Although the government's data-mining program relied heavily on information and technology that the government received from private companies, relatively little of the public outrage generated by Edward Snowden's revelations was directed at those private companies. We argue that the mystique of the Internet giants and the myth of contractual consent combine to mute criticisms that otherwise might be directed at the real data-mining masterminds. As a result, consumers are deemed to have consented to the use of their private information in ways that they would not agree to had they known the purposes to which their information would be put and the entities--including the federal government--with whom their information would be shared. We also call into question the distinction between governmental actors and private actors in this realm, as the Internet giants increasingly exploit contractual mechanisms to operate with quasi-governmental powers in their relations with consumers. As regulators and policymakers focus on how to better protect consumer data, we propose that solutions that rely upon consumer permission adopt a more exacting and limited concept of the consent required before private entities may collect or make use of consumer's information where such uses touch upon privacy interests.
TABLE OF CONTENTS INTRODUCTION I. CONSUMERS, CONSENT, AND DATA MINING A. What We Talk About When We Talk About Consent B. Do Consumers Really Want Data Mining? C. Does Data Mining Hurt Consumers? II. PRIVATE DATA MINING AS AN EXERCISE OF QUASI-GOVERNMENTAL POWER A. Privatization of Laws, Rules, and Regulations B. Rights Deletion with a Click 1. Limiting Remedies and the Role of the Judiciary Through Boilerplate 2. Deleting Rights Through Opaque Bargains and Monopoly Power C. Governmental Power Without Accountability 1. Speech Restrictions and the Private Regulatory Nature of the Internet a. How Section 230 of the CDA Diminishes Users' Ability to Control Speech b. Speech Restrictions and Non-Disparagement Clauses 2. Deprivation of Personal Property Without Due Process 3. Email Scanning and Other Unreasonable Searches and Seizures D. The Best of Both Worlds: Corporations as Quasi-Governmental Agencies and as Empowered Citizens III. DOWNGRADING "CONSENT" CONCLUSION INTRODUCTION
In 2013, Edward Snowden, a contractor working for the National Security Agency ("NSA"), shared with journalists from the Manchester Guardian information revealing that the NSA was engaged in a massive data-mining operation that enabled the NSA to eavesdrop on the telephonic and electronic communications of U.S. citizens and residents. (1) On June 5, 2013, Guardian reporter Glenn Greenwald published the first (2) of a long series of articles (and now also a book) (3) in which he revealed that the NSA was collecting the phone records of millions of Verizon customers daily. (4) That same day, Greenwald reported on the NSA's PRISM program, through which it gained access to data collected by technology companies including Google, Facebook, Apple, Microsoft, YouTube, and other U.S. Internet service and telephone communications providers. (5) According to the Guardian, the PRISM program went beyond mere data mining. It gave the NSA direct access to these companies' systems, so that it could access "email, video and voice chat, videos, photos, voice-over-IP--Skype, for example--chats, file transfers, social networking details, and more." (6)
The media were quick to respond. Edward Snowden became a household name, and debates rage over whether he is a hero or a traitor. (7) Condemnation of the NSA's PRISM program was nearly universal. (8) But while a wave of outrage was directed at the government agency, the private companies that provided the government with their customers' information largely escaped criticism or condemnation. (9) This is striking because if the NSA acted illegally, it was able to do so only because the Internet giants were already engaged in data mining. Major telecommunications and Internet-based businesses regularly engage in highly invasive data mining, and they do so largely without negative consequences, even though their conduct is what makes NSA data mining possible. (10) That is, the U.S. government lacks the surveillance savoir faire of these private businesses. (11) Private businesses harvest their customers' data all the time with impunity.
This Article explores the reasons why people are generally tolerant of private surveillance and argues that such surveillance is, if anything, more violative of privacy and personal autonomy than is government surveillance. We use the term "Internet giants" to refer to those technology companies that dominate the online environment, such as Google, Facebook, Yahoo, and Microsoft. We argue that, due to their size and market dominance, these companies exercise quasi-governmental authority and monopoly power that makes consumer consent to data collection meaningless.
In Part II, we discuss and reject three reasons often given for the lack of outrage at private surveillance. First, the courts generally support the notion that people who use technology, including telephone and Internet service, agree to the Terms of Service ("TOS") that the providers of those services furnish. The Internet giants disclose in those TOS that they engage in data mining, or at least that they have the right to do so. As a result, the argument goes, nobody should be outraged that the Internet giants engage in mining the data provided by the customers because the customers have consented to such use.
Second, government data mining is more threatening than private data mining because the government has the power to detain, interrogate, arrest, and even, in certain circumstances, target individuals, including U.S. citizens, for killing. (12) Private businesses data mine simply so that they can send consumers advertisements and offers that will most likely interest them.
Third, and relatedly, some argue that data mining by private companies do not harm consumers. Private companies provide the public with useful products, and they use metadata to enhance those products and to deliver those products more efficiently to the consumers who desire them.
In Part II, we argue that consumers have not given meaningful consent to private companies' data mining. We discuss survey data that indicates that consumers would not willingly choose to sacrifice their privacy in exchange for targeted advertising. Finally, we discuss the ways in which private data mining harms ordinary consumers.
In Part III, we go a bit further and argue that data mining by the Internet giants is, if anything, more objectionable than government data mining. The Internet giants use data mining to shape and control the environment in which consumers use their products and services. They do so without either transparency or the sort of regulation and oversight to which government entities are subject. In addition, specialized legislation immunizes them from the sorts of liability to which natural persons are exposed. Companies use data mining to shape the lives of natural persons in myriad ways, ranging from terms and conditions of employment and the approval of individual credit to the cultural transformations of the reasonable expectation of privacy and control over intellectual property. In so doing, the Internet giants undermine any meaningful distinction between private and governmental data mining. Private companies use data mining to override political consensus that has been achieved through democratic processes and to dictate to We the People, the conditions of our existences. Corporate power allows private actors to undertake governmental functions without being subject to democratic controls, and data mining is both a product of, and a tool to facilitate, this corporate usurpation of democracy.
In Part IV, we return to our focus on the thin concept of consent as it applies to contract formation. While conceding the market efficiencies that How from form contracting generally, we contend that a more robust concept of consent ought to be applicable in the context of data mining that infringes on personal privacy. Before corporations can harvest consumer data, they must disclose the purposes for which they will use that data, and consumers must specifically and expressly consent to those uses. We believe that effective communication of data collection practices is possible only when the process by which companies elicit consumer consent affects the consumer experience. We argue that the process of consent should be disruptive, not the seamless, nearly frictionless process that it is now. There must be a moment when consumers are conscious of the fact that, by purchasing a product or services, they are agreeing to have their data collected in ways that are clearly identified and for purposes that are spelled out and to which they agree with specificity.
Our aim here is not to condone government overreaching. Rather, we intend to show that private data mining is just as objectionable and harmful to individual rights as is governmental data mining. Moreover, because corporate actors are now empowered to use their technological advantages to manipulate and dictate the terms on which they interact with the public, they govern us in ways that can mimic and even supersede governance through democratic processes. From this perspective, the distinction between private and public data mining becomes less significant. The government relies on private companies to provide it with the metadata it needs for its data-mining projects, and private companies engage in data-mining practices about which we should be every bit as suspicious as we are about NSA data mining.
CONSUMERS, CONSENT, AND DATA MINING
In this Part, we address three common arguments for why people do not object to data mining by private companies. The most formidable...