Lively debates over a virtual cuppa

Can privacy and the Internet coexist?

An illustration of Mark Bartholomew and Sanjukta Das Smith faces in the foam of two cups of coffee

Mark Bartholomew, left, and Sanjukta Das Smith. Illustrations: Chris Lyons, BFA ’81

“We all know we should have long passwords with multiple sets, but we don’t do it.”
Mark Batholomew, Professor of Law, University at Buffalo

Websites like Facebook and Google are collecting more data on their users than ever before, leading us to wonder whether all those targeted ads are worth it. We asked two Internet privacy scholars—Mark Bartholomew, professor in the Law School, and Sanjukta Das Smith, an assistant professor in the School of Management—to share their perspectives.

Mark Bartholomew: It’s sometimes nice to have ads that are targeted to you, but I think there’s a cost. There was a Pew study just a couple months ago about Internet use, and 90 percent of respondents said privacy is a concern. People are definitely worried about it.

Sanjukta Das Smith: That’s interesting because there have been other studies where people were more optimistic when it was about their own privacy as opposed to others—as in, it can’t happen to me. I see that in the types of security habits people adopt. They know what they should be doing, but don’t follow through on it.

MB: Passwords are a great example. We all know we should have long passwords with multiple sets, but we don’t do it. So maybe in the abstract I have these concerns, but when it comes to executing, I want the website to do the functional thing I’m asking for.

SDS: Age also has a lot to do with it. Right now we have this large section of consumers who haven’t had a life that precedes the Internet. Soon we’re going to have another batch who’ve never known life without a smartphone. I think they’re willing to give up a lot of control over their privacy in exchange for the perceived benefits.

MB: There’s sort of a push-pull between two forces. On the one hand, I think there’s a lot of support for more control over one’s data and for some real benchmarks for businesses to follow. On the other hand, we have this attitude that consumers ought to be able to decide these things for themselves.

SDS: I do know a lot of people who like targeted ads. And without some amount of predictive analytics happening in the background, there wouldn’t be those ads. It’s a difficult problem because we don’t want to stifle innovation, but we have to educate consumers about the benefits and the costs.

MB: Something I’m playing with is, when does it pass muster to manipulate people? “I know that you like sports cars and you like the color red, so here’s a targeted ad for a red sports car.” That doesn’t seem to be manipulating me. But “I know where you are and so I try to make an advertisement appear serendipitously when it’s not serendipitous at all”—for me, that’s iffy.

SDS: I think this is another place where age comes into the picture. Younger users tend to take these types of situational awareness apps for granted. They feel it adds value. I can clearly see other segments of the population not being comfortable with that at all, and understandably so.

MB: So I’m curious, as an expert in this field, do you take steps to protect your own privacy?

SDS: I don’t use situational awareness apps at all. I don’t know how much of that is because I work in this field. It probably has a lot to do with it. I do see the amount of information that people reveal online and it’s not that they’re not aware of what happens out there. Again, they feel that it can’t happen to them. For example, a friend of mine posted videos of her vacation on her YouTube account. Her Facebook account is not linked to her YouTube account. A digital marketing firm found her videos, was able to connect that to her Facebook profile, found her home phone number and called her after sending her a Facebook message about that video.

MB: People haven’t quite realized the power of aggregation. There’s a great app for your browser called Lightbeam, which tracks each website you go to and then how many third-party services are hiding in that data. You just go to three sites and there’ll be a chart with 100 entities kind of circling around them. They’re aggregators and their job is to connect the dots.

SDS: My friend got quite a jolt because of this. This is a person who was otherwise savvy. Yet I don’t see too much discussion happening about online privacy. We only see it in fits and spurts when something bad happens. Then people wake up and have this intense discussion, and then the news cycle moves on to the next big item. Unless there’s some persistent push from consumers on this, is there incentive from the business side to curb their data collection practices? I don’t see that happening.

How do you take your coffee?

Mark: I'm a sucker for anything with hazelnut creamer.
Sanjukta: Black.