Data or privacy? Businesses can have both, MIT Sloan research finds

There’s an ongoing debate over which kind of world delivers better economic value to consumers and business: one without restrictions on data collection? Or one that favors privacy through regulated data protections?

A team of researchers conducted multiple studies to tackle the question of who benefits from the data economy and exactly how trade-offs arising from the protection or sharing of personal information affect data’s potential value. 

Led by Alessandro Acquisti, a professor of IT at the MIT Sloan School of Management, the researchers set out to pressure-test the conventional wisdom that any economic benefits gleaned from the collection and analysis of consumer behavioral data are diminished when regulation-mandated data protections are in play. 

“Under the conventional wisdom of the privacy debate, there is one world in which we have more data and one in which we have more privacy, and the two worlds have almost antithetical outcomes,” said Acquisti, who leads the Data, Markets and Privacy group at the MIT Initiative on the Digital Economy. 

Free-flowing data versus strong privacy controls

Presenting at IDE’s annual conference, Acquisti said that without regulation, data flows freely and organizations can glean the measurable benefits that arise from data flows, analytics, and generative AI, including more innovation, greater efficiency, and better economic outcomes. On the other hand, regulations that protect data are likely to result in more autonomy, dignity, and freedom for individuals — a troika of benefits that are far less tangible and revenue-specific.

Yet the research found that the dichotomy isn’t black-and-white: While there are some short-term negative effects associated with stronger data privacy controls, it’s possible to collect ample data, retain sufficient privacy guardrails, and still manage to score the intended economic wins over the long term. 

“My broader argument is, there tends to be short-term effects concentrating on upstream variables, like the impact of data regulation on the efficiency of advertising,” Acquisti said. “The more interesting question is, does the regulation, in the long term, negatively affect the downstream variables, like the availability of content to online users?”

Acquisti worked with different research teams to explore different aspects of the issue and concluded that overall, balance is best. The studies aimed to answer the following key questions.

Does data regulation cause economic harm?

There have been notable concerns that countries’ adoption of the European Union’s General Data Protection Regulation could adversely affect their ability to create quality content. Using a longitudinal dataset of EU and U.S. news and media websites, Acquisti and his research colleagues studied the response to GDPR over time, including whether restrictions on online tracking affected downstream outcomes.

The research team drew its conclusions by evaluating metrics like social media engagement and text analytics. They uncovered short-term impacts — for example, a reduction in average page views per user on EU sites compared with U.S. sites where the GDPR wasn’t relevant. But there was no evidence of short- or long-term negative impacts related to new-content generation or quality. 

Agentic AI: Business Implications and Applications

In person at MIT Sloan

Register now

There was also no difference in the survival rates of media sites across the EU and U.S., and no sign that monetization strategies changed at higher rates in regions where GDPR was adopted. EU online content providers made some changes to data collection practices pursuant to regulatory directives, but their strategic use of data minimization and consent mechanisms helped them maintain a pace of content production and audience engagement that was on par with that of their U.S. counterparts.

“Much of the research in this area has been focused on capturing effects which happen six, 12, 18 months after the enactment of GDPR, which is more likely to capture the shock of the regulation rather than a long-term, new equilibrium adaption to the regulation,” Acquisti said. 

Do targeting restrictions impact the availability of high-quality content?

In another study, Acquisti and research colleagues looked at the effect of effect of Apple’s App Tracking Transparency framework, which restricted developers’ access to personal identifiers used for targeted advertising. 

Using a variety of metrics to compare data from Apple’s App Store and Google Play in the 18 months after the framework’s debut, the team found only a temporary decline in the number of new iOS apps in the store and no significant increase in developers exiting the platform. There was a modest reduction in developer use of some of the ad monetization services, but there were no meaningful changes in observable user engagement or content quality. 

“Contrary to pessimistic predictions, ATT did not trigger developer withdrawal but instead prompted adjustment to a more privacy-protective environment,” the researchers write.

Can privacy-preserving technologies coexist with data analytics?

Tools such as homomorphic encryption, federated learning, and differential privacy, which have been available for decades, maintain individual privacy while data is analyzed. There has been some controversy associated with such technologies, however. For example, some scholars claim that the privacy noise (statistical uncertainty) that differential privacy techniques introduce by design to datasets could cause “a precipitous decline in the quantity and quality of evidence-based policy research,” Acquisti said.

In particular, when the U.S. Census Bureau employed the privacy technique, critics raised concerns about the integrity of census-guided democratic processes, including the allocation of funding to educational districts.

Acquisti and his research colleagues made the case that the trade-offs around differential privacy mask deeper uncertainties in census data. When they compared the financial repercussions of errors inherent in census data with the effects of the use of a differential privacy mechanism, they found that data errors account for significantly greater funding misallocations to educational districts than the use of differential privacy techniques. 

Another study Acquisti conducted with colleagues examined whether differential privacy would harm social science research. The researchers selected 93 published studies and tried to replicate the original results after the addition of privacy noise. The team was able to replicate about 91% of the originally published results. Their takeaway: that any misalignment due to differential privacy noise can be mitigated or corrected.

While the debate around privacy and economics typically manifests as a contrast between two possible futures, Acquisti’s research shows that it’s very possible to balance both. “We should not assume privacy protection is inherently economically damaging,” he said. “We can use tools to protect privacy and still benefit from data.”

Alessandro Acquisti is the T. Wilson (1953) Professor in Management and a professor of information technology at the MIT Sloan School of Management. His research has spearheaded the application of economics and behavioral economics to the study of privacy and personal data, and the investigation of privacy and disclosure behavior in social media.