Cybersecurity Policy Report, FTC Workshop Spotlights Potential Consumer Data Harms, Benefits, (Feb 27, 2026)

By Jeff Williams

There is no shortage of thorny issues to sort through as policy-makers, economists, and academics try to define, understand, and measure the harms and benefits that arise from the collection, use, and disclosure of consumer data, speakers and panelists indicated during a Federal Trade Commission workshop.

During a prerecorded video message, FTC Chairman Andrew Ferguson, said the workshop would “undoubtedly inform future work of the FTC” regarding consumer data issues.

“Measuring benefits and harms to consumers is always a difficult task, but it is most difficult in emerging markets fueled by rapid technological innovations,” he said.

The commission must answer “difficult questions” as it meets its FTC Act obligations, including how data should be valued, what constitutes harm to consumers’ privacy “when most consumers do not fully grasp the mechanisms by which their data are acquired, shared, stored, protected, and monetized for advertising purposes,” and how the agency can take enforcement actions that withstand judicial review.

Mr. Ferguson urged against assuming that there was a “necessary conflict between consumer choice and technological innovation that drives economic growth” or a "conflict between consumer privacy and technological innovation in a data-driven economy.”

Though in an “ideal world, without any tradeoffs, we would want to maximize both things,” Mr. Ferguson said, “ours is not the ideal world and we must be clear-eyed about the costs of trading off some goods for others.”

During the event’s first panel discussion, Alessandro Acquisti, a professor of management and information technology at the Massachusetts Institute of Technology’s Sloan School of Management, questioned the benefit to consumers of having their personal data used for targeted advertising.

Among other things, he noted the “striking” results of studies he conducted that showed that consumers who made purchases based on targeted advertising paid an average of 10% more for those products than they would have for identical or competitive products found through “organic” search results, he said.

Research suggests “that there are at least doubts over whether consumers benefit, from an economic perspective, from behaviorally targeted ads,” Mr. Acquisti said.

Ginger Jin, an economics professor at the University of Maryland, discussed the potential harms she said could come from websites using surveillance pricing based on personal information about users.

Such practices can lead to “first-level price discrimination” because they enable online merchants to use data to determine the highest price each individual consumer is willing to pay for a product, she said.

“We could get into a situation where everyone could be worse off because of this,” Ms. Jin said.

Overall, she said, “When we combine advanced technology with personal information, surveillance pricing or similar personalization practice could generate harm from more effective price discrimination, more privacy loss, and a strategic behavior in the data markets.”

Avinash Collis, assistant professor at the Heinz College of Information Systems and Public Policy at Carnegie Mellon University, detailed, among other things, research he conducted that showed that approximately 40% of consumers would be willing to pay $25 per year to prevent their data from being shared with data brokers.

During a subsequent panel, Michael Baye, professor-business economics and public policy at Indiana University’s Kelley School of Business, highlighted the difficulty of setting data privacy policies based on consumer harms and benefits.

“The issue is when we start trying to find solutions for problems that we all kind of feel, ‘Yeah, there’s an issue,’ we don’t know how to quantify the benefits and costs,” he said. “That’s when we adopt policies that last for decades that have no value.”

In many cases, he said, “a privacy policy that benefits some types of consumers is going to harm others and vice versa.”

Mr. Baye argued that platforms, because they must satisfy both users and advertisers, had incentives to “maximize social welfare” by implementing privacy and personalization practices that satisfy both constituencies.

Howard Beales, emeritus professor–strategic management and public policy at the George Washington School of Business, argued in favor of targeted advertising, saying that the "most important thing to keep in mind is that it’s information that funds the Internet.”

Advertising revenue “produces important and valuable services” for consumers, he said. “The utility of the information that you’re getting from the ads is enough to offset any disutility from the ads themselves.”

Among other benefits, he said, “advertising enhances competition,” which “leads to lower prices” and “stronger incentive for product improvements.”

Omri Ben-Shahar, a professor and director of the Coase-Sandor Institute for Law and Economics at the University of Chicago Law School, said the potential harms from privacy regulations needed “to be taken into account when we think about scope and the type of regulatory techniques that we are using.”

In particular, he argued, there are “social costs” from privacy laws that, for instance, reduce the use of facial recognition that can lead to stopping human trafficking or limiting the safety and cost benefits consumers can receive from voluntarily allowing car insurance companies to track their driving habits.

“You cannot do privacy regulation without looking at the same time at the benefits,” Mr. Ben-Shahar said.

Malika Korganbekova, assistant professor–marketing at the University of Chicago Booth School of Business, outlined her research showing that “personalization actually does help consumers” in the form of providing faster search results, saving time on purchase decisions, and reducing product returns.

Ms. Korganbekova also cited her research indicating that consumers with a good understanding about the personalization practices of large websites expressed greater satisfaction with their experiences using those websites.

Speaking during a later panel on data breaches, how they impact consumers, and efforts to minimize injuries to consumers, Jeff Prince, professor–business economics and public policy at Indiana University, said academics were still determining the best ways to measure the harms and effects of data breaches.

Mr. Prince noted that factors that are considered typically include monetary and reputational costs, exposure to spam campaigns, and risks of profiling and surveillance.

Sebastian Schuetz, assistant professor–organizational leadership and information analytics at the Leeds School of Business at the University of Colorado, Boulder, said there were “fundamental questions” about whether organizations had incentives to properly protect customer data.

“The return on investment is often unclear, specifically when the consequences are externalized to consumers and don’t really affect the firms themselves,” he said.

It appears that “organizations systematically underinvest in cybersecurity,” Mr. Schuetz said. “We see data breaches every day. That just means that there just is not enough being done.”

Sunil Wattal, associate dean–research and doctoral programs at the Fox School of Business at Temple University, agreed that companies “tend to systematically underinvest in technology” needed to protect against data breaches.

Mr. Wattal also pointed to other factors that could lead to data breaches, including human error that “actually outweighs” problems caused by lack of investment in technical solutions.

Tyler Moore, professor-cybersecurity and information assurance at the University of Tulsa, said that “a lot of work remains to be done” to assess which cybersecurity defenses are most effective.

“It’s hard to determine cause and effect between firm investment and cybersecurity defenses on the one hand and how that reduces the likelihood of experiencing those instances in the first place on the other.”

“Unfortunately, as a society, we are avoiding taking steps that would make robust measurement more feasible and allow us to really get a better handle on these questions,” he said.

Among other things, he said, there is no consistent record collection regarding cyber attack instances and disclosures.

News: FederalLegislation DataPrivacy DataBreach DataSecurity