Smartphones have popularized the concept of on-the-go entertainment with users now spending over five hours per day on their mobile device. This steady demand is great for businesses as long as this usage has reliable 3G or 4G broadband, or WiFi access. Data efficiency decreases the farther one travels from metropolitan areas, whether that be by plane or automobile, whereas the demand for entertainment is constant.

In-flight entertainment systems and broadband are popular with 70 percent of survey respondents citing they would be willing to pay 7 USD for connectivity[1]. Total revenue from these passenger connectivity services will reach $5.4 billion by 2025 growing at a rate of 23 percent CAGR[2].

Wireless in-flight entertainment is expected to reach 9000 aircrafts by 2021 with connected commercial aircrafts reaching 23,100 by 2025. Market size is expected to reach 9.82 billion by 2024[3] with in-flight broadband growing at a CAGR of almost 11% [4].

While these estimates seem in-line, the IFE connectivity may achieve an even higher trajectory due to High Throughput Satellites (HTS). Connectivity will increase 3x reaching 1,500 Gbps by 2017 while increasing 5x to 285 Gbps in 2018. These increased data speeds will also lower costs contributing to more widespread adoption for IFE services.

Cars are also pushing forward on-the-go entertainment with the global in-car market expected to reach $33.8 billion by 2022 up from 14.4 billion in 2016. The automotive landscape is undergoing a drastic change with only 2% of cars online in 2012 compared to an estimated 90% to be connected to the IoT by 2020. [5].

An Infographic on Key Trends in On-the-Go Entertainment:

Hackers go about achieving their goals with reverse engineering software to find vulnerabilities they can exploit, data they can extract, or ways to modify the software to do something it was never intended to do. The primary consequences of applications getting hacked include financial loss, destroyed brand reputation, exposure to liability, and regulatory risk.

Over 7 billion identities have been stolen in data breaches over the last eight years equal to one data breach for every person on the planet. 

Why do Hackers Attack Mobile Devices and Applications?

In order to understand threats, we must understand what hackers are trying to achieve. Hackers will mount different kinds of attacks to achieve different kinds of goals. And so, defending against hackers in the context of application security may involve defending against many different kinds of attacks on your mobile device.

Hackers might be interested in bypassing business logic. For example, they might want to bypass controls that let them cheat at a video game or violate the terms of a software license. Of more serious concern is the potential for hackers to bypass controls in safety critical systems. It is not inconceivable that lives could be at risk if a hacker were able to hack a medical device, connected car or some component of critical infrastructure, such as a wind farm, a coal or nuclear power plant, a power grid, or a water treatment facility.

According to a recent study, automobiles today run systems that have more than 100 million lines of code. Those applications often contain valuable intellectual property, which hackers would rather steal than develop. For example, they might be a competitor or a nation state with inferior technology attempting to improve their own products in order to compete more effectively.

Hackers might also be interested in obtaining valuable pieces of data that are managed within the application, such as music or video, financial data, or privacy sensitive health data.

While data can be protected with cryptography, this only shifts the problem from protecting the data directly to protecting the cryptographic keys. Cryptographic keys are not only used to protect data. They can also be used to create a secure identity for a device.

A device may need such a key to authenticate to a cloud service. If a hacker were able to obtain this secret, they might be able to masquerade as that device or as the owner of the device. Cryptographic keys are also used to establish secure communications. For example, HTTPS is a familiar protocol that uses SSL/TLS to secure communication to websites. If a hacker were able to obtain these keys, they could snoop on or alter supposedly secure communications.

For all of these reasons, hackers are highly motivated to steal cryptographic keys embedded in or controlled by an application.

Sometimes hackers aren’t interested in the application itself, but using the application as a digital stepping stone to try to achieve some other goal. Hackers are often interested in obtaining root access on the device the application is running on, so they can install malware or use the device as a launch pad to attack something else.

Consider the 2016 Mirai botnet that infected web enabled cameras and installed a piece of malware that launched the largest distributed denial of service attack in history against the dynamic domain name service Dyn, causing wide spread internet outages. Those 100,000 cameras were able to launch 1.2 terabytes per second of data at a major piece of the global internet infrastructure. Here the goal of the attacker was not to compromise the webcam directly, but rather to bring down the web services of many companies whose DNS was controlled by Dyn.

Hacking Mobile Devices: Reverse Engineering and Tampering

Hackers employ two fundamental techniques when attacking: reverse engineering and tampering. If the hacker is trying to bypass business logic, they have to find where in the application the business logic resides. That requires reverse engineering. Then they typically must tamper with the application to bypass that logic.

If the hacker is trying to steal intellectual property, sensitive data or cryptographic keys from an application, they have to know where to look in the application. Unless those secrets are obvious, hackers need to reverse engineer the application to find them.

If the hacker is trying to create a stepping stone attack, they often use the workflow shown in Figure 1:

• First, they find some vulnerability in the application, which again requires reverse engineering;
• Then, they craft an exploit that takes advantage of that vulnerability;
• Finally, they attack by launching the exploit to the application.

In a remote attack like the popular SQL injection attack, this may involve sending the message to the application over the internet. But if they have physical access to the device, which with mobile and IoT based systems can be as easy as a trip to the store, then they can directly tamper with the device.

Prior to the advent of mobile computing, security was limited to corporate IT assets that were often physically secured in facilities owned and managed by the company. According to a recent SANS Institute study, organizations spend as much as 12 percent of their IT budget on security.

In a Ponemon Institute study, it was found that organizations have a 27.7 percent probability of having a material data breach in the next 24 months at an average cost of $3.62M.

Meanwhile, the world of computing has changed. Security is not just about physically secure data centers and corporate controlled computing assets. Instead, end users have gone mobile, connecting to cloud enabled services, often with their own personal devices. And with the rise of the Internet of Things, there will be billions of connected computing devices on the planet in the next several years.

The primary consequences of applications getting hacked include financial loss, destroyed brand reputation, exposure to liability, and regulatory risk. Over 7 billion identities have been stolen in data breaches over the last eight years equal to one data breach for every person on the planet. Meanwhile, mobile’s rapid expansion has introduced a complicated and potentially hostile environment that is difficult to manage and protect.

64 percent of security practitioners said they were very concerned about the use of insecure mobile applications in the workplace with an average of 472 mobile applications reported as actively used in organizations.

Prior to the advent of mobile computing, security was limited to corporate IT assets that were often physically secured in facilities owned and managed by the company, on a network behind a managed firewall, and possibly in a datacenter with multi-factor access, physical security, and armed guards. Because the company owned those assets, they were able to dictate what applications could run on those machines, and actively manage and monitor them, providing the latest patches, endpoint security, and other controls dictated by corporate IT. Assets located in such places were implicitly trusted.

Today, the situation has changed. Mobile devices dominate the market, often as the primary or only way users access the Internet and the many cloud services available. These devices also have very little, if any, physical security. It is a well-worn path hackers use to access such devices to reverse engineer or tamper with the applications running on them, often through rooting, jailbreaking or hoodwinking the user.

This shift has created all sorts of new business models to take advantage of the popularity of mobile devices.

 

These new business models come with new security problems:

• New forms of payment using near field communications (NFC) on mobile devices are becoming popular in recent years. These applications require that credentials to authenticate users must be stored on the device. If those credentials are compromised, then a hacker can execute fraudulent transactions.
• Mobile devices are being used in the automotive industry to enable remote parking from your smartphone. A compromise of the device could pose a serious safety risk.
• In healthcare, patients are using mobile devices to manage sensitive information collected from various devices ranging from fitness monitors to blood glucose monitors to improve care and create data driven treatment options. A compromise of such a device can lead to a loss of privacy and sensitive information. Or even worse, if a device is hacked, it could potentially lead to life-threatening consequences for the patient.

 

Internet of Things

By 2025, the total global worth of IoT technology will reach USD 6.2 trillion with the most value coming from health care devices (USD 2.5 trillion) and manufacturing (USD 2.3 trillion). Meanwhile, we see a persistent lack of IoT security investment with 67 percent of medical device makers expecting an attack on their devices while only 17 percent taking measures to prevent an attack. These numbers are staggering when you consider U.S. hospitals have an average of 10 to 15 connected devices per bed with some hospitals registering 5,000 beds — totaling 50,000 connected devices per hospital.

Furthermore, traditional security solutions do not port well to the IoT world, due to differences in system architectures and resource constraints. Therefore, IoT security solutions have not evolved enough and are prone to numerous vulnerabilities.

Summary: This analysis answers the following questions:

• Search is a large driver of revenue and doesn’t require data but what other portions of Alphabet’s advertising model will be affected by the GDPR?
• How much revenue do the higher risk methods currently contribute to earnings?
• Where is Alphabet most likely to incur GDPR fines?
• How will non-personalized ads affect earnings and network sites?

Alphabet (GOOG) was announced in 2015 as a holding company to help separate Google’s advertising business from the sprawling investments in Fiber internet, cloud computing, smart home products and connected car products. While these new gadgets and the promise of AI have helped successfully rebrand Google’s search and advertising business, it’s important to remember that Alphabet is still an old-fashioned advertising company with nearly 90% of Q1 2018 revenue, or $26.6 billion, coming from advertising and only 15%, or $4.6 billion, coming from these other ambitions.

Therefore, understanding the nuances of advertising especially as it relates to data regulations is going to be key for any savvy Alphabet investor. While you can invest in Alphabet for AI or connected cars, we are in the beginning of the hype cycle for these technologies, whereas the current stock price reflects advertising. Unfortunately, top-rated analysts struggle to understand Alphabet’s business model as it relates to the GDPR and CEO Sundar Pichai did not offer any answers. In the Q1 2018 earnings call, Mark Mahaney of RBC Capital Markets asked if the “GDPR or other regulation is likely to impact materially the targeting capabilities that advertisers have on Google?” The CEO replied:

“You know, above everything else as we are working through GDPR we are making sure we are focused on getting that user experience right for our users and our partners. But to clarify your question further, you know, first of all, it’s important to understand that most of our ad business is Search, where we rely on very limited information, essentially what is in the keywords to show a relevant ad or product. And so, you know, we’ve been preparing this for 18 months and I think ­­ I think, you know, we have focused on getting the compliance right. It will be a years’ long effort and, you know, we are helping not just us, but our publishers and partners. But overall, we think we’ll be able to do all that, you know, with a positive impact for users and publishers and advertisers, and so our business.”

This answer was over-simplified at best. Yes, Search is a large driver of revenue but what are the other portions of the advertising machine which will be affected? And how much revenue do the higher risk methods currently contribute to earnings?

In addition, while Alphabet has been preparing for 18 months, they recently dropped new terms and conditions on publishers only 8 weeks before the GDPR took effect – and publishers are not happy about it.

Publishers are essential for quite a few elements to the Alphabet’s advertising machine as they provide additional surface area for ad space. By installing Google’s ad software onto websites and applications, publishers allow Google to advertise on their sites.

Most importantly, because this relates to ad revenue from networks outside of Google-owned properties, this portion of revenue is what holds the highest risk in this new era of data regulations – and the revenue is sizeable enough to lead to missed earnings in the future.

Alphabet & Data Regulations: The Good, The Bad and The Ugly

The Good: Search Doesn’t Need Data; Gmail, Chrome and Google Maps Have User Consent 

Quite a few of Google’s data-driven applications and services such as Gmail, Chrome and Google Maps can easily obtain user permission in exchange for the services these applications and browser provides. In addition, Google AdWords, which is based off search intent, will provide a safe haven Google’s advertising revenue as this does not require the company to harvest private data. However, even search is not immune as it’s been enriched with data such as location to enhance search results.

The Bad: Android OS Collects Surveillance-Level Data without User Consent

In one study of 850,000 internet users last year, mainly in the U.S. and Europe, Google tracked 64% of all pages loaded by mobile and web browsers

It’s hard to know where to start when looking at Google’s sprawl of potential data regulation issues. We could start with the fact they have a deal with data brokers that gives them access to 70% of our purchases made with credit cards and debit cards (without consent). The company is literally in your bank account. This is for the purpose of letting advertisers know if you completed a sale following an ad seen on one of Google’s properties. Another place to start is implicit data for advertising purposes, which uses your search history to target ads to you outside of Google search. This is why when you privately email your friend about a trip to Rome, you mysteriously get advertisements for flights to Rome on other websites.

While online tracking and conversion tracking are both invasive, the Android operating system is a surveillance-level behemoth with over 2 billion devices in circulation while littered with millions of applications leaking data to Alphabet’s advantage. Exponentially speaking, Android is impossible to contain. One study by the French research organization Exodus Privacy and Yale University’s Privacy Lab found that more than three in four Android apps contain a third-party tracker which extracts personal information, including location and in-app behavior. The apps the trackers were discovered includes Uber, Twitter, Spotify, and Tinder. The Privacy Lab found the in-app trackers revealed “an extensive data mining market buried within the mobile app ecosystem” enabling physical surveillance including through the use of WiFi, Bluetooth and ultrasonic sound inaudible to the human ear to track geolocations in real time.

Takeaway: Android will be the most likely source for fines by the European Union as it will be challenging to partition device IDs by geographies. Some have conjectured Alphabet will risk fines before voluntarily reducing their cyber intelligence. The fines are 1.6% of annual global revenue, or $4.4 billion for Google.

The Ugly: Walking the Razor’s Edge Between Data Violations and Non-Personalized Ads

Data collected from the Android OS augments and enriches data science modeling for Alphabet to monetize the data elsewhere. That “elsewhere” is Adsense, AdX and AdMob. Google’s AdSense and AdX Networks enable non-Google websites to incorporate Google display advertising, and this is what current publishers are in an uproar about.

To summarize, Alphabet is attempting to become a co-controller for data in some instances and a processor in other instances. It’s unknown how the European Union will view data leaks from publishers to Alphabet.

Source: Quora

The level of involvement Google has as either a co-controller or processor is important for investors to understand as these regulations continue to play out. This may be hard to imagine today, but if data collection returns to property-owned data collection only, then the premium price advertisers pay for Google ad inventory may diminish as Google will struggle to differentiate itself from other advertising options from a campaign ROI standpoint if or when it fails to get the proper consent to collect the data and broker the ads.

Source: Statista

The worst case scenario here is that Google has to display “non-personalized” ads where consent isn’t obtained – which Google is already prepared to do: “As previously announced, we’re also launching a Non-Personalized Ads solution (DFP/AdX, AdMob, AdSense) to enable publishers to present EEA users with a choice between personalized ads and non-personalized ads (or to choose to serve only non-personalized ads to users in the EEA).”

As mentioned above, this is where the premium price can potentially recede. By being forced to serve non-personalized ads, the competitive advantage Google has will diminish in this circumstance.

Bottom Line: 

While Search is intact, there are many layers to data collection and ad targeting which will lower ROI campaign performance as the data Alphabet is allowed to collect continues to wane. In this article, we’ve discussed that the Android OS is leaky and the most likely part of Alphabet’s business to be fined. As far as revenue is concerned, non-personalized ads is the potential weakness especially on network sites as $17.59 billion was earned from network sites annually in 2017.

Summary: Despite knee jerk volatility, Roku will become a large cap stock in OTT (over-the-top) within 2-5 years. While Pay TV operators continue to bleed subscribers, Roku has the best business model to capitalize on these losses compared to highly fragmented OTT and SVOD competitors. In addition, Roku has maintained competitive vigor as the number one streaming device in the United States while remaining vendor agnostic. Going global will cement this position.

Roku (ROKU) stock prices have fluctuated wildly from being one of the hottest stocks in 2017 with a 400% return from the IPO price of $14 to a high in December of $56. From there, the streaming device maker saw shares drop 42% where it’s been range-bound at $31-$34 per share. That is, except when Amazon (AMZN) announced a fairly irrelevant partnership with a dying brick-and-mortar Best Buy (BBY) resulting in an 11.8% drop.

Or, the announcement of Roku offering access to ESPN+, which bumped the shares up 12%. While some are still confused on Roku’s value proposition, one thing is for certain, Roku’s stock is volatile and will continue to test investors’ technological depth on how exactly a hardware company plans to stay profitable … except, Roku is not a hardware company. Wall Street just (mistakenly) thinks it is.

This article originally appeared May 8th on Seeking Alpha.

Ahead of earnings this week, KeyBanc placed a $42 price target on the stock at about 27% above current levels of the shares. Notably, many short sellers lost the gamble when the lock-up expired six months after the IPO date in March with false expectations the market would be flooded with shares. The stock has seen about an 11% decline since March from the price of $39 – not the crash short investors were hoping for. Meanwhile, Roku’s short interest has dropped 38% since its peak from 10 million shares shorted at the end of March to 6.2 million shares shorted by mid-April.

Roku’s stock will continue to be volatile as the company expects to continue losing money in 2018 aiming to operate “at, or near, break-even on an operating cash flow basis.” Yet bulls continue to focus on the huge upside potential as the number one streaming device in the United States with $90 million in revenue coming from the ad-supported platform.

Looking beyond the knee-jerk volatility, here are the top reasons Roku will be a large cap stock in OTT (over-the-top) within 2-5 years.

1. Blood In The Water:

The peak for pay TV in the United States occurred in 2010/2011 when it began a predictable erosion. The number of pay-tv subscribers fell by 8,000 in 2012 and accelerated to 164,000 subscriber losses in 2014. Last year, the erosion neared deterioration with the top 10 pay TV operators losing a staggering 3 million linear subscribers in 2017 according to Leichtman Research.

Roku is the most synonymous business model with cable and satellite TV providers and can capitalize long-term on this massive subscriber loss by leveraging its advertising, audience development and content distribution services, which make up 89% of gross margins from the platform. In fact, if Roku was a traditional cable company, it would be the third largest distributor of content in the United States behind Comcast (CMCSA) and AT&T (T) with 19 million active subscribers.

2. Vendor Agnostic:

Roku critics cite too much competition for this mid-cap stock to carry the growth needed for long-term gains, especially from Apple (AAPL), Google (NASDAQ:GOOG) (GOOGL) and Amazon who all have a play in the hardware market for OTT video streaming services. However, this weakness is actually Roku’s strength. The Roku operating system, Roku OS 8, is a robust, reliable option for OTT streaming and has attracted partnerships with 1 in 5 smart TVs in the United States.

Meanwhile, operating systems like Samsung’s (OTC:SSNLF) Tizen continue to be plagued with bugs. But by being vendor-agnostic, Roku has still been able to secure a partnership for their free ad-supported channel with competing OSs like Samsung/Tizen. In addition, by remaining agnostic, Roku has maintained a full menu of original programming while corporate spats between Google (YouTube) and Amazon Prime restrict content choices.

Roku has also built a formidable catalog of 5,000 channels that even Google has not even come close to rival. This is where the discussion as to Roku being a hardware company should curtail as the “player” revenue will soon be eclipsed by the platform revenue (platform revenue stood at 45% in Q4 2017). It’s the latter where the company is making its largest investments including OTT advertising measurement tools, launching the free Roku channel, growing licensing fees and partnering for live TV.

3. There’s More To OTT Than Highly Fragmented Subscriptions:

Previously, viewing data and ratings on SVOD (subscription video on demand) such as Netflix (NFLX), Hulu Plus and Amazon Prime and other OTT content was not disclosed even by Nielsen (NLSN). However, in a recent interview, Nielsen COO Steve Hasker revealed four previously undisclosed statistics about SVOD such as 89.5% of SVOD content is primarily viewed on the television glass whereas 11.5% is viewed on smartphones and tablets.

Of this time, 80% is spent on catalog programming whereas 20% is spent on original content. Meanwhile, as competition increases, the costs for original programming are escalating with Netflix spending $8 billion in 2018 in order to remain competitive for a small piece of the pie (20% of how time is spent). Meanwhile, Roku has held firm on not creating original programming and the statistics support this. The costs for original programming are likely to escalate as HBO, Showtime, and now Apple will continue to compete for this space.

In addition, subscribers pay for quite a few premium $8+ subscription channels, which will eventually lead to subscription fatigue – not to mention mitigate the reason cord-cutters leave pay TV services – which is to lower costs. For a subscriber with YouTube TV ($40) and three premium channels ($24-26), they are paying $65+ per month. This pricing will meet resistance by cord cutters and ad-supported video on demand (AVOD) will be the answer.

Most importantly, original programming will consolidate or bundle (like it has on cable) and Roku is the perfect middleman to do this.

4. Global Potential:

This point ties into the previous two points where agnosticism in hardware and operating system along with building out a free, ad-supported channel will help Roku crush global expansion – especially in the emerging markets. The low price point for both the hardware and free content is desirable for global adoption, plus the 5,000 channels that Roku offers caters to differences in cultural viewing preferences.

Roku has shown competitive vigor by maintaining the lead as the top streaming media player in the United States claiming 37% of devices with nearly 40 million U.S. customers use Roku once per month. It’s only a matter of time until they take this success to the billions of people overseas who can’t afford pay TV or want to reduce pay TV costs.

5. Purely OTT Play:

In reference to the first point, there is an opportunity to capitalize due to massive pay TV subscriber losses such as last month when Charter (CHTR) lost 12% of market cap after reporting 112,000 subscriber losses and Comcast reported a loss of 98,000 in video users compared to a gain of 41,000 one year ago in Q1 2017.

This bloodbath from attrition will continue to accelerate through 2025 when even TV networks are expected to experience a 41% revenue loss. Roku is a very desirable purely OTT mid-cap choice with 19 million users and a $3.29 billion market cap that narrows in on this staggering market trend. Compare this to Charter Communications, which has a $65 billion market cap and only 16 million users.

Conclusion:

In the next 2-5 years, Roku will outpace competitors globally as it continues to be the cheapest, agnostic option with the most channels. Its executive team is experienced in OTT media and advertising, and the platform revenue will redefine how investors see this razor/razor blade opportunity (device player that locks in licensing fees and advertising). The free channel especially is attractive setting it apart from the over-abundance of paid, subscription channels. In addition, live TV will be an attractive space for Roku with the company already recently partnered with ABC News, People TV and Cheddar.

Next month, when General Data Privacy Regulations (GDPR) take effect, there will be a seismic shift across many technology stocks reflecting a private data drought.

Facebook is a half a trillion-dollar profit machine because of a business model dependent on first-party data which will come under scrutiny May 25 under the new GDPR policies.

Average revenue per user (ARPU) currently stands at $26.76 compared to $4.08 at IPO. With strict policies for data control, consent, erasure and portability, ARPU and earnings will drop significantly.

 

Editor’s note: This article was published on Seeking Alpha on April 17th, 2018

Investors should be aware of a data bust set to occur on May 25 due to policies called General Data Protection Regulation (GDPR). Since 2012, big data has been traded like a commodity, helping to raise stock prices and boost earnings. We saw a peak in Facebook’s (NASDAQ: FB) average revenue per user, especially on mobile which comprises 88% of earnings, when the company introduced Audience Network to target audiences across third-party mobile websites and applications. However, these current methods for collecting and leveraging data without consent are undergoing massive changes in the coming months.

Why the GDPR Matters in the United States:

General Data Protection Regulation (GDPR) is the biggest data privacy shake-up in history and it comes at a time when many tech companies already are under scrutiny. In brief, the GDPR has four principles covering data control, consent, portability and erasure. Companies must obtain explicit permission any time data is collected on an EU citizen. Users can request all of the data a company has collected and must be able to revoke consent. The provision which may be most profit busting is that users also will have the ability to erase their data or port and transfer their data to another company. Both erasure and portability will greatly weaken ad-targeting capabilities.

While the measures are directly binding and applicable to any company that services a citizen of the European Union, it will be challenging for US lawmakers to defend a lower level of privacy after the regulations are in effect. Most companies service at least one European customer and therefore must abide by the policies within these countries. You can expect an additional global ripple effect due to difficulties in partitioning data and siloing by country. In addition, immense pressure will continue to build over the coming months as all FAANG companies will be asked why there are separate standards for citizens outside European borders. Recently, Mark Zuckerberg was asked if he planned to give North American Facebook users a lower standard of data protection in an April 4 conference call to which he replied “we’ll make all controls and settings the same everywhere, not just in Europe.” One week later, on April 9, the Center for Digital Democracy along with other consumer and privacy organizations wrote an open letter to Facebook requesting the company to officially adopt GDPR measures in the United States. Not if, but when this happens, there will be a seismic shift across many technology stocks reflecting a private data drought.

Cambridge Analytica is Mild Compared to What’s Coming:

Facebook’s Cambridge Analytica scandal is a mild situation of third-party data being bartered (Congress called this “rented”). The scandal saw data from 87 million users accessed through Facebook’s Open Graph API (application programming interface), which allowed data to be accessed by third-party developers in exchange for Facebook becoming the authority in user identities across tens of thousands of applications and websites. Most of this data was traded without consent, such as when Cambridge Analytica obtained profiles from friends of friends to identify the personalities of American voters and to influence voting behavior.

While Facebook testified last week, very few Facebook users (and perhaps senators) understand the far-reaching implications of having 87 million identities in the hands of data scientists, who can model the training set and create a psychological prediction graph through a practice called look-alike modeling. The psychological prediction graph obtained from lookalike modeling can then be used beyond the Facebook platform to influence behavior through micro-targeted ads elsewhere. Essentially, your behaviors and intents logged on Facebook create a level of mind control that can be unsettling on an ordinary day – but most certainly on a hyped election day.

The ethics in this situation may take time to sort out. However, Cambridge Analytica will have a minor effect on Facebook’s business model. The Open Graph API was an equal and free exchange (although by scraping and trading application data, there’s most certainly value as the API enriched Facebook’s platform data by resulting in stronger predictions). In the industry, this is known as third-party data.

The cataclysm that Facebook and all tech companies next month must navigate relates to first-party data, which will be heavily scrutinized and regulated under GDPR policies.first-party data, which will be heavily scrutinized and regulated under GDPR policies.

You Are the Product because Data is Bartered, Not Sold

Wall Street analysts are speculating that Facebook stock can rebound and may be at its bottom. But let’s be clear. Facebook can rebound from the Cambridge Analytica scandal but these analysts fail to consider the impending GDPR. Today, Facebook is a half a trillion dollar profit machine because of a business model dependent on first-party data (or the data Facebook holds on its customers). Advertisers buy audiences from this data and pay an extraordinary amount of money to advertise to these audiences because Facebook’s data has logged behaviors and intents to influence users to make impulsive purchases. Just like a political campaign can influence voters to vote a certain way. Facebook’s advertising network can influence people to buy things they may not necessarily want or need due to psychological profiling.

An essential piece to this is that Facebook has an advertising network that uses this data to target advertisements outside of the social media platform. Thousands of mobile websites and applications benefit from better ad targeting based on Facebook’s data – and this exchange is done without user consent. This is why Facebook’s earnings are 88% from mobile – they make money on mobile outside of the social media platform.“Facebook holds an enormous amount of data on users collected without consent on user activity happening outside of the platform,” Bruce Schneier explained, a security expert and fellow at Harvard’s Berkman Center: “Everything people do, either on Facebook directly or on sites that have a Facebook ‘Like’ button, reveals information about them to Facebook … Facebook tracks you even when you’re not on Facebook, because of their extensive surveillance network on sites that link to them.” Additionally, Facebook tracks location without explicit consent through iOS and Android location services. For instance, they can even inform advertisers whether you’ve walked into a physical retail store following an ad display – actually, you can be within 150-1,500 feet of the store and the advertiser will know.

First-Party Data is How Facebook Makes Money – Without Consent

There are three sets of data that Facebook uses for ad targeting. First-party data owned by Facebook, first-party data owned by brands, and third-party data from various applications and mobile websites.

1. First-party data owned by Facebook:The four principles of the new regulations under the GDPR are data control, consent, portability and erasure. Facebook’s business model is at great risk because users did not give consent for data collected outside of the platform such as location data and web browsing activity (among others). Facebook also is sharing data outside of the social media platform to advertisers without consent to boost profits through their ad network. The disclosureFacebook describes includes what you did on the social media site without taking into account data collected through the API, artificial intelligence used on photos and videos, lookalike modeling and psychological profiling. Currently, Facebook offers an eight-week snapshot of advertisers who hold your account information with one user finding over 2,000 advertisers had accessed his information on a rolling basis in this short time frame – none of which had consent.

Average revenue per user currently stands at $26.76 per user in the United States and Canada per year. Historically, Facebook made $4.08 per user in the United States and Canada when the company had its IPO in 2012. The last six years have reaped the benefits of unregulated data through mobile and the Audience Network which uses Facebook first-party data in questionable ways. When users get a clear picture of what’s being tracked and delete their data, as provided for by the GDPR, the average revenue per user (ARPU) will drop significantly. User sentiment already is shaky following Cambridge Analtyica with 9% of Facebook users in the United States deleting their account and 35% are reportedly using Facebook less.

1. First-party data owned by brands:Facebook allows brands to upload their customer data and target audiences accordingly. For instance, the retailer Target (NYSE:TGT) may have first-party data on you from purchases you made in the store that can be uploaded and used to advertise to custom audiences on Facebook. Many brands also will undergo the same regulations as to how they obtained their data with fines up to 4% of an organization’s global turnover.
2. Third-party data:Facebook already has announced plans to shut down the self-serve tool that advertisers use to import data from third-partiessuch as Oracle (NYSE: ORCL) and Acxiom (NASDAQ: ACXM). More announcements have followed to shut down managed Custom Audiences which will make the platform less desirable from a targeting standpoint. Most of these moves are to reduce Facebook’s liability now but will soon be mandatory under GDPR regulations.

What to Expect When Data Dries Up

Facebook’s entire model is based on being able to share data with advertisers, as confirmed by Sheryl Sandberg earlier this month. In fact, what she stated was “Our service depends on your data, (so) we don’t have an opt-out at the highest level. That would be a paid product.”

What Sandberg failed to mention is that an opt-out at the highest level is coming for EU citizens next month and there is immense pressure for all technology companies to extend these privacy protections to North American citizens. The alternative, which is to convert 2 billion users to a paid product, will cause massive attrition for the platform.

The bottom line is that Facebook’s 2014 revenue was $12.4 billion before it began to collect data and sell audiences through questionable practices including off the platform across apps and mobile sites. Over the last three years, the commodity of data has been more valuable than oil with 2017 revenue reaching $40 billion. What will come of Facebook when the data dries up? As Zuckerberg stated, “it will take years to sort this out.” Meanwhile, the bottom is nowhere in sight.

Disclosure: I/we have no positions in any stocks mentioned, and no plans to initiate any positions within the next 72 hours.

Next month, when General Data Privacy Regulations (GDPR) take effect, there will be a seismic shift across many technology stocks reflecting a private data drought.

Facebook is a half a trillion-dollar profit machine because of a business model dependent on first-party data which will come under scrutiny May 25 under the new GDPR policies.

Average revenue per user (ARPU) currently stands at $26.76 compared to $4.08 at IPO. With strict policies for data control, consent, erasure and portability, ARPU and earnings will drop significantly.

 

Editor’s note: This article was published on Seeking Alpha on April 17th, 2018

Investors should be aware of a data bust set to occur on May 25 due to policies called General Data Protection Regulation (GDPR). Since 2012, big data has been traded like a commodity, helping to raise stock prices and boost earnings. We saw a peak in Facebook’s (NASDAQ: FB) average revenue per user, especially on mobile which comprises 88% of earnings, when the company introduced Audience Network to target audiences across third-party mobile websites and applications. However, these current methods for collecting and leveraging data without consent are undergoing massive changes in the coming months.

Why the GDPR Matters in the United States:

General Data Protection Regulation (GDPR) is the biggest data privacy shake-up in history and it comes at a time when many tech companies already are under scrutiny. In brief, the GDPR has four principles covering data control, consent, portability and erasure. Companies must obtain explicit permission any time data is collected on an EU citizen. Users can request all of the data a company has collected and must be able to revoke consent. The provision which may be most profit busting is that users also will have the ability to erase their data or port and transfer their data to another company. Both erasure and portability will greatly weaken ad-targeting capabilities.

While the measures are directly binding and applicable to any company that services a citizen of the European Union, it will be challenging for US lawmakers to defend a lower level of privacy after the regulations are in effect. Most companies service at least one European customer and therefore must abide by the policies within these countries. You can expect an additional global ripple effect due to difficulties in partitioning data and siloing by country. In addition, immense pressure will continue to build over the coming months as all FAANG companies will be asked why there are separate standards for citizens outside European borders. Recently, Mark Zuckerberg was asked if he planned to give North American Facebook users a lower standard of data protection in an April 4 conference call to which he replied “we’ll make all controls and settings the same everywhere, not just in Europe.” One week later, on April 9, the Center for Digital Democracy along with other consumer and privacy organizations wrote an open letter to Facebook requesting the company to officially adopt GDPR measures in the United States. Not if, but when this happens, there will be a seismic shift across many technology stocks reflecting a private data drought.

Cambridge Analytica is Mild Compared to What’s Coming:

Facebook’s Cambridge Analytica scandal is a mild situation of third-party data being bartered (Congress called this “rented”). The scandal saw data from 87 million users accessed through Facebook’s Open Graph API (application programming interface), which allowed data to be accessed by third-party developers in exchange for Facebook becoming the authority in user identities across tens of thousands of applications and websites. Most of this data was traded without consent, such as when Cambridge Analytica obtained profiles from friends of friends to identify the personalities of American voters and to influence voting behavior.

While Facebook testified last week, very few Facebook users (and perhaps senators) understand the far-reaching implications of having 87 million identities in the hands of data scientists, who can model the training set and create a psychological prediction graph through a practice called look-alike modeling. The psychological prediction graph obtained from lookalike modeling can then be used beyond the Facebook platform to influence behavior through micro-targeted ads elsewhere. Essentially, your behaviors and intents logged on Facebook create a level of mind control that can be unsettling on an ordinary day – but most certainly on a hyped election day.

The ethics in this situation may take time to sort out. However, Cambridge Analytica will have a minor effect on Facebook’s business model. The Open Graph API was an equal and free exchange (although by scraping and trading application data, there’s most certainly value as the API enriched Facebook’s platform data by resulting in stronger predictions). In the industry, this is known as third-party data.

The cataclysm that Facebook and all tech companies next month must navigate relates to first-party data, which will be heavily scrutinized and regulated under GDPR policies.first-party data, which will be heavily scrutinized and regulated under GDPR policies.

You Are the Product because Data is Bartered, Not Sold

Wall Street analysts are speculating that Facebook stock can rebound and may be at its bottom. But let’s be clear. Facebook can rebound from the Cambridge Analytica scandal but these analysts fail to consider the impending GDPR. Today, Facebook is a half a trillion dollar profit machine because of a business model dependent on first-party data (or the data Facebook holds on its customers). Advertisers buy audiences from this data and pay an extraordinary amount of money to advertise to these audiences because Facebook’s data has logged behaviors and intents to influence users to make impulsive purchases. Just like a political campaign can influence voters to vote a certain way. Facebook’s advertising network can influence people to buy things they may not necessarily want or need due to psychological profiling.

An essential piece to this is that Facebook has an advertising network that uses this data to target advertisements outside of the social media platform. Thousands of mobile websites and applications benefit from better ad targeting based on Facebook’s data – and this exchange is done without user consent. This is why Facebook’s earnings are 88% from mobile – they make money on mobile outside of the social media platform. “Facebook holds an enormous amount of data on users collected without consent on user activity happening outside of the platform,” Bruce Schneier explained, a security expert and fellow at Harvard’s Berkman Center: “Everything people do, either on Facebook directly or on sites that have a Facebook ‘Like’ button, reveals information about them to Facebook … Facebook tracks you even when you’re not on Facebook, because of their extensive surveillance network on sites that link to them.” Additionally, Facebook tracks location without explicit consent through iOS and Android location services. For instance, they can even inform advertisers whether you’ve walked into a physical retail store following an ad display – actually, you can be within 150-1,500 feet of the store and the advertiser will know.

First-Party Data is How Facebook Makes Money – Without Consent

There are three sets of data that Facebook uses for ad targeting. First-party data owned by Facebook, first-party data owned by brands, and third-party data from various applications and mobile websites.

1. First-party data owned by Facebook: The four principles of the new regulations under the GDPR are data control, consent, portability and erasure. Facebook’s business model is at great risk because users did not give consent for data collected outside of the platform such as location data and web browsing activity (among others). Facebook also is sharing data outside of the social media platform to advertisers without consent to boost profits through their ad network. The disclosure Facebook describes includes what you did on the social media site without taking into account data collected through the API, artificial intelligence used on photos and videos, lookalike modeling and psychological profiling. Currently, Facebook offers an eight-week snapshot of advertisers who hold your account information with one user finding over 2,000 advertisers had accessed his information on a rolling basis in this short time frame – none of which had consent.

Average revenue per user currently stands at $26.76 per user in the United States and Canada per year. Historically, Facebook made $4.08 per user in the United States and Canada when the company had its IPO in 2012. The last six years have reaped the benefits of unregulated data through mobile and the Audience Network which uses Facebook first-party data in questionable ways. When users get a clear picture of what’s being tracked and delete their data, as provided for by the GDPR, the average revenue per user (ARPU) will drop significantly. User sentiment already is shaky following Cambridge Analtyica with 9% of Facebook users in the United States deleting their account and 35% are reportedly using Facebook less.

1. First-party data owned by brands: Facebook allows brands to upload their customer data and target audiences accordingly. For instance, the retailer Target (NYSE:TGT) may have first-party data on you from purchases you made in the store that can be uploaded and used to advertise to custom audiences on Facebook. Many brands also will undergo the same regulations as to how they obtained their data with fines up to 4% of an organization’s global turnover.
2. Third-party data: Facebook already has announced plans to shut down the self-serve tool that advertisers use to import data from third-parties such as Oracle (NYSE: ORCL) and Acxiom (NASDAQ: ACXM). More announcements have followed to shut down managed Custom Audiences which will make the platform less desirable from a targeting standpoint. Most of these moves are to reduce Facebook’s liability now but will soon be mandatory under GDPR regulations.

What to Expect When Data Dries Up

Facebook’s entire model is based on being able to share data with advertisers, as confirmed by Sheryl Sandberg earlier this month. In fact, what she stated was “Our service depends on your data, (so) we don’t have an opt-out at the highest level. That would be a paid product.”

What Sandberg failed to mention is that an opt-out at the highest level is coming for EU citizens next month and there is immense pressure for all technology companies to extend these privacy protections to North American citizens. The alternative, which is to convert 2 billion users to a paid product, will cause massive attrition for the platform.

The bottom line is that Facebook’s 2014 revenue was $12.4 billion before it began to collect data and sell audiences through questionable practices including off the platform across apps and mobile sites. Over the last three years, the commodity of data has been more valuable than oil with 2017 revenue reaching $40 billion. What will come of Facebook when the data dries up? As Zuckerberg stated, “it will take years to sort this out.” Meanwhile, the bottom is nowhere in sight.

Disclosure: I/we have no positions in any stocks mentioned, and no plans to initiate any positions within the next 72 hours.

As GM CEO Mary Barra said in a keynote speech, “A cyber incident is a problem for every automaker in the world. It is a matter of public safety.” As Tesla, GM and many others continue to release connected vehicles – and soon driverless vehicles, the dangers are set to increase. In fact, more than half of the vehicles sold today are connected and vulnerable.

By 2025, the driverless market will be worth $42 billion up from nearly nothing with an official market entry still being anticipated [1]. Self-driving cars have the potential to save 292,000 lives annually from preventing collisions. This is in addition to the added benefits of reducing traffic and climate change, along with the costs of car ownership.

While gaining access to, and being able to control or steal a vehicle such as a Tesla is disturbing enough, it raises several concerns about not only connected cars, but also the mobile applications that extend the features of these vehicles. In fact, mobile apps are quickly becoming the main target for malicious behavior. Over the last four years, there has been a 188 percent increase in the number of Android vulnerabilities and a 262 percent increase in the number of iOS vulnerabilities. In addition, according to Gartner, 75 percent of mobile apps would fail basic security tests.

In another report, more than 80 percent of mobile apps on both the Android and iOS platforms revealed cryptographic implementation issues. Recently, Android malware has become more stealth and has begun to obfuscate code to bypass signature-based security software. Despite Google’s response to critical vulnerabilities and patches of critical issues in the Android OS, end users are still dependent on device manufacturers for these updates.

Driverless Car Security Infographic:

The main source of security and data breaches are found in hacking, malware and social engineering [2].

There are four major attack clusters in the automotive sector:

• Direct physical attack: Cars can be breached through the OBDII port and/or while in for maintenance or lent to other drivers.
• Indirect physical attack: A carrier is used to compromise the vehicle such as a USB stick, SD card, or through a software patch.
• Wireless attacks: Bluetooth and mobile networks including the current development of iOS and Android apps open up the vehicle to an abundant variety of attacks.
• Sensor fooling: As of yet, there are no known hacks documented that indicate you can take over a car by fooling the sensors alone.

Consumers are becoming more aware of the dangers around connectivity with 62% saying they are concerned that connected cars will become easily hacked in the future and 48% saying data privacy and security are extremely important. Executives of car manufacturers are also aware of the heightened concern with 52% rating data security and privacy as being of upmost importance to their customers [3].

While the path towards better cyber security for connected cars is a multi-actor road map, auto manufacturers who take the lead will be improving the security of their own brand and product will also improve the safety of their customer.

We live in a digital world where almost everything we touch is being stored on servers, the cloud or in mobile applications. Technologists push for the adoption of digital services and applications while consumers push back for safety and fraud protection. Fintech solutions on mobile are in a predicament; on one-hand these solutions offer the premium convenience of making deposits and transfers on-the-go, and the on the other hand, it digitizes and potentially sells off a person’s most valuable possession: their wallet.

Banks and financial institutions have quite a bit to gain – especially on a global level. Although still in its early stages, the cumulative investment for FinTech in 2017 is forecast to be $150 billion.

FinTech Solutions on Mobile – Hacks Worth up to $25 Billion

“White hat” hackers (the good guys), such as security researcher Sathya Prakash, have been known to expose hacks worth up to $25 billion by taking money out of one of India’s largest banks with just a few lines of code. “I could’ve done this with anybody’s account,” Prakash told reporters at Motherboard – all he needed was an account number. While this hack had a happy ending, with a quick patch and no money lost, not all hacks do. According to Lookout, a mobile security and antivirus firm, as many as 3 percent of Android users have encountered a mobile threat in the past year [1]. This may seem like a small number, but when you consider well-known financial institutions have over 50,000 employees (and some that have over 150,000 employees like Chase or Wells Fargo), the math comes out to 1,500 to 4,500 employees who are potentially introducing risks through their mobile device operating system.

FinTech Solutions on Mobile – Reach Millennials through Mobile Banking

Millennials are digital natives and have become mobile FinTech power users with 87% of those aged 18-35 using mobile services. 71% of them expect mobile banking to transform their future. In fact, Millennials are using mobile banking 8.5 times per month compared to 3.1 times per month for the average mobile banking user. Across all age groups, 60% state mobile banking is the #1 reason for switching banks.

You can access more statistics in the Infographic below.

FinTech Solutions on Mobile – Public Perception of Mobile Banking Security is Low

For those who do not use mobile banking, 57% state it’s because they believe mobile banking is not safe, and 61% cite security as the #1 reason for not using mobile banking. In fact, only 2% of mobile banking users believe it to be “very safe” while more than 50% believe it to be somewhat unsafe or very unsafe [2]. Global financial institutions are doing their best to protect themselves by introducing features such as biometric authentication, 2 Factor Authentication, end-to-end encryption, and AI fraud scanning. Convincing customers to use and embrace these technologies is essential as research shows that users will quickly leave a bank they do not trust.

In addition to building all these technical solutions to solve real security problems, the very real issue of convincing the public to trust a particular financial institution with their assets is a moving target and perhaps a more difficult challenge.

To those who figure this out, leadership of the future financial markets await.

Sources:

[1] https://www.nbcnews.com/storyline/hacking-in-america/new-way-you-ll-get-hacked-through-banking-app-your-n651571
[2] https://www.federalreserve.gov

Two years ago the San Bernardino shooting stirred a debate within the security community regarding warrant-proof encryption. The debate, known as “mobile backdoor access,” refers to exceptional access to encrypted communications and data by law officials. In theory, the Department of Justice wants technologists to “hide a key under the door mat” for law officials to access when they have the proper warrants. However, many security professionals and technologists have resisted this request due to creating weaknesses that are irreversible and require falsified automatic updates which may introduce other vulnerabilities.

Perhaps the biggest conflict for technologists, as pointed out by Herbert Lin, the Senior Research Scholar of Cyber Policy and Security at Stanford, is that anything less than deploying the best security (that is technologically possible) could constitute a neglect of professional obligation and ethics. Last November at the Intertrust LINE event, I had the opportunity to interview Lin, who is on the front lines of this debate. The conflict, as he pointed out in his keynote, exists in whether you can technologically design a system allowing exceptional access that is also secure. The security community says this is not possible while law enforcement says it is possible. Lin argues the parties are not talking about the same thing, as to talk about the same thing will require less-than-maximal security for users and less-than-desired capability for law enforcement (the proverbial grey area). In other words, maximal security is a technology issue, and adequate security is a policy issue — and it’s impossible to use a technical argument to solve policy.

Watch this 2 minute clip by Herbert Lin briefly covering the topic of mobile backdoor access: “Should We Build a Backdoor Into Mobile Devices?”Should We Build a Backdoor Into Mobile Devices?”

In his keynote, Lin poses questions that all sides must eventually answer during this debate and inevitable compromise, including tech vendors and the privacy community.

Questions we must answer for mobile backdoor access:

Questions for Law Enforcement:

· Why is law enforcement unwilling to acknowledge they’re asking the public to accept a lower level of cybersecurity?

· Why has a technical proof of concept not been provided? You think it can exist. Then prove it.

· How often and for what purposes are exceptional access capabilities expected to be used? If it begins for terrorism, when will it end?

Questions for Tech Vendors:

· Why do vendors provide password features if they’re against backdoors? This proves there situations where technologists have decided the benefits outweigh the consequences.

· How would exceptional access stifle innovation? Why should information technology not be subject to regulation? Lin points out technology is often subject to regulatory measures such as seat belts in cars.

Questions for the Privacy Community:

· What is the actual harm of having a back door? There are many people who are worried about being harmed that would not actually be harmed.

· How often are improper exceptional accesses expected to occur? The privacy community has the understanding there are to be zero improper uses, while one in 1 million or one in 10 million is more reasonable.

Click here to view the full keynote by Herbert Lin, entitled “Unresolved Issues Regarding Exceptional Access to Encrypted Data and Communications.”

Thanks for reading.

p.s. Don’t forget to follow me if you enjoyed this article!  On Twitter @Beth_Kindig and on Medium 

Savvy consumers today are aware that marketers and corporate companies mine personal data from mobile phones and computers, sourced primarily from search engines, social media sites, emails, text messages, and GPS location information. The internet, a free virtual public space idealized in the nineties, has become colonized through a swath of promised conveniences. In the beginning, the lure of free, convenient services for data was enticing.  The improvement in user experience when checking email in the cloud was great enough so as not to elicit questions as to how the emails were handled – such as when Google launched Gmail in 2004, adding a second signal to enrich the profile of search engine users through personally identifiable information. GPS tracking has also since become a powerful method of gathering information on an individual. E-commerce sites advertise by dropping cookies to track online behavior. Thermostats, in a promise to lower heating bills, track data on how people behave inside their homes. But the underpinnings of demand for data by marketers and big corporations remains obscure to most individuals. What is the value of this data and is the digital privacy of individuals a fair trade for the use of internet services and applications?

Ambient Intelligence: A Higher Level of AI Cognition

Many believe that technology’s dominance over privacy is inevitable.  Today, humans in developed countries occupy a mixed digital and physical space, one that is largely driven by automatic collection, trading and analysis of information with little or no effort to protect the fundamental rights and liberties of those who use the technology. As the physical and digital worlds merge, digital privacy is no longer a right, but rather a commodity to be traded and sold – meanwhile, physical privacy continues to be protected.

Technology is simply moving faster than policy mechanisms, and this allows technologists to impose their own rules. Big data has fueled a sharp uptick in data mining and profiling with the intent to predict human behaviors and preferences. A White House report released in October 2016 notes that big data is actually the precursor to artificial intelligence and that the availability of big data from e-commerce, businesses, social media, and science have “…provided the raw material for dramatically improved machine learning approaches and algorithms.”

Once interoperability evolves for the many facets of the Internet of Things, along with a higher level of AI cognition, ambient intelligence will emerge. In a world of ambient intelligence, devices work seamlessly to carry on life activities using information and devices hidden in the network. The devices will grow smaller and become more integrated into the environment. Imagine an AI-powered assistant delivering products and services to you the instant they are required; whether it’s a ride when you leave the airport, replacing the groceries you’ve eaten earlier in the week, or ordering your drycleaning. The point for the bots and sensors will be to learn and know as much about your personal habits as possible to increase convenience.

Clearly, technologists have some responsibility that is absent from the current discussion on AI and ambient intelligence. The general population may not demonstrate substantial concern (or understanding) to change its behavior or modify its choices, but that doesn’t mean that these mechanisms should go unchecked.  Higher order thinking makes the case that people (and society) need more control over personal information, including any machines placed to observe, construct or produce knowledge on an individual.

 

What is the Value of Privacy – and do Consumers care?

“Control over personal information is control over an aspect of the identity one projects to the world, and the right to privacy is the freedom from unreasonable constraints on the construction of one’s own identity.” –Philip Agre

Gartner predicts that by 2018, 50 percent of business ethics violations will occur because of the improper use of big data and analytics.  At the same time, some companies have railed against this, taking steps to distinguish themselves under a banner of data ethics.  Services such as Whatsapp and Signal have shunned data collection entirely by using end-to-end encryption. This decision has helped eliminate potential liability in handling sensitive, personal data, because it simply isn’t retained.

However, not every company can grow – let alone survive – without some level of data science. Big data is the fuel source even as the “engines” such as mobile, artificial intelligence and ambient intelligence become more sophisticated and subtle in their operations. In this case, data platforms are driving these decisions, and those that have a policy for privacy ethics will statistically deliver more value as marketers, startups and corporate companies alike need to connect with consumers without creeping them out.

These proactive decisions can help to sway the perspective of consumers, especially in a competitive space. According to a study by The University of Pennsylvania, more than half of Internet users are concerned about protecting privacy, but feel it may be too late. According to Pew, 74% of Americans say it is “very important” to be in control of their personal information. Meanwhile, according to Chapman University, Americans’ number-one fear is of man-made disasters (e.g., terrorist attacks).  A close second is the tracking of personal data by government and corporations, outranking concerns about crime, the environment and natural disasters.

At this point, to say that consumers “do not care about privacy” is to dodge the ethical responsibility that comes with collecting data. As technology advances to include our immediate surroundings, the discussion around big data deepens as it may affect identity and lessen autonomy. In the future, those who handle data as an intermediary– which means delivering the necessary data to first-party companies while buffering and protecting the information collected on consumers – will fare better professionally than those who approach sensitive information like a commodity.