The Strange Case of Privacy in Equilibrium Models

TL;DR

This paper examines how differential privacy influences consumer and advertiser behavior in targeted advertising, revealing counter-intuitive effects where increased privacy can sometimes lead to more information leakage and higher advertiser profits.

Contribution

It introduces an equilibrium model analyzing the complex and sometimes non-monotonic effects of privacy levels on market outcomes in targeted advertising.

Findings

Increasing privacy can increase information leakage.

Higher privacy levels may decrease consumer utility.

Privacy effects can be non-monotonic and discontinuous.

Abstract

We study how privacy technologies affect user and advertiser behavior in a simple economic model of targeted advertising. In our model, a consumer first decides whether or not to buy a good, and then an advertiser chooses an advertisement to show the consumer. The consumer's value for the good is correlated with her type, which determines which ad the advertiser would prefer to show to her---and hence, the advertiser would like to use information about the consumer's purchase decision to target the ad that he shows. In our model, the advertiser is given only a differentially private signal about the consumer's behavior---which can range from no signal at all to a perfect signal, as we vary the differential privacy parameter. This allows us to study equilibrium behavior as a function of the level of privacy provided to the consumer. We show that this behavior can be highly counter-intuitive, and that the effect of adding privacy in equilibrium can be completely different from what we would expect if we ignored equilibrium incentives. Specifically, we show that increasing the level of privacy can actually increase the amount of information about the consumer's type contained in the signal the advertiser receives, lead to decreased utility for the consumer, and increased profit for the advertiser, and that generally these quantities can be non-monotonic and even discontinuous in the privacy level of the signal.