Market Segmentation for Privacy Differentiated Free Services

Transcription

1 1 Market Segmentation for Privay Differentiated Free Servies Chong Huang, Lalitha Sankar arxiv: v [s.gt] 18 Nov 16 Abstrat The emerging marketplae for online free servies in whih servie providers earn revenue from using onsumer data in diret and indiret ways has lead to signifiant privay onerns. This leads to the following question: an the online marketplae sustain multiple servie providers (SPs) that offer privay-differentiated free servies? This paper studies the problem of market segmentation for the free online servies market by augmenting the lassial Hotelling model for market segmentation analysis to inlude the fat that for the free servies market, a onsumer values servie not in monetized terms but by its quality of servie (QoS) and that the differentiator of servies is not produt prie but the privay risk advertised by a SP. Building upon the Hotelling model, this paper presents a parametrized model for SP profit and onsumer valuation of servie for both the two- and multi-sp problems to show that: (i) when onsumers plae a high value on privay, it leads to a lower use of private data by SPs (i.e., their advertised privay risk redues), and thus, SPs ompete on the QoS; (ii) SPs that are apable of differentiating on servies that do not diretly target onsumers gain larger market share; and (iii) a higher valuation of privay by onsumers fores SPs with smaller untargeted revenue to offer lower privay risk to attrat more onsumers. The work also illustrates the market segmentation problem for more than two SPs and highlights the instability of suh markets. Keywords-free online servies, privay-differentiated servies, quality of servie, market segmentation. I. INTRODUCTION There has been a steady inrease in online interations between onsumers and retailers, where the term retailers refers to entities who sell or offer (for free) a produt. In fat, many oft used online servies are offered for free and onsumers impliitly aede to traking for ustomized servies. Targeted ads are a part of the emerging revenue/profit model for suh retailers, heneforth referred to as servie providers (SPs), espeially those offering free servies. Consumers are delighted by free servies until they begin enountering privay violations on a daily/frequent basis. While suh infrations taken individually ould be ignored or disounted, the totality of data available about onsumers with a variety of retailers and the resulting privay onsequenes raise serious onerns. Servie providers are beginning to aknowledge that onsumers are sensitive to privay violations. For example, Google [1] and Apple [] reently adopted differentially private mehanisms for olleting user data for statistial analyses. However, the details of these mehanisms are opaque and offer even less larity on whether the onsumer C. Huang and L. Sankar are with the Department of Eletrial, Computer, and Energy Engineering at Arizona State University, Tempe, AZ 8587 ( hong.huang@asu.edu, lalithasankar@asu.edu). February 4, 18 DRAFT

2 atually has a hoie. In this ontext, it is worth understanding if privay-differentiated servies an provide suh hoies for onsumers. In a ompetitive marketplae, the aggregate weight of targeting may drive some ustomers to seek a more privay-protetive alternative. The ost to the onsumer for this ation may be a lower quality of servie (QoS) (e.g., poorer searh engine apabilities). However, it ould eventually lead to a more open model for onsumer sharing of private information, i.e., one from impliit assent to informed onsent. In this paper, we identify and formalize onditions under whih privay-differentiated servies are sustainable and examine when ompetition based on privay protetions ould lead to a sustainable marketplae for online free servies. As a hypothetial running example we posit a marketplae with two searh engines Google Searh and DukDukGo. The former traks searhes by users thereby offering higher quality servie (QoS) (e.g., searh auray) while the latter expliitly does no traking and may offer a relatively lower QoS. More generally, our model allows differentiating SPs by their QoS and privay-sensitive offerings to determine the existene of a stable market for privay-differentiated servies. We apply and build upon lassial game theoreti methods, in partiular the Hotelling model for market segmentation, to quantify the market segmentation. We also generalize the model to multiple SPs (e.g., Google, DukDukGo, and Bing) and illustrate the instability of multi-ompetitor markets. A. Related Work An extensive body of literature on eonomi models for privay was reently reviewed by Aquisti et al. [3]. These models illustrate the large semanti range overed by the word privay. Targeted advertising is a ommon method for servie providers to exploit knowledge of a onsumer in a way that an ause privay violations. Our work is informed by the literature on targeting strategies for retailers [4] [13], but rather than optimizing retailer strategies we are interested in identifying how privay-differentiated servies an address privay onerns. The problem of market segmentation is a lassi and well-studied problem in miroeonomis [14] with fous on how priing and produt differentiation an lead to a stable and ompetitive marketplae. However, the free online servies market present a new hallenge wherein monetary quantifiation of both free servies and the data olleted about onsumers is not simple and straightforward. Equally hallenging is the quantifiation of onsumer privay sine it requires apturing the heterogeneous expressions of privay sensitivity that an range from don t are at one extreme to hyper vigilant at the other. However, some aspets of market models an be brought to bear to our problem; in partiular, the oligopolisti market model with a small number of ompetitors, barriers to entry that are not as high as those for monopolies, and with differentiated produts fits appropriately for the markets we are onsidering wherein two or (a few) more servie providers offer produts of the same type but differentiated by QoS and privay risk. For a two-player oligopolisti market game, the Cournot-Nash and Bertrand duopoly models are onsidered lassi models wherein the two firms differentiate using quality and prie, respetively. A more nuaned model that aptures differentiation between two firms and onsumer preferenes is the Hotelling model [15]. This model aptures differentiation between market players by mapping firms to positions on a unit length line suh that the loation is indiative of the firm s differentiation level, the total line length is refletive of the entire market, a onsumer s privay preferene is a point on the line, and the optimal loations of the firm resulting from the

3 simultaneous game between the players indiate the resulting segmentation. The model aptures utility for onsumer as both the advantage (prie, quality, et) from the firm as well as the distane ost from the onsumer s loation to that firm. Consumers hoose the seller whih give them the highest utility (in terms of their valuation of the produt and its prie as well as the transportation osts). The Hotelling model has also been extended to inlude gradations in produt (quality) and ustomer types via a vertial variant of the model [16]. Privay and market segmentation. Jentzsh et.al. [1] propose a model to study ompetitions between two servie providers by taking onsumer s privay preferene (binary hoies: low privay/high privay) into aount using a vertial Hotelling model. Thus, onsumers selet the servie provider based on their privay onerns and the amount of payment to the servie provider. They provide analysis of equilibrium strategies for SPs. In [11], Lee et al. study the influene of privay protetion on the segmentation of a duopoly. In their model, firms may offer standard and personalized produts with personalized pries to three different types of privay-sensitive onsumers (the unonerned who always share information, pragmati ones who only share if a firm adopts privay protetion, and the fundamentalists who never share data). They show that a privay-friendly firm an enlarge market share by attrating more pragmatists to share personal information. From this expansion it an earn more profits rather than ompete with its rival for the other onsumers. In ontrast to both above-mentioned models, our model differs in fousing on free servies, and thus, introdues new models for quantifying QoS- and privay-based differentiators; furthermore, our model generalizes the disrete set of privay sensitive onsumers in [11] to a ontinuous set of privay risks thus allowing analysis of over an entire range of privay expression and present a more nuaned view of how SPs should offer servies to all types of onsumers. B. Our Contributions Our work introdues a game-theoreti interation model for free online servies offered by two or more SPs with the goal of understanding whether privay-differentiated servie offerings have the ability to apture market share. Our model aptures a variety of free online servies suh as searh engines, soial networking sites, and software apps that are free, and therefore, use onsumer data in a variety of ways for revenue generation. Speifially, our model is based on the spatial Hotelling model wherein the loation is now proxy for both the privay risk levels that the SPs offer and onsumers prefer (both often at odds). The QoS of the servie now models the lassial produt prie. Our model differentiates itself from the Hotelling model in the following sense: unlike the lassial model of non-negative transportation osts from onsumer loation (preferene) to either SP loation, a onsumer with a speifi privay risk hoie gains from hoosing an SP with a lower risk offering and loses from hoosing one with a higher risk offering. This in turn leads to different outomes than the lassial model; we use a three-stage sequential game to ompute the optimal strategies for the SPs and the resulting market share for speifi models of ost and revenue (to SPs), distribution of onsumer heterogeneous privay hoies, as well as QoS valuation (to onsumers). We present losed form solutions for the two SP market with linear valuation funtions (ost, revenue, onsumer utility) and a uniform distribution of onsumer preferenes; for this settings, our results highlight the following: (i) when onsumer plae a high value on privay, it leads to a lower use of private data by SPs, i.e., their advertised 3

4 privay risk redues; (ii) SPs offering high privay risk servies are sustainable only if they offer suffiiently high QoS; (iii) SPs that are apable of differentiating on servies that do not diretly use onsumer data gain larger market share; and (iv) higher onsumer privay valuation fores SPs with smaller privay-independent (untargeted) revenue to offer lower privay risk servie to attrat more onsumers. In extending the work to more than two SPs, we illustrate the instability of suh markets and highlight the hallenges of studying market segmentation for more than two partiipants (a problem aknowledged in eonomis [17]). C. Organization of the Paper The paper is organized as follows: Setion II introdues the system model and the non-ooperative game formulation. The main result for a two-sp market with linear valuation funtions are presented in Setion III. Setion IV disuss equilibrium results for a market with multiple SPs. Finally, onluding remarks and future work are provided in Setion V. II. PROBLEM MODEL AND GAME FORMULATION Our parametrized model detailed below aptures the following privay-differentiated market segmentation problem: servie providers offer free servies differentiated by QoS and privay risks. Online servies that are offered for free often generate revenue by using the data they obtain from their onsumers Their gain from using onsumer data is aptured by a revenue funtion and their ost of doing so is aptured by a ost funtion. The goal of eah SP is to hoose a QoS and privay risk tuple that maximizes its profit (differene of revenue and ost). The hetrogeneous expression of onsumer privay sensitivity is modeled as a (probability) distribution of the population over a range of privay risk values. The onsumer will hoose the SP that maximizes a desired funtion of QoS, the privay risk tolerane of the onsumer, and the privay risk offered by the SP. A stable strategy i.e., a strategy from whih no partiipant will deviate without redution in utility, of suh a non-ooperative game will yield an optimal partition (market segmentation) of the onsumers. We build upon the lassial Hotelling model proposed by Hotelling in [15] to study market segmentation. Formally, we introdue a game-theoreti model for two SPs and infinitely many onsumers. Eah SP offers the same type of free servies (e.g., searh engine, soial network) with a ertain privay risk guarantee ε and quality of servie (QoS) v. Thus, an SP differentiates its servie by a tuple (ε, v) that it advertises to all onsumers. The goal of this work is to determine the fration of onsumers (market segment) that hoose eah SP when the SPs offer (ε, v) tuples that maximize their profit. A. Two-SP Market Model 1) SP Model: We onsider two rational (i.e., profit maximization entities) SPs, denoted by and. Both SPs provide the same kind of free servie; but they differs in the QoS offered. Thus, and offer QoS v 1 and v, respetive, where in general v 1 v. Furthermore, and guarantee that the privay risk for using their servies is at most ε 1 and ε, respetively, where ε 1, ε [, ]. Without loss of generality, we assume ε ε 1. Under this onsumption, must offer a higher QoS (v v 1 ). Otherwise, its strategy will be dominated by 4

5 its opponent sine will offer both higher QoS and lower privay risk. For example, and ould be Dukdukgo and Google, respetively, in the searh engine market, with the QoS given by the auray of searh results. On the other hand, the privay risk an orrespond to different guarantees they provide on onsumer data use; e.g., whether they will use onsumer data only for statistial purposes or target onsumers with tailored ads. We model this privay risk guarantee as a variable taking values over a ontinuous range. In pratie, suh guarantees may be oarse granular hoies; for example, between ompletely opting out of the targeting or allowing data use only for statistial purposes or omplete data use only by SP or all possible data usage and sale. We assume that the SPs generate revenue in two ways: (i) by exploiting the private data of onsumers to offer targeted ads and other servies to onsumers; and (ii) by providing interested advertisers an online platform to reah onsumers. This latter revenue is independent of private data and simply derived from the revenue apability of the platform. Let R P (ε i ) denote the revenue of SP i, i {1, }, resulting from using the private data of onsumers and let R NP,i denote the revenue generated without using onsumers private information (e.g., from interested advertisers). The total revenue, R(ε i ), of SP i from offering privay guaranteed servie is thus R(ε i ) = R P (ε i ) + R NP,i, i {1, }. (1) In reality, offering free servies to onsumers often omes with a ost to the SPs, suh as the ost of servie and online platform reation and ontinued operations. Furthermore, we note that free online servies profit from using onsumer data and therefore enumber data proessing related osts. Let C(v i ; ε i ) denote the ost of offering free servies with privay risk level ε i. We model C(v i ; ε i ) as sum of two non-negative osts: (i) C QoS (v i ) of providing servies with QoS v i ; and (ii) C P (ε i ) as the proessing (data analytis) ost of exploiting private data to the level of ε i suh that C(v i ; ε i ) = C QoS (v i ) + C P (ε i ), i {1, }. () Thus, via (1) and (), our model aptures the fat that the benefit of using private data by eah SP involves both ost and revenue. ) Consumer Model: We build upon the lassial Hotelling model to formulate both onsumer utility and the resulting onsumer-sp game. The Hotelling model maps retailers to two loations (x 1, x ) on a [, 1] line suh that the strategy of eah retailer is to determine the best loation-prie tuple that maximizes its profit. The loation (see Figure 1a) is a proxy for a speifi produt differentiator. A onsumer with its own produt differentiator preferene (traditionally assumed to be uniformly distributed over [, 1]) is mapped to a loation x [, 1] on the line as shown in Figure 1a. Suh a spatial model allows omputing the market segment by identifying both the optimal loations of the retailers and an indifferent threshold between the two optimal retailer loations at whih both retailers are equally desirable. For suh a uniform onsumer preferene model, the segmentation for eah retailer is simply its distane to the indifferene point (see Figure 1a). Consumers hoose the retailer with the least produt prie and transportation ost (modeled as a linear funtion of loation) for a desired onsumer valuation of the produt. Note that transportation osts are metaphorial for any non-prie-based differentiation of the two retailers. 5

6 For our problem, we obtain a Hotelling model by: (i) introduing a normalized privay risk and mapping it to spatial loation; and (ii) by viewing the QoS as the net valuation of servie by the onsumer. Note that sine we study a free servies market, we use QoS as a measure of onsumer satisfation. We note that in the lassial Hotelling model, the onsumer pays a non-negative transportation ost for any retailer whose loation is different from its own. However, our problem departs from this model in that higher and lower privay risks offered by SPs relative to a onsumer preferred privay risk hoie are not viewed similarly. We assume there exists infinitely many rational onsumers that are interested in the servies provided by the SPs. In keeping the standard game-theoreti definition, rational refers to onsumers interested in maximizing some measure of utility via interations with the SPs. We use a random variable E [, ] to denote the heterogeneous privay hoies of onsumers; suh a model assumes that the privay preferenes of onsumers are independent and identially distributed, a reasonable assumption when the onsumer set is very large. Let E = ε denote the privay risk preferene of a onsumer. If an SP i offers a privay risk guarantee ε i higher than ε, then using its servie will result in a privay ost to the onsumer due to pereived privay risk violation. On the other hand, the onsumer gains from hoosing an SP i that offers an ε i < ε as a result of the extra privay protetion offered. Let x = F E (ε) [, 1] be a differentiable umulative distribution funtion of ε. Thus, x = F E (ε) an be onsidered as a normalized privay risk tolerane (i.e., restrited to [, 1]) whih indiates the proportion of the onsumers with a privay risk tolerane of at most ε. Sine the privay risk ε i an be over an arbitrary range [, ], the normalized spatial privay risk is given by the CDF F E (ε i ). Thus, for a onsumer whose normalized privay risk tolerane is loated at x [, 1], its atual privay risk tolerane is ε = F 1 (x). We an similarly map the privay risks offered E by the SPs to normalized loations x 1 = F E (ε 1 ) and x = F E (ε ) on the [, 1] line as shown in Figure 1b. Analogous to the Hotelling model, we let u i (x) denote the utility (in units of QoS) from SP i as pereived by a onsumer with a normalized privay preferene (loation) x. Our model for u i (x) ontains two parts: (i) a positive QoS v i offered by SP i ; and (ii) the gain or loss in the pereived QoS as a result of a mismath between onsumer privay preferene and SP i s privay risk offering. We introdue a gain fator t that allows mapping the privay mismath t(x x i )ε i to a QoS quantity. This mismath utility indiates that when the SP offers a servie with privay risk lower than the onsumer s tolerane, the onsumer reeives a positive utility due to extra privay protetion. However, if the servie offered has a higher privay risk than the onsumer s tolerane, the onsumer will reeive negative utility for privay risk violation. In other words, given the same level of QoS, the better the privay risk guarantee an SP offers, the more the onsumer prefers the SP. We now write the utility or profit funtion for both onsumers and SPs. 3) Consumer utility and SP profits: For the onsumer loated at x, the overall pereived utility for hoosing servies provided by and are u i (x) = v i + t(x x i )ε i, i {1, }. (3) 6

7 Transportation ost: t x-x i Purhase from Retailer1 Indifferene threshold Purhase from Retailer Privay risk of SPs: 1 Loation Retailer 1 Retailer x 1 x τ x x 1 (a) Classial hotelling model Normalized user privay risk tolerane x 1 x 1 (b) Our modified hotelling model x Figure 1: User hoie model for using different SPs For eah SP i, i {1, }, let (v i, ε i ) be its ompetitor s strategy. For the revenue and ost models in (1) and (), the profit of SP i is simply the differene π i (v i ; ε i ; v i ; ε i ) = [R(ε i ) C(v i ; ε i )]n i (v i ; ε i ; v i ; ε i ), i {1, }, (4) where n i (v i ; ε i ; v i ; ε i ) denotes the fration of onsumers who hoose SP i. Modelling Assumption 1: We assume that the servies provided by both SPs have non-negative QoS. Sine onsumers are rational, they expet to have positive utility through the interations with the SPs. It is reasonable to assume that SPs have no inentive to offer servies with a negative QoS. In other words, we assume v 1 and v. Modelling Assumption : We assume the model parameters are hosen suh that they ensure the market is ompletely overed by and. The above assumption implies that eah onsumer must hoose one of the SPs. Suh an assumption is impliitly built into the lassial Hotelling model to ensure ompetition between SPs and our model ontinues to do so too. Later we provide a suffiient ondition for sustaining the equilibrium market segmentation under these assumptions. B. Two-SP Non-ooperative Game Formulation We note that the SPs ompete against eah other through their distint QoS and privay risk offerings, whih in turn affets onsumer hoies and helps determine the stable market segmentation. Thus, the interations between and an be formulated as a non-ooperative game in whih the strategy (ation) of eah SP is a (privay risk, QoS) tuple and that of the onsumer is hoosing an SP. Furthermore, we assume that the SPs are rational and have perfet information, implying that they play to maximize their own profits and know the exat profit funtion for any given strategy. The interations between retailers and onsumers in the Hotelling model an be viewed as a sequential game [15]. For our model, suh a sequential game involves three stages. In the first stage, the differentiator, i.e. the normalized privay risk ε i, is advertised by SP i. Thus is followed by eah SP determining its QoS for the advertised risk. Finally, the onsumers hoose the preferred SP based on the (ε i, v i ) tuple that maximizes its utility. The game an be formally desribed as follows: (i) a set of players {1,, C}, where 1 and denote and, respetively, and the set C ontains infinitely many onsumers; (ii) a olletion of strategy tuples (ε i, v i ) E i V i 7

8 for SP i and a olletion of binary hoies (strategies) for the onsumer b B = {1, }; and (iii) a profit funtion π i for eah SP i and a utility funtion u i for eah onsumer for hoosing SP i. C. The Subgame Perfet Nash Equilibrium for the Two-SP Game In a sequential game, eah stage is referred to as a subgame [18]. One often assoiates a strategy profile with a sequential game. A strategy profile is a vetor whose i th entry is the strategy for all players at the i th stage of the sequential game. A non-ooperative sequential game has one well-studied solution: the Subgame Perfet Nash Equilibrium (SPNE). A strategy profile is an SPNE if its entries are the Nash equilibria of the subgame resulting at eah stage of the sequential game. The SPNE of a sequential game aptures an equilibrium solution suh that no player an make more profit by unilaterally deviating from this strategy in every subgame. Sine the above non-ooperative game is a game with finite number of stages and perfet information, it an be solved using bakward indution. Bakward indution is the proess of reasoning bakwards in time, starting from the last stage of the sequential game, to determine a sequene of optimal strategies. It proeeds by first determining the optimal strategies in the last stage. Using this information, one an then deide the optimal strategies for the seond-to-last stage of the game. This proess ontinues bakwards until the optimal strategies for every stage has been determined. We apply bakward indution to the three stage game desribed above as follows. Stage 3, Users deisions: Eah onsumer loated at x [, 1] an hoose the servies provided by either or based on its valuation funtion in (3). The resulting optimal strategy for the onsumer is to hoose the SP whose index is given by arg max i {1,} v i + t(x x i )ε i. (5) Sine the onsumer s utility is a linear funtion of the normalized privay risk x and the market is ompletely overed by the SPs, there exists a threshold x τ suh that the onsumer loated at x τ is indifferent to using servies provided by or. Thus, at the indifferene threshold x τ, we have u (x τ ) = u 1 (x τ ) (6) = v + t(x τ x )ε = v 1 + t(x τ x 1 )ε 1. Simplifying further, the indifferene threshold for hoosing between the two SPs is given by x τ = v 1 v + t(f E (ε )ε F E (ε 1 )ε 1 ), (7) t(ε ε 1 ) where x 1 and x have been replaed by their orresponding normalized privay risk values. Thus, given the SPs tuples (ε i, v i ), i {1, }, the optimal strategy of a onsumer loated at x is to use the servie of if x x τ and otherwise. Stage, SPs determine QoS: In the seond stage, for a given privay risk guarantee ε i, SP i hooses its QoS v i to maximize its profit π i. Sine a onsumer s normalized privay risk tolerane denotes the fration of the population 8

9 whose privay risk tolerane is at most ε, x τ determines the proportion of onsumers who hoose, i.e., n 1. As a result, the profit funtions of and an be written as π 1 (v 1 ; ε 1 ; v ; ε ) =[R(ε 1 ) C(v 1 ; ε 1 )] v 1 v + t(f E (ε )ε F E (ε 1 )ε 1 ), t(ε ε 1 ) (8) π (v 1 ; ε 1 ; v ; ε ) =[R(ε ) C(v ; ε )][1 v 1 v + t(f E (ε )ε F E (ε 1 )ε 1 ) ]. t(ε ε 1 ) (9) To find the SPNE in this stage, we use the best response method [19]. The best response is a funtion whih aptures the behavior of eah player while fixing the strategies of the other players. For any v i V i, we define BR i (v i ) as the best strategy of SP i suh that BR i (v i ) = arg max v i π i (v i ; ε i ; v i ; ε i ), i {1, }. (1) In the Nash equilibrium, eah player plays the best response with respet to other players strategies. Thus, a Nash equilibrium in this stage is a profile v = (vi, v i ) for whih v i BR i (v i ), i {1, }. (11) To find the Nash equilibria, we first alulate the best response funtion of eah SP, then find a strategy profile v for whih v i BR i(v i ), i {1, }. For a given set of privay risk guarantees {ε 1, ε }, the optimal QoS v i of SP i, i {1, } in the SPNE is then determined by the solution to the following set of simultaneous equations v 1 = arg max v 1 π 1 (v 1 ; ε 1 ; v ; ε ), v = arg max v π (v 1 ; ε 1 ; v ; ε ). (1) Stage 1, SPs determine privay risk guarantee: In the first stage, we ompute equilibrium strategies ε 1 and ε that the two SPs should advertise for optimal market share. Note that x τ, v1, and v have been omputed in stages 1 and for a fixed ε 1 and ε, and therefore, are funtions of ε 1 and ε. The objetive funtions π 1 and π are thus also funtions of ε 1 and ε ; this in turn implies they an be maximized to find the equilibrium strategy ε 1 and ε using the best response method. III. TWO-SP MARKET WITH LINEAR COST AND REVENUE FUNCTIONS Thus far, we have onsidered a general model for the onsumer distribution of privay preferenes. To obtain better intuition and meaningful analytial solutions, we onsider a linear ost and revenue model for eah SP. We define the ost funtion of SP i to be C(v i ; ε i ) = v i + λε i, i {1, }, (13) where and λ are onstant sale fators in units of ost/qos and QoS/privay risk, respetively. In addition, we model the revenue of eah SP from offering a privay guaranteed servie by a linear funtion R(ε i ) = rε i + p i, i {1, }, (14) 9

10 where r is the revenue per unit privay risk for using onsumers private data. The parameters p 1 and p model the fixed revenues of the SPs that are independent of onsumers private data. A. Consumers with Uniformly Distributed Privay Risk Tolerane We assume onsumers have uniformly distributed privay risk tolerane between and. The resulting normalized privay risk of eah SP is given by Let x i = F E (ε i ) = ε i, i {1, }. α = r λ (15) and C = t. (16) Note that α is the ratio of net profit from using onsumer data for a unit of privay risk to the ost for providing a unit of QoS. Furthermore, C is the ost of providing non-zero utility to the onsumer with a maximal mismath of privay risk (relative to SP). By using the bakward indution method, the omputed SPNE of the two-sp non-ooperative game is presented in the following theorem. Theorem 1: There exists an SPNE for the two-sp non-ooperative game if the model parameters {, α, t,, p 1, p } satisfy The losed form solution of the SPNE is given by 1 16(p p 1 ) 1, 9t (17) 4α 3t 16(p p 1 ) 4α t, 3t 9t 3t (18) (1α) (15t) + 88t(p + p 1 ) [16(p p 1 )]. (19) ε = 1α + 15t 16(p p 1 ), () 4t v = (α + t)α6 + (α t)9t + (t α)8p + (α + t)16p 1, 4t (1) ε 1 = ε 3 4, () v1 = v 3 4 α + p p 1. 3 (3) At the equilibrium, i.e., for the SPNE, 1 8(p p1) 9t of the population hoose the servie provided by while the remaining 1 + 8(p p1) 9t of the population hoose. The total profit of and are given by π 1 = 4 (9t 7t 8 (p p 1 ) ) ; π = 4 7t (9t 8 + (p p 1 ) ). 1

11 The proof of Theorem 1 is provided in Appendix A. In theorem 1, we observe ε = ε , whih implies for any SPNE strategy profile, the SP who with the higher QoS will offer a privay risk guarantee 3 4 more than its ompetitor. Furthermore, a higher maximum net profit for using private data, denoted by α, enourages SPs to offer higher privay risk guarantees. However, a larger differene in revenues independent of private information between and, denoted by p p 1, enourages SPs to lower their privay risk guarantees to attrat more onsumers with lower privay risk tolerane. Also, a larger C will result in a larger differentiation in privay risk guarantee in the equilibrium strategies of and. Finally, as p p 1 inreases, the market share of dereases while s market share inreases. By (16), x τ, π 1, and π an be simplified to x τ = 1 8(p p 1 ) 9 C. (4) π = 1 3 (3 4(p p 1 ) C+ ) 4 3 π1 = 1 C 3 (3 4(p p 1 ) C ) 4 3 (5) C Note that for a fixed p p 1, both π 1 and π are dereasing funtions of C when C [, 16(p p1) 9 ] and inreasing afterwards. On the other hand, by (17), we have 16(p p1) 9 t, whih implies C 16(p p1) 9. Therefore, both π 1 and π are inreasing funtion of C in the SPNE. This indiates both SPs will make more profits in the SPNE with a larger C. B. Consumers with Normally Distributed Privay Risk Tolerane In this setion, we model onsumers privay tolerane as a random variable E that follows a normal distribution N (, σ ) with a mean of and a standard deviation of σ. Sine E [, ], we restrited the normal distribution to lie within the interval [, ]. Then E onditional on E [, ] follows a trunated normal distribution with umulative distribution funtion Φ( ε σ ) Φ( σ ) Φ( σ ) Φ( σ ) ε [, ] F E (ε) = ε [, ] 1 ε [, + ] where Φ(y) denotes the CDF of the standard normal distribution., (6) In ontrast to the uniform distribution ase, the CDF in (6) is not amenable to a losed form solution. Thus, we haraterize the equilibrium numerially. To find the SPNE, we first ompute the SPNE QoS in the seond stage as funtions of privay risk guarantees by solving (1). Then, we use an iterated best response method to find the optimal privay risk guarantee of an SP by fixing other SPs strategies in eah iteration. When the proess onverges, we have found an SPNE in whih no SP is better off by unilaterally deviating from the equilibrium. C. Illustration of Results In this setion, we illustrate our model and results. First, we assume onsumers have uniformly distributed privay risk tolerane. We plot eah SP s SPNE strategies, market share, and total profit with respet to onsumers 11

12 maximum privay risk tolerane for different values of the QoS/privay risk sale fator t. Later, we study the model in whih onsumers privay risk tolerane follows a normal distribution N (, 1) trunated between and. The model parameters are given as follows: Parameter λ r p 1 p Value Table. I: Numerial Example Model Parameters 1) Consumers with Uniformly Distributed Privay Risk Tolerane: In this setion, we vary from 3 to 5 to study properties of SPNE. Note that by theorem 1, t must belong to [.58,.85] for a stable and sustainable SPNE. In Figure, we plot the equilibrium strategies of different SPs. Observe that both privay risks and QoSs are linear funtions of, as expeted for the linear model assumed. Furthermore, it an be seen that as t, the valuation of privay by onsumer, dereases, eah SP will inrease its privay risk to generate more profit from using private data. Correspondingly, the SPs will have to provide higher QoS to attrat onsumers SP s privay risk SP, t=.6 SP, t=.6 1 SP, t=.65, t=.65 SP, t=.7 SP, t=.7 1 SP s QoS , t=.6, t=.6, t=.65, t=.65, t=.7, t= _ 5 Consumer s maximum privay risk tolerane ε (a) Privay Risk of SPs vs. onsumers maximum privay risk tolerane for different values of the QoS/privay risk sale fator t at SPNE _ 5 Consumer s maximum privay risk tolerane ε (b) QoS of SPs vs. onsumers maximum privay risk tolerane for different values of the QoS/privay risk sale fator t at SPNE Figure : Equilibrium strategies of SPs vs. onsumers maximum privay risk tolerane for different values of the QoS/privay risk sale fator t under a uniform distribution of onsumer privay risk The market shares of different SPs in the SPNE are presented in Figure 3. We observe that the equilibrium market share of dereases as t inreases. The intuition behind this is that if t inreases, the onsumer s valuation of privay mismath also inreases. Thus, it is more diffiult for to attrat onsumers with privay tolerane lower than ε. As a result, its market share dereases. Notie that in Figure 3, as dereases, the equilibrium market share of also inreases. This is beause onsumers experiene a smaller negative utility from the mismath between their preferred and the offered privay risk when the net range is smaller (reall that the utility from mismath is given by t(x x i )ε i, ε i [, ]). Thus, has the inentive to offer high QoS with high privay risk. As a result, more onsumers will hoose the SP with a higher privay risk to enjoy a higher QoS. 1

13 1 Market Share (Perent) SP, t=.6 SP, 1 t=.6, t=.65, t=.65 SP, t=.7 SP, t= _ Maximum privay risk tolerane ε Figure 3: Market shares of SPs at SPNE vs. onsumers maximum privay risk tolerane for different values of the QoS/privay risk sale fator t under a uniform distribution of onsumer privay risk In Figure 4, we plot the total profit at the SPNE for eah SP as a funtion of the maximum onsumer privay risk tolerane for different values of t. As shown in the figure, the total profit of both SPs at SPNE inreases as inreases. This is due to the fat that a larger indiates a larger range of onsumer preferenes, and then, more possibilities for the SPs to exploit private information. Thus, both SPs an benefit from the using the private data of onsumers that have a higher privay risk tolerane. As t dereases, the total profit of both SPs derease. This is due to the fat that as t dereases, the SPs intend to inrease their privay risks to generate more profit, As a result, the QoS of eah SP inreases to attrat more onsumers (see Figure ), that in turn has the onsequene of inreasing the ost of providing servies. Thus, the SPs have lower profits..66 t=.6 t=.65 t=.7.1 t=.6 t=.65 t= Profit.6 Profit _ 5 Maximum privay risk tolerane ε (a) Total profit of vs. onsumers maximum privay risk tolerane for different values of the QoS/privay risk sale fator t at SPNE _ 5 Maximum privay risk tolerane ε (b) Total profit of vs. onsumers maximum privay risk tolerane for different values of the QoS/privay risk sale fator t at SPNE Figure 4: Total equilibrium profit of SPs vs. onsumers maximum privay risk tolerane for different values of the QoS/privay risk sale fator t under a uniform distribution of onsumer privay risk 13

14 ) Consumers with Normally Distributed Privay Risk Tolerane: We now onsider the ase in whih onsumers privay risk tolerane follows a trunated normal distribution with a mean of and a standard deviation of 1. The equilibrium strategies of different SPs are shown in Figure 5. As with the uniform distribution senario, here too we observe that the privay risk and the QoS offered by eah SP are linear funtions of. We also notie that in the SPNE, will always provide servie with maximum privay risk (Figure 5a). This is beause the trunated normal distribution fores to forfeit privay differentiation while maximizing its profit. This allows to gain an advantage (relative to the uniform distribution). Furthermore, we observe that the value of t has slightly less influene on strategies of SPs in the SPNE ompared to uniformly distributed onsumer privay tolerane Privay risk , t=.6, t=.6, t=.65 SP, t=.65 1, t=.7, t=.7 QoS , t=.6, t=.6, t=.65, t=.65 SP, t=.7, t= _ 5 Maximum privay risk tolerane ε (a) Privay Risk of SPs onsumers maximum privay risk tolerane for different values of t at SPNE _ 5 Maximum privay risk tolerane ε (b) QoS of SPs vs. onsumers maximum privay risk tolerane for different values of t at SPNE Figure 5: Equilibrium strategies of SPs vs. onsumers maximum privay risk tolerane for different values of t under trunated normal privay risk tolerane distribution Figure 6 shows market shares of different SPs at SPNE vs. onsumers maximum privay risk tolerane for different values of t under trunated normal privay tolerane distribution. As t dereases, the market share of at SPNE inreases, and vie versa. Also, when dereases, the equilibrium market share of also dereases. Furthermore, it an be seen that for the same, the market share of ( ) is smaller (larger) when onsumers privay tolerane follows the trunated normal distribution ompared to uniform distribution. Furthermore, our numerial analysis shows that at SPNE, is fored to provide servie with maximum privay risk. We argue that this is due to the shape of the distribution that limits the number of onsumers at the two extremes thus ompelling the two SPs ompete for the large bulk of onsumers distributed around /. Given the ability of to make more profit on untargeted servies relative to, the SPNE solution leads to inreasing its market share to be profitable and ahieving profitability with a smaller market share. The relationship between total profit of different SPs at SPNE vs. onsumers maximum privay risk tolerane for different values of t is shown in Figure 7. Similar to Figure 4, both SPs total profit inreases as inreases. However, in ontrast to Figure 4, as t dereases, the total profit of inreases. This is beause always offers in the SPNE. Notie that s equilibrium QoS is also a linear funtion of ε (see Figure 5b). On the 14

15 1 9 8 Perent , t=.6, t=.6, t=.65, t=.65, t=.7, t= _ Maximum privay risk tolerane ε Figure 6: Market shares of SPs at SPNE vs. onsumers maximum privay risk tolerane for different values of t under trunated normal privay tolerane distribution other hand, s market share inreases as t dereases (see Figure 6). By (4), (13), and (14); the total profit of inreases as t dereases t=.6 t=.65 t= t=.6 t=.65 t= Profit Profit _ 5 Maximum privay risk tolerane ε (a) Total profit of vs.onsumers maximum privay risk tolerane for different values of t at SPNE _ 5 Maximum privay risk tolerane ε (b) Total profit of vs. onsumers maximum privay risk tolerane for different values of t at SPNE Figure 7: Total equilibrium profit of SPs vs. onsumers maximum privay risk tolerane for different values of t under trunated normal privay risk tolerane distribution IV. MARKET WITH MULTIPLE SERVICE PROVIDERS In the previous setions, we studied the market with two SPs. In this setion, we examine a generalized model with multiple SPs (Figure 8). We allow for a finitely arbitrary number of SPs, eah of whih offers the same type of free servie but with different QoS and privay risk guarantee to onsumers. In partiular, we assume there are m SPs in the market. Our models for ost, revenue and utility for eah SP as well as the onsumers are the same as for the two-sp model desribed in Setion II-A3. Furthermore, we assume a onsumer s privay risk tolerane is uniformly distributed between [, ε]. Analogous to the two SP model, the interations between the m SPs and onsumers an also be viewed as a non-ooperative sequential game. The m-sp game proeeds in three stages. 15

16 In the first stage, eah of the m SPs hooses its own privay risk guarantee resulting in a vetor ε = (ε 1, ε,..., ε m ) (on the interval [, ]). Without loss of generality, we assume ε 1 ε... ε m. At the seond stage, given the privay risk ε determined in the first stage, the SPs simultaneously determine their QoS values to obtain a vetor v = {v 1, v,..., v m }. At the last stage, eah onsumer hooses the SP that yields the maximal pereived utility for the onsumer. (Privay risk, QoS) (Privay risk, QoS)... SP m (Privay risk, QoS) Model Privay risk of SPs 1 Normalized User privay x1 x xi x x m 1 risk tolerane A user s privay risk tolerane i SP i SP i s loation on normalized user privay risk tolerane range: m SP m x F 1 ( ) i E i Figure 8: Market model for multiple SPs offering servies with privay guarantee To find the SPNE, we apply bakward indution to the three stage game desribed above as follows. In the last stage of the game, for fixed QoS and privay risk guarantee strategies of the SPs, onsumers hoies of SPs are determined by their privay risk toleranes. In the two-sp ase, the onsumer loated at x τ divides the set of onsumers into two onvex subsets where the onsumers in the left subset will hoose and vie versa. However, for the multiple SP ase, the market share of SP i (i {1,..., m}) is not neessarily a onvex set between the indifferene threshold in whih onsumers are indifferent to hoosing SP i 1 or SP i and the threshold in whih onsumers are indifferent to hoosing SP i or SP i+1. This is due to the fat that in general the problem requires eah SP i to ompete with all other SPs, even if their privay risk offerings are very different (e.g., SPs with a large differene in loations in Figure 8). We note that this will not happen in the equilibrium sine an SP with zero market share would be better off by either improving its QoS to attrat some onsumers or just exit the market. Therefore, in the equilibrium, eah SP only ompetes diretly with its two losest neighbors. For given QoS profile v = {v 1, v,..., v m } and privay risk profile ε = (ε 1,..., ε m ), the market share of eah SP are n 1 = v 1 v + t(f E (ε )ε F E (ε 1 )ε 1 ), t(ε ε 1 ) n i = v i v i+1 + t(f E (ε i+1 )ε i+1 F E (ε i )ε i ) t(ε i+1 ε i ) i {,..., m 1}, n m = 1 v m 1 v m + t(f E (ε m )ε N F E (ε m 1 )ε m 1 ). t(ε m ε m 1 ) Furthermore, we define the objetive funtions of SP i to be v i 1 v i + t(f E (ε i )ε i F E (ε i 1 )ε i 1 ), t(ε i ε i 1 ) π i ( ε; v) = [R(ε i ) C(v i ; ε i )]n i ( ε; v), i {1,..., m}. 16

17 For a given privay risk guarantees profile ε, the optimal QoS of SP i (i {1,..., m}) is determined by while fixing all other players strategies. arg max v i π i ( ε; v), i {1,..., m} (7) We note that the ost funtion C(v i ; ε i ) and the market segmentation omputed in the first stage are both linear funtions of v i. Thus, for a fixed privay risk guarantee profile ε, the objetive funtions of SP i in this stage is a onave funtion with respet to its own strategy v i. Furthermore, the feasible set of eah SP s strategy is a onvex set. Thus, the non-ooperative game among the SPs in this stage an is a m-player onave game. By [], there exists a Nash equilibrium. We define δ i 1 t(ε i+1 ε i), y 1 r(ε 1 ) + p 1 λε 1 tx ε + tx 1 ε 1, y N r(ε N ) + p N λε N t(1 x N )ε N + t(1 x N 1 )ε N 1 and y i r(εi)+pi λεi+txiεi txi+1εi+1 t(ε i+1 ε i) + r(ε i)+p i λε i tx i 1ε i 1+tx iε i t(ε i ε i 1) simultaneous linear equations obtained from πi( ε; v) v i i {,..., m}. Applying the first order ondition to SPs profit funtions (solving =, i {1,,..., m}) yields the equilibrium strategies v 1 = v + y 1, (8) vi = v i+1δ i + v i 1 δ i 1 + y i, i {,.., m}, (9) [δ i + δ i 1 ] v m = v m 1 + y m. (3) In the last stage, the SPs determine their privay risk guarantees ε by onsidering equilibrium strategies in previous stages (n i and v i is determine by i {1,..., m}) as funtions of ε. Therefore, the optimal privay risk strategy of SP i arg max ε i π i ( ε; v), i {1,..., m} (31) while fixing all other players strategies. For reasons of intratability (solving highly parameterized high order polynomial equations), a full haraterization of privay risk equilibria ould not be ahieved. Thus, we haraterizes the SPNE numerially by using the iterated best response method. We onsider a three-sp market and adopt the model parameters presented in Table SP i is given by i i+1 I. Furthermore, we assume t =.7 and = 5. The initial privay risk of for i {1,, 3}. Although there exists an SPNE in the seond stage of the sequential game for fixed privay guarantees, the existene of an equilibrium in the first stage an not be guaranteed. The best response strategies of the SPs for different values of s privay independent revenue are plotted in Figure 9. It an be seen that the two SPs with lower privay risks proeed to jump over eah other in eah round of best response iteration, attempting to lower its privay risk to attrat more onsumers from its ompetitor. The SP with the highest revenue independent of using private data adopts a high privay risk strategy to fous on onsumers with high privay risk tolerane and exploiting their private data extensively. Furthermore, we observe that when p is large, SP 3 s privay risk strategy is also higher on average. On the other hand, s best response strategy is lower. The intuition behind is that a larger p allows to set a higher privay risk to make more profit from using onsumer data. This fores SP 3 to inrease its privay risk to differentiate itself from. On the other 17

18 SP 3 4 SP 3 4 SP Privay risk 3.5 Privay risk 3.5 Privay risk Number of iterations (a) Best response of eah SP s privay risk (p =.75) Number of iterations (b) Best response of eah SP s privay risk (p =.6) Number of iterations () Best response of eah SP s privay risk (p =.45) Figure 9: Best response of eah SP s privay risk for different values of s revenue independent of using private data hand, a higher privay risk of will enourage to lower its privay risk to attrat more onsumers. V. CONCLUSIONS Our work seeks to understand the effet of offering privay- and QoS- differentiated online servies on onsumers with heterogeneous expressions of privay sensitivity. We have quantified this effet as the fration of onsumers that prefer lower privay risks with the aompanying lower QoS to the alternative of higher risks and higher QoS. We have presented an analysis built upon the lassial Hotelling model to ompute these frations for both the two and multi SP problem. Analogous to the lassial segmentation models, our problem also involves parameters that apture ost, revenue, and onsumer valuation funtions that are dependent and independent of the privay risks. While suh parametrized model an make the analysis hallenging, our results for relatively simple yet meaningful funtions suh as linear ost models and uniform (as well as trunated Gaussian) distribution of onsumer preferenes suggests that SPs that have higher profits from untargeted servies have an edge in the market. SPs ompeting on offering lower privay risks have to offer better QoS or figure out other means of inreasing untargeted revenue to gain market share. The market segmentation model assumes at least two or more SPs were able to overome the barrier to entry and differentiate themselves. Thus, a related question we will address going forward is whether suh barriers to entry are in fat surmountable when ompetitors use privay as a differentiator. These analyses are ruial for developing better privay poliies to effetively enable safe and seure online ommere. VI. ACKNOWLEDGEMENTS We wish to thank Professor Anand Sarwate at Rutgers University for many interesting disussions. This work is funded in part by the National Siene Foundation under grant CCF APPENDIX APPENDIX Starting form the last stage in whih onsumers hoose different SPs, we use bakward indution to find the SPNE of the sequential game. In the last stage, eah onsumer loated at x [, 1] hooses an SP whih maximize 18

19 its utility funtion (3). By (7) and the assumption that onsumers privay risk toleranes are uniformly distributed, the indifferene threshold x τ is given by x τ = v 1 v + t(ε ε 1 ) t(ε ε 1 ) = n 1 (v 1 ; ε 1 ; v ; ε ). (3) At the seond stage, the optimal strategy of eah SP is determined by the solution of (1). For fixed privay risk guarantees ε and ε 1, the objetive funtion of SP i, i {1, } in this stage, i.e. π i (v i ; ε i ; v i ; ε i ), is a onave funtion with respet to its own strategy v i. Furthermore, the feasible set of SP i s strategy is a onvex set (v i [, + ]). Thus, the non-ooperative subgame between and in this stage an be onsidered as a two-player onave game. By Theorem 1 and in [], we an establish Proposition 1: For fixed privay risk strategies, there exists a unique Nash equilibrium in the game between and at the seond stage. To ompute the equilibrium strategy of the seond stage, we first substitute (13), (14), and (3) into (9) and (8). Then, we apply the first order ondition to SPs profit funtions and solve the simultaneous equations given by Solving the above simultaneous equations yields v 1 = rε 1 + p 1 v = rε + p π i (v i ; ε i ; v i ; ε i ) v i = i {1, }. (33) + v λε 1 tx ε + tx 1 ε 1, (34) + v 1 λε t(1 x )ε + t(1 x 1 )ε 1. (35) For given privay guarantees ε 1, and ε, solving the simultaneous linear equations above by substituting (34) into (35) yields the equilibrium strategies v 1(ε, ε 1 ) = (rε 1 + p 1 ) + rε + p 3 v (ε, ε 1 ) = (rε + p ) + rε 1 + p t(1 + x 1)ε 1 λ(ε + ε 1 ) t(1 + x )ε, (36) 3 + t( x 1)ε 1 λ(ε + ε 1 ) t( x )ε. (37) 3 At the first stage, the SPs determine their optimal privay risk by onsidering the QoS of eah SP and the market segmentation omputed in previous stages as funtions of privay risks offered by the SPs. By substituting (37) and (36) into (9) and (8), the profit funtions of the SPs an be written as π = 9t(ε ε 1 ) [p p 1 + ( r λ + t ε ε 1 )(ε ε 1 )], (38) π 1 = 9t(ε ε 1 ) [ p p 1 + ( r + λ + t + ε + ε 1 )(ε ε 1 )]. (39) Next, we apply the first order ondition to SPs profit funtions to ompute the equilibrium strategies. Taking the 19