“If you’re not paying for the product, you are the product”, or so the saying goes. Free internet services abound and in the beginning, we did not put much thought into why; we were just happy to have the free email account or free social media arguments with strangers or whatever the case may be. Over time, we became a little savvier and started asking questions as to how these companies paid for this “free” service, and by now it’s so obvious that our personal data is valuable that even bad guys are stealing it and selling in on the black market. But how valuable is our data, really?
Setting the value of anything is difficult. There are many factors, such as how much money it took to get the item into a saleable state and how much desire there is in the market for that item. In the case of personal data, it gets even more granular.
For example, hackers are generally not the omnipotent Neos that are portrayed in the movies. Most of them are stumbling around the internet hoping to find something unsecured that they can sell. Because most of them don’t have any master plan, they end up with dribs and drabs of personal information such as a credit card number, or a PayPal login, or a Social [Security/Insurance] Number. Pieces of data like that are less valuable than “full” packages which include everything a bad guy would need to assume an identity.
For non-criminals, the valuation can be even harder because the transaction is never as cut and dried as “here’s a valid passport number, give me $30”. The purchaser just gets all the data the selling company has and it is up to the acquirer to figure out how to monetize it. How much money can a company make if it has a list of thousands of middle-aged account managers in Boca Raton that make over $100K a year and have two dogs? I don’t know, but this type of question is what purchasers have to answer to prevent overpaying for a company.
There are a number of reasons why a company purchases another. Two of the big ones are to acquire technology and to acquire data. The US courts are tied up for the next decade with patent suits and companies generally want to avoid being named in an intellectual property lawsuit. There’s almost no value in winning a patent lawsuit because the winning company just continues to keep doing what it is doing, but it has now given a ton of its money to lawyers so it comes out if with less capacity to carry on business. A much better plan is to just avoid any potential lawsuits entirely by purchasing a competing or complementary company outright, including all its intellectual property.
The second main reason for acquisitions these days is to acquire a company’s data. Facebook is the 800lb gorilla in the room and it has the largest trove of user data on the planet. That data is perceived as very valuable and many companies would love to have it. Facebook generates over 98% of its revenue by selling ad space to advertisers targetted by that user data. Facebook has a market capitalization of over $4 billion dollars, so that is a good insight into how much advertisers are willing to pay to leverage Facebook’s user data.
Let’s look at some recent acquisitions to get a sense of how much our personal data is worth.
Microsoft acquired LinkedIn: $60
LinkedIn kind of a unique site in that it’s a social network, but targetted at businesses, workers, and job seekers. It goes off the rails now and again, but for the most part, it works as advertised and discussions on the site are generally work-related. Most of the personal data on LinkedIn surround employment history and work connections. It’s not exactly the spiciest of personal data, but it was still worth $26 Billion (with a B) to Microsoft. I think it is fair to say that Microsoft didn’t need the technology and most of that value is in the user data.
LinkedIn makes most of its money from recruiting, followed by advertising.
At the time of the acquisition, LinkedIn reported 433 million users. This makes each user’s data worth about $60. Not very much individually, but quite a number overall.
Intuit acquired Credit Karma: $71
Credit Karma is a service that allows users to check their credit reports for free and without damaging their reports by adding “hits” to it. The service makes money by recommending credit devices (credit cards, loans, etc) to users and presumably takes a commission for doing so. It operates in Canada, the US, and possibly other countries.
Intuit is in the complimentary space of providing personal and professional finance products such as QuickBook for accounting and Mint for personal expense tracking. The marriage here is a no-brainer and honestly, running an API call to get a credit report isn’t exactly ground-breaking technology. It’s pretty obvious to me that the value Intuit sees in Credit Karma is the user data.
At the time of the acquisition, Credit Karma has 100 million members and Intuit paid $7.1 billion for it. That is about $71 per user.
Facebook acquired Instagram: $33
Given that one of the most profitable companies in the world makes almost all of its money from user data, I thought that this would be a whopping number. However, it seems that even Facebook knows that user data isn’t all that valuable in isolation - it needs volume to be worth a lot. Another interesting thing about Instagram is that it had zero (as in NO) revenue at all when purchased.
At the time of the acquisition, Instagram had 30 million users and Facebook paid $1 billion for it which is about $33 per user.
What do bad guys pay for your data?
The example of acquisitions above shows us what companies consider personal data to be worth. But there is another very large market for user data and that is the black market. These days, the black market is the Dark Web (not to be confused with the Deep Web) and some enterprising researchers at Experian have compiled some data on what personal data sells for on these sites.
A social security number sells for about $1. On the other hand, a passport can sell for $2,000. Here is an opportunity to show how money can replace work: if a bad guy has a valid SSN, he can use that to get progressively more difficult pieces of identification and can eventually get a passport under that person’s name. But that takes time and therefore even though an SSN can eventually beget a passport, bad guys are as lazy as the rest of us and would prefer to just pay a 2000% markup instead of doing the work. Free markets, FTW!
In between, we see working logins to online accounts such as PayPal worth an average of $100 or so, depending on how much money the bad guy estimates he can get out of the site, and even loyalty cards ($20) and diplomas ($400) have value.
Final thoughts
I went into this article thinking that personal data would be worth a lot more. Whenever I read about an acquisition it has these huge numbers; billions and billions of dollars are spent every time and I thought that would be reflected in large numbers for each individual user data set. I was so sure that the thesis for this post was going to be something like “your data is worth so much more than you think”. But, despite my leaning towards bias confirmation, it is just not true. Our individual user data really isn’t worth that much after all.
Deeper Look: What is Personal Data Actually Worth?