The Surveillance Economy: Is Your Personal Data Becoming the World's Most Valuable Commodity?

1. The Business Model Built Around You

The internet was once promoted as a place where information could flow freely and people could connect without traditional barriers. Today, it has become one of the world's most sophisticated data-collection environments.

Many digital services appear free to use. Social networks, search engines, video platforms and mobile applications allow people to communicate, research, shop and entertain themselves without necessarily paying a subscription.

However, these services still need to generate revenue. For many platforms, advertising provides a major source of income, and personal data helps advertisers identify the audiences most likely to respond to their campaigns.

This has created what is increasingly known as the surveillance economy: a system in which information about people's activities, preferences and behaviour becomes a valuable commercial resource.

The information collected can include browsing histories, shopping habits, approximate or precise location, device identifiers, search queries and interactions with digital content. When combined, these details can help companies build profiles that reveal much more than any individual action would suggest.

The US Federal Trade Commission's 2024 investigation into social media and video-streaming companies documented extensive data collection, targeted advertising practices and the use of information obtained from data brokers. [1]

The underlying business incentive is straightforward. The more accurately a company can understand its audience, the more effectively it may be able to sell advertising, personalise services and predict future behaviour.

But there is a difference between using data to improve a service and collecting information in ways that people neither understand nor reasonably expect.

That difference sits at the heart of the surveillance economy debate.

2. How Much Can Companies Learn From Your Digital Footprint?

A person's digital footprint is the trail of information generated through everyday technology use.

Consider a typical day. Someone checks the weather on a smartphone, searches for a new job, watches financial videos, visits an online retailer and uses a navigation application to travel across town.

Each activity may reveal a different piece of information. The weather search suggests an immediate interest. The financial videos indicate a possible investment interest. The job search may reveal career ambitions, while location records could indicate where the person works, shops or spends their free time.

Individually, these signals may appear relatively harmless. Combined, they can create a more detailed picture of someone's routine, interests and potential intentions.

Tracking technologies extend beyond conventional cookies. They can include advertising identifiers, tracking pixels, embedded software development kits and device fingerprinting, which attempts to recognise a device through characteristics such as its browser and technical configuration.

In April 2026, the UK's Information Commissioner's Office (ICO) published updated guidance and analysis concerning these technologies. Its accompanying impact assessment cited research suggesting that more than 80 third parties, on average, can access data within seconds of someone opening a webpage. [2]

This does not mean every website exposes every visitor's complete personal profile to 80 companies. The finding illustrates how many intermediaries can become involved in the wider online tracking ecosystem.

For users, the difficulty is knowing which organisations receive their information, how long they retain it and what happens after it leaves the original service.

3. The Hidden Industry of Data Brokers

Some of the most important businesses in the surveillance economy operate largely outside the public spotlight.

Data brokers collect, combine, analyse or sell information about individuals. Their sources can include commercial databases, publicly available records, mobile applications, advertising systems and other data suppliers.

A broker may not need to know someone's name initially. It may be able to work with a device identifier, location history or other digital signals and connect them with additional information later.

This creates a market in which personal information can move between organisations without a direct relationship between the individual and every company involved.

The risks become particularly serious when data reveals visits to sensitive locations.

In January 2025, the Federal Trade Commission finalised an order prohibiting data broker Mobilewalla from selling sensitive location data following allegations that it sold such information without taking reasonable steps to verify consumer consent. The case involved information that could reveal visits to healthcare facilities and places of worship. [3]

In May 2026, the FTC announced a proposed settlement that would restrict data broker Kochava and its subsidiary from selling, sharing or disclosing sensitive location data without affirmative express consent, subject to the terms of the proposed order. [4]

These cases demonstrate why location information deserves particular attention. A record that appears to contain only device movements can reveal sensitive details about a person's life.

The wider issue is accountability. When information passes through multiple intermediaries, people may have little visibility into who possesses it or how it is being used.

4. Your Location Is Worth More Than You Think

Location data has become one of the most revealing forms of personal information.

Smartphones, navigation applications, connected vehicles and other devices can generate location records that help services provide directions, local recommendations and safety features.

The same information can also be used for commercial profiling.

A company that observes repeated visits to particular shops may infer shopping preferences. Regular journeys may reveal commuting patterns. Visits to medical facilities, religious sites or political gatherings can expose information that a person would not necessarily choose to disclose publicly.

In January 2025, the FTC finalised an order against Gravy Analytics and its subsidiary Venntel, prohibiting them from selling, disclosing or using sensitive location data, subject to limited exceptions. The action followed allegations concerning the collection and sale of location information that could reveal visits to healthcare facilities and places of worship. [5]

Such cases highlight the limits of relying on a person's name being absent from a dataset. Location patterns and other identifiers can still make information sensitive or potentially link it to an individual.

Connected vehicles present another example. In January 2025, the FTC announced action against General Motors and OnStar over allegations involving the collection and sharing of precise location and driving-behaviour data without adequate notice and consent. The proposed order included restrictions on disclosures to consumer reporting agencies. [6]

The lesson is that data collection is no longer confined to browsing the internet. It can follow people into their cars, homes and daily routines.

5. The Rise of Surveillance Pricing

What if your personal information influenced not just which advertisements you see, but how much you pay?

This possibility is often called surveillance pricing: the use of information about individuals or groups to tailor prices or offers.

In January 2025, the FTC published initial findings from its market study into surveillance pricing intermediaries. The agency reported that companies examined in the study could use information such as location, browsing history, shopping behaviour, demographics and even mouse movements to help tailor prices for individual consumers. [7]

The findings did not establish that every retailer uses personalised prices, nor did they prove that every consumer pays a different price for the same product.

Nevertheless, they raised important questions about how personal information might influence commercial decisions.

Imagine two customers viewing the same product. One frequently searches for discounts, while the other repeatedly purchases premium goods. A pricing system could potentially use those behavioural signals to determine which offers to display or how much of a discount to provide.

In another situation, location or demand information could influence the promotions presented to a customer.

Some personalisation benefits consumers. Discounts targeted at price-sensitive shoppers can help them find cheaper options, and dynamic pricing can reflect changing supply and demand.

The concern arises when consumers cannot tell whether they are receiving a fair offer, what information influenced the decision or whether their personal circumstances are being exploited.

As AI makes it easier to analyse large datasets, the boundary between useful personalisation and opaque commercial discrimination may become harder to identify.

6. Artificial Intelligence Is Making the Problem More Powerful

Traditional data profiling often relies on predefined categories: age groups, locations, shopping interests or previous purchases.

Artificial intelligence can make these systems more sophisticated by identifying patterns across large volumes of information and estimating what someone might do next.

A model could use past interactions to predict which products a customer may purchase, whether they are likely to respond to a promotion or which content may hold their attention.

More advanced systems can combine information from different sources, potentially drawing inferences that the individual never explicitly shared.

For example, a person may never tell an advertising platform that they are considering changing jobs. However, a combination of career-related searches, professional content and browsing activity might lead a model to estimate that possibility.

Such predictions are not necessarily accurate. AI-generated profiles can contain errors, rely on misleading correlations or incorrectly categorise people.

Yet those mistakes can still matter if a business uses the resulting profile to decide which opportunities, advertisements or prices to present.

The danger is not simply that companies know more about individuals. It is that automated systems can use those assumptions to shape the options people encounter.

This creates an important distinction between observing behaviour and influencing it.

A recommendation system may help someone discover a useful product. A system optimised primarily for engagement or sales may instead prioritise content and offers that maximise commercial outcomes, even when those outcomes do not perfectly align with the user's interests.

The more personal the information becomes, the more important it is to understand what the system is trying to optimise.

7. Are Social Media Platforms Selling Your Attention?

Personal data is only one part of the surveillance economy. Human attention is another.

Social media platforms compete for the time people spend watching videos, reading posts, scrolling through feeds and interacting with content.

Many recommendation systems learn from signals such as watch time, clicks, likes, shares and previous viewing behaviour. These signals help determine what appears next in a user's feed.

Personalisation can make digital services more relevant. It can also create feedback loops in which people are repeatedly shown material similar to what they have already engaged with.

The commercial incentive matters. When a platform earns revenue from advertising, longer sessions and more opportunities to display adverts can be valuable.

However, it would be inaccurate to claim that all recommendation systems deliberately promote harmful content or that personalised feeds inevitably manipulate users. Different platforms use different objectives, safeguards and ranking methods.

The concern is whether users understand why content appears and have meaningful control over the process.

The European Union's Digital Services Act addresses aspects of this problem by requiring greater transparency around online advertising and recommendation systems. For very large platforms and search engines, it also provides users with options to access recommendation systems that are not based on profiling. [8]

This is a significant shift: regulators are increasingly examining not just what information platforms collect, but how automated systems use that information to influence the digital environment.

8. Privacy Is Becoming a Question of Economic Power

The surveillance economy is often discussed as a matter of personal privacy. It is also a question of economic power.

Large technology companies can benefit from extensive datasets, sophisticated analytical tools and the ability to deploy them across enormous user bases.

Smaller competitors may struggle to match those advantages, particularly when they lack access to comparable data or the resources to build advanced advertising systems.

The resulting concentration can reinforce the position of established platforms. More users can generate more data, which may improve targeting and services, attract more advertisers and strengthen the business.

This is not the only reason major technology platforms succeed. Product quality, network effects, infrastructure, distribution and brand recognition also matter. Nevertheless, data can be an important competitive asset.

For consumers, concentrated data power raises questions about choice. If one company controls a service that has become essential for communication, work or social connection, abandoning it may carry significant practical costs.

A user might prefer not to share certain information but still feel reluctant to leave a platform used by friends, family or colleagues.

That is why meaningful privacy protection cannot depend entirely on individuals reading lengthy policies and making isolated choices. It also requires clear rules about what companies can collect, how they use it and when information may be shared.

9. Can Personal Data Be Truly Anonymous?

Companies sometimes describe datasets as anonymised or de-identified, suggesting that information can be used without exposing the people behind it.

Removing names and direct identifiers is useful, but it does not automatically eliminate privacy risks.

A dataset containing location patterns, purchase histories or demographic characteristics may still reveal distinctive combinations of information. If those patterns can be matched with other records, it may be possible to infer someone's identity or sensitive characteristics.

The FTC has repeatedly highlighted the risks associated with browsing and location data, including datasets that do not contain conventional identifiers such as names or social security numbers. [9]

The distinction matters because privacy risks depend on the information's context, the available matching data and the methods used to process it.

There are techniques that can reduce these risks, including aggregation, data minimisation, access controls and differential privacy. Each has limitations, and no single technique provides a universal guarantee.

Organisations should therefore avoid treating the removal of names as sufficient proof that a dataset can be shared without consequences.

For consumers, the practical implication is that information may remain sensitive even when it appears anonymous.

10. Are Governments Keeping Pace With Corporate Surveillance?

Governments face a difficult balancing act. Digital data can support innovation, research, fraud prevention and public services, but its collection and use can also threaten privacy and civil liberties.

The regulatory response is developing across different jurisdictions.

In the UK, the Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Its data protection provisions were brought into force in stages, with the ICO confirming in June 2026 that all those provisions were in force. The Act updates parts of the UK's existing data protection framework rather than replacing the UK GDPR or the Data Protection Act 2018. [10]

Separately, the ICO's guidance on online advertising explains that the use of storage and access technologies for advertising generally requires consent under the relevant UK rules. Organisations must also comply with applicable data protection obligations when processing personal information. [11]

In the European Union, the Digital Services Act introduces transparency requirements for online advertising and restricts targeted advertising based on sensitive personal data. It also prohibits profiling-based targeted advertising to minors where platforms know with reasonable certainty that the user is a minor. [8]

These rules represent meaningful attempts to limit the most intrusive practices and give users greater control.

However, legislation does not automatically eliminate the underlying incentives to collect data. Compliance can be complex, enforcement takes time and technologies evolve quickly.

The effectiveness of regulation will depend on whether authorities have the resources, information and powers needed to investigate violations and make protections meaningful in practice.

11. The Privacy Paradox: Why Do People Keep Sharing?

Many people express concern about privacy while continuing to use services that collect personal information.

This is sometimes described as the privacy paradox.

The explanation is not necessarily hypocrisy. Digital services provide genuine benefits, including communication, entertainment, navigation, education and access to financial services.

People may understand that data collection occurs but lack a realistic alternative. They may also struggle to judge the consequences of sharing information when those consequences emerge months or years later.

Consent screens add another complication. Long policies and complicated settings can make it difficult to understand what is being agreed to.

A person who clicks "accept" may simply want to access a website, rather than make an informed decision about a network of advertisers, analytics providers and data intermediaries.

The ICO's work on online tracking has emphasised the importance of meaningful user control and clear information about how personal data is used. [12]

A more effective privacy system should make reasonable choices easier. Users should not need specialist technical knowledge to understand whether a service tracks them, which information is shared or how to withdraw consent.

12. How to Protect Yourself in the Surveillance Economy

Individuals cannot eliminate digital tracking entirely, but they can reduce unnecessary exposure.

Review app permissions. Restrict location, microphone, camera, contacts and background access where those permissions are not needed. Choose approximate location instead of precise location when the service allows it and accuracy is unnecessary.

Check advertising and privacy settings. Review personalisation controls on major platforms, disable optional tracking where possible and use available tools to request access to or deletion of personal information.

Be selective with apps. Before installing an application, consider whether its features justify the permissions it requests. An application that provides a simple service may not need access to contacts or continuous location.

Limit browser tracking. Use browser privacy settings, block unnecessary third-party cookies where supported and consider reputable content-blocking tools. Remember that cookie controls alone do not prevent every form of tracking.

Reduce unnecessary account connections. Linking multiple services can make it easier for information to be combined across accounts. Avoid connecting accounts unless the integration provides a clear benefit.

Think carefully about connected devices. Smart speakers, vehicles, fitness trackers and other devices may collect information beyond conventional web browsing. Review their data settings and retention policies.

Use your legal rights. Depending on the applicable law and circumstances, you may be able to request access to your data, object to certain processing, withdraw consent or ask for deletion. In the UK, the ICO provides guidance on these rights.

These measures can help, but they are not perfect solutions. Some tracking takes place through systems that users cannot easily inspect, and privacy controls vary between providers.

The wider responsibility remains with organisations to collect only what they need, explain their practices and protect information throughout its lifecycle.

13. What Happens Next? Three Possible Futures

The future of the surveillance economy is not predetermined. Three broad outcomes are possible.

Scenario one: Surveillance becomes more sophisticated. AI systems become increasingly effective at predicting behaviour, while businesses continue expanding their use of personal data. Privacy protections improve slowly, leaving consumers with limited visibility into how their profiles influence commercial decisions.

Scenario two: Regulation forces a reset. Stronger enforcement, clearer consent requirements and better privacy-preserving technology reduce unnecessary collection. Businesses continue using data, but with tighter limits on sensitive information, sharing and profiling.

Scenario three: Consumers gain greater control over their data. New tools and data intermediaries allow individuals to manage permissions, share information selectively and move their data between services more easily. This could give consumers more bargaining power, although the benefits would depend on adoption, security and the business models of the services involved.

The UK government explored this third possibility in a consultation on empowering people through data intermediaries, published in June 2026 and updated in August. The initiative examines how intermediaries could help individuals access, manage and share personal information on their own terms. [13]

Such approaches could help rebalance the relationship between individuals and organisations, but they are not a complete answer. Giving people more control over data does not remove the need for limits on harmful collection and use.

The likely future will combine elements of all three scenarios. Some businesses will continue to rely heavily on personalisation, while regulation and consumer expectations push others towards more privacy-conscious models.

14. The Verdict: Who Really Owns Your Digital Life?

Personal data has become one of the most important resources in the modern economy. It helps power digital advertising, recommendation systems, commercial analytics and emerging AI applications.

Used responsibly, it can make services more useful, help businesses understand customers and support innovation.

But the surveillance economy creates a serious imbalance when organisations can collect and combine information at a scale that individuals cannot easily see or control.

Location records can reveal sensitive movements. Behavioural profiles can shape the offers people receive. AI can make inferences from information that was never explicitly provided. And data brokers can create additional risks when information passes beyond the service where it originated.

The challenge is not to stop all data collection. It is to establish clear boundaries around what is reasonable, transparent and fair.

Governments must enforce existing protections and address gaps. Companies must take responsibility for their data practices rather than treating consent as a box to tick. Individuals should have practical tools to make informed choices without sacrificing essential digital services.

Ultimately, the surveillance economy forces society to confront a fundamental question: should personal information be treated simply as a commercial resource, or as something over which individuals retain meaningful rights and control?

The answer will help determine whether the next generation of digital technology empowers people—or makes it easier to predict, influence and profit from their behaviour.

Sources

[1] Federal Trade Commission — A Look Behind the Screens: Examining the Data Practices of Social Media and Video Streaming Services, September 2024 https://www.ftc.gov/reports/look-behind-screens-examining-data-practices-social-media-video-streaming-services

[2] Information Commissioner's Office — Guidance on the Use of Storage and Access Technologies: Impact Assessment, April 2026 https://ico.org.uk/media2/q2vfsrak/guidance-on-the-use-of-storage-and-access-technologies-impact-assessment.pdf

[3] Federal Trade Commission — FTC Finalizes Order Banning Mobilewalla from Selling Sensitive Location Data, January 2025 https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-order-banning-mobilewalla-selling-sensitive-location-data

[4] Federal Trade Commission — FTC to Ban Kochava and Subsidiary from Selling Sensitive Location Data to Settle Charges, May 2026 https://search.ftc.gov/news-events/news/press-releases/2026/05/ftc-ban-kochava-subsidiary-selling-sensitive-location-data-settle-charges-they-sold-location-data

[5] Federal Trade Commission — FTC Finalizes Order Prohibiting Gravy Analytics, Venntel from Selling Sensitive Location Data, January 2025 https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-order-prohibiting-gravy-analytics-venntel-selling-sensitive-location-data

[6] Federal Trade Commission — FTC Takes Action Against General Motors for Sharing Drivers’ Precise Location and Driving Behavior Data Without Consent, January 2025 https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-takes-action-against-general-motors-sharing-drivers-precise-location-driving-behavior-data

[7] Federal Trade Commission — Surveillance Pricing Study Indicates Wide Range of Personal Data Used to Set Individualized Consumer Prices, January 2025 https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-surveillance-pricing-study-indicates-wide-range-personal-data-used-set-individualized-consumer

[8] European Commission — The Digital Services Act https://digital-strategy.ec.europa.eu/en/policies/digital-services-act

[9] Federal Trade Commission — Cracks Down on Mass Data Collectors: A Closer Look at Avast, X-Mode, and InMarket, March 2024 https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/03/ftc-cracks-down-mass-data-collectors-closer-look-avast-x-mode-inmarket

[10] UK Government — Data (Use and Access) Act 2025: Data Protection and Privacy Changes, updated June 2026 https://www.gov.uk/guidance/data-use-and-access-act-2025-data-protection-and-privacy-changes

[11] Information Commissioner's Office — How Do the Rules Apply to Online Advertising? https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/how-do-the-rules-apply-to-online-advertising/

[12] Information Commissioner's Office — Our Work on Online Tracking https://ico.org.uk/for-organisations/online/our-work-on-online-tracking/

[13] UK Government — Empowering People Through Data Intermediaries, June 2026, updated August 2026 https://www.gov.uk/government/consultations/empowering-people-through-data-intermediaries/empowering-people-through-data-intermediaries