What are your cookies worth?

If something is free, then you are the product.

Or: “The problem with cookies”.

The Norwegian Data Protection Authority (2015) recently published a report discussing how there is a digital race taking place these days, in regards to knowing the users. When we visit a website today we don’t engage with just one company: the publisher, the ad exchanges, ad networks, data brokers, data management platforms plus more. All kinds of info gathered is sold on a real-time fast ad exchange network, which sells the user’s advertising space to the highest bidder. The user is then showed ads from this winner company. (Steel et al., 2013)

Data brokers are companies that hold vast information about individual consumers. These gather information from address lists and aggregated anonymous data from public registers and publically available statistics. In other words, they make use of data that is already publically available and collects them for a buyer. (The Norwegian Data Protection Authority, 2015) Data management platforms (DMP) are big-data solutions to analyse data and make a complete profile of the buyer. (The Economist, 2014) These use identity handling systems that enables them to gather information from many different sources and unify them to identify a particular buyer. Loyalty cards, Cookies, IP address, web beacons and device fingerprints are all used to make a complete picture of you, the buyer. (The Norwegian Data Protection Authority, 2015, Acxiom, 2014).

Hustinx (2014) mentions that: “Many people believe that ad-funded content on the Internet is free. This is wrong. We pay for access to the services with our personal data”.

I think that most consumers are not certain of what things like cookies really do and therefore accepts them. I also believe users are unaware of data brokers, 3rd party cookies and such – they believe it is only the website publisher that stores information about them. (The Norwegian Data Protection Authority, 2015, pp. 38, Hustinx, 2014)

Test yourself: How much are YOU worth to the advertisers? My personal data is worth $1.5039. How valuable is yours? http://www.ft.com/


The Norwegian Data Authority’s report mentions: «When consumers have no knowledge about what is going on, they cannot demand services that offer better privacy.” Therefore, I do not expect a person to be aware or take actions for his/her own privacy – they do not know what is happening or that they should protect themselves. This, I believe, should be the responsibility of the publisher of the website.

The authority’s recommendations for better privacy include, and I agree:

  1. Publishers taking responsibility for 3rd party access to their pages.
  2. Companies collecting data must base the processing of such on active user consent.
  3. Publishers must give user who do not consent to this collection, access to services too.
  4. The privacy policies must be improved, shortened and be written in an easier language so most users can understand it.
  5. Publishers and their co-companies must produce guidelines for greater openness and transparency regarding targeted advertising.

(The Norwegian Data Protection Authority, 2015) These statements are also supported by the European Data Protection Supervisor (Hustinx, 2014).

Implications of companies or a person collecting information can be devastating if used the wrong way. Stalkers who are good at computing could surely be able to enter one of these complete profiling systems and find out where their prey are likely to be and what they are up to. Also, individuals could have their private life exploited and blackmailed in return for not publishing private browsing history or information about them. Every person (should) have a right to privacy. (Hustinx, 2014, pp. 21-22)

These profiles might also be bad for people with addictive tendencies. A company might know that you spent X amount of dollars on, say, betting last year and that you haven’t spent that much time or money on these sites so far. Suddenly you might see betting and gambling adverts everywhere you direct your browser to. You don’t really have any way of saying «stop it» to them! You have little privacy or freedom.

However, I believe the biggest problem is not the targeted advertisement, but rather all the information behind it. Companies could be able to pay for excluding competitors in your everyday browsing. (Hustinx, 2014, pp. 21-24) They could decide to only show you the most expensive product – flight companies are in fact doing this already today. (Constantinides and Diercks, 2014)

I believe the topic of digital privacy will be more highlighted in the years to come.

How does cookies work?
Let us end this post with a thought experiment extracted from The Norwegian Data Protection Authority (2015) report:




Acxiom. (2014) ‘Case study: The Guardian, Boosting audience engagement across the globe’, [Online]. Available from: http://dq2qu0j6xxb34.cloudfront.net/wp-content/uploads/2014/02/The-Guardian.pdf  Acxiom. (Accessed: 25.09.2016).

Constantinides, D. E. and Diercks, R. H. J. (2014) ‘Airline price discrimination: a practice of yield management or customer profiling?’, Anonymous Paradigm shifts & interactions, 43rd EMAC Conference, Valencia, June 3-6, 2014,

Hustinx, P. (2014) ‘Privacy and competitiveness in the age of Big Data: The interplay between data protection, competition law and consumer protection in the Digital Economy’. Available from: https://secure.edps.europa.eu/EDPSWEB/webdav/shared/Documents/Consultation/Opinions/2014/14-03-26_competitition_law_big_data_EN.pdf European Data Protection Supervisor. (Accessed: 25.09.2016).

Steel, E., Locke, C., Cadman, E. and Freese, B. (2013) ‘How much is your personal data worth?’ 12.06.2013, Financial Times [Online]. Available from: http://www.ft.com/cms/s/2/927ca86e-d29b-11e2-88ed-00144feab7de.html#axzz3lAaLdwax (Accessed: 25.09.2016).

The Economist. (2014) ‘Little Brother, Special Report on Advertising and Technology’, [Online]. Available from: https://www.economist.com/special-report/2014/09/11/little-brother (Accessed: 03.08.2018).

The Norwegian Data Protection Authority. (2015) ‘THE GREAT DATA RACE.  How commercial utilisation of personal data challenges privacy. Report, november 2015’, https://www.datatilsynet.no/English/Publications/The-Great-Data-Race/ : Datatilsynet.

Image source: Brett Jordan, Flickr, Generic CC licence, no changes made to image: https://flic.kr/p/7ZRSzA