Can reputation protect data privacy?

Consumers who believe that a firm values its reputation over immediate profits are more confident in entrusting their personal data with the said firm. Building on this idea, Professor Yao models various scenarios of firm and consumer data interactions and then compares the outcomes in different market structures.

“Companies have a strong motivation to sell users’ data for immediate profits, and may not realise that they can actually gain consumer trust and loyalty by honouring their commitments to user privacy.”

Professor Jesse Yao

The analyses find that privacy protection thrives in a monopoly setting, where one firm dominates. In this setting, customers quickly find out which firm to blame for any data sales. Considering the risks of permanent reputational damage by selling or recklessly handling user data, the firm has a strong incentive to protect data to keep consumer trust and loyalty.

In a competitive market with multiple firms relentlessly trying to outmanoeuvre each other, reputation fails to serve as a privacy gatekeeper. Since consumers cannot easily identify which company leaks or sells their data, and individual firms do not bear the full consequences of harming consumer trust, the repercussions for the offenders are weak and temporary.

Take Apple’s operating system iOS, for instance. The company has quasi-monopoly power over its closed ecosystem and tight controls on both hardware and software. Consumers cannot install software from other manufacturers and will easily point fingers for any data breaches. Since Apple cares so much about reputation, it has strong incentives not to misuse users’ data.

On the other hand, the open Android ecosystem has numerous hardware manufacturers and software developers sharing the market. Consumers often cannot tell which apps were responsible for privacy violations due to noisy data flows and shared infrastructure, making the environment more prone to privacy risks, as evident in many news reports.

“We even find situations where two competing companies at first wanted to stick to their privacy commitment and were very willing to keep their reputations, but the temptation was so strong that they eventually failed to do so,” says Professor Yao.

Why privacy policy and regulation matter

Unfortunately, there is no purely monopolistic market in the real world, and people nowadays use multiple apps on various devices. Companies can easily gain short-term profits by selling data, and customers will find it hard to track down the responsible party. This lack of accountability reduces firms’ incentives to protect privacy. In this case, regulation plays a vital role in ensuring consumers’ rights.

Sound regulation can extend benefits for both consumers and companies. Protecting data privacy will make consumers more confident to share their information and to get better product offerings. At the same time, companies benefit from enhanced reputations and sustainable profits from loyal customers.

“Consumers and companies actually share the same interest, but the companies might be tempted to act against consumers’ interest by selling their data for short-term gains,” says Professor Yao. “Therefore, well-designed regulations are important to encourage businesses to behave responsibly, which benefits both consumers and companies in the long run.”

On top of that, regulators shall impose fines to deter firms from violating privacy commitments. “Liability fines by themselves are not enough, but liability fines with regulatory monitoring could do the trick,” he says.