Europe needs a regulated market for personal data

The idea that European Union residents could trade their personal data has come to the fore in the context of sparring between internet platforms and data protection authorities over ‘pay-or-consent’ models. Unfortunately, the debate has become stuck between two unworkable extremes: the status quo of unrestricted use of user data versus enacting consent rules so stringent that they effectively make it impossible to share data. Both positions would harm European consumers. Policymakers should chart a middle course that protects citizens while preserving the benefits of data-driven services.

A traveller searching for flights to Lisbon, for example, might want Portuguese hotels to offer her relevant deals through advertising, if the law and technology permit the travel website to communicate her interest. Such data sharing creates real value: the user discovers options, the hotel reaches interested customers and the platform gains ad revenue.

The current regime, however, gives most of the power to the platform. Platforms exploit commercial data, location data, social networks and even sensitive medical information with minimal control or compensation given to consumers. Platforms thus capture billions annually in advertising revenue.

Without appropriate consent, such amassing of data and tracking violates users’ fundamental privacy rights. Lack of specific, informed consent on the part of the user or coercion of the user by the platform into choosing to share both violate EU data protection rules. But, if regulation of the choice process entirely or mostly eliminates platforms’ ability to monetise data through targeted advertising, some valuable ‘free’ online digital services may no longer be tenable.

The solution is not to choose between these extremes, but to balance them through regulated markets to achieve a middle ground. An analogy with labour markets indicates how this could be done.

Millions of Europeans are employed legally, but that employment places temporary restrictions on their freedom of movement in exchange for wages. Employment contracts don’t violate fundamental rights in part because labour markets are heavily regulated: child labour is banned, overtime is permitted, workplace safety is enforced and discrimination is illegal. These regulations ensure that trade in labour respects fundamental rights and allows market participants to gain, rather than to be exploited.

Data markets can be designed similarly. Policymakers need to move beyond the view of the European Data Protection Board that “personal data cannot be considered as a tradeable commodity”, to create markets that enable consumers gain relative to the status quo, both in protection and compensation.

Such data-market regulations would identify which personal data is too vulnerable to be traded (the EU already does this for children's data and highly sensitive information) and ban those transactions. It would require transparent choice architectures, preventing platforms from using dark patterns to steer users toward sharing more data. It could require platforms to offer services at varying privacy levels with corresponding benefits or fees.

In practice, this could mean large platforms that want to collect personal data for advertising offering consumers a menu with minimal data processing as a zero-fee option, intensive tracking as a subsidised option and no data processing as a paid option. The first option – the more-private, zero-fee plan – could be the default, thereby protecting users who do not make an active choice. Platforms would gain revenue from the second option – users who opt-in to greater levels of sharing their data. Platforms would therefore have an incentive to offer compensation to those users who make an informed, active choice to share personal data.

The biggest platforms are large enough to make such bilateral data transactions work. Google and Meta could offer such menus of options. Smaller websites cannot build such infrastructure economically, highlighting the need for regulatory frameworks that would enable data intermediaries to facilitate these markets.

Without such data-market reform, Europe faces two undesirable futures. Either personalised advertising markets shut down and valuable consumer content decreases, or courts and regulators find ways to allow platforms to continue processing personal data without genuine consent. This would delegitimise privacy laws while permitting continued exploitation of consumers.

Either outcome would be bad for contestability and fairness. The largest incumbent firms already control vast data troves; their competitors need access to data to challenge them and enter new markets. Such competitors can more easily grow within well-regulated data markets. A default option that does not share all data and that allows user control over sharing would give users leverage to force platforms to offer them a bigger share of the advertising surplus. Consumers would gain from both enhanced privacy and higher compensation, while platforms would be enabled to operate sustainable, legally compliant, advertising-supported business models.