Who owns consumer data? Do consumers trust companies with their data? Will consumers embrace new technologies that reveal more information about them to companies? Are companies ready to respond to changing attitudes about consumer data?

These are core questions that investors need to consider about data privacy, the option to shield our personal data from public view or corporate use and sale. Currently, companies have largely unfettered access to the data they gather about consumers, even as technologies make it possible to know more about consumers’ online (and offline) activities. By some estimates, the number of devices connected to the internet will rise from 8 billion today to 100 billion by 2030. As devices proliferate and data-mining tools become more sophisticated, companies have increasing access to information such as our physiological traits, personal habits, location, political beliefs, lifestyle habits and purchasing behavior.

Such data may give rise to products and services that we can only imagine at present. But these potential advances come at the cost of diminished consumer privacy and the risk that our data will be used for purposes society may neither intend nor desire, such as discrimination, employee surveillance, social engineering, or unfair political influence.

Both consumer attitudes and the regulatory environment reflect deep ambivalence about the role of data in the modern economy. Studies show that many consumers do not support collection of their data, but feel powerless to prevent it. Although data flows globally, the regulations that govern it are regional and inconsistent: e.g., new EU regulations strengthen consumers’ control over the use of their personal data, while the US regulatory environment remains permissive.

Even as society struggles with the tradeoff between innovation and control, investors have demonstrated a keen interest in companies with strategies to monetize this growing pool of data. Companies have always sought competitive advantage through better information. The accelerating supply of personal data has raised the importance of data access and analytics to corporate performance, which in turns drives demand for even more data. At the center of this trend are the FANG stocks, for whom data does not merely support their business model but lies at the core of their strategy. Most of The FANG companies did not exist 20 years ago, but now make up nearly 15% of the S&P 500, having been favored by investors in the form of valuations far outstripping the rest of the index.

We believe that the ambiguity of the current circumstances is unsustainable. While the exact future of data privacy is not possible to predict with confidence, investors should be concerned that companies whose business models rely on increasing quantity and scope of consumer data are at risk if the public ambivalence turns to opposition.

To better understand that risk, we consider four potential operating environments that companies may face:

1. Low demand for privacy, low regulation: Consumer acceptance of data collection and use grows, and regulators prioritize the free flow of information over privacy. Technological innovation grows quickly, but the risk of unintended negative social consequences, such as discrimination, rises. In this scenario, companies that have high exposure to data would be best positioned to take advantage of the opportunities.

2. Low demand for privacy, high regulation: Overreaching regulations lead to dissatisfaction among companies and consumers, as market demands go unmet. Trust is difficult to obtain because the system lacks legitimacy. Companies with low exposure to data issues will avoid the regulatory risks associated with this scenario. New entrants will struggle to grow while managing compliance costs.

3. High demand for privacy, low regulation: Regulators fail to effectively respond to consumer concerns about data privacy. Technological innovation accelerates, as does the risk of unintended consequences. Lack of trust in the system creates challenges for new companies and products to gain acceptance, and consumers may take steps to restrict access to data on an individual basis. Companies that achieve high trust of employees and consumers are best positioned to navigate the instability of this scenario. In this scenario, new business models may emerge to help consumers protect their own privacy.

4. High demand for privacy, high regulation: Regulators restrict data gathering in response to consumer privacy concerns. Technological progress slows, but the system creates a high degree of trust that enables new companies and new technologies to achieve consumer acceptance with relative ease. Unintended consequences are kept to a minimum. Because no one positioning dominates this scenario, individual company management and governance to establish trust and engagement will take on particular importance.

This report:

  • Defines the issue of data privacy;
  • Identifies key regulatory, technological and behavioral trends that will drive societal response to concerns about data privacy;
  • Outlines four possible scenarios for the impact of data privacy concerns on companies;
  • Examines the potential implications of uncertainties about data privacy on eight case-study companies whose business models may involve the gathering, use and possible sharing of data; and
  • Concludes with a general framework for investors to monitor the impact of evolving attitudes toward data privacy on companies, plus an overview of emerging data-privacy solutions.

Download the full report here.

This report was prepared by Cornerstone Capital Group for the Investor Responsibility Research Center Institute.