You don’t pay a subscription fee to use Google Search, Instagram, Gmail, or dozens of other apps you probably open every day. That’s not because these companies are being generous — it’s because you’re not actually the customer. You’re the product being delivered to someone else: advertisers, data brokers, and anyone else willing to pay for detailed knowledge about who you are and what you do. This piece breaks down exactly how that economy works, what it’s actually worth, and what it means for you in practical terms.
The Business Model Behind “Free”
The core mechanic is simple: instead of charging you money, “free” platforms collect data about your behavior — what you search for, who you talk to, where you go, what you buy, what you linger on, what you scroll past — and convert that data into revenue, primarily through targeted advertising. The more precisely a platform can predict what you want, the more valuable your attention becomes to advertisers willing to pay for it.
This isn’t a small side business. Google alone generated roughly $264.6 billion in advertising revenue in 2024, almost entirely built on knowing enough about its users to sell precisely targeted ad placements. Beyond the platforms you interact with directly, there’s an entire secondary industry — data brokers — whose sole business is collecting, packaging, and reselling personal information to other companies. That data broker market was valued at roughly $270 billion in 2024, with more than 5,000 companies globally participating in it.
What’s Actually Being Collected
It’s easy to underestimate the scope of this because most of it happens invisibly, in the background, with no obvious moment where you’re asked, “is this okay?” Personal data collected and traded in this economy commonly includes:
- Your name, contact information, and address
- Age, income level, and purchase history
- Subscriptions and app usage
- Political affiliations and religious beliefs
- Details about your friends and family
- Location history and movement patterns
- Browsing history and search queries
This information is pulled from a wide range of sources: website cookies, tracking pixels embedded in apps and pages, loyalty card programs, court and vehicle records, social media activity, and browser fingerprinting — a technique that identifies your device based on its specific technical characteristics, even without a traditional tracking cookie. Once collected, it gets bundled, cross-referenced with other data sources, and sold onward for targeted advertising, marketing, and customer profiling.
What Your Data Is Actually Worth
It’s genuinely difficult to put a single precise number on the value of one person’s data, because it depends on what’s being measured and by whom — but the estimates that do exist are striking. One widely cited analysis estimated that Facebook and Google combined generated over $600 per year in advertising revenue for the average American internet user, based on their public financial filings. Other analyses, using more conservative methodologies, put the number in the range of $200 or so per year per user from personal data alone — and that figure only accounts for two companies, not the full ecosystem of ad-tech firms, data brokers, and internet service providers that also profit from the same underlying behavior.
Separately, consumer surveys have found that people, when asked directly, tend to value individual pieces of their own data — an email address, a location history — surprisingly highly, often estimating a single data point’s worth in the tens of dollars. The gap between what people believe their data is worth and what companies actually pay for it (often described as fractions of a penny per data point in bulk transactions) is itself telling: individual pieces of data are cheap, but the aggregated, cross-referenced profile built from thousands of those data points over years is where the real value sits.
It’s Not Just Advertising Anymore
The “free platform sells your attention to advertisers” model is the most familiar version of this story, but the data economy has broadened. A growing trend among enterprises in 2026 involves treating data itself as a direct revenue product — packaging datasets, building paid API access to data streams, and selling analytics services derived from user behavior, separate from traditional advertising entirely. Industry analysts have projected the global data monetization market to be worth several billion dollars in 2026 alone, with double-digit annual growth expected through the next decade.
What this means in practice is that even platforms you pay a subscription fee for aren’t necessarily exempt from this dynamic — your data can still be a secondary revenue stream, packaged and sold or used to build products entirely separate from the service you signed up for.
When It Goes Wrong: Real Enforcement Cases
This isn’t just an abstract economic pattern — it has real, documented consequences when companies mishandle the data they collect. Some recent examples give a sense of scale and severity:
- California regulators settled with General Motors for $12.75 million over its OnStar connected-car program sharing detailed driving behavior data without proper authorization.
- The Federal Trade Commission took action against the dating platform OkCupid and its parent company for sharing millions of user photos and location data with third parties.
- The UK’s data protection regulator fined Reddit roughly £14.47 million for unlawfully processing children’s personal data.
- The FTC permanently banned data broker Kochava from selling sensitive location data after a multi-year legal case.
- A settlement involving Kaiser Permanente addressed the health system’s multi-year use of tracking pixels that may have exposed data for millions of members.
These aren’t isolated incidents — they reflect a pattern of companies collecting and sharing data in ways that went well beyond what users reasonably expected, often involving especially sensitive categories like health information, children’s data, and precise location history.
The Cost of Getting Breached
Beyond intentional data sharing and selling, there’s the separate risk of data simply being stolen. Data breaches remain expensive and increasingly costly for the companies responsible: the global average cost of a data breach was around $4.44 million in the most recent industry analysis, while in the United States specifically, the average breach cost has climbed to a record $10.22 million. Healthcare organizations have consistently faced the highest breach costs of any industry, largely because medical records contain exactly the kind of detailed personal information that’s valuable for identity theft and insurance fraud.
Notably, the rise of AI hasn’t necessarily made things riskier in a uniform way — recent industry analysis found the average breach cost was similar whether AI was involved in an organization’s operations or not, though breaches involving unmonitored “shadow AI” systems tended to run more expensive, and a large majority of organizations surveyed admitted they had no formal governance policies in place to manage AI-related data risk at all.
The Regulatory Landscape Is Catching Up — Slowly and Unevenly
Governments have been responding to this data economy, though the response remains fragmented, especially in the United States. As of 2026, twenty U.S. states have comprehensive consumer privacy laws in effect, each granting residents specific rights over their data and requiring covered businesses to honor opt-out requests — a patchwork that started with California’s landmark law in 2020 and has expanded state by state since, with several new state laws taking effect at the start of 2026 alone.
Globally, the picture is more unified but still incomplete: an estimated 144 countries now have some form of national data privacy law, covering roughly 82% of the world’s population. That’s a meaningful shift from a decade ago, but enforcement and consumer rights still vary enormously depending on where you live — someone in the European Union, under GDPR, has considerably stronger legal protections and clearer rights than someone in a U.S. state without a comprehensive privacy law.
What You Can Actually Do About It
None of this means you need to abandon free platforms altogether — for most people, that’s neither realistic nor necessary. But there are concrete, practical steps that meaningfully reduce how much of your data ends up in this economy.
Review and limit app permissions. Most apps request more access than they strictly need to function. Periodically check what permissions you’ve granted — location, contacts, microphone — and revoke anything that isn’t essential to how you actually use the app.
Use your legal opt-out rights if they apply to you. If you live in a state or country with a comprehensive privacy law, you likely have the right to request that a company delete your data or stop selling it. These requests take a few minutes and are often underused simply because people don’t know they exist.
Be selective about what you share, especially in sensitive categories. Health information, precise location data, and information about children carry outsized risk if mishandled, and multiple recent enforcement cases specifically involved these categories. Extra caution here is proportionate to the actual risk.
Use browser and search tools designed around privacy. Privacy-focused browsers and search engines, along with browser extensions that block tracking pixels and third-party cookies, meaningfully reduce the volume of behavioral data collected about you without requiring you to give up the underlying service.
Treat “free” as a signal to ask a question, not a red flag by itself. Nearly every major platform runs on this model, so the useful habit isn’t avoiding free services — it’s periodically asking what a given service is likely collecting and whether that trade-off still feels reasonable for the value you’re getting.
The Honest Bottom Line
“Free” was never actually free — it was a different kind of payment, made in data instead of dollars, often without a clear price tag attached so you could evaluate whether the trade was a good one. That doesn’t make every free platform predatory or unusable; plenty of the value exchange is genuinely reasonable once you understand what’s happening. But understanding the mechanics — what’s collected, what it’s worth, who’s buying it, and what protections you actually have — puts you in a position to make that trade-off deliberately, rather than by default.