Regulating Data Monetization

Companies today generate hundreds of billions of dollars each year by collecting massive amounts of information about human activity and wringing predictive insights from it. The scale of these influence activities is stunning: your driving habits dictate your car insurance rates, buying the wrong thing will increase your borrowing costs, and the information ecosystem you inhabit is finely tuned for keeping your attention available to the highest bidder. States have recently enacted new consumer privacy laws that confer on individuals a series of generally applicable rights over their personal information. But this approach has proven ineffective at disciplining firms’ data activities, especially amid a raft of other doctrines that increasingly ensure that corporate platforms exercise all the real power over user-derived data. More fundamentally, conflating privacy with individual control over data misapprehends that privacy is a social phenomenon with a rich array of collective benefits and that the firms that threaten it operate at scale. This Article charts a different course. Rather than relying on individual decision-making to govern scalar processes and collective effects, holding the information age’s real power and profit to account requires going to the source, regulating how companies transform data into money. They do so through individualized differentiation—the process of offering customized, personalized, or otherwise distinct products, services, and prices to their customers, users, employees, and other counterparties. Recognizing that the law already regulates some aspects of these differentiation activities, the Article then proposes that these efforts should be expanded, improved, and systematized in two ways: by disrupting the surveillance trade that fuels differentiation and by imposing new restrictions on the differentiated offerings themselves. This Article’s contributions—uncovering firms’ data-monetization strategies, exposing how law already governs them, and proposing how it should in the future—lay the foundation for a data-governance regime that infuses democratic accountability into the informational processes that govern modern life.