addresses individual data rights while ignoring population-level modification and market structure is not wrong — it is solving one problem while leaving the others intact.

The comparison problem. Market defenders compare a regulated version of the data economy to an unregulated one and ask who loses access to services. Behavioral modification critics compare the data economy to a counterfactual in which cognitive liberty is legally protected and ask how different human choice-making looks in that world. Structural reformers compare concentrated platform power to a world with genuine competition and ask whether the current arrangement was the necessary consequence of technological development or a contingent outcome of regulatory failure. These comparisons are not contradictory, but they are not measuring the same thing. Deciding which comparison is most important is not a technical judgment. It reflects a prior commitment about which dimension of the problem — individual rights, collective cognition, or market structure — is the primary site of the harm.