Abstract

Many online platforms generate revenue through targeted advertising, which depends on access to detailed consumer data. While platforms collect information directly from their users, they can also track both users’ and non-users’ off-platform browsing behaviour, allowing them to build consumer profiles that are valuable to advertisers. In this context, data externalities arise when user-provided data (e.g. demographic information) enables platforms to infer non-users’ characteristics, raising important privacy concerns. Focusing on Meta’s Facebook, we provide empirical evidence on the extent of off-platform tracking and quantify data externalities. We first demonstrate that Facebook monitors a substantial portion—over 40%—of online activity for both users and non-users of the platform. We then train a machine learning model using only data from Facebook users to identify patterns that link individuals’ browsing behaviour with their demographic attributes. Applying this model to non-users’ browsing data, we find that Facebook can infer non-users’ demographic characteristics with significantly higher accuracy than random guessing, providing evidence of data externalities. We further examine the impact of the European General Data Protection Regulation (GDPR) and find that while the regulation reduced Facebook’s tracking of non-users by over a third, it only marginally decreased data externalities by 1.4 percent. Our findings suggest that even with stricter privacy regulations, platforms can infer personal information from off-platform tracking, limiting the effectiveness of policies aimed at enhancing consumer privacy.