You Are the Product: Two Decades of Giving up Data Control

A decade or so ago, I searched “Amsterdam” in Google in anticipation of my upcoming trip. On top of all the search results, my flight ticket came up. I was not searching in my inbox, I was searching in Google. Underneath the flight number, departure time and gate, sat my hotel booking for the same trip: the address and the check-in time, lifted from a separate email, sent by a different company, that had nothing to do with the word I had searched for, other than the city of Amsterdam. I had not asked Google to become my personal assistant, read through my emails, and present them to me like this. It had already read both messages, worked out they belonged to the same journey, and assembled them into an itinerary I never requested.

It was the first time I understood, plainly, that the service I thought I was using was quietly using me back. Gmail was not a filing cabinet that held my letters. It was a machine that read them, and what it built by reading them — a model of who I am, where I go, and what I am about to do — was worth far more to Google than storing a few emails ever cost. I had assumed I was the customer. I was the product.

And the itinerary does not vanish when the trip ends. There is no reason for Google to discard it and every reason to keep it, because stacked over a few years these records stop being journeys and become a pattern: the airlines I pick, the class of hotel I book, the places I return to, the price I will pay. That is no longer a convenience, it is a travel profile of unusual precision. Google no longer has to hope that a discount on a trip to Madrid might tempt me; it can offer me Amsterdam again, at a hotel a notch above the last one, but for the same price. I never asked for an itinerary to appear above my search results, and that was only ever the visible part. The same reading runs over every other email that arrives, from shop receipts to job application confirmations. Each one is unremarkable alone. Compounded over years, they add up to more detail about you than you would ever have agreed to hand over in one sitting.

None of this makes Google uniquely villainous. I do not think anyone at the company sat down and designed a surveillance machine out of malice; they built a system where a better prediction earns more advertising money, and it did exactly what it was built to do. Keep that frame for everything that follows: a system doing exactly what it was rewarded to do, running on the details of your life.

The Bargain Underneath

The deal underneath most of the consumer internet is simple, and almost nobody has actually read it. The service is free at the point of use — search, email, maps, a social feed — because the money is made elsewhere, by selling access to what can be predicted about you. You do not pay with money. You pay with the behaviour that trains the prediction, and you have been paying for the better part of two decades.

The scale of that trade is not hidden; it is in the accounts. In the final quarter of 2024, Google took $72.5 billion in advertising revenue, roughly three-quarters of everything it earned. The people paying that money are advertisers, and what they are buying is the ability to reach the version of you that Google has assembled from everything you have done. That is the transaction the free service conceals: your behaviour goes in, a prediction about you comes out, and advertisers pay to reach the person it describes.

No Single Piece Is the Problem

The unsettling part was never the flight confirmation itself. It was that Google had joined it to something else and drawn a conclusion, and that is the mechanism worth understanding. Almost nothing collected about you is sensitive on its own. A search is a few words. A location is a dot on a map. A purchase is a line on a receipt. The profile is what emerges when they are laid over one another.

Take an ordinary week. You search a symptom you would not say out loud. Your phone notes that you stopped near a clinic two days later. A calendar invite names the specialist. No single one of those facts is private; together they are a medical history you never chose to write down. The same trick reads your politics from the events you attend, your faith from the building you enter on a Sunday, your finances from the shops you return to. I have argued before that the real privacy harm is rarely a single record and almost always the linkage between them, and this is that argument in its commercial form. The value is in the joins.

Declining, in any meaningful sense, is not really on offer either. Google Maps records where you have been by default, and an Associated Press investigation found that it keeps logging location for many services even after you switch Location History off. The setting that looks like consent does not deliver the refusal it implies.

Advertisers Are Not the only Buyer

The same question applies here as to any other system that watches us: who pays the cost, and who gets the benefit? I have made a version of this argument before about surveillance more broadly — when the group bearing the cost and the group getting the benefit are different, the justification needs to be stronger than “it helps someone.” With advertising, at least the arrangement is simple: you pay in behaviour, an advertiser buys the prediction, and the loop stays fairly narrow. Once the same profile becomes available to government agencies, the loop widens, and the number of those requests keeps growing. Between 2014 and 2024, Google, Meta and Apple handed over data on 3.16 million user accounts to US authorities. In the most recent year on record, Google and Meta alone received close to half a million requests.

Most of those requests name a specific person: a warrant, reviewed by a judge, tied to an individual suspect and a specific investigation. That is due process working the way it is supposed to, and I have no issues with it. Reverse warrants and geo-fence orders invert that logic. Instead of starting with a suspect and asking a platform for their data, investigators start with a place or a search term and ask the platform who matches it — who was near this location, who searched this phrase — and everyone who fits is swept into the answer before anyone has been suspected of anything. That is the part I do not support. It replaces individualised suspicion with a search through an entire population, and treats matching a pattern as reason enough to be looked at.

It helps to walk that chain back to where it began, because the everyday version of it is the clearest one. You sign up for an email account to send and receive letters, and that much you agree to, plainly and knowingly. Everything after that, you are never really asked about. The account becomes a profile of who you are, where you go, and what you are likely to do next. The profile is sold on to advertisers, with nobody explaining what it holds or how far it travels. And if a reverse warrant ever comes looking, that same profile can place you near the wrong location or tie you to the wrong search, so that a profile built to sell you a hotel room becomes a reason to suspect you of something else entirely. Only the first of those steps was ever a choice you made; the rest happened around you, without a moment where anyone stopped to ask. That is the part worth reflecting on, because it is easy to argue about the warrant at the end and miss that the difficulty began much earlier, in something so ordinary nobody thought to question it: the quiet assumption that a letter box should also be a profile.

You Cannot Hand It Back

The reasonable response, once you see this, is to want out: delete the account, clear the history, start again. It does not work as cleanly as it sounds, for reasons I have written about separately. Backups persist, copies have already spread, and “legitimate interest” is a wide enough door to keep almost anything through. Deletion is real in intention and partial in practice, and you are rarely allowed to verify which. The tools people reach for instead — a private browser, a VPN, a paid email provider — help from here on, but they cannot undo the profile already assembled, and they leave the default that produces it in place for everyone who comes after.

Which brings me to the objection this whole subject attracts: I have nothing to hide. It is the wrong frame, and it concedes the wrong thing. Privacy was never about hiding wrongdoing; it is about context. You would not hand a stranger on the street your bank statements, not because your transactions are criminal but because they are yours, and because the same fact means something different depending on who is holding it and why. A profile merges all of those contexts into one file. The search you made during a frightening week, and the place you went at eighteen, end up sitting beside everything else you have ever done, stripped of whatever made sense of them at the time. Nobody needs to act in bad faith for this to matter. The data only needs to keep existing, and someone — an advertiser today, an employer or an official tomorrow — needs a reason to look. The point was never that you are guilty of something. It is that you no longer get to decide what your own history means.

Nobody Signed up for This

No one clicked “I agree” believing they were trading a psychological profile for a mail client. The consent was real in the legal sense and hollow in every other one. We accepted terms we did not read, for services we could not easily do without, and the bill came due slowly, in a currency we did not know we were spending.

I do not think the answer is to retreat from all of it. I still use free services, and on some of them I am happily the product; when the trade is small and I can see it, it is a fair one. But for the things I care about most, I would rather pay and know where I stand. I pay for my email, I pay for my search engine, and I pay for my VPN. I am grateful that these services exist and that they chose to be different: I pay them, they provide the service, and that is the whole of the deal. It is the kind of ordinary, honest transaction I assumed I was making all along, with no second product built out of me on the side.

The catch is that this is a fix I make one service at a time, for myself, and it should not have to be. A default this important should be chosen out in the open, not folded into a checkbox nobody reads. The arrangement itself is the problem: a detailed picture of who we are became someone else’s to own and sell, and we were never really asked. We could be, before the next free service asks the same of us. And we could build the next internet so that, by default, no one has to make this fix one service at a time.