The adequacy of consumer privacy law in America is a constant topic of debate. The majority position is that United States privacy law is a “patchwork,” that the dominant model of notice and choice has broken down,[1] and that decades of self-regulation have left the fox in charge of the henhouse.

A minority position chronicles the sometimes surprising efficacy of our current legal infrastructure. Peter Swire describes how a much-maligned disclosure law improved financial privacy not by informing consumers, but by forcing firms to take stock of their data practices.[2] Deirdre Mulligan and Kenneth Bamberger argue, in part, that the emergence of the privacy professional has translated into better privacy on the ground than what you see on the books. [3]

There is merit to each view. But the challenges posed by big data to consumer protection feel different. They seem to gesture beyond privacy’s foundations or buzzwords, beyond “fair information practice principles” or “privacy by design.” The challenges of big data may take us outside of privacy altogether into a more basic discussion of the ethics of information.[4] The good news is that the scientific community has been heading down this road for thirty years. I explore a version of their approach here.

Part I discusses why corporations study consumers so closely, and what harm may come of the resulting asymmetry of information and control. Part II explores how established ethical principles governing biomedical and behavioral science might interact with consumer privacy.

I. Rationales for Studying Behavior

There are only a handful of reasons to study someone very closely. If you spot a tennis rival filming your practice, you can be reasonably sure that she is studying up on your style of play. Miss too many backhands and guess what you will encounter come match time. But not all careful scrutiny is about taking advantage. Doctors study patients to treat them. Good teachers follow students to see if they are learning. Social scientists study behavior in order to understand and improve the quality of human life.

Why do corporations study consumers? An obvious reason is to figure out what consumers want so as to be in a position to deliver it—hopefully better and cheaper than a competitor. I assume the reason that Microsoft employs the second greatest number of anthropologists in the world (after the United States government)[5] has to do with designing intuitive and useful software. But is that the only reason companies study consumers? And if not, how should we think about consumers as subjects of scientific scrutiny?

Were you to play the market equivalent of tennis against a corporation, it seems fair to think you would lose. They have several advantages. The first advantage is superior information. The websites and stores you visit gather whatever data they can about you and may supplement that information with profiles they purchase from third-party data brokers.[6] They also run data through powerful algorithms in a constant quest for novel insight.[7] The second advantage is that firms tend to control the circumstances of their transactions with consumers, sometimes entirely. Apple does not divulge its preferences and travel to a website you created from scratch in order to sell you music.[8] Firms hire people with advanced degrees and give them access to cutting-edge technology and rich datasets. These people write the legal terms and design the virtual and physical spaces in which our interactions with the firms occur.

Such advantages are fine in a win-win situation. The truth, however, is that sometimes consumers lose. The well-documented use of software by banks to maximize consumer overdraft fees by manipulating when ATM and debit transactions get processed is a simple enough example.[9] But pause to consider the full universe of possibility. Recent research suggests that willpower is a finite resource that can be depleted or replenished over time.[10] Imagine that concerns about obesity lead a consumer to try to hold out against her favorite junk food. It turns out there are times and places when she cannot. Big data can help marketers understand exactly how and when to approach this consumer at her most vulnerable—especially in a world of constant screen time in which even our appliances are capable of a sales pitch.[11]

If this sort of thing sounds far-fetched, consider two recent stories published by the New York Times. The first article—obligatory in any discussion of big data and privacy—focuses on how the retail giant Target used customer purchase history to determine who among its customers was pregnant, following which Target added ads related to babies in their direct marketing to those customers.[12] A second article describes the “extraordinary” lengths to which food manufactures go to scientifically engineer craving.[13] Either story alone raises eyebrows. But taken together they bring us closer than is comfortable to the scenario described in the previous paragraph.

My current writing project, Digital Market Manipulation, discusses the incentives and opportunities of firms to use data to exploit the consumer of the future.[14] But it is easy to take such concerns too far. The ascendance of big data will likely improve as many lives as it impoverishes.[15] The same techniques that can figure out an individual consumer’s reservation price or pinpoint a vulnerability to a demerit good can filter spam, catch terrorists, conserve energy, or spot a deadly drug interaction.[16] And big data may never deliver on its extraordinary promise. Both its proponents and detractors have a tendency to ascribe near magical powers to big data. These powers may never materialize.[17] Yet the possibility that firms will abuse their asymmetric access to and understanding of consumer data should not be discounted. I believe changes in this dynamic will prove the central consumer protection issue of our age.[18]

II. Ethical Principles

People have experimented on one another for hundreds of years. America and Europe of the twentieth century saw some particularly horrible abuses. In the 1970s, the U.S. Department of Health, Education, and Welfare commissioned twelve individuals, including two law professors, to study the ethics of biomedical and behavioral science and issue detailed recommendations. The resulting Belmont Report—so named after an intensive workshop at the Smithsonian Institute’s Belmont Conference Center—is a statement of principles that aims to assist researchers in resolving ethical problems around human-subject research.[19]

The Report emphasizes informed consent—already a mainstay of consumer privacy law.[20] In recognition of the power dynamic between experimenter and subject, however, the Report highlights additional principles of “beneficence” and “justice.” Beneficence refers to minimizing harm to the subject and society while maximizing benefit—a kind of ethical Learned Hand Formula. Justice prohibits unfairness in distribution, defined as the undue imposition of a burden or withholding of a benefit. The Department of Health, Education, and Welfare published the Belmont Report verbatim in the Federal Register and expressly adopted its principles as a statement of Department policy.[21]

Today, any academic researcher who would conduct experiments involving people is obligated to comply with robust ethical principles and guidelines for the protection of human subjects, even if the purpose of the experiment is to benefit those people or society. The researcher must justify her study in advance to an institutional, human subject review board (IRB) comprised of peers and structured according to specific federal regulations.[22] But a private company that would conduct experiments involving thousands of consumers using the same basic techniques, facilities, and personnel faces no such obligations, even where the purpose is to profit at the expense of the research subject.[23]

Subjecting companies to the strictures of the Belmont Report and academic institutional review would not be appropriate. Firms must operate at speed and scale, protect trade secrets, and satisfy investors. Their motivations, cultures, and responsibilities differ from one another, let alone universities. And that is setting aside the many criticisms of IRBs in their original context as plodding or skewed.[24] Still, companies interested in staying clear of scandal, lawsuit, and regulatory action could stand to take a page from biomedical and behavioral science.

The thought experiment is simple enough: the Federal Trade Commission, Department of Commerce, or industry itself commissions an interdisciplinary report on the ethics of consumer research. The report is thoroughly vetted by key stakeholders at an intensive conference in neutral territory (say, the University of Washington). As with the Belmont Report, the emphasis is on the big picture, not any particular practice, effort, or technology. The articulation of principles is incorporated in its entirety in the Federal Register or an equivalent. In addition, each company that conducts consumer research at scale creates a small internal committee comprised of employees with diverse training (law, engineering) and operated according to predetermined rules.[25] Initiatives clearly intended to benefit consumers could be fast-tracked whereas, say, an investigation of how long moviegoers will sit through commercials before demanding a refund will be flagged for further review.

The result would not be IRBs applying the Belmont Report. I suspect Consumer Subject Review Boards (CSRBs) would be radically different. I am not naïve enough to doubt that any such effort would be rife with opportunities to pervert and game the system. But the very process of systematically thinking through ethical consumer research and practice, coupled with a set of principles and bylaws that help guide evaluation, should enhance the salutary dynamics proposed by Mulligan, Bamberger, Swire, and others.

Industry could see as great a benefit as consumers. First, a CSRB could help unearth and head off media fiascos before they materialize. No company wants to be the subject of an article in a leading newspaper with the title How Companies Learn Your Secrets. Formalizing the review of new initiatives involving consumer data could help policy managers address risk. Second, CSRBs could increase regulatory certainty, perhaps forming the basis for an FTC safe harbor if sufficiently robust and transparent. Third, and most importantly, CSRBs could add a measure of legitimacy to the study of consumers for profit. Any consumer that is paying attention should feel like a guinea pig, running blindly through the maze of the market. And guinea pigs benefit from guidelines for ethical conduct.[26]

I offer CSRBs as a thought experiment, not a panacea. The accelerating asymmetries between firms and consumers must be domesticated, and the tools we have today feel ill suited. We need to look at alternatives. No stone, particular one as old and solid as research ethics, should go unturned.