The Data Economy: Surveillance as Media's New Business Model

Selling attention, then selling prediction

Every advertising-financed medium has had to answer the same question: what, exactly, is being sold to the advertiser. The penny press of the 1830s sold circulation, a count of how many people held the paper in their hands. Broadcast television, a century later, sold audience share, an estimate of how many households a channel reached during a given hour, measured by ratings services and sold in aggregate blocks. Digital platforms started the same way. Early web advertising was priced by the impression, a single ad shown once to an anonymous visitor, an audience-count model translated onto a screen.

What the platforms found, through the 2000s and into the 2010s, was that this model radically undersold what they actually possessed. A search engine or a social network did not just know that a visitor existed; it could observe, page after page and click after click, what that specific person searched for, where they lived, what they bought, and what they had looked at the day before. An advertiser paying for that individual prediction, rather than a rough demographic slice, would pay more for it, because the prediction was more likely to convert into a sale. The product for sale changed, quietly, from a count of eyeballs to a forecast of one person's next decision.

The infrastructure built to sell that forecast is called real-time bidding. For most of the display advertising a person sees on the open web, a single webpage load triggers an auction that runs in the time it takes the page to render. A bid request goes out carrying a profile of the visitor: the device, the approximate location, and a set of behavioral signals drawn from that person's browsing history. Hundreds of advertising intermediaries can receive that same request for a single page view and bid against one another for the right to show an ad to that specific visitor. It is a market that transacts, many times a second, in individual predictions rather than aggregate audiences.

That auction, run at a scale of billions of impressions a day, is what turned personal behavioral data into the raw material of the media economy. The data broadcast in each bid request has itself become a subject of privacy complaints in Europe, precisely because the mechanism depends on distributing a profile of an identifiable person to a long chain of companies most of whom that person has never heard of. The commodity being traded is not the ad slot. It is the knowledge of who is looking at it.

The scale of the wager

The clearest evidence of how completely this model took over a company's economics is Alphabet, Google's parent. In 2021, advertising accounted for 82 percent of Alphabet's total revenue, a figure drawn from the company's own reporting. Search, Maps, Gmail, and YouTube are used by billions of people for free; the business that pays for all of it is the same behavioral-prediction engine described above, applied to a company whose products generate more individual signal than almost any other on the internet.

A ratio that high is not typical even for an advertising-supported company. It means a business built its entire economics around one activity: inferring what an identified person is likely to want next, and selling that inference. The company's public-facing products, the search bar, the map, the inbox, the video feed, function as the surface where that inference is collected, not as the source of the revenue that funds them.

Google did not hold that position alone. Together with Meta, the two companies controlled the largest concentration of ad-financed wealth in the history of media, and they held it specifically because their targeting data was the most granular available at scale. Industry estimates put their combined share of US digital advertising spending at 50.5 percent in 2022, easing to 48.7 percent in 2023 and 47.7 percent in 2024. The decline is real, and it marks the first sustained loss of ground the pairing had suffered since digital advertising became the dominant form of ad spending in the previous decade. It does not, on its own, mean the underlying model is fading. It means the model has new competitors.

When the mechanism became visible: Cambridge Analytica

The public did not get a clear look at how the prediction engine worked until March 2018, when reporting revealed that Cambridge Analytica, a political consulting firm, had improperly obtained data from as many as 87 million Facebook users. The data had not been stolen in a conventional breach. It had been harvested starting in 2014 by a personality-quiz app built by the academic researcher Aleksandr Kogan, using access Facebook's developer platform granted at the time to any app a user installed.

The scale of the exposure came from a design choice in that platform, not from Kogan's app alone. A user who installed the quiz gave the app access to their own data. The app also reached data about that user's entire network of friends, most of whom had never heard of the app and had not consented to anything. A few hundred thousand installs turned into tens of millions of exposed profiles, because the platform's own architecture treated a friend's data as reachable through anyone in that friend's network.

The episode became famous for its political use, Cambridge Analytica had marketed itself as a firm that could build psychological profiles for campaign targeting, but its lasting significance for the media economy was narrower and plainer. It showed, in public and in detail, that the same behavioral-inference machinery built to sell an ad could be extracted wholesale and repurposed by a third party the platform never intended to supply.

The reckoning that followed was financial as much as reputational. The United States Federal Trade Commission fined Meta 5 billion dollars, at the time the largest privacy-related penalty the agency had ever imposed on any company. It was a domestic US response to a scandal that had, by its nature, touched users well outside American jurisdiction, since Facebook's audience and its data pipelines were never confined to one country.

Sovereignty over the second resource

The Cambridge Analytica fine was large, but it was also a single national regulator acting after the fact. European regulators took a different route, one aimed less at punishing a specific scandal and more at asserting standing control over a resource that was, by its nature, crossing their borders continuously. Under the General Data Protection Regulation, a European user's data can be moved outside the European Economic Area only under specific legal safeguards, and Meta's core business model, transferring EU user data to servers and systems in the United States for processing and ad targeting, put it in direct and repeated conflict with that requirement.

On 22 May 2023, Ireland's Data Protection Commission, the lead GDPR regulator for Meta because the company's European operations are headquartered in Dublin, fined the company 1.2 billion euros specifically for unlawfully transferring EU and EEA Facebook users' personal data to the United States. It was, and remains, the single largest fine ever issued under GDPR. The penalty targeted the transfer itself, not any one downstream use of the data, which is the clearest evidence that European regulators had come to see the data pipeline, not merely what was built on top of it, as the thing worth regulating.

That fine was not an isolated event. Meta and its affiliated entities accrued roughly 2.8 billion dollars in cumulative GDPR fines over the four years following the regulation's stricter enforcement phase, an order of magnitude beyond Google's own GDPR penalties, which escalated more gradually: 100 million euros in 2020, 150 million euros in 2021, and 325 million euros by 2025. Both companies were fined under the same law for the same underlying behavior, using European users' data at a scale and a specificity the regulation was written to constrain, but Meta's business model, more dependent on cross-platform behavioral tracking, drew the heavier and more repeated penalty.

The geopolitical logic underneath these fines is straightforward once stated plainly. The platforms that built the data economy are headquartered in the United States; the people whose behavior generates the data being sold live everywhere, including inside a European regulatory zone with its own law and its own enforcement apparatus. GDPR gave that zone a mechanism to reach into a foreign company's core business model and price the cost of moving a European resource across a border. It is the same contest that has recurred with every dominant medium: whoever sets the terms on which the medium's raw material moves, print runs, broadcast spectrum, or now, data, holds real power over the economy built on top of it.

A duopoly loosening its grip, not surrendering it

The erosion described above, from a combined 50.5 percent share to 47.7 percent over two years, is genuine competition, not collapse. Two readings of that fact sit uneasily next to each other, and both belong here. The data-advertising model has, in one sense, funded a great deal of content and commerce that would otherwise have needed a subscription or a storefront: it paid for nearly two decades of free search, free social platforms, and free video, and it let a small retailer or a local business reach a precisely defined customer at a price no comparable print or broadcast placement ever offered.

In another and equally true sense, the same model concentrated decision-making power in an unusually small number of companies. A newspaper's circulation was a public number anyone could check. The behavioral profile a platform builds on an individual user is proprietary, opaque to the person it describes, and the auction that trades it runs entirely inside infrastructure a handful of companies control. Amazon and TikTok entering that market did not decentralize the resource; they added two more large, similarly opaque holders of it. A market with two dominant buyers of behavioral prediction now has four, which is more competition, but it is not the same as an open one.

Both readings belong in the account of what happened. The data economy expanded who could afford to advertise and who could be reached precisely, while narrowing, to a handful of companies, who got to hold the data that made that precision possible. Neither fact cancels the other.

From ad auctions to answer engines

The mechanism described in this history, individual behavioral data traded to determine who sees what, was built for one purpose: deciding which ad a person sees. It is worth naming, carefully, where a version of that same underlying resource is heading next. Systems that answer a question directly, rather than returning a list of links, are trained and tuned on enormous stores of data about how people ask, search, and respond, some of it adjacent to the same behavioral signal that built the ad economy.

The businesses an AI system names in its answer are not chosen through the real-time bidding auction described above; that is a different mechanism, built for a different purpose, and collapsing the two would misstate history. What carries over is the pattern this account keeps repeating: control of the infrastructure that reads, ranks, and surfaces information shapes both who profits from it and which government gets to set its terms. The fight over data crossing the Atlantic inside an ad auction is an early instance of a question regulators are now asking again about the data feeding the systems that decide who gets named.

That question does not yet have a settled answer, and this account does not attempt to supply one. What the history of the data economy does establish is the pattern itself: every time a medium's dominant infrastructure became the place where the most valuable resource changed hands, control over that infrastructure, not the content riding on top of it, became the real site of economic and political contest. Advertising's shift from selling attention to selling prediction was one instance of that pattern. It will not be the last.