Study on monetising privacy. An economic model for pricing personal information

An economic model for pricing personal information [Deliverable – 2012-02-27]

Study on monetising privacy II An economic model for pricing personal information

Contributors to this report

DIW Berlin, Mohrenstr. 58, 10117 Berlin T. 49-(0)30-897 89 234, F.-103, www.diw.de Kinofix, CPC1 Capital Park, Cambridge CB21 5XE, UK, www.kinofix.de

Authors:  Dr Nicola Jentzsch, DIW Berlin (Germany), team leader  Sören Preibusch, University of Cambridge (United Kingdom)  Andreas Harasser, DIW Berlin (Germany)

Advisers to the project:  Professor Pio Baake, DIW Berlin (Germany)  Professor Dorothea Kübler, WZB (Germany)  Professor Sudipta Sarangi, Louisiana State University (U.S.A.)

ENISA project management:  Demosthenes Ikonomou, ENISA  Rodica Tirtea, ENISA

Other ENISA staff involved in the project:  Barbara Daskala, Stefan Schiffner

Acknowledgements

The authors would like to thank Georg Weizsäcker, Hans-Theo Normann, Robert Pitterle and Sudipta Sarangi for helpful support. We are in particular indebted to Dorothea Kübler and Pio Baake for their advice. The experiment has been approved by the University of Cambridge ethics committee and was reviewed by the Berlin Data Protection Officer. We are also indebted to the research assistants at the Technical University of Berlin, the ESMT, and the cinema operators we cooperated with for this project.

Study on monetising privacy III An economic model for pricing personal information

About ENISA

The European Network and Information Security Agency (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

Contact details

For contacting ENISA or for general enquiries, please use the following details:  E-mail: sta@enisa.europa.eu  Internet: http://www.enisa.europa.eu

For questions related to this project, please use the following details:  E-mail: sta@enisa.europa.eu

Legal notice

Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA Regulation (EC) No 460/2004 as lastly amended by Regulation (EU) No 580/2011. This publication does not necessarily represent state-of-the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. © European Network and Information Security Agency (ENISA), 2012

Study on monetising privacy 1 An economic model for pricing personal information

1 Executive summary

Personal data is nowadays traded like other commodities in the market place, yet our understanding of cost–benefit trade-offs that individuals undertake when making purchases on the Internet and disclosing personal data is far from complete. This study analyses the monetisation of privacy. ‘Monetising privacy’ refers to a consumer’s decision of disclosure or non-disclosure of personal data in relation to a purchase transaction. PPrriivvaaccyy iiss aa hhuummaann rriigghhtt;; tthhiinnkkiinngg aabboouutt tthhee eeccoonnoommiiccss ooff pprriivvaaccyy ddooeess nnoott cchhaannggee tthhiiss bbaassiicc ffaacctt.. TThhee aauutthhoorrss ooff tthhiiss rreeppoorrtt ccoonnssiiddeerr aann eeccoonnoommiicc aannaallyyssiiss ooff pprriivvaaccyy aass ccoommpplleemmeennttaarryy ttoo tthhee lleeggaall aannaallyyssiiss aass iitt iimmpprroovveess oouurr uunnddeerrssttaannddiinngg ooff hhuummaann ddeecciissiioonn--mmaakkiinngg wwiitthh rreessppeecctt ttoo ppeerrssoonnaall ddaattaa.. Do some customers of online services pay for privacy? Do some individuals value their privacy enough to pay a mark-up to an online service provider who protects their information better? How is this related to personalisation of services? The main goal of this report is to enable a better understanding of the interaction of personalisation, privacy concerns and competition between online service providers. Consumers benefit from personalisation of products on the one hand, but might be locked in to services on the other. Moreover, personalisation also bears a privacy risk, i.e. that data may be compromised once disclosed to a service provider. This report employs different methods in order to analyse the questions above. A theoretical model is introduced that takes into account the competition between two service providers. In this respect, consumers may select the service provider of their choice, depending on their privacy concerns and the offers made by service providers. In a variation of the model, consumers may select a service provider, but they may also choose whether they would like to have their services personalised in the future. The analysis of the data requirement of service providers and their pricing strategies shows that different data requirements serve as a differentiation device by which the providers may alter their prices/offerings. A simplified version of the model was implemented in the laboratory in order to better understand how consumers make choices on the basis of the above-mentioned criteria. With 443 participants, the experiment is the largest laboratory experiment in the field of privacy economics to date. Different scenarios were implemented (so-called treatments), where participants were faced with two different service providers offering cinema tickets. The majority of participants who purchased two tickets in the laboratory experiment remained loyal to the service provider used for the first purchase (142 of 152 participants). The laboratory experiment also shows that the majority of consumers buy from a more privacy-invasive provider if the service provider charges a lower price. A non-negligible proportion of the experiment’s participants (13–83%), however, chose to pay a ‘premium’ for privacy. They did so in order to avoid disclosure of more personal data or because the privacyfriendly service provider promised not to use their data for marketing purposes.

Study on monetising privacy 2 An economic model for pricing personal information

The laboratory experiment was complemented by a hybrid and field experiment with over 2,300 participants and 139 transactions and observations. The field experiment confirmed the trends observed in the laboratory; the only difference noticed is that in case of no price difference the privacy-friendly service providers which request less personal data obtained a greater market share. The report concludes with recommendations derived from this study. Users should be provided with options that allow them to disclose less personal data. Since such differentiation might lead to higher service prices, the EU regulatory framework should be sufficiently flexible to allow differentiation between service providers, enabling comparison of prices and requiring market players to offer privacy-friendly services. In the future, easy-to-understand comparison of the data protection practices of service providers will become more important. Only if information practices (i.e. the collection and use of personal data) are more easily comparable will they play a useful role in the consumer’s decisions. Finally, portability of profiles for consumers will reduce potential switching costs which may arise if consumers choose to personalise their product at a particular service provider. Such profile portability should be conditioned on the consent of the consumer.

Study on monetising privacy 3 An economic model for pricing personal information

2 Introduction 2.1 Context and scope

The advances in Information and Communication Technologies (ICTs), the spread of the Internet and new business models, including social networks, as well as new practices such as behavioural profiling, web and location tracking (ENISA 2011a) are posing challenges and are motivating the reform of the data protection legal framework in Europe. In a 2011 EuroBarometer Survey, 74% of Europeans stated that they see disclosing personal data as an increasing part of modern life and 43% of Internet users say they have been asked for more data than necessary when trying to obtain access to or use an online service. A better understanding is needed of the basic mechanisms of consumers’ data disclosure given their existing privacy concerns. Therefore, the rationale of this report is to better understand the consumers’ trade-offs with respect to monetising personal information by disclosure or non-disclosure of it to a service provider (ENISA 2011a: 25). Our knowledge about the economics of privacy; that is, the cost–benefit trade-offs individuals undertake when conducting economic transactions that involve personal information, is far from complete. Likewise, more understanding is required to address questions such as whether and how service providers can gain a competitive advantage by collecting less information on consumers. In its Communication on the Digital Agenda for Europe the European Commission states that a lack of trust in the online environment is hampering the development of Europe’s online economy and that consumers will not shop online if they do not feel their rights are clear and protected. Personal data is nowadays traded among service providers like other commodities, meriting an analysis of individual transactions in the market place. For example, according to ENISA (2011b: 26–27), 47% of the service providers interviewed treated personal data as a commercial asset; and 48% revealed that they share data with third parties (ENISA 2011b: 26– 27). Therefore, it is important to also understand the economic dimension of privacy.

Study on monetising privacy 4 An economic model for pricing personal information

2.2 Methodology, experiments and assumptions

In the first stage of this project the authors reviewed the literature on the economics of privacy, focusing in particular on economic experiments. A number of references are provided and discussed in section 4. One of the main findings is that a large share of literature is devoted to social exchange (such as surveys) and that economic experiments that implement real purchase transactions are rather scarce. To the knowledge of the authors, there are no works in economics that combine theoretical and experimental methods for the analysis of the interplay of privacy concerns, product personalisation and competition. Identification of individuals is a precondition for the collection of their personal data and it is therefore also a precondition for personalisation. Personalisation is the tailoring of characteristics of a product or service to an individual consumer’s preferences. Personal information as a base for personalisation allows the differentiation of consumers and dynamic price discrimination. Personalisation can increase switching costs, if consumers who want to switch to a rival of their current service provider cannot simply transfer information from the old to the new provider. Disclosure of personal data might also induce privacy concerns for some individuals; this may limit the number of service providers to which the individual wants to disclose personal data. For this study an economic model has been developed assuming competition between two service providers. The model developed and used in the study assumes an environment with differentiated products, i.e. differentiation in price, in personalisation level and/or personal data required. The model provides, on the one hand, insights into service providers’ behaviour with regard to the collection of personal data on consumers in a competitive environment, and, on the other hand, information on how consumers react to the collection of such data. The model is presented in two versions – (a) a one-period version, which is used to illustrate some of the effects in the most basic setup where consumers make just one purchase; and (b) a two-period version including product personalisation and consumer ‘lock-in’, where consumers repeatedly interact with the service providers. The models used, the assumptions and the different scenarios are introduced in section 5 and the mathematical background is presented in the Annex. To validate the model, different types of experiments have been conducted: the laboratory experiment, and a hybrid and field experiment (section 6). These are complementary to each other. The laboratory experiment is a controlled environment, where the participants (in this study, students at a university in Berlin) know that they are part of an experiment. Laboratory experiments are widely used in economics for the analysis of economic incentives and decisions of individuals by involving them in real tasks and actions. Moreover, they can be used to test theories or the assumptions of theories. The actions of individuals do have real monetary and information implications for the individuals, which makes this research different from survey-based research.

Study on monetising privacy 5 An economic model for pricing personal information

At the end of the laboratory experiment, the participants filled out an exit questionnaire covering questions regarding privacy concerns and interest in personal data protection. The hybrid experiment is a combination of laboratory and field, because we invited students from the experimental pool to a website on the Internet, where they could carry out a purchase transaction. Finally, in the field the participants (who come from the Internet-using population) do not know that they are part of an experiment. The websites used for the hybrid and field experiment are the same as for the laboratory experiment, with the only difference being the graphical design to make it more attractive for field visitors. Theoretical as well as experimental methods have their limitations and rely on a few key assumptions. To reduce the complexity of the model, a number of simplifications were introduced, i.e. only two types of consumers were assumed, those with low and those with high privacy concerns. Regarding service providers, only two different types of requirements were assumed regarding the amount of personal data collected. This was implemented in the experiment, however, without introducing strategic behaviour of service providers. The latter would have created problems from a data protection perspective and would have needed to be tested in separate experiments. Finally, the participants in the laboratory experiment were students at a large German university; this is a non-random selection and generalising the results to other populations and other types of transactions should be done with caution. Future research should use experimental methods to further expand to other types of transactions such as social networks.

2.3 Some findings

The answers that participants provided in the exit questionnaire with regard to privacy concerns and interest in personal data protection by organisations showed a rather high concern for privacy as well as a high interest in the topic (section 6.3.1). Some other findings: - Almost all participants in laboratory experiment (over 90%) stayed with the service provider they first selected in case of two purchases; - If the price is the same at the two providers, the majority of purchases in the laboratory are conducted at the privacy-friendly online service provider (about 83% of all tickets sold); this observation shows that if offers are placed next to each other and consumers can compare the amount of data collected, consumers take information practice into account; - In the cases where also the price differs, the market share of the privacy-friendly service provider drops, below or close to one third. When comparing the treatments in the laboratory and the field for all purchases, is noticeable that the privacy-friendly service provider has a much larger market share, if the differences in

Study on monetising privacy 6 An economic model for pricing personal information

data collection are obvious and prices are the same. However, once prices change and a privacy-unfriendly competitor charges a lower price the privacy-friendly service provider loses market share. However, about a third of purchases of consumers show that are willing to pay a mark-up at the privacy-friendly service provider.

2.4 Structure of the study

This report is structured as follows. Section 2 provides an introduction. Section 3 covers the fundamentals of the economics of privacy, which are important for its economic analysis. Section 4 provides an overview of the recent theoretical and experimental research in economics on personalisation, behaviour-based pricing and privacy. In section 5 an introduction to the economic model is provided. The details of this model are given in the Annex (section 10). Section 6 provides an overview of the experimental work, which tests some of the assumptions and scenarios considered in the model. Finally, in section 7 conclusions are drawn and recommendations made. The report is accompanied by a glossary of terminology.

Study on monetising privacy 7 An economic model for pricing personal information

3 The fundamentals of the economics of privacy

The economics of privacy is a field of research at the intersection of economics, law and computer science. It is devoted to the study of the economic cost–benefit trade-offs individuals undertake when disclosing personal data in economic transactions (so-called ‘privacy calculus’) as well as the competitive implications of protection of personal data for service providers. In the following, however the focus is on the demand-side, i.e. the consumers. Two different types of exchanges are differentiated in the report to achieve a better classification of exchange models observable. Another basic taxonomy of online Service Models with a baseline differentiation into commercial and non-commercial can be found in ENISA (2011b: 11).

3.1 Identification and personal information

Identification is the process whereby a subject, for example a natural person, is singled out from an anonymous mass, the so-called ‘anonymity set’. Identification can occur with different degrees, where higher degrees denote a more precise identification. Identification as differentiation may occur on the basis of personal information such as name, address, identity numbers, behavioural and/or biometric data. The European Data Protection Directive applies four key elements to the definition of personal data, stating that personal data is (1) any information that is (2) relating (linked) to an (3) identifiable or identified (4) natural person. In the context of this report, we distinguish between personal information and private information as used in economics. Personal information contains differentiation power, because it singles a person out from the mass. Private information, on the other hand, denotes an unequal distribution of information among market players (e.g. consumers and firms), where one player has the information and the other does not. Therefore, information is private if it is not common (public) knowledge. Personal data can be public, such as the names and birth dates of celebrities, yet it retains its differentiation power. However, personal information can also be private, for example if an individual manages to keep their real name and birth date private by using a false name and fictitious birthday.

Study on monetising privacy 8 An economic model for pricing personal information

From the economic point of view as employed in this report, the state of privacy arises with asymmetric distribution of personal data between market participants, where one side privately holds personal information. Note that we do not suggest this as general definition, but rather as a definition employed in this report. Privacy is therefore a relationship of asymmetric distribution of personal data between market players. Many other definitions of privacy originate in the legal, political and philosophical disciplines. The economic view does not devalue these concepts, but is complementary to them. There are situations of symmetric and asymmetric identification. Symmetric identification occurs where both market sides can identify each other; in the asymmetric situation only one side can identify the other, not vice versa. Reciprocity in identification is an important ingredient for trust and can influence an individual’s actions (see also section on ‘Experiments with Identification’). Identification may or may not be subject to negotiation in economic transactions (Preibusch 2006). If the transaction is a take-it-or-leave-it offer conditioned on identification, consumers have no choice but to opt out completely. This means a potential customer does not buy the product or service. If identification is not a component of the negotiations, challenges arise regarding the optimal level of identification. Identification differs among different types of transactions. While 90% of online shoppers state that they have disclosed their name and 89% their address for online shopping (Special EuroBarometer 2011: 40); among people using social networks, 79% state that they disclosed their name and 39% their home address when using social networks. Online purchases are often conditioned on identification. This is different for social networks, where truthful disclosure of identity data can be voluntarily chosen.

3.2 Economic exchange of personal data

At the most basic level, we consider economic exchange as exchange intermediated by money. It should be differentiated from social exchange based on either real or perceived reciprocity between transaction partners. It is important to understand these concepts in order to understand the focus of this study. Social exchange, where consumers disclose personal data to firms in exchange for using their unpaid services, is not considered here. This would involve use of social networks or online services that are ‘for free’, except the consumer is monitored while using them (Internet search engines, free email services, etc.). We exclude social exchange and focus on transactions that are intermediated by money. In the transaction the consumer trades off monetary wealth and privacy. Two different types of exchanges can be differentiated: (1) pure information transactions; and (2) composite transactions involving goods/services and information as a by-product (see Figure 1).

Study on monetising privacy 9 An economic model for pricing personal information

Information Transaction

Service Consumer

Provider

Composite Transaction

Service Consumer 2a - Provider

Figure 1 Information and composite transactions

In the pure information transaction (see upper part of Figure 1) consumers disclose personal data in the transaction. For example, consumers who participate in a survey disclose personal information. A pure information transaction, which does not involve a physical product, allows the consumer to focus on the terms of trade (TOT) for personal data. Pure information transactions are not analysed in this report, because they involve different trade-offs and motivations. However, this is a topic for further research in future, requiring a social exchange analysis. The second type of transaction displayed in Figure 1 (lower part) is a composite transaction, which involves a good or service and information as by-product. The main focus of the consumer is on the good or service the consumer wants to purchase. The exchange of personal data can be implied in the transaction or be a by-product of it, where a person needs to disclose personal data actively. We lump these two versions of the composite exchange together under the term ‘by-product’. Consider Internet shopping for music CDs: browsing behaviour and purchase actions of a customer are recorded by the firm and this

Study on monetising privacy 10 An economic model for pricing personal information

might go unnoticed by the consumer. However, if the consumer wants to have the CD shipped to his/her home address, this address needs to be disclosed. A composite transaction is more complex when compared to a pure information transaction. A composite transaction requires greater cognitive processing (‘thinking’), because the TOT for the good’s purchase aside, there are also TOT for the information disclosure. The consumer has to weight (a) the costs and benefits of obtaining the good; and (b) the costs and benefits of information disclosure. NNoottee:: IItt iiss iimmppoorrttaanntt ttoo sseeppaarraattee tthhee ddiiffffeerreenntt ttyyppeess ooff ttrraannssaaccttiioonnss,, bbeeccaauussee tthheeyy eennttaaiill ddiiffffeerreenntt iinncceennttiivveess aanndd mmoottiivveess.. AAtt tthhee mmoosstt bbaassiicc lleevveell,, tthheerree iiss eeccoonnoommiicc aanndd ssoocciiaall eexxcchhaannggee.. TTrraannssaaccttiioonnss ccaann bbee ccllaassssiiffiieedd iinnttoo ppuurree iinnffoorrmmaattiioonn ttrraannssaaccttiioonnss oorr ccoommppoossiittee ttrraannssaaccttiioonnss iinnvvoollvviinngg ggooooddss//sseerrvviicceess aanndd iinnffoorrmmaattiioonn,,wwhhiicchh ggiivveess rriissee ttoo ssaalliieennccee.. This brings us to another important concept: salience (DellaVigna 2009). Salience is ‘relevance’ or ‘attention’: if a feature of a product or service is salient, it stands out. Consider again the purchase of a CD on the Internet. While one firm might hide the terms of the privacy policy somewhere under the general commercial clauses, another might state directly, right next to the CD, that purchase will be recorded and purchase information shared with third parties. In this case, the terms of the policy stand out. More simply stated, consider a composite transaction T involving the transaction of a good (GT ) and the transaction of information ( IT ):

T  GT  IT (1.1)

With salience included in (1.1) above, T  GT (1 )IT (1.2) The salience parameter  , with0   1, decreases the weight of IT in the composite transaction.   0, on the other hand, denotes equal weight in attention devoted to the information and the good. Consider the example where a consumer compares offers for car  insurance on the Internet. She will look for the best insurance at the lowest price. Privacy



policy terms in the insurance contract are often not as important (i.e. they have low salience)



as other product features. They may enter the consumer’s cost–benefit trade-off concerning insurance with little or no weight in the decision. The reason is that the primary purchase of car insurance is already highly complex. In Figure 1 (lower part) the bold print and arrows denote the consumer’s focus. Composite transactions involve a privacy risk, i.e. a probability that personal data are compromised. It depends on the consumer’s privacy concern or awareness and interest in data protection issues, whether the terms of the privacy policy are important or not in her decision.

Study on monetising privacy 11 An economic model for pricing personal information

3.3 Truthful disclosure of personal information

Much theoretical work in economics is devoted to finding incentive-compatible mechanisms, which ensure that individuals reveal their true valuation of a good or service. The true valuation is private information held by the individual. In economics, if the revelation of truthful information is optimal for an individual, the mechanism of revelation is said to be ‘incentive-compatible’. If a market mechanism is not incentive-compatible, individuals will reveal some valuation, but not necessarily their true one. Consider a situation where consumers are asked for personal data in order to obtain a discount. This personal data is their private information and there is no mechanism to verify whether the information they disclose is true. If consumers are utility-maximising and at the same time concerned about their privacy, it is a dominant strategy to lie to obtain the discount while cushioning the 18,19 potential negative effects that arise from truthful disclosure of their personal data. Individuals then resort to disclosing some information, which must not be related to their natural identity. Disclosing arbitrary information reduces differentiation power. Examples of such behaviour are the adoption of fake identities or pseudonyms in order to conceal the real identity (e.g. ‘Donald Duck’ instead of the real name). If differentiation power is reduced, privacy concerns fade away, which is problematic as they are at the very core of research in the economics of privacy. This is a lesson we learnt from the pilot conducted for this study: Here we observed individuals who strategically invalidated their personal data by disclosing obviously wrong information. NNoottee:: IInn oorrddeerr ttoo pprrootteecctt tthheeiirr ppeerrssoonnaall ddaattaa,, ssoommee iinnddiivviidduuaallss wwhhoo aarree ccoonncceerrnneedd wwiitthh tthheeiirr pprriivvaaccyy ssttrraatteeggiiccaallllyy iinnvvaalliiddaattee tthheeiirr ppeerrssoonnaall iiddeennttiiffiieerrss bbyy ddiisscclloossiinngg bboogguuss iinnffoorrmmaattiioonn.. TThheeyy hhaavvee aann iinncceennttiivvee ttoo ddoo ssoo ggiivveenn tthhaatt tthhee ddeetteeccttiioonn pprroobbaabbiilliittyy iiss llooww aanndd tthhee ccoonnsseeqquueenncceess ooff ssuucchh iinnffoorrmmaattiioonn ddiisscclloossuurree aarree nnoott nneeggaattiivvee.. Much of the research screened for this study as potential literature background is not incentive-compatible, because the information disclosed by participants is not checked for accuracy. In particular, where individuals are asked for sensitive personal data that cannot be verified, results could be biased. Information that cannot be externally verified includes opinions, attitudes and norms, for example. However, a problem also arises where individuals are asked for verifiable data such as name, address, weight and height, but then this information is not verified. Thus, we classify research with no real economic/monetary

Study on monetising privacy 12 An economic model for pricing personal information

component and no verification mechanism as ‘not incentive-compatible’ in the economic sense and exclude it from our literature review. This also excludes all studies that rely upon unpaid participation of individuals in surveys on privacy attitudes. We also find that a pure information transaction is not comparable to a composite transaction, because a survey reply is T  IT and social exchange, whereas an Internet purchase is T  GT (1 )IT and economic exchange. In addition we excluded works with paid participation in surveys and studies that present participants with hypothetical choices, not involving any real actions and consequences. In hypothetical choice situation, respondents might not be able to tell how they would act or value a specific task/good in a hypothetical  situation (Krahnen et al. 1997).

3.4 Privacy, personalisation and competition

To our knowledge, there are no works in economics that combine theoretical and experimental methods for the analysis of the interplay of privacy concerns, product personalisation and competition. Identification is a precondition for the collection of personal data and therefore it is also a precondition for personalisation. Personalisation is the tailoring of characteristics of a product or service to an individual consumer’s preferences (see also Glossary, section 8). The base for personalisation is personal information. It allows differentiation of consumers and dynamic price discrimination. When disclosing personal data, consumers often incur costs such as typing effort or some other disclosure aversion. At the same time, personalisation might increase consumer utility, if the consumer obtains a more tailored product. Once the product better fits the personal preferences of the consumer, he/she might be less inclined to switch to another firm. This might be the case because disclosing personal information had costs and the firm can now offer a better product. In this case, it could be that price differences must increase to induce switching of consumers to the rival, once the consumer obtained a personalised product. Personalisation can increase switching costs, if consumers who want to switch to a rival of their current service provider cannot simply transfer information from the old to the new provider. Disclosure of personal data might also induce privacy concerns and for some individuals these might increase with the rise in the number of service providers to which personal data are disclosed. These people might opt to stay at one service provider.

Study on monetising privacy 13 An economic model for pricing personal information

4 Literature discussion 4.1 Microeconomic theory

4.1.1 Behaviour-based pricing and product personalization

In the area of personalisation and behaviour-based pricing (BBP), theoretical research can be separated into monopoly and duopoly models. While personalisation is the tailoring of the product to a customer’s preferences, behaviour-based pricing is the practice of basing the price upon a customer’s past purchase history. We identified nine papers that use monopoly models and 27 papers that use duopoly models, which are relevant for our study. In this report, we use a duopoly as the existence of a rival competitor that allows consumers to choose between offers. Such choice is not the case in a monopoly setting. Choice is at the same time a precondition for switching behaviour. Thus, our approach excludes all monopoly models. Among duopoly models, the majority are devoted to BBP. A classic result from this literature is that once both firms set personalised prices, they face a ‘Prisoner’s dilemma’ due to intensified localised competition (Villas-Boas 1999; Fudenberg and Villas-Boas 2006; Stole 2006). Firms can now identify their own customers (their ‘strong market’) as well as those of the rival (‘weak market’) and accordingly compete in prices. For several different reasons, behaviour-based price discrimination is not the same as product personalisation. Similar to the Prisoner’s dilemma result above is the market outcome if both firms start to personalise products and lose a degree of differentiation. In this case both firms are worse off in the second period of the game compared to the situation where both only provide standard products. Zhang (2011) combines BBP and product personalisation in one model. This paper, however, does not include consumer privacy concerns arising from product personalisation. The most closely related work is a duopoly with product personalisation and heterogeneous consumers in terms of brand preferences and privacy concerns. We identified Lee et al. (2011) as such a work. The authors use a Hotelling model of two firms, which may offer standard and personalised products with personalised prices. Firms face three different kinds of consumers: the ‘unconcerned’ who always share information, ‘pragmatic’ ones who only share if a firm adopts privacy protection, and fundamentalists who never share data. The game has three stages. In the first, the firms decide simultaneously on privacy protection, in the second they decide on the price of standardised products and in the third on the pricing of personalised

Study on monetising privacy 14 An economic model for pricing personal information

products. Finally the consumers make their choice. The authors show that privacy protection, in the case where only one firm adopts it, works as a competition-mitigating effect. The privacy-friendly firm can enlarge market share by inducing pragmatists to share personal information. From this expansion it can earn substantial profits rather than compete with the rival for the other consumers. IInnnnoovvaattiioonn iinn MMooddeelllliinngg.. OOuurr mmooddeell ddiiffffeerrss ffrroomm tthhee aabboovvee aass iitt iinnttrroodduucceess aa sseeccoonndd ppeerriioodd,, wwhheerree ccoonnssuummeerrss aarree aabbllee ttoo sswwiittcchh ttoo tthhee rriivvaall.. TThhiiss iiss ddiiffffeerreenntt ffrroomm LLeeee eett aall.. ((22001111)),, wwhheerree tthhee ccoonnssuummeerr cchhooiiccee iiss tthhee ffiinnaall ssttaaggee..MMoorreeoovveerr,,uunnlliikkee LLeeee eett aall.. ((22001111)) aanndd ZZhhaanngg ((22001111)),, wwee ddoo nnoott iinnttrroodduuccee ppeerrssoonnaalliisseedd pprriicceess,, bbuutt aa ddiissccoouunntt ffoorr iinnffoorrmmaattiioonn ddiisscclloossuurree wwhhiicchh iiss tthhee ssaammee ffoorr aallll ccuussttoommeerrss.. MMoorreeoovveerr,, wwee hhaavvee sswwiittcchhiinngg ccoossttss ffoorr ccoonnssuummeerrss wwhhoo ddeecciiddee ttoo hhaavvee tthheeiirr iinnffoorrmmaattiioonn ssttoorreedd ffoorr ffuuttuurree ppeerriiooddss.. IInn tthhaatt sseennssee oouurr rreesseeaarrcchh iiss aallssoo rreellaatteedd ttoo lliitteerraattuurreess oonn ccuussttoommiissaattiioonn ((DDeewwaann eett aall.. 22000000)),, bbuutt tthheessee wwoorrkkss iinn ggeenneerraall ddoo nnoott ffoorrmmaalliissee pprriivvaaccyy ccoonncceerrnnss..

4.1.2 Theoretical welfare effects of privacy regulations

Another fruitful area of research is the theoretical welfare effects of privacy regulations. For example, such regulations could prevent firms from sharing information with third parties. No general conclusions on consumer welfare can be derived from this literature, because the welfare effects of the regulations depend on the peculiarities of the model. At the most general level, the literature can be differentiated into models that analyse endogenous privacy policies; that is, a firm’s incentive to adopt a privacy policy (Calzolari and Pavan 2006; Akçura and Srinivasan 2005), a consumer’s choice to adopt anonymisation technologies or otherwise avert identification by the firm (Acquisti and Varian 2005; Conitzer, Taylor and Wagman 2010) and the effects of exogenous privacy regimes. In the latter, an outside regulator imposes rules on the market. In order to limit the discussion, we only consider one model (Hermalin and Katz 2006). The interested reader is referred to models such as Dodds (2008), Kahn, McAndrews and Roberds (2000) and Taylor (2004). Consider a situation where there are laws on data protection. These laws function as a commitment device: consumers can sue a firm in case of breaches of data protection. Further, companies cannot influence the legal framework and change the rules in the short term. Therefore, laws are not considered as endogenous, but as an exogenously given framework for economic action. Since the legal framework influences the incentives of players, it also has an effect on economic welfare and rent distribution among market participants. In Hermalin and Katz (2006), n firms post a menu of offers to a finite number of households. Households are of two types, either good or bad. There is no intrinsic valuation of privacy in this model on the part of the households. Two cases are outlined: a situation where firms move first and a situation where households move first.

Study on monetising privacy 15 An economic model for pricing personal information

Firms move first – There are two scenarios: the Recognition Regime and the Privacy Regime. (i) Recognition Regime: Here, the firms make an offer and can compel households to reveal an indicator variable. This variable is a signal of the households’ private information; (ii) Privacy Regime: In this regime firms can be forced not to use the indicator variable. However, they can write incentive-compatible contracts. These assure truthful revelation of private information. This leads all good types to reveal themselves, leading to the automatic revelation of bad types at the same time. Households move first – In this situation, households can decide whether to reveal information or not. The outcome is identical to the Privacy Regime above. Good types will reveal their information (assumed bad types cannot mimic them). The firm then builds a certain belief about those households that did not disclose information and makes two offers to both groups. The authors establish conditions under which the location of property rights to information (firm or household) does not matter, as incentives to disclose by good types will automatically also reveal bad types.

4.2 Experimental economics

The literature devoted to empirical evidence on privacy is very diverse. In order to limit the review for this report, we apply a rigid approach. Firstly, we review only papers with an economic experimental design. To be classified as such, the experiment must entail a real economic transaction inducing a real monetary or reputational impact for the participant. The experiment might be a lab or a field experiment. Therefore, we exclude any study that elicits privacy attitudes or data disclosure with no further action derived from information collection, except for the privacy research conducted with the information collected by the researcher. Experiments in which experimenters deceive participants are excluded as well. Most of these experiments cannot be considered incentive-compatible. From 31 papers reviewed in the area of privacy, 12 were classified as surveys and 19 as experiments. Among the latter there are five identification experiments and four papers devoted to privacy (Adar et al. 2005; Beresford et al. 2011; Tsai et al. 2009; Giannetti and Jentzsch 2011). We refer briefly to the identification experiments and then discuss the other works.

4.2.1 Experiments with personal identification

Standard experiments are conducted in anonymity. The reason is the fear on the part of the experimenters that interpersonal effects arising through identification might contaminate economic incentives. For example, through identification an implicit multi-stage game could arise, individuals leave the laboratory and are still identified by others outside of it. However, identification has proven to be a powerful variable that has – once introduced properly in a controlled way – a powerful impact on economic actions. At times this powerful impact reaches the extent of reversing theoretically predicted results (Bohnet and Frey 1997 1999; Charness and Gneezy 2008; Jenni and Loewenstein 1997). For example, identification in

Study on monetising privacy 16 An economic model for pricing personal information

Dictator games leads to greater contribution to the partner compared to anonymous situations. In fact the variation in the amount of money the Dictator leaves on the table for the recipient is a function of the degree of anonymity (Hoffman et al. 1996). Another example of the powerful impact of personal identification is public good games. In these games, individuals can decide upon a contribution to a public good. Identification leads to greater contribution in these games, because the actions of participants change significantly with less anonymity (Levitt and List 2007). Personal identification, therefore, has an impact on an individual’s economic actions. Much more research is needed in this area in future. In our experiment, we introduce privacy considerations. Our participants need to identify themselves with a ‘portfolio of personal information’ (their real name, date of birth, etc.). Unlike in the above literature, our participants are not identified to other participants in the lab, but identify themselves to the firm at which they purchase, once they choose to have their information stored on the purchase form.

4.2.2 Economic experiments on privacy

Experimental designs that implement real purchase transactions are scarce. To the knowledge of the authors, there are only Beresford et al. (2010), Tsai et al. (2010), Gideon et al. (2006) and Gianetti and Jentzsch (2011). Other works are either survey-based experiments or incentivised pure information transactions (see for example Huberman et al. 2005). Beresford et al. (2010) use a hybrid field experiment to analyse the willingness to pay for privacy, where participants were given the choice of buying a DVD from one of two competing online stores. While these stores were identical, one required more sensitive personal data than the other. In the test treatment, when the DVDs were one Euro cheaper at the privacy-invasive firm, virtually all buyers chose the cheaper store. In the control treatment with identical prices, people did not systematically prefer the more privacy-friendly firm, but chose both firms equally often. Not studied in this experiment was the effect of privacy policies and data usage. The authors conclude from their research that individuals are not willing to pay one Euro for their privacy. In the experimental design of Giannetti and Jentzsch (2011), participants are of two types in terms of results they achieve in a test; they are either above or below a median, mimicking ‘good’ and ‘bad’ types. They can purchase a voucher and reduce the price of it by disclosing their test result. During each period there is a specific probability that information gathered by the firm to which data was disclosed will be compromised. Such an incident can lead to the disclosure of the data to other participants. The purpose of this experiment is to learn about the participants’ decision-making, when there is a probability that information is compromised.

Study on monetising privacy 17 An economic model for pricing personal information

In Tsai et al. (2010), participants in the laboratory experiment are offered two different items by several vendors that differ in their protection of personal data. The offered products were a pack of batteries or a sex toy. The experiment had three components: an ‘online’ survey about privacy concerns, the shopping simulation, and an exit survey. The authors state that the informational and monetary payoffs were real. They set the experiment up in such a way that individuals could find their valuation of privacy by making comparisons of the price charged by protective merchants vis-à-vis non-protective ones. This is a one-shot situation (one purchase) compared to our two-purchase situation. The stimulus varied included a simple link to a privacy policy as currently encountered on the web; and a way of making it more salient by having the search engine presenting privacy icons. Participants had to use their credit card to make the purchase from a real merchant online. The authors find that when privacy policy information is displayed in a more salient way, participants take the privacy policy into account and tend to purchase from online retailers that score higher on the privacy protection index. In this case, they are even inclined to pay a premium for websites that protect their privacy better. For example, for the sex toy purchases, ‘participants in the privacy information condition made significantly more purchases from the high privacy website (33.3%) than participants in the no privacy indicator condition’ (Tsai et al. 2010: 26). The researchers conclude that consumers are willing to pay for privacy once presented with easier-to-digest information. Gideon et al. (2006) presented laboratory participants with an engine for searching or selecting websites to purchase two products (a surge protector and a box of condoms). The participants were asked to first purchase the less sensitive product and then the more sensitive product using the ‘Privacy Finder,’ which displays privacy policies in a more salient way. The authors found that the ‘Privacy Finder’ had a significant impact on purchases made with respect to the privacy-sensitive purchase. This is similar to Tsai et al. (2010). It is dissimilar to our experiment, however, in that we hold salience constant by not varying privacy policies or displaying privacy seals. Moreover, we introduce repeated purchases and with it personalisation and switching possibilities.

Study on monetising privacy 18 An economic model for pricing personal information

5 The model 5.1 Assumptions

Firms. The supply side of the market consists of two firms j {A,B} located at opposing 32 33 ends of the Hotelling line of length 1. Firm A is assumed to be placed at location 0 and firm B at location 1. The firms sell a homogeneous good in each period t {1,2} with production cost normalised to 0. Moreover, the firms require consumers to pay a price pj,t and to provide either a small or large set of personal datad j {d,d}. In each period, each firm

offers the good at a price/data requirement combination ( pj,t, dj ), which we refer to as a ‘bundle’. The firms receive some exogenous benefit from collecting data. We assume that firm j receives benefit q>0 each time a consumer buys at firm j if d j d .

Consumers. Consumers are differentiated in their location. Each consumer has an address i [0,1], which means that there are infinitely many consumers with their mass normalised to 1. Additionally, consumers have an exogenously given concern i for disclosing their personal

information. This privacy concern (or interest in data protection) may either be high or low and is denoted by i {,} with   Pr(i ) . In each period a consumer chooses a firm

to buy from. Consumers have a homogeneous valuation for the good, which is denoted by v and assumed to be sufficiently large to guarantee participation. Consumers incur a transportation cost for buying the good, which is equal to the unit transportation cost r times the distance between their own and the firm’s location. Additionally, consumers face costs for disclosing personal data, which is denoted by c(i,d j ) with c(,d j )  c(,d j ) and

c(i ,d)  c(i,d). Highly concerned consumers have higher cost for any data requirement

and higher data requirements imply higher cost for any type of consumer. Furthermore, we assume that c(,d)  c(,d)  c(,d)  c(,d) , i.e. that the difference between costs from a

low and high data requirement is higher for highly concerned consumers than for others.

Study on monetising privacy 19 An economic model for pricing personal information

In the two-period model we introduce the possibility of product personalisation: Consumers may choose to get an increased value from the product, if they buy from the same firm in both periods. Personalisation can be a pre-filled form or some other modification of the product based upon personal data the consumer provided. However, in order to receive this benefit consumers also incur some cost, which is thought of as cost from an increased data requirement in order to carry out the personalisation. Consumers decide at the end of the first period whether they want personalisation. This is implemented in the experiment as the decision to have information stored for a pre-filled form. The possibility to personalise the product not only increases the benefit to consumers, but also induces the possibility of consumer lock-in. Consumers only receive the benefit if they stay with the same firm throughout the entire game. In terms of utility this translates into consumers being able to gain some exogenously given benefit b, which is homogeneous across consumers. The consumers’ decision whether to have the product personalised is denoted by  {0,1} and comes at the cost of c(i, ) with the same assumptions as on the cost function as above. This means that in addition to disclosure consumers must – for personalisation to work – allow storage of their data, which is associated with higher costs for highly concerned customers.

5.2 Timing in the model

One-period model: The timing of the game is such that in the first period, firm A starts by choosing a data requirement and a price. Afterwards firm B observes these choices and makes its choices on data requirement and price. This sequence of decisions can be justified by the observation that a large retailer (e.g. Amazon) moves first, while other smaller retailers are able to observe prices and data policy of the large firm and react accordingly. Then the firms offer the chosen bundles to the consumers, who make their choices. At the end of the period all choices are observed and utilities and profits are realised. Two-period model: In this model the first period is played as in the one-period model. At the end of the first period, however, consumers decide on personalisation. Then the second period starts. The data requirement choices are the same as in the previous period. This can be thought of as choice of a specific technology to which the firm is tied for the entire game. Again, firms choose prices in a sequential way and reveal their bundles. Consumers make their choices after observing these bundles. At the end of the second period respective utilities and profits are realised.

Study on monetising privacy 20 An economic model for pricing personal information

5.2.1 One-period model

In the one-period model, firms maximise the profit function: arg max  j ()  nj (p j (d j )q) pj,d j where a firm’s market share is denoted byn j and (dj ){0,1} denotes the firm’s decision whether to have a high or low data requirement. Thus, (d) 1 and(d) 0 . We will write  j for (d j ) .

Consumers maximise their utility by deciding which firm to buy from: argmax ui()  v  pj  r j i  c(i,dj )

To analyse the firms’ pricing and data requirements decisions, we start with the case where consumers do not incur any transportation cost. This allows us to focus on the fact that different data requirements serve as differentiation devices, which softens price competition and thus increases the firms’ profits. Furthermore, zero transportation costs mimic the online environment in which the experiment takes place, where differences in location or exogenous brand preferences are absent. On the experimental website, the firms’ offers for tickets are placed right next to each other. This is comparable to price comparison machines on the Internet, where offers are put right next to each other. The impact of positive transportation cost is also analysed below. 5.2.1.1 Special version with transportation costs equal to zero With zero transportation costs firms face full price competition as differentiation in terms of location becomes irrelevant to consumers. The only differentiation which is still available to firms is the choice of different data requirements. Consumer choices are determined by the difference in prices and costs the firms impose on consumers with their data requirements. Since costs are different for the two groups of consumers the market may be segmented along the privacy concern of consumers. This holds in asymmetric equilibria where firms differentiate in terms of their data requirement and equilibrium prices are such that only highly concerned consumers choose the firm with the low data requirement. We can in fact observe such a situation in the laboratory experiment. While asymmetric equilibria lead to positive profits, they only exist if the firms’ benefit q from collecting data is not extreme; that is, neither very high nor very low. For extreme values of q both firms choose either high data requirements (if is very high) or low data requirements q (if is very low) and earn zero profits. The logic behind these results is that, because firm q B is the second mover, it might always choose to undercut firm A in prices and also decide to take the same or a different data requirement. Firm A anticipating firm B’s behaviour tries to set its own price and data requirement such that firm B acts in a way which leaves firm A with positive profits. However, such a strategy is not available to firm A if is either very high or q very low.

Study on monetising privacy 21 An economic model for pricing personal information

Case 1: Let us start with the assumption that q  c() . With q  max c(),  c()  (1 )c() we have a symmetric equilibrium with

  

   1 *

If q  min c(),1 c()  c() , we get an efficient equilibrium with d j  d,j and

  

Study on monetising privacy 22 An economic model for pricing personal information

We now solve a general version of the one-period model with positive transportation cost. The firms’ pricing strategies now change drastically, because they are ex-ante differentiated. We solve the game by backward induction, starting with consumers’ choices for given sets of data requirements and prices. Solving for the critical consumer (denoted with superscript c), who is indifferent between the two firms A and B, depending on the type yields: 1 pA  pB  c( c ,dA)  c( c ,dB )

i ( c )  

2 2r Market shares can now be denoted by:

nj  L( j)  (i ()  (1 )i ( ))

with location L(A)  0 and L(B)  1. Then solving for firm B’s reaction function in prices yields:  1 pB  (r  pA  (c(,dA) c(,dB))  (1 )(c(,dA)  c(,dB))  qB) 2 The pricing function indicates the following:  The higher the cost firm B imposes on consumers compared to the cost firm A imposes  on them, the lower will be firm B’s price.  Firm B’s optimal prices increase, if the unit transportation cost r rises, as it becomes more costly to choose the firm which is located further away from one’s own location.  The decision to have a high data requirement and the pricing decisions are strategic  substitutes. Thus, if firm B requires d , pB decreases. Comparing profits under the two different data requirements leads to the following decision:  d,if c()  (1 )c()  q dB   d, otherwise  Note that c(i )  c(i,d)  c(i ,d) and thus firm B’s data requirement decision is independent of A’s data requirement. In the next step, solving for A’s pricing function in general yields:  1 pA  (3r  (c(,dA)  c(,dB))  (1 )(c(,dA)  c(,dB))  qA  qB) 2 Under c()  (1 )c()  q comparing A’s profits for the different data requirements leads to the following equilibrium: 

Study on monetising privacy 23 An economic model for pricing personal information

  3r   5r (dA  d, pA  ),(dB  d, pB  ) 2 4 If c()  (1 )c()  q , the same comparison of profits leads to the equilibrium:   3r  2q   5r  4q (dA  d, pA  ),(dB  d, pB  )  2 4 In both equilibria we obtain market shares of:  3  5 nA  ,nB   8 8 Note that both equilibria are symmetric and efficient in terms of comparing the benefits from high data requirements and the average cost for providing personal data. Symmetry comes from the fact that once a certain data choice is optimal for one of the firms it also has to be  optimal for the other firm, as these choices balance the firms’ benefits from high data requirements and the negative impact on their demand.

5.2.2 Two-period model

In this model consumers not only make a choice on the firm, but also whether to have personalisation or not. This leads to the following maximisation problem for the consumers: 2 arg max ui()  (v  pj,t  r j  i  c(i,dj ))  c(i, ) b j1, j2,  t1 with  1 if the consumer opts for personalisation and   0 otherwise as well as   1 if j1  j2 , and   0 if j1  j2 b can only be received if , i.e. the benefit from personalisation the same firm is chosen in both periods. In the laboratory experiment, we call these buyers ‘loyals’. The firms’ profit function is the sum of the firms’ profits in both periods with consumers buying at price pj,t plus the exogenous benefit q if d j  d for each consumer. Thus firms maximise: arg max  j ()  nj,t pj,t  (d j )q p ,p ,d  j,1 j,2 j t1 Again, it holds that (d j){0,1} with (d) 1 and(d) 0 and we will write  j for (d j ) .

The consumers’ decisions to have their products personalised are influenced by a trade-off between the costs and benefits of personalisation. A consumer only chooses a personalised product if c(i,1)  b . But as consumers can only realise the benefit under the condition that j1  j2 rational expectations may lead them to strategically avoid personalisation in order to prevent being locked in in the second period. This can be the case if, for instance, the price

Study on monetising privacy 24 An economic model for pricing personal information

differences are such that the firm charging a lower price in the first period charges a higher price in the second period. If the net difference is higher than the net benefit for the consumer, this consumer may choose not to have the product personalised although c(i ,1)  b . Due to this reason, there can be no equilibria in which consumers personalise and switch firms in the model. Turning to the different cases and defining b()  b  c(,1) , we have to consider the following three scenarios (note that c(,1)  c(,1) also implies b()  b()): a) No consumer chooses to get a personalised product: 0  b()  b() b) Only those with a low concern choose to personalise: b()  0  b() and do not switch c) All consumers have their product personalised b()  b()  0 and do not switch.

Again, we start by considering the case with transportation cost of zero, which mimics the online environment of the experiment. Comparing the one- and two-period model and considering the impact of personalisation on the firms’ decisions with respect to their data requirements, we have two counteracting effects. On the one hand firms have a higher incentive to differentiate their products by choosing different data requirements, which increases the parameter range, where inefficient equilibria exist. Only by differentiating are firms able to make positive profits in both periods. On the other hand, personalisation abates this effect as it allows firms to make positive profits even if they choose the same data requirements. These profits require transferring surplus from consumers to the firm, but as the possibility of personalisation increases welfare, consumers may still be better off in equilibrium. To analyse these two effects we first consider the case in which no consumer opts for personalisation. The impact of personalisation is analysed in the next subsection, where we assume that only consumers with  have an incentive to opt for personalisation. In the following, we restrict the analysis to the case with no personalisation as well as the case with a share of consumers personalising.

5.2.2.1.1 No personalisation: 0  b()  b()

The range of inefficient market segmentations, where consumers with a low (high) privacy concern choose the firm with the high (low) data requirement, increases in this scenario. This is due to the fact that differentiating from the competitor becomes more attractive, as there is two times the surplus to be extracted from consumers, compared with the one-period model. Still, symmetric equilibria, which are efficient, exist if is sufficiently high or low. In q the first case it becomes too attractive to choose the high data requirement, while in the second case it becomes too prohibitive to impose high costs on consumers, so that firms

Study on monetising privacy 25 An economic model for pricing personal information

rather refuse to differentiate. For intermediate values of q the asymmetric equilibria are efficient.

5.2.2.1.2 Personalisation with b()  0  b()

We solve the model for different kinds of parameterisations. Starting with an intermediate value of  1/ 2 , we derive several different kinds of equilibria. Similar to the case with 0  b()  b() these equilibria are symmetric for either high or low values of q . For intermediate values of q we get asymmetric equilibria. However, due to the lock-in effect even symmetric equilibria allow firms to make positive profits, as they are able to extract some surplus from their consumers, without losing too many of them to the competitor.

Under the scenario that no consumer chooses to have the product personalised, we get a simple repetition of the pricing game. Thus, the equilibria are as in the one-period model with   p j,1  pj,2,j . In all cases where at least some of the consumers have an incentive to choose personalisation the solution of the second period requires solving the whole game. The reason is that consumers who choose to personalise base their decision of firm choice in the first period on the expected prices in the second period: with rational expectations no consumer who anticipates that it is optimal for him to buy from different firms would opt for

Study on monetising privacy 26 An economic model for pricing personal information

personalisation. As along as consumers anticipate rather high price differences in the second period, avoidance of personalisation may be the optimal behaviour. Moreover, as the fraction of consumers who opted for personalisation in the first period also determines the equilibrium prices in the second period, second-period prices and first-period decisions and demands are interdependent. The implied maximisation problem of the firms becomes rather complex; therefore we focus on the case with b()  0  b() , as it features consumers who choose to personalise as well as those who refuse personalisation. Using the result from the one-period model with positive transportation costs, we also restrict the analysis to symmetric equilibria. As r  0 already provides differentiation between firms, the differentiation tool of choosing different data requirements becomes obsolete. Thus, if it is beneficial for one of the firms to choose d j  d it is also beneficial for the other. We still have two different scenarios as equilibrium candidates. The first is one where not all consumers with  opt for personalisation, but instead switch the firm they buy from. The second scenario is such that all consumers with  opt for personalisation and do not switch firms. Concerning the first candidate and taking into account equilibria with both interior and corner solutions for the firms’ pricing decisions, we can show that no equilibrium exists where some of the consumers with  switch. With interior solutions the difference between firms’ optimal prices is too low in order to compensate consumers for losing their personalisation benefit, which means that none of them would want to switch (the respective equilibrium does not exist). Considering corner solutions, where firms set the maximum price within certain intervals, all consumers would either choose Firm A or Firm B in the second period. However, the maximum prices, which allow for such a scenario, are also not part of an equilibrium, as it gives the firm which would be without consumers in the second period high incentives to marginally reduce its price in order to attract at least some consumers who did not personalise. Turning to the second scenario, where all personalising consumers are loyal and focusing on interior equilibria in which both firms serve both types of consumers, the analysis shows that the firms’ equilibrium profits do not depend on or on . These results resemble the results q b obtained in the one-period model. They are based upon the fact that the firms’ pricing behaviour is driven by the marginal profits from attracting additional consumers. Moreover, analysing the firms’ profits with respect to  , i.e. the fraction of consumers who do not personalise, shows that the firms’ profits are the higher the lower  and thus the higher the number of personalising consumers. Intuitively, the more consumers that personalise the more consumers are locked in in the second period and the higher the firms’ equilibrium prices and profits. A similar but more complex reasoning holds for the firms’ pricing strategies in the first period. Although firms try to attract a high number of personalising consumers by charging low prices, firms also take into account that price competition in the second period

Study on monetising privacy 27 An economic model for pricing personal information

tends to be less intense if the firms’ market shares in the first period are rather symmetric. This holds especially for Firm B , which can anticipate that the price Firm A will choose in the second period is the higher the more personalising consumers Firm A has attracted in the first period. The last effect dominates the first and the firms’ first-period equilibrium prices will be the higher the more consumers personalise. Summarising these results indicates that while the consumers’ benefits from personalisation do not affect the firms’ pricing strategies directly, personalisation induces different strategic effects, which soften price competition and lead to higher firms’ profits. The Annex contains the technical background of this model.

Study on monetising privacy 28 An economic model for pricing personal information

6 The privacy experiments

We now discuss the design, experimental protocol and results from the different types of experiments we conducted: the laboratory experiment, hybrid and field experiment. These are complementary to each other. The laboratory is a controlled environment, where the participants know that they are part of an experiment. Participants are students at a university in Berlin. The hybrid is a combination of laboratory and field, because we invited students from the experimental pool to a website on the Internet, where they could do a purchase transaction online without coming to the laboratory. Finally, in the field the participants do not know that they are part of an experiment and they must not be students, but come from the Internet-using population as a whole.

6.1 Translation of the model into the experiment

We implemented a simplified two-period version of the model without transportation costs. The implementation is described in detail below. In essence we tested the following aspects: whether there are different types of consumers with different privacy concerns, as well as their firm choice and switching behaviour. The following situations were implemented: - Two-period version of the model with zero transportation costs and with both firms choosing the same data requirements and prices. This version contains the personalisation option for consumers as well as constant prices; - Two-period version with one firm choosing a low data requirement and the other a high data requirement either with or without price differences. This version also contains the personalisation option and constant prices. There were two real private companies (Event Sales and Cine Sales) offering the tickets over the Internet. Their offers were placed right next to each other in order to obtain a scenario with no transportation costs. Note that strategic firm behaviour as in the model was not

implemented in the laboratory, because the firms were ‘computerised’. Moreover,

participants were informed that prices do not change across periods. This restriction was implemented to preclude participants disclosing their personal data to other (human) participants, which could create severe data protection problems outside of the laboratory.

6.2 Laboratory experiment

Laboratory experiments are widely used in economics for the analysis of economic incentives and decisions of individuals by involving them in real tasks and actions. Moreover, they can be used to test theories or assumptions of theories. The actions of individuals do have real monetary and information implications for the individuals, which makes this research very different from survey-based research; see section 3 of this report.

Study on monetising privacy 29 An economic model for pricing personal information

6.2.1 Place, time period and participants

We conducted the experiment at the Technical University of Berlin in Berlin, Germany, between June and November 2011. Altogether 443 students of different disciplines participated, which makes this experiment the largest laboratory experiment on the economics of privacy to date. The students who participated are registered in a student pool and they were invited to the lab sessions with a neutral email invitation. While they knew that they were participating in an experiment, they were aware that they were carrying out transactions on a live website on the Internet. They had no details about the ultimate purpose of the experiment and did not know that it was about personal data disclosure in particular.

6.2.2 Design of the laboratory experiment

The invitation was framed in a neutral way by referring to an economic experiment only. This way, we avoided pre-selection effects that might arise if the experiment only attracted individuals who were interested in privacy matters. Participation was voluntary. After admission to the laboratory, the participants were given the instructions for the experiment. These instructions explained the rules of the experiment in simple terms. After signing the consent form to participate, each participant started the experiment by doing a brief comprehension test that allowed us to ensure that instructions were well understood by the students. Participants used a website in the laboratory that is similar to the field website. The website is an Internet portal of providers of cinema tickets. On this website, they could choose a cinema and showing and then purchase the ticket from one of the two firms providing the tickets (Figure 2 shows a screenshot from the field experiment, Table 1 shows the different treatments). The difference between the firms is described below. After the finalisation of the purchase, the participants could repeat the transaction if they wanted to buy a second ticket. Only the repetition ensures that we can observe switching behaviour and it ensures that we implement the two-period model. NNoottee:: IInn tthhee llaabboorraattoorryy,, hhyybbrriidd aanndd ffiieelldd,, aallll ccoommppoonneennttss ooff tthhee ccoommppoossiittee ttrraannssaaccttiioonn wweerree rreeaall,, mmeeaanniinngg tthhee ccoolllleeccttiioonn ooff ppeerrssoonnaall ddaattaa,, tthhee cciinneemmaa ttiicckkeettss ssoolldd aanndd tthhee ppaayymmeenntt wwiitthh tthhee ppaarrttiicciippaannttss’’ oowwnn mmoonneeyy.. PPaarrttiicciippaannttss wweerree nnoott ddeecceeiivveedd,, eeiitthheerr aabboouutt tthhee ttrraannssaaccttiioonn,, tthhee ffiirrmmss,, tthheeddaattaa ccoolllleeccttiioonn,, oorr ddaattaa uussaaggee.. Participants could compare the offers of the two firms and choose the offer they liked best or not purchase at all, because purchase was voluntary. We varied the differences between the two firms in order to extract the effects of one firm requesting more information than the other or the effect of different data usages. Regardless of the firm chosen, each purchase was subsidised by the experimenters by €2, resulting in residual prices as low as €3 per cinema ticket even for peak cinema times.

Study on monetising privacy 30 An economic model for pricing personal information

Figure 2 Order summary and choice of firms At the end of the experiment the participants filled out an exit questionnaire, paid the subsidised ticket price, obtained the ticket/s and left the laboratory. A show-up fee was paid out and set off against any outstanding payments for the purchases made. Individuals who did not purchase anything obtained only the show-up fee, as is common in experimental research. Note that the participants had to pay the outstanding balance with their own money. This way we avoided budget effects and ‘gambling’ arising from money given to the participants upfront, before the experiment took place. In order to extract the effect that differences in data requirements between firms make on purchase behaviour, we varied the stimulus. The situations with a varied stimulus were then compared to a basic control treatment in which the firms are similar. Next, the difference between the offers of the two firms were either: (a) differences in number of data items required from the participant; (b) differences in data items required and differences in prices; (c) differences in data usage, while both firms have the same prices; and (d) differences in data usage and prices; see Table 1. We conducted two pilot sessions with 48 participants aimed at testing the design. In the treatments with price difference and different number of items, the privacy-invasive firm

Study on monetising privacy 31 An economic model for pricing personal information

charged a ticket price €0.50 below its competitor. The pilots showed that a €0.50 price difference leads to a noticeable variation in behaviour of the participants; they do not all choose the same firm, but vary in their choice.

Table 1 Variation in treatments

In the basic control treatment (5 in Table 1), the firms are identical with regard to the prices and/or their data requirements. This is our benchmark scenario. In the other treatments, either the prices or the data requirements are varied. Note that prices remain constant from one period to the next in all treatments. Difference in data requirements: Both firms in the experiment always asked for a minimum set of personal data such as full name, email address and date of birth. Depending on the treatment, the stimulus in data collection was either: (a) the collection of additional data items (such as mobile phone number) by the privacy-unfriendly firm; or (b) the usage of the email address for advertising at the privacy-unfriendly firm. In order to create incentive compatibility, we implemented a ‘lie detection device’ that ensured truthful revelation of actual personal data by participants. While this can affect external validity, it ensures that individuals have a real privacy concern. As explained above, if participants have the opportunity to misstate personal information, they can cushion potentially negative effects arising from its disclosure. We introduced a mechanism in which we verified the students’ personal data. Participants knew that once they provided wrong information their payoff would collapse to zero. Any incorrect personal data was detected

Study on monetising privacy 32 An economic model for pricing personal information

with 100% probability, because the research assistants checked the data provided by all buyers in the laboratory.

6.3 Results from the laboratory experiment

As stated, there were 443 participants in the laboratory experiment including 24 participants in the second pilot, where we did identity verification. Of these 443 people, 40.41% were women and 59.59% men. In the general population in Germany, there are 51% women and 49% men. However, in the German population there is a higher share of men (about 80%) who use the Internet, compared to 70% of women. Summary statistics: The purchase statistics are given in Table 2. Across the whole sample (n=443), 251 individuals did not buy any tickets, 40 bought only one and 152 bought two tickets, which is a relatively high share of two-time buyers (57%). Among those who bought two times, 142 (93.42%) stayed with the firm they had chosen in the first period and only 10 switched (6.58% of two-time buyers). Therefore, by far the larger share remained with the same company. Note that this is the sample across all treatments, some of which have variations in prices or data requirements, although there is no variation over the two periods in those. Furthermore, there is no significant difference in terms of privacy concern or interest in data protection between the buyers and non-buyers. This means that the purchase action does not seem to introduce a pre-selection effect in terms of attracting only individuals that have little to no privacy concern or little to no interest in data protection. In the analysis below, we disaggregate the different treatments, because these differences influence the decision of individuals in terms of which company they choose. Interestingly, there were 10 people who switched from one firm to another. Whereas 9 people switched from Firm 1 to Firm 2, one person switched from 2 to 1. Three of the 10 switchers did not store data and seven individuals stored data, but still switched to the other company in the second period to buy their tickets there. These people had to re-enter the information at the new company. Note that the instructions clearly explained to individuals that prices remained constant across periods. In the exit questionnaire, we could probe the reasons for switching. All switchers recognised that they had bought from different firms. Some mentioned that they randomised, because prices were the same; others wanted to try out the other firm. Therefore, there seems to be no systematic behavioural bias.

Study on monetising privacy 33 An economic model for pricing personal information

Table 2 Overview statistics (whole sample, all treatments)

6.3.1 Privacy concern and interest in data protection

In the questionnaire, we collected answers to a number of questions related to the participants’ purchase experience, trust and risk perceptions as well as data protection. Moreover, we used the instrument developed in Smith et al. (1996) on measuring the privacy concern of individuals. The instrument is a battery of 15 questions, where answers are given on a Likert scale, ranging from ‘strong disagreement’ to ‘strong agreement’ with higher values denoting higher concern. We have calculated the average and median across individuals (see Figure 3 for the average). This figure shows that the there is a high frequency of individuals (over 361 out of 443 participants) with an elevated privacy concern. Note that we posed these 15 questions in an exit questionnaire. When using data from the whole sample, the privacy concern (median) is weakly correlated with the choice of the firm in period 1 (Pearson coefficient 0.0953, pvalue=0.0449). But the choice is not correlated with the average privacy concern. Apart from the 15 questions used for calculating the privacy concern, we asked one additional question on the interest in the practices of organisations with regard to protecting personal data. The answers to this question were not used in the computation of the privacy concern.

Study on monetising privacy 34 An economic model for pricing personal information

The overwhelming majority of participants in the laboratory experiment revealed that they are either ‘interested’ or ‘very interested’ in whether a firm protects their information (about 93%). Only about 0.7% of participants stated that they are ‘not interested at all’ if organizations that collect personal data also protect this information.

Figure 3 Privacy concern among participants

6.3.2 Monetising privacy

Do some people pay for privacy? Meaning, do some individuals value their privacy enough to pay a mark-up at the firm which collects less information? Or asked in a different way, would it pay for firms to differentiate according to the concern for privacy of consumers? In order to analyse this question, we conducted a number of statistical tests that allowed us to compare the different aforementioned treatments. To obtain results, we compare the average outcome of the treatment and control group in terms of purchases conducted at Firm 1. For example, we can compare the basic control treatment 5 with identical firms (same data requirements and same prices) with the treatment 4 (different number of data items and same prices). In the latter treatment, one firm requests more information than the other, meaning that both firms are differentiated. Since participants are randomly assigned to treatments we can be sure to capture a causal effect. If we compare the treatment 4 (same prices and different number of data items) to treatment 3 (different prices and different number of data items) we are able to extract the effect of a price difference in terms of shares of purchases at firms that differ on the number of data items they collect. In the following, all numbers are rounded; see Table 3 and 4. Comparison of treatment 4 and treatment 5: We now compare the situation in which firms are identical (treatment 5) to the situation where they vary on the number of items they

Study on monetising privacy 35 An economic model for pricing personal information

collect (treatment 4). We vary only one stimulus (number of data items collected) from one treatment to the next such that we can be sure of the effect of the stimulus. Moreover, both firms’ offers are located right next to each other on the website, such that the difference in data collection is rather obvious to the buyer. We find that the market share of Firm 1, the privacy-friendly firm, is significantly higher in treatment 4 compared to treatment 5.

Table 3 Overview of buyers and their purchases at both firms: all

The difference between the treatment groups is statistically significant based upon the Mann-

Whitney tests at the conventional .05-significance level. If there are no price differences and data requirement differences, over 60% of market share in terms of purchases is picked up by Firm 1. This increases to 83% if there are differences in data requirements. If we do the analysis only with loyals, ignoring one-time buyers, the share of tickets sold to loyals of Firm 1 is higher in treatment 4 compared to treatment 5. Thus, if it is very obvious that one firm collects more information than the other, all else being equal, a majority of purchases are made at the privacy-friendly firm.

Study on monetising privacy 36 An economic model for pricing personal information

This is in line with the literature stating that consumers take privacy protection into account, once it is more salient in the purchase (Tsai et al. 2010; Gideon et al. 2006). In our case, the differences in data collection efforts are obvious in treatment 4. Since consumers had the offers right next to each other, they could compare which information was required from them by the firms.

Comparison of treatment 3 and treatment 4: Next is the comparison of the situation where firms vary on the number of data items they collect (treatment 4) with the situation in which they vary on the data items and prices (treatment 3). In the latter case, the privacy-friendly Firm 1 charges €0.50 more compared to its privacy-unfriendly competitor. The share of tickets sold by the privacy-friendly firm now decreases strongly (from 83% to 31%) from treatment 4 to 3. The difference between the treatments is statistically significant based upon the Mann- Whitney tests. This means that the market share of the privacy-friendly firm is significantly reduced, once a competitor charges a lower price, while collecting more information. This result also holds if we only account for loyals. The market share of Firm 1 decreases from 84% to 29% between treatment 4 and 3. However, we also observe a significant share of purchases still conducted at Firm 1, despite the fact that these customers have to pay a higher price. This holds for about a third of buyers.

Table 4 Overview of buyers and their purchases at both firms: loyals

Study on monetising privacy 37 An economic model for pricing personal information

Comparison of treatment 2 and treatment 5: Again in treatment 5 firms are identical, whereas in treatment 2 they differ on data usage only. We find that there is not a significant difference between the two treatment groups. The Mann-Whitney test was not significant and the result is analogous if only loyals are used in the analysis. Comparison of treatment 1 and treatment 2: Finally, we compare the treatment, where firms only differ on data usage (treatment 2) and on data usage and price (treatment 1). Since we vary only one stimulus (price differences) from one treatment to the next we can be sure of the effect of this variation. Similar and in line with the above observations, the market share of Firm 1 is higher in treatment 2 (62%) than in treatment 1 (13%), considering all one- and two-time sales across both periods. This difference is statistically significant. The share of loyals’ purchases at Firm 1 is higher in treatment 2 (60%) compared to treatment 1 (9%). All in all, we observe the following regularities in the laboratory experiment: in treatments without a price difference (treatments 5, 4, 2), the privacy-friendly firm is able to snatch a higher share of the market, i.e. a higher share of purchases made by participants. In treatments where there is a price difference between firms (treatments 1, 3) the privacyunfriendly firm obtains a greater market share. The result is similar if we conduct the analysis only for loyals. A higher share of the sales to loyals of the privacy-friendly firms occurs in treatments without price differences. However, once the privacy-unfriendly firm charges a lower price, it can obtain a greater share of all ticket sales to loyals.

6.4 Field and hybrid experiment

The field and hybrid experiment is complementary to the laboratory experiment. For the field and hybrid experiment, we used an experimental website with the same features as in the laboratory. While hybrid participants were invited to the experimental website, visitors in the field did not know that they were part of an experiment.

6.4.1 Place, time period and participants

We conducted the field experiment between September and December 2011. The website featured advertising. Within the time frame we had 2,300 visitors, 87 of which chose a firm (‘choosers’), including 10 buyers. One of the reasons for this low number might be the credit card payment facility. Implementing direct debit would have been too risky for this project, but would probably have reduced the number of non-buyers. We will primarily use the number of choosers for the analysis. The hybrid is a mixture of laboratory and field, as the invitations were directed to individuals in different pools at different universities in Germany. We invited the students to the experimental website. Participation was voluntary. The invitations were sent out in November to TU Berlin students (roughly 900 registered students who had not already participated in the lab); ESMT (about 300 registered students); and Heinrich-Heine University in Düsseldorf (about 1,300 registered

Study on monetising privacy 38 An economic model for pricing personal information

students). The hybrid experiment ran until the end of December as well. Of 750 individuals who were on the website, 52 chose a firm including 16 bought tickets. In addition, we invited friends to the experimental website. Hybrid participants and friends obtained an extra link, which helped us to identify them in order to separate them from the pure field visitors, which were not personally invited, but found the website on the Internet.

6.4.2 Design of the field and hybrid experiment

The websites used for the hybrid and field experiment were exactly the same as for the laboratory experiment, with the only difference being the graphical design to make it more attractive for visitors. In order to attract buyers to the field website, we had to take a number of advertising measures. For example, after launching the website, we started advertising on the Google, Facebook, VZNetworks, Yahoo and Bing networks and introduced film teasers. One of the outcomes of the field experiment is that it is notoriously difficult to attract potential customers to a new website, because the setting is real and risk aversion of individuals could prevent them from trying out purchases. Because of the low number of buyers, we refrained from sending out questionnaires. However, we have enough observations on choice of a firm in the field, i.e. visitors chose a firm, and typed in their personal information.

6.5 Results from the field and hybrid experiment

For the analysis, we used data from both types of deployments, field and hybrid. This way, it was possible to compare treatments 3 and 4 as well as 4 and 5 (see Table 5). As stated above, the field data are generated in a more natural environment, where we cannot influence external factors that might also influence the individuals’ decisions. Therefore, it is important to run experiments in the laboratory as well in order to extract the effects in a more controlled environment. We are particularly interested in whether the share of all choosers (one- and two-time choosers) varies with the treatment as above and whether the same is the case for loyals, i.e. two-time choosers of the same firm. Note that we work with data on choice behaviour; i.e. individuals who chose a firm, entered their data and then either made the purchase or for some reason did not make a purchase. Comparison of treatment 4 and treatment 5: We compare the situation of two identical firms (treatment 5) with the situation where they differ only on the number of data items they collect (treatment 4), analogous with the laboratory experiment. In this comparison we find that there is no significant difference between the two treatment groups, because the Mann- Whitney test was not significantly different from zero. However, this result is significant at the 0.1 significance level when only using data on loyals, i.e. people who chose the same firm two times, while ignoring one-time choosers. We find that the share of loyal choosers of the privacy-friendly firm is significantly higher in treatment 4 compared to treatment 5 (42%

Study on monetising privacy 39 An economic model for pricing personal information

versus 19%). However, in the field treatment 4 the privacy-unfriendly firm has a greater share among loyals.

Table 5 Overview of choosers at Firm 1 and Firm 2 in the field and hybrid experiments All choosers All loyal choosers No. Choose Did not choose Choose Did not choose Treatment of participants Firm 1 Firm 1 Firm 1 Firm 1 (%, rounded) (%, rounded) (%, rounded) (%, rounded) ** 3 67 42 58 5 95 4 29 90 10 42 58 * 5 43 16 84 19 81 *There is no difference between firms in treatment 5. Individuals who did not choose Firm 1 either chose Firm 2 or no firm. ** In this treatment, price differences exist. Comparison of treatment 3 and treatment 4: To extract the effect of a price difference we compare a situation of two firms that collect different amounts of information, but have equal prices (treatment 4) to the situation, where they collect different amounts of information and charge different prices (treatment 3). In treatment 4, the privacy-friendly firm is chosen much more often than not (90%). In treatment 3 the share is 42% for Firm 1. Through the price difference is just €0.50, the share in consumers’ choices drops. There is a statistically significant difference in medians between the two treatment groups with respect to the choice of Firm 1 across both periods. This is similar in the case where we use only observations on the loyals who chose the same firm two times. The share in this market is higher for the privacy-friendly firm in treatment 4 (42%), compared to the situation where the rival charges a lower price (5% only) in treatment 3. From comparing the treatments 3, 4, 5 in the laboratory and the field for all purchases, we find that the privacy-friendly firm has a much larger market share, if the differences in data collection are obvious and prices are the same. However, once prices change and a privacyunfriendly competitor charges a lower price the privacy-friendly firm loses market share. But more than a third of purchases by consumers show that they are willing to pay a mark-up at the privacy-friendly firm. In case of loyals a comparison shows inconsistencies, as more twotime buyers pick Firm 2, the unfriendly firm, than Firm 1 in the field treatment 4.

6.6 Assumptions used for the experiments and caveats

The laboratory and the field experiments rely on a number of assumptions. Future research could focus on relaxing these assumptions. In order to reduce the complexity of the theoretical model, we introduced a number of limitations, i.e. we have limited the model to the case of two firms and consumers of two types, with high and low privacy concerns. This is

Study on monetising privacy 40 An economic model for pricing personal information

a simplification, because there are a greater variety of privacy types among consumers. Moreover, in the model consumers are sophisticated, but in the real world they might not anticipate that personalisation could lock them in and lead to higher prices in future periods. But there are also a number of caveats related to the empirical research conducted here. Research studies based on random sampling of participants generalise to the population from which the sample was drawn. Our research, which follows the common design for economic experiments, is not based on a random sample. We worked for the laboratory with participants registered at the experimental pool of the Technical University of Berlin. While participation in the experiment was based upon a neutral invitation, there is an element of self-selection in terms of motivation to come to the experiment. However, once in the laboratory, participants were randomly assigned to a treatment. It is debatable whether results obtained on students in a laboratory environment can be generalised to the general population. In general, results from the laboratory are considered to be a useful tool in providing qualitative evidence (Levitt and List 2006). Only to a small extent could we observe more natural behaviour in the field. In fact the field experiment would have needed a much longer running time in order to collect more observations on choice and especially purchase behaviour. One of the questions is whether the experimental manipulation is in fact the main cause of the observed choices of participants (internal validity). It relates to other factors that could potentially cause change in choice/behaviour. We have conducted tests on whether the participants in the different treatments were drawn from the same population in terms of age and gender (such that there is no bias due to a selection effect). These tests showed no bias in selection. And we are also planning to conduct tests of ranking and whether participants tend to choose the firm located on the left-hand side. These will be part of a future research study.

Study on monetising privacy 41 An economic model for pricing personal information

7 Conclusions and recommendations

This study is focused on economic transactions; that is, economic exchange intermediated by money, where the disclosure of personal information is a by-product and at times gets the consumer a discount. This excludes transactions which we consider to be social exchange, such as social networks, voluntary participation in anonymous surveys and usage of free services on the Internet. Therefore, the presented research should not be generalised to other populations or transactions that individuals conduct with regards to their personal data. In order to reduce the complexity of the theoretical model used herein, we introduced a number of assumptions. Future research could focus on relaxing these assumptions. For example, we have limited the model to the case of two firms and consumers of two types, with high and low concern. This is a simplification, because we can assume that there is a greater variety of privacy types among consumers, as in fact we observed during this study. Moreover, in the model consumers are sophisticated, but in the real world they might not anticipate that personalisation could lock them in and lead to higher prices in future periods. We implemented a simplified version of the model in the laboratory and field. For example, we implemented the version of the model with no transportation costs by placing the offer of the two service providers right next to each other. At the moment, it is too difficult for the consumers to compare different information practices of online service providers. This is exactly the area where we would propose that policy-makers ought to improve transparency for consumers. RReeccoommmmeennddaattiioonn 11 –– IIff tthheerree aarree lliittttllee ttoo nnoo ddiiffffeerreenncceess iinn tthhee pprriicceess ooffffeerreedd bbyy sseerrvviiccee pprroovviiddeerrss oonn hhoommooggeenneeoouuss ggooooddss,, aa ccoommppeettiittoorr wwhhoo hhaass aa rreedduucceedd ddaattaa rreeqquuiirreemmeenntt ((pprriivvaaccyy-ffrriieennddllyy sseerrvviiccee pprroovviiddeerr)) ccaann oobbttaaiinn aa ccoommppeettiittiivvee aaddvvaannttaaggee aass lloonngg aass tthhiiss ttyyppee ooff ddiiffffeerreennttiiaattiioonn iiss oobbvviioouuss ttoo tthhee ccoonnssuummeerr.. TThhee rreeaassoonn iiss tthhaatt ccoonnssuummeerrss ccaann –– bbyy cchhoooossiinngg tthhee sseerrvviiccee pprroovviiddeerr wwiitthh aa lloowweerr ddaattaa rreeqquuiirreemmeenntt –– rreedduuccee tthheeiirr ccoossttss ooff ddiisscclloossuurree ooff ppeerrssoonnaall ddaattaa.. RReeccoommmmeennddaattiioonn 22 –– TThhee rreegguullaattoorryy ffrraammeewwoorrkk sshhoouulldd aallllooww ffoorr ssuuffffiicciieenntt fflleexxiibbiilliittyy tthhaatt oonnlliinnee sseerrvviiccee pprroovviiddeerrss ccaann ooffffeerr ddiiffffeerreenntt mmeennuuss rreeggaarrddiinngg pprriicceess aanndd ppeerrssoonnaall ddaattaa rreeqquuiirreemmeennttss:: ffrroomm ppeerrssoonnaalliisseedd sseerrvviicceess wwhheerree iiddeennttiiffiiccaattiioonn iiss rreeqquuiirreedd aanndd aass ssuucchh mmoorree ppeerrssoonnaall ddaattaa iiss ccoolllleecctteedd ttoo lleessss ppeerrssoonnaalliisseedd sseerrvviicceess wwiitthh ffeewweerr rreeqquuiirreemmeennttss ffoorr ccoolllleeccttiioonn ooff ppeerrssoonnaall ddaattaa.. IInn ffaacctt,, iitt sshhoouulldd bbee rreeqquuiirreedd –– iiff nnoo ootthheerr lleeggaall rreeqquuiirreemmeennttss rreessttrriicctt tthhiiss iinn ssppeecciiffiicc ccaasseess oorr aarreeaass ssuucchh bbaannkkiinngg –– tthhaatt sseerrvviiccee pprroovviiddeerrss aallssoo ooffffeerr sseerrvviicceess wwiitthhoouutt iiddeennttiiffiiccaattiioonn ooff ccuussttoommeerrss,, iinn oorrddeerr ttoo lliimmiitt tthhee ccoolllleeccttiioonn ooff ppeerrssoonnaall ddaattaa.. If it is obvious which online service provider collects less personal information a significant share of the market is gained by the privacy-friendly service providers, given that the prices are similar and the products are similar. This observation was especially pronounced in the field experiment. An increase in transparency of information practices of firms must to be accompanied by an increase in price transparency. Prices should be advertised excluding any discounts for which

Study on monetising privacy 42 An economic model for pricing personal information

consumers are only eligible by providing additional personal data. Moreover, if personal data are used for price discrimination, the consumer should be informed about the fact that this is taking place and what type of discrimination is used. RReeccoommmmeennddaattiioonn 33 –– TThhee ddiiffffeerreenncceess iinn ddaattaa rreeqquuiirreemmeennttss,, ddaattaa pprrootteeccttiioonn aanndd pprriivvaaccyy ppoolliicciieess mmuusstt bbee mmaaddee mmoorree vviissiibbllee ttoo ccoonnssuummeerrss iinn oorrddeerr ttoo eennaabbllee ccoommppaarriissoonn ooff tteerrmmss bbeettwweeeenn oonnlliinnee sseerrvviiccee pprroovviiddeerrss.. TThhee mmoorree ssttaannddaarrddiisseedd aanndd ssiimmppllee tthheessee tteerrmmss aarree,, tthhee eeaassiieerr ccoommppaarriissoonn wwiillll bbee.. IIff ddaattaa pprraaccttiicceess aarree ddiiffffiiccuulltt ttoo ccoommppaarree,, tthhee tteerrmmss ooff ttrraaddee ffoorr ppeerrssoonnaall ddaattaa mmiigghhtt nnoott iinnfflluueennccee tthhee ddeecciissiioonn ooff tthhee ccoonnssuummeerr,, wwhhoo wwoouulldd ootthheerrwwiissee ppaayy aatttteennttiioonn ttoo pprriivvaaccyy iissssuueess.. IInn tthhiiss ccaassee,, tthhee ccoonnssuummeerr tteennddss ttoo iiggnnoorree tthheemm bbeeccaauussee ooff tthheeiirr ccoommpplleexxiittyy.. TThhee rreessuulltt iiss tthhaatt oonnlliinnee sseerrvviiccee pprroovviiddeerr ccaannnnoott uussee pprriivvaaccyy sseettttiinnggss ttoo ffiitt ccoonnssuummeerr pprreeffeerreenncceess ttoo oobbttaaiinn aa ccoommppeettiittiivvee aaddvvaannttaaggee.. RReeccoommmmeennddaattiioonn 44 –– PPeerrssoonnaall pprrooffiilleess aarree oofftteenn tthhee bbaassee ffoorr ppeerrssoonnaalliissaattiioonn ooff pprroodduuccttss oorr sseerrvviicceess.. IIff ppoorrttaabbiilliittyy ooff pprrooffiilleess aammoonngg ffiirrmmss iiss mmaannddaatteedd,, ccoonnssuummeerrss wwiillll ffaaccee ddeeccrreeaasseedd sswwiittcchhiinngg ccoossttss aanndd bbeenneeffiitt ffrroomm iinntteennssiiffiieedd pprriiccee ccoommppeettiittiioonn iinn tthhee mmaarrkkeett.. HHoowweevveerr tthhee ttrraannssffeerr ooff pprrooffiilleess sshhoouulldd bbee ccoonnddiittiioonneedd oonn tthhee ccoonnsseenntt ooff tthhee ccoonnssuummeerr aanndd iinn aaccccoorrddaannccee wwiitthh ppeerrssoonnaall ddaattaa pprrootteeccttiioonn lleeggiissllaattiioonn.. The majority of the participants in the study express their concerns for privacy (section 6.3.1). However, the results of the experiments show that when there is a price differentiation the consumers show a tendency to choose cheaper services/goods. RReeccoommmmeennddaattiioonn 55 –– PPeerrssoonnaall ddaattaa pprrootteeccttiioonn aanndd pprriivvaaccyy iiss aa hhuummaann rriigghhtt.. TThhee EEuurrooppeeaann CCoommmmiissssiioonn,, EEUU MMeemmbbeerr SSttaatteess aanndd ddaattaa pprrootteeccttiioonn aauutthhoorriittiieess sshhoouulldd eennffoorrccee aa cclleeaarr aanndd ccoonnssiisstteenntt lleeggaall ddaattaa pprrootteeccttiioonn ffrraammeewwoorrkk..

Study on monetising privacy 43 An economic model for pricing personal information

8 Glossary

This glossary is complementary to the glossary of terms in ENISA (2011b: 38) and the definitions of key terms in ENISA (2011c: 9). These are only working definitions in the context of this study. Addressability: The firms’ ability to reach consumers based upon their personal data. The degree of addressability can be represented as the proportion of consumers at each point in the market who are in the firm’s database; the firm can offer these consumers customised prices. (Source: Chen and Iyer 2002). Behaviour-based pricing: Behaviour-based pricing is a mechanism whereby a firm uses a consumer’s previously observable behaviour to set prices based upon this personal information. Customisation: Customisation refers to a consumer’s own specification of product features to purchase. The customer and not the firm initiate customisation. This is the main difference to personalisation (Source: Arora et al. 2008). Data protection: Data protection denotes the legal and regulatory codes enacted to protect personal information of individuals. Lock-in: Lock-in effects arise where consumers are prevented from switching easily and without costs to another provider. Personalisation: Personalisation refers to a firm’s tailored product offerings to an individual consumer based on its data about that consumer. This research follows this terminology and uses the word ‘personalisation’ for the strategy analysed. The firm and not the consumer initiates personalisation. This is the main difference from customisation (Source: Arora et al. 2008). Privacy: The term denotes a social convention of keeping specific personal data private, i.e. not releasing it to the public. In the context of this study, the term denotes the asymmetric distribution of personal information between market participants. Privacy Policy: Privacy policies are terms set by firms, which inform about their personal data handling practices. Consumers who read these terms are informed about the terms of trade for their personal data. Targeting: A firm's targetability is the ability to predict the preferences and purchase behaviour of consumers for the purpose of customising prices or product offers (Chen, Narasimhan and Zhang 2001).

Study on monetising privacy 44 An economic model for pricing personal information

9 References

Study on monetising privacy 45 An economic model for pricing personal information

Study on monetising privacy 46 An economic model for pricing personal information

10 Annex. Technical appendix

The technical appendix illustrates how the predictions and equilibria described in the report are derived.

One-period model with r=0

Consider first the decisions of the consumers. With r  0 each consumer maximises its utility which leads to

1 if pA  c(i ,dA )  pB  c(i ,dB )  c c  c c  i (i )  1/ 2 if pA  c(i ,dA )  pB  c(i ,dB )  c c  0 if pA  c(i ,dA )  pB  c(i ,dB )  

Turning to firms' decisions we first analyse different scenarios and then characterize the optimal decisions of firm A. Scenario A dA  d : Considering different data requirement decisions of firm B and its

potentially optimal pricing decisions leads to the following profits for B and A :

In order to earn positive profits, firm A has to ensure that B reacts as described in the third line. Thus firm A will try to set pA such that 3 1 2 B  max{B,B} Taking into account different parameter constellations, the above inequality leads to 0 if q  c( ) and c( )  (1 )c( )  q  1  (c( )  (1 )c( )  q) if q  c( ) and c( )  (1 )c( )  q pA   1  (q  c( )) if c( )  q  c()   0 if c( )  q

Scenario B dA  d : Proceeding as above we obtain: 1 1 dB  d  B : pA  q  A  0 2 2 dB  d  B : pA  c()  A  0 3 3 dB  d  B : ( pA  c( ))  A  ( pA  q)(1 )

Analyzing 3 1 2 B  max{B,B}

leads to the following pricing decisions of firm A  q if q  c()  1 1 c()  q if c()  q  c() pA   1 1 1 c()  c() if c()  q and c()   c()  (1 )q  1  q if c()  q and c()  c()  (1 )q  

Study on monetising privacy 47 An economic model for pricing personal information

Substituting these prices in firm A 's profit function and comparing its profits, we get the following equilibrium data requirement decisions and equilibrium profits q  c( ) 1 dA  d  dB  d A  0 if q   (c( )  (1 )c( )) 1 dA  d  dB  d A  c( )  (1 )c( )  q if q   (c( )  (1 )c()) qc( ),c( )

dA  d  dB  d A  (1 )(q  c( )) if q  (1 )c( )  c( ) dA  d  dB  d A  (c()  q) if q  (1 )c( )  c( ) q  c( ) 1 dA  d  dB  d A  c( )  c()  (1 )q if q  1 c( )  c( )

Solving by backward induction we first turn to the consumers and compute the location of the indifferent consumers, given any combination of prices and data requirements. pApBc(c ,dA)c(c ,dB) c 1 i i 2  2r if i ( c )[0,1]

c  c i ( c )   1if i ( c ) 1

 0 otherwise  

This leads to the following market shares for firm A and B:

nA  i ()  (1 )i () nB  1 nA

Then, solving for firm B’s price reaction function yields:  1 pB  (r  pA  (c(,d A)  c(,dB ))  (1  )(c(, dA)  c(,dB ))  qB ) 2 Now, comparing profits under the two different data requirements leads to the following: 1 1 2 B : (r  pA  (c(,dA)  c(,d))  (1 )(c(,dA)  c(,d))) dB  d 8r B   2 1 2 B : 8r (r  pA  (c(,dA)  c(,d))  (1 )(c(,dA)  c(,d))  q) dB  d 

Thus, firm B’s data requirement decision will be:  d if c()  (1 )c()  q dB    d otherwise Then regarding firm A, we can compute the pricing function:  1 pA  (3r  (c(,dA)  c(,dB))  (1 )(c(,dA)  c(,dB))  qA  qB) 2 This leads to the following profits:

Study on monetising privacy 48 An economic model for pricing personal information

1 2 A  (3r  (c(,dA)  c(,dB)) (1 )(c(,d A)  c(,dB ))  qA  qB) 16r We now have to consider two different cases separately: 1. Case: c()  (1 )c()  q

Taking into account firm B’s decisions, we get the following price for A:  1 pA  (3r  (c(,dA)  c(,d))  (1 )(c(,dA)  c(,d))  qA) 2 This in turn leads to the comparison of the following profits: 1 9r A : 16 dA  d  A   2 2 1 A : 16r (3r  (c(,d)  c(,d))  (1 )(c(,d)  c(,d))  q) dA  d  As in this case c()  (1 )c()  q , we get as the optimal data requirement decision:  dA  d Collecting the decisions, the equilibrium in this case is:   3r   5r (dA  d, pA  ),(dB  d, pB  ) 2 4 2. Case: c()  (1 )c()  q

In this case the pricing function is:  1 pA  (3r  (c(,dA)  c(,d)) (1 )(c(,d A)  c(,d))  qA  q) 2 Thus, the profits, which have to be compared, are now: 1 1 2  : (3r  (c(,d)  c(,d))  (1 )(c(,d)  c(,d))  q) d  d A 16r A  A   2 9r A : 16 dA  d  As in this case it holds that c()  (1 )c()  q , we can state:  dA  d This gives the following equilibrium:   3r 2q   5r  4q (dA  d, pA  ),(dB  d, pB  ) 2 4 In both equilibria market shares are equal to:  3  5 nA  ,nB  8 8 Two-period model with r=0 Scenario a): 0  b()  b()

To characterise the equilibria in the two-period model we start with the second period where we analyse the firms’ pricing decisions for dA  d  d  dB and d A  d  d  dB . We then turn to the first period where we analyse both the firms' pricing decisions as well as the firms' profits for different data requirement decisions of firm B. Using these results and comparing

Study on monetising privacy 49 An economic model for pricing personal information

the profits of firm A with d  d and d  d allows us to determine the equilibrium in the

overall game. Note further that dA  dB leads to zero profits in both periods.

Second period prices and profits

a) d  d  d  d : Using the potentially optimal pricing decisions of firm B, firm B's and A 's

second period profits are given by 1 1 B,2 : pA,2  c( ) ; A,2  0 2 2 B,2 : (pA,2  c( )) ; A,2  ( pA,2  q)(1 ) 3 3 B,2 : 0 ; A,2  (q  c( )) As in the one-period model, firm A tries to induce firm B to set its prices such that firm A earns the highest possible profit. Comparing profits and calculating firm B's best response as well as the implied profit of firm A , we get the following pricing decisions of firm A : 1  c( ) if q  c( )  c( )  c( )

     

 1  A,2  c( )  c( )  (1 )q if q  c( )   c( )  c( )  1 0 if q  1 c( )  c()  1 0 if q  c( )  c( )  c( )

  

A's second period profits are given by 1 1 B,2 : pA  q  c( ) ; A,2  0 2 2 B,2 : (pA  q  c( ))(1  ) ; A,2  pA 3 3 B,2 : 0 ; A,2  c( )  q Proceeding as above and calculating the firm B's best response and the implied profit of firm A, we get the following pricing decisions of firm A : 1 0 if q  c()  (1 )c()

  

 1 1 pA,2   c()  (1 )c() q if q   c()  (1 )c()  1 c()  q if q  1 (2  )c()  c()  The firms' second period profits can be written as

Study on monetising privacy 50 An economic model for pricing personal information

  

 1  A,2  c( )  (1 )c( )  q if q   c( )  (1 )c( )  1 c( )  q if q  1 (2  )c( )  c( )  1 q  c( ) if q  c( )  (1 )c( )

     

in the first period as well as the second period profits given above we get the following overall profits for firm B and A : 1 1 dB  d  B : pA,1  q ; A  0 2 2 dB  d  B : pA,1  c( ) ; A  q  c( ) 3 3 dB  d  B : ( pA,1  c( )) ; A  ( pA,1  q)(1 )  q  c( ) 4 4 dB  d  B : 0 ; A  q  c( )  q  c() 1 2 Using    and comparing profits shows that firm A is not able to induce firm B to

choose d . Hence, we get d  d and

A  B  0 1  Case 2): c()   c()  c() q  c()  1 c()  c() ; Here overall profits for

firm B and A are given by 1 1 dB  d  B : pA,1  q ; A  0 2  2 dB  d  B : pA,1  c()  1 c()  c() ; A  c()  c() (1 )q 3  3 dB  d  B : (pA,1  c()) 1 c()  c() ; A  (pA,1  q)(1 ) c()  c()  (1 )q

positive profits by inducing firm B to choose d  d only if   0.5 . In this case the firms'

profits are given by 1  A  q  (3 2)(c( ) q)  c( ) 1 



B  c()(2  ) c()  (1 )q (1 )

Study on monetising privacy 51 An economic model for pricing personal information

A  2c( )  c( )  (1 )q



B  2 c()  c() 1  1 Case 4): c()  c()  q ; The profits of firm B and A are given by 1   dB  d  B : pA,1  q ;  A  0 dB  d  B : pA,1  c( )  c( )  q ;  A  0 dB  d  B : ( pA,1  c( ))  c( )  q ;  A  ( pA,1  q)(1  ) 2 1 Since again    and q is small enough, firm A chooses p  q which leads to

A  0 and B  2c()  q

b) dA  d : Again there are 4 different parameter constellations to be analysed.

 c()  (1 )c() q  maxc()   c()  c() ,1 (2  )c()  c();

In this case the firms' profits are given by 1 dB  d  B : pA,1 ; A  0 2 1 dB  d  B : pA,1  q  c()   c()  c() ; A  c()  (1 )c()  q 3 1 dB  d  B : ( pA,1  q  c())(1 )   c()  c() ; A  pA,1  c()  (1 )c()  q 2 1 2 3    A pA,1    Using B B firm sets such that B B which leads to

Study on monetising privacy 52 An economic model for pricing personal information

 A  2c( ) (1 )c( )  q

1   B  2 c( ) c()

 c()   c()  c() q  1 (2 )c()  c()

Case 3): ; Calculating the firms' profits we get 1 dB  d  B : pA,1 ; A  0 2 1 dB  d  B : pA,1  q c()   c()  c() ; A  c()  (1 )c()  q 3 1 dB  d  B : (pA,1  q  c())(1 )   c()  c() ; A  pA,1  c()  (1 )c()  q 1 2 3 1 and thus B  B . Using B   B leads to A  c( )  2(1 )c( )  q(1  2) 1  B  c( )  q  2c()



dB  d  B : pA,1 ;  A  0 dB  d  B : pA,1  q  c( ) ;  A  c()  q dB  d  B : ( pA,1  q  c( ))(1 ) ;  A  pA,1  c()  q 1 2 1 3 reveals   . Comparing  and  shows that firm A is not able to induce firm B to

choose d . Hence, we get d  d and

A  B  0 Collecting these results and comparing the profits of firm A for d  d and d  d we can

deduce the profit maximising data requirement decision of firm A and thus the overall equilibrium of the game. However, we first have to compare the critical values of q which leads to 1 1 1)c( )  c( )  c( )  c()  (1 )c( )

  1 

2) c( )  (1 )c( ) c( )  c( )  c( )   0.6

 1   1 

3)c()  c()  c() c()  c()  c()

1  

Study on monetising privacy 53 An economic model for pricing personal information

1  1 4)c( )  c()  c()? c()  c( )  ?0.4

 1 

1  1 5)c( )  c()  c()? (2  )c( )  c( )  ?0.2

 1 

1 1 6) c()  c( ) (2  )c( )  c( ) 1  1  Assuming  0.4,0.6 we get the following outcomes: 1 1.)q  c()  c( )  c( )



 d A  d  dB  d   A  0 1 1 2.)c()  c( )  c( ) q  c( )  (1 )c( )

 

1  d A  d  dB  d   A  q  (3  2)(c( )  q)  c( ) 1  

1 

3.) c( )  (1  )c( ) q  c( )  c( )  c( )

 1 

1  d A  d  dB  d   A  q  (3  2)(c( )  q)  c( ) 1    d A  d  dB  d   A  2c( )  (1 )c()  q

 1 

4.)c()  c()  c() q  c( )  c( )  c( )

1   

 d A  d  dB  d   A  2c( )  c( )  (1  )q  d A  d  dB  d   A  2c( )  (1 )c()  q 1  1 5.)c()  c( )  c( ) q  c()  c( )

 1  

 d A  d  dB  d   A  2c( )  c( )  (1  )q

 d A  d  dB  d   A  c()  2(1  )c( )  q(1  2) 1 1 6.) c()  c( ) q  (2  )c( )  c( ) 1   1   d A  d  dB  d   A  0  d A  d  dB  d   A  c()  2(1  )c( )  q(1  2) 1 7.) (2  )c( )  c( ) q 1    d A  d  dB  d   A  0

Study on monetising privacy 54 An economic model for pricing personal information

The symmetric equilibria in case 1) and 7) are again efficient. The asymmetric equilibria are efficient for intermediate values of q only. For instance in case 2), as the upper bound is larger than c() , the equilibrium is inefficient as soon as q  c() . However, if q is smaller than c() the equilibrium is efficient. In the other cases the asymmetric equilibrium

can be inefficient, if q is close to one of the limits. Scenario a): b()  0  b() We start with the assumption of symmetric data requirements dA  dB  d and dA  dB  d . Here the effect of personalisation is very pronounced as firms would otherwise make second period profits of zero in a symmetric equilibrium. Therefore let us turn to second period profits: i) Assume first period market shares are nA,1  nB,1  0.5 . Then we have to compare the following profits 1 1 1 1 B,2  (1 )( pA,2  b  q) ; A,2  (1 (1 ))( pA,2  q) 2 2 2 1 2 1 B,2  (1 2 (1 ))( pA,2  q) ; A,2  2 (1 )(pA,2  q) 3 3 B,2  pA,2  b  q ; A,2  0

Comparing the profits of firm B, calculating the optimal price p leads to the following A,2 profits 1 2b(1) 2 b(3  ) if 1 (6  )  1 if 1 (6  ) S1 S1     b(1 2) ;   2 A,2   B,2 b(1 ) 4 if (6  ) 1 if (6  ) 1   4 ii) If first period prices are p  p , then all consumers buy at firm A in period 1. Thus, A,1 B,1 second period profits are given by 1 1 B,2  (pA,2  q) ;  A,2  ( pA,2  q)(1 ) 2 2 B,2  pA,2 b  q ;  A,2  0

Therefore, we get S2 S2 b A,2  b and B,2  1  iii) If first period prices are p  p , then all consumers buy at firm B in period 1 which A,1 B,1 leads to 1 1 B,2  (pA,2  b  q)(1 ) ;  A,2  (pA,2  q) 2 2 B,2  pA,2  q ;  A,2  0

and S3 S3  1  A,2  b(1 ) and B,2  b 1     

Study on monetising privacy 55 An economic model for pricing personal information

Note that in all cases no consumer, who has chosen personalisation in the first period, switches in the second period. Turning to the first period we get the following overall profits S3 S3 pA,1  q B,2 if pB,1  pA,1  A,2 if pB,1  pA,1 S 1 S1 S 1 S1 B  2 pA,1  q B,2 if pB,1  pA,1; A  2 pA,1  q A,2 if pB,1  pA,1

Case 1): 1  6  ; Substituting the above given second period profits, overall profits can

be written as 1 p  qb if p  p b(1 ) if p  p A,1  B,1 A,1 B,1 A,1 1 2b(1) 1 B   pA,1 q  if pB,1  pA,1; A   pA,1  q b3  if pB,1  pA,1 2 1  2    b1 if pB,1  pA,1 pA,1  q b if pB,1  pA,1  

Comparing these profits and calculating the best response of firm B and the optimal price pA,1 leads to 2 1 pA,1  b  q

1 

and the following profits S S   A  b(1 ) and B  b 1  Case 2): (6 ) 1; Again, using the above given second period profits, we get 1 b(1 ) if pB,1  pA,1  pA,1  q  b if pB,1  pA,1 2  1 1  1 2 2 pA,1  q b 4 if pB,1  pA,1 1  B,1  2 pA,1  q b 4 if pB,1  pA,1; A,1   12

Comparing these profits and calculating the best response of firm B and the optimal price pA,1 leads to 21 1 b  q if    1 3 pA,2   151 1 b 2 1  q if   3   

and the following profits 1  1 S b(1 ) if   3 S b 1 if   3 A   1  41 ; B    1 1 b 21 if   3 b 1 if   3  

Now, we turn to the case where dA  d  d  dB . Again we start with the second period and

analyse the firms' profits given different market shares in period 1.

Study on monetising privacy 56 An economic model for pricing personal information

i) If first period market shares were either such that only consumers with i  or all

consumers regardless of their type bought from firm A then second period profits are given by: 1 1 B,2 : pA,2  b  c( ) ; A,2  0

The optimal pricing decisions of firm A and the implied profits for both firms are given by c  c  b c  c  b  if q  1 1 c c b 1 c c b c c b                   pA,2   1 if   q  1  1c  c  b  c  if   q  c  c  b 0 if q  1 A1  1 c c b  c c b            A,2  c    c   b  q(1 ) if   q  1

ii) If in contrast all consumers bought from firm B in the first period, second period profits are given by 1 1 B,2 : pA,2  b  c() ; A,2  0

Prices and profits are given by c  c  b  if b  c   q 1 pA,2   ; b  c  if b  c   q A2 0 if b  c   q A,2   ; b  c( )  q if b  c   q   A2 1 c   c  b if b  c   q  B,2   0 if b  c   q 

Now, we turn to the first period pricing decisions when data requirements are asymmetric. We get the following overall profits:

Study on monetising privacy 57 An economic model for pricing personal information

 1

pA,1  2 2b  c   c   1   1   1 0 if q   2 2b  c   c  AA  1 1     A     1 1 2b  c   c    1 q if q   2 2b  1 c   c    1 AA  B  2 2c   c  1   b 1  

1  

Study on monetising privacy 58 An economic model for pricing personal information

 1

pA,1  2 2b  c   c   1  1  1 0 if q   2 b1   2 1   c   c 

AA  21     

A   1  1 1 b  2c   c    1 q if q   2 b1   2 1 c   c    21 AA  B  2 2c   c  1   b 1  

1        1      

  B  1 c   c   b if pB,1  pA,1  c   pA,1  c  if pB,1  pA,1  c   1 pA1  q c   c    1 q  b if pA,1  c   pB,1  pA,1  c 

   

 A   c   q  c    c   b  q(1 ) if pB,1  pA,1  c    b  c   q if pB,1  pA,1  c   These profits lead to pA1   c( ) AA  B  c   c   b 1 

A  c   q  c    c   b  q(1 ) Case 4): b  c   q; In this case, profits are  pA1  c  if pA,1  c   pB,1  pA,1  c 

    

 B  0 if pB,1  pA,1  c   pA,1  c  if pB,1  pA,1  c   1  pA1  q c( )  q if pA,1  c   pB,1  pA,1  c 

 

 A  2q  c( ) if pB,1  pA,1  c    b  c( )  q if pB,1  pA,1  c   Prices and profits are given by:

pA,1   c(); B,1  0 and A,1  2q  c()

Finally, assume dB  d  d  dA . We proceed as in the previous case. i) If first period market shares were either such that only consumers with   or all consumers regardless of their type bought from firm B we get the following scheme

Study on monetising privacy 59 An economic model for pricing personal information

This leads to the following second period outcomes c  1   c   1bq 1c()bc()  if q    c  1 c   1 bq  1 c( )b c() 2 c( )b c( )               pA,2    if   q  1  2c()bc() c( )  b  q if 1  q  1c( )bc( ) 0 if q   A3  1 c( ) b c( ) 2 c( ) b c( )              A,2  c   1    c   b q if   q  1

   

ii) If all consumers bought from firm A in the first period we get 1 1 B,2 : pA,2  q  c() ; A,2  0

And thus c  1  c  bq  if q  b  c( )  pA,2   c( )  q if q  b  c() A4 0 if q  b  c( ) A,2   c( )  q if q  b  c()  1 A4  c   c   b if q  b  c( )  B,2   0 if q  b  c( ) 

Turning to the first period, profits and prices are given by: A4 B,2 if pB,1  pA,1  c   A3 B  1 pA,1  c   q B,2 if pA,1  c   pB,1  pA,1  c 

Study on monetising privacy 60 An economic model for pricing personal information

Again, we have to consider different parameter constellations: 2c()bc() Case 1): q  1 ; Analysing the profit functions 1  pA,1  c   q if pA,1  c   pB,1  pA,1  c   B  0 if pB,1  pA,1  c   pA,1  c   q if pB,1  pA,1  c   pA1  c   b  q if pA,1  c   pB,1  pA,1  c   A  c   c   2q if pB,1  pA,1  c 

 c   b  q if pB,1  pA,1  c   pA,1 leads to the following price and overall profits pA,1  c   q

 c   1    c   b q if pB,1  pA,1  c   pA,1 The optimal price and the firms' profits are given by 1 1 1 2  b  c  c  1  q if q  2 1 1 c  c  1 2b1         pA,1   2 1 1  c  c  1  q if q  2 1 1 c   c  12 b1       

Study on monetising privacy 61 An economic model for pricing personal information

            

With all these different cases in mind, we now turn to the firms' data requirement decisions, which are made at the beginning of the first period. To make the model more tractable we derive these decisions for a couple of different parameter values which feature the characteristic results, instead of the whole range of parameters. We start with an intermediate value of   0.5 . Under this assumption, a choice of dA  d leads to the following comparison for firm B 's profits:

q  3c   2c   2b : B  B  dB  d

q  3c   2c   2b : B  B  dB  d

Study on monetising privacy 62 An economic model for pricing personal information

In contrast, d  d implies that we have a symmetric equilibrium for low values of q only:

q  b  c() : B  B  dB  d

q  b  c() : B  B  dB  d Considering the decision of firm A and evaluating the firms' profits for all parameter constellations we get 1)q  3c( )  2c()  2b  dA  d  dB  d   A  3b 2)2c( )  c( )  2b  q  3c()  2c( )  2b  dA  d  dB  d   A  3b 3)2c( )  c( )  q  2c( )  c( )  2b  dA  d  dB  d   A  3b 4)b  c()  q  2c( )  c( )  dA  d  dB  d   A  3b  c( )  2c( )  q 5)b  c()  q  b  c( )  dA  d  dB  d  A  3b  c( )  2c( )  q 6)b  2c( )  c( )  q  b  c( ) 1 3  dA  d  dB  d  A   c( )  c( )  b  q 2 2 7)3c( )  2c( )  2b  q  b  2c()  c() 1 3  dA  d  dB  d  A   c( )  c( )  b  q 2 2 8)3c( )  2c(  2b  q  dA  d  dB  d  A  3b

obtain 19 q  1 6 b : dB  d 1 q  2  4b : dB  d Thus, all possible equilibria are asymmetric, except for the case in which if q is sufficiently low. Assuming different values of b and q leads to the following results:

Study on monetising privacy 63 An economic model for pricing personal information

given by dB  d . This leaves both firms with positive profits.

Study on monetising privacy 64 An economic model for pricing personal information

The similarity to the one-period model is due to the fact that without personalisation the second period is just the repetition of the first periods pricing decision. As there is no lock in, there is no additional surplus to be distributed. b()  0  b() Scenario b): Using the result from the one-period model that both firms choose the same data requirement, we focus on the case with dA  dB  d . With dA  dB  d we would get the

same results expect that equilibrium prices are reduced by q. Solving the model with backward induction, we first have to analyse the firms' and consumers' behaviour in the second period. Taking into account that all types consumers may switch in the second period, we first show that there are no equilibria in which consumers with  do actually switch. We then characterise the equilibria where all consumers of type  opt for personalisation and do not switch in the second period.

First we show that an equilibrium in which consumers with i  switch firm does not exist. We first consider the case in which consumers, who have bought from firm A in the first period, buy from firm B in the second period. In order to do so we construct indifferent consumers for both types:

c r  pA,2  pB,2  b i2 ( )  2r c r  pA,1  pB,1  b i1 ( )  2r i2 ( )  2r i1 ( )  2r

Note that i2 ( ) denotes an indifferent consumer of type  , who is indifferent between

buying from firm A in both periods and switching from A to B. This means i1 ( ) is thought of as being indifferent between switching from A to B and staying with B in both periods. For

consumers of type  , it ( ) denotes the indifferent consumer in period t.

To start with the firms’ pricing decisions we use the part of the profit function, which relates to the second period. Thus, we get:  j,2  nj,2 pj,2

According to the indifference conditions above, we can rewrite the second period profit function as:

A,2  ((1 )i2    i2   )pA,2

Study on monetising privacy 65 An economic model for pricing personal information

B,2  ((1 )(1 i2   )  (1 i2   ))pB,2

For firm B we derive the optimal reaction function, by plugging in the indifferent consumers and differentiating the profit function with respect to price: r  (1 )b  pA,2

i2   

8r Now, let us turn to the first period. We now consider the following profit functions:

 A,1  ((1 )i1    i1   ) pA,1  A,2 B,1  ((1 )(1 i1   )  (1i1   ))pB,1  B,2

Again, we derive the reaction function for firm B: r  (1 )b  pA,1

i1   

8r c 3(r  b(1 ))

i1   

8r

By construction we would require i1      i2  . However, this does not hold here and thus

optimal pricing decisions lead us to a contradiction.

Study on monetising privacy 66 An economic model for pricing personal information

For the case of consumers switching from firm B to firm A, we get the similar results, which are derived accordingly. For the second period we now get: * 3r (1 )b pA,2  2 * 5r  (1 )b pB,2  4 c 3r  b(13)

i2   

8r For the first period, the results are now: * 3r  (1 )b pA,1  2 * 5r  (1 )b pB,1  4 c 3r  b(1 3)

i1   

8r

Again, the necessary condition that i1      i2  holds is violated.

Now, let us consider the possible corner solution, in which one firm sets a second period price, such that all consumers choose this firm. Therefore, assume any first period market share nA,1 and any second period price pA,2 . If firm B wants to get all consumers in the second

period, it has to choose a strategy pB,2  pA,2  b r in order to compensate the consumer for whom choosing B is least favourable. Note that firm A would make zero profits in this period. Therefore, it could just lower the price according to a standard undercutting- argument until profits are driven out of the market. In such a situation firm B could choose to sacrifice a few consumers, but making positive profits on all other consumers with a slight increase of pB,2 .

Thus, switching to another strategy as pB,2 is beneficial for firm B and thus one would have to consider candidates for an interior solution again. But as these candidates have already been shown to lead to contradictions, we are able to conclude that this type of equilibrium does not exist in this game.

Turning to the equilibria where only consumers with  switch, we first characterise the firms' pricing strategies in the second period. We then turn to the first period decisions of the consumers and the firms.

Study on monetising privacy 67 An economic model for pricing personal information

Calculating the firms' pricing decisions in the second period, we have to take into account that

the firms' demand functions are kinked. More precisely, while the indifferent consumer i2 ( ) is given by   pB,2  pA,2  r 

indifferent consumer i2 () is given by c pB,2pA,2rb c i ( ) : max{0, } if p  p  b  r(1 2i ( )) 2 2r B,2 A,2 

i2 ( )  i ( ) if  b  r(1 2i ( ))  pB,2  pA,2  b  r(1 2i ())  c pB,2pA,2rb

i2( ) : min{ 2r ,1} if pB,2  pA,2  b  r(1 2i ( )) 

where i () denotes the consumer with  who was indifferent between buying from firm A

and firm B in the first period.

Using i2 ( ) and i () the firms' profits in the second period can be written as

 c 3 c c A,2  pA,2 i2 ()  (1 ) i2() if pB,2  pA,2  b  r(1 2i ())  as well as 1 c c c   p (1 i ( ))  (1 )(1 i ( ) if p  p  b  r(1 2i ( )) B,2 B,2 2 2  B,2 A,2  2 c c c c B,2  B,2  pB,2(1 i2 ( ))  (1 )(1 i ( ) if b  r(1 2i ( ))  pB,2  pA,2  b  r(1 2i ( ))

  

2 

Study on monetising privacy 68 An economic model for pricing personal information

turning to firm A, firm A 's profit function can be written as 1 1  1 A,2   4r pA,2 pA,2  (1 )b  3r if pB,2  pB,2  2 1 c c  2 A,2   4r pA,2 ( pA,2  r(2  i ( ))  2r(1 i ()) if pB,2  pB,2 A,2   2c c  2c 1 A,2  2r bpA,2  pA,2i () if pB,2  pB,2  3 1  3    p p  (1 )b  3r if p  p A,2 4r A,2  A,2  B,2 B,2   2c Note for later reference, that A,2 is linearly increasing in pA,2 as long as pB;2  pB,2 . Furthermore, undercutting firm A and inducing some consumers with  to switch by  1 choosing pB,2  pB,2 becomes more attractive for firm B the higher the price of firm A .  Analysing A,2 and calculating the optimal price pA,2 for firm A we get the following set of possible equilibrium prices  1 2 3 c1 c2 pA,2 pA,2, pA,2, pA,2, pA,2, pA,2 with

2 

i1 ()  min{max{0, },1} 2r

the indifferent consumer with  , i.e. i () , is implicitly given by the solution of the following equation (assuming interior solutions)  c  c b  pA,1  pA,2  2r i ()  b  pB,1  pB,2  2r (1 i ())   c where the second period equilibrium prices pA,2 and pB,2 are functions of i () (see above).

Solving this equation for the candidate equilibrium prices we get, assuming again i ()(0,1)

Study on monetising privacy 69 An economic model for pricing personal information

Given the second period profits as well as i () , we are now able to specify the firms' overall profits:

A  pA,1 i1 ()  (1 )i () A,2   pA,2pA,2,pB,2pB,2

B  pB,1(1  i1 ())  (1 )(1 i ()) B,2   pA,2pA,2,pB,2pB,2 Using these profit functions and calculating the firms' optimal prices reveals that the  2  2 equilibrium prices are given by pA,2  pA,2 and pB,2  pB,2 as long as  is high enough. To be more specific, using the same parameter constellations as in the case with zero transportation costs and calculating the firms' profits for all possible deviations, shows that  1/ 4 suffices to guarantee that the firms' pricing decisions in the first period lead to an  2  2 interior equilibrium with pA,2  pA,2 and pB,2  pB,2 in the second period. Solving for the   optimal first period prices pA,1 and pB,1, we get that the firms' reduced profit functions do not depend on q and b . More precisely, we obtain   c c A  pA,1 i1 ( )  (1 )i ( )  A,2   pA,2pA,2,pB,2pB,2 (473  (1834  (1937  4(87  4))))  r (7  ) (19  3(14  ))   c c B  pB,1(1 i1 ())  (1 )(1 i ()) B,2   pA,2pA,2,pB,2pB,2 2(8901 (47424  (83307  (53252  (10999  (892  25))))))  r 2 2 (7  ) (19  3(14  ))   Differentiating  A and  B with respect to  reveals that both profits are decreasing in  . Intuitively, the higher  , the lower is the fraction of consumers who choose personalisation and thus the lower the fraction of consumers who are locked-in in the second period. Since second period equilibrium prices decrease in  ¸ an increase in  reduces the firms' profits. Considering first period decisions, firm B can anticipate that the price firm A will choose in the second period is the higher the more personalising consumers firm A has attracted in the first period. Firm B 's incentive to increase its first period demand by choosing a rather low price is therefore higher for an increased  , i.e the lower the number of consumers who opt for personalisation. Taking these effects together, shows that equilibrium prices in both periods and thus the firms' profits decrease with  .

Study on monetising privacy 2 An economic model for pricing personal information

P.O. Box 1309, 71001 Heraklion, Greece www.enisa.europa.eu