Surveillance Capitalism: The Business Model That Monetized Human Behavior

Zusammenfassung

Surveillance capitalism is the term coined by Harvard Business School professor Shoshana Zuboff to describe a new economic logic, pioneered by Google and perfected by Facebook, in which human experience itself becomes raw material for a market in behavioral predictions. Users are not customers; they are the source of the data that is the actual product. The system was built largely without democratic deliberation, took hold before it was named, and has become the financial foundation of the modern internet — a structure that Zuboff argues is as fundamentally threatening to human freedom as the industrial capitalism Marx analyzed was to physical labor.

The Core Mechanism

In 2019, Shoshana Zuboff published The Age of Surveillance Capitalism, the culmination of research she had begun publishing as academic papers from 2014 onward. Her framework, while contested, provided the most systematic analytical description of a phenomenon that millions of people had sensed but struggled to articulate.

The mechanism works in four steps:

Behavioral data extraction. Every action a user takes online — every search, click, scroll, pause, purchase, location check, and relationship formation — is recorded. This is the raw material.
Prediction machine construction. The extracted data is fed into machine learning systems that build models of individual and collective behavior. These models are not merely descriptive; they are predictive — they estimate the probability of future actions.
Behavioral futures market. The predictions — “this user is 73% likely to purchase running shoes in the next two weeks,” “this user’s emotional state makes them 40% more susceptible to political messaging” — are sold to advertisers, political campaigns, and other interested parties.
Behavioral modification at scale. The most sophisticated operations don’t just predict behavior; they nudge it, using the platform’s own content selection to guide users toward the predicted (and therefore bought-and-sold) behaviors.

The key innovation, Zuboff argues, was not data collection itself — computers had always generated data — but the appropriation of surplus behavioral data: the data that goes beyond what’s needed to deliver the service. A search engine needs to know your query to return results. It does not need to know how long you paused on each result, what you searched before and after, where you were when you searched, or what you bought following the search. All of that is surplus — extracted, retained, and repurposed without the user’s meaningful awareness.

Google: The Origin Point

AdWords, launched by Google in October 2000, is the moment Zuboff identifies as the birth of surveillance capitalism’s business model. The critical innovation was not the idea of selling advertising against search queries — GoTo.com had done that. It was using past user behavior to improve ad targeting beyond what the immediate query revealed.

Google’s engineers discovered that combining a user’s search history, location data, browsing patterns (collected through Google’s analytics tools embedded across millions of websites), and behavioral signals produced advertising predictions far more accurate than any single data point. A user who had searched for “knee pain” three weeks ago, then searched for “marathon training,” and who was currently searching for “running shoes” was worth dramatically more to an advertiser than the search query alone indicated — because the behavioral history created a prediction.

This discovery drove Google’s advertising revenue from near zero in 2000 to $70 billion by 2015, $134 billion by 2019, and $237 billion by 2023. The surplus data was not a byproduct; it was, increasingly, the primary product.

Every Google service — Gmail (reading email to target advertising), Google Maps (tracking physical movements), Chrome (monitoring browsing behavior across the web), Android (tracking app usage and location on mobile devices), Google Analytics (embedded on over 50 million websites to collect behavioral data from non-Google users) — extended the behavioral data collection surface. The services were, in Zuboff’s framing, not primarily products for users; they were instruments for extracting behavioral data from users, which was then sold to third parties.

The Scale of Behavioral Data Collection

Google’s Chrome browser holds approximately 65% of the global browser market. Google Analytics is embedded in over 55% of all websites. Android runs on approximately 70% of global smartphones. This means Google collects behavioral data on most people who use the internet — including people who have never created a Google account — through tracking mechanisms that operate invisibly in the background of ordinary internet use.

Facebook: The Social Graph as Prediction Engine

Facebook’s contribution was to add the social dimension to behavioral prediction. Google knew what you searched for and where you browsed; Facebook knew who you knew, what you said to them, what you responded to emotionally, and how your behavior changed in response to what your social network showed you.

The social graph — the map of who you knew and how strongly — proved to be extraordinary leverage for behavioral prediction. People with friends who had recently purchased baby products were likely to be pregnant or know someone who was. People whose social networks contained high proportions of people with certain political views were likely to be persuadable toward those views. The graph made individual behavioral data meaningful in ways it was not in isolation.

Facebook’s 2014 emotional contagion experiment made the mechanism starkly visible. Researchers at Facebook and Cornell University manipulated the News Feeds of 689,003 users without their knowledge or consent — showing some users more positive content, others more negative — to study whether emotional states transferred through the platform. They found that they did: users shown more negative content produced more negative posts themselves. The paper was published in PNAS in June 2014 as a demonstration that “emotional states can be transferred to others via emotional contagion through the content of News Feed.”

The informed-consent protocols were minimal: Facebook’s terms of service included a clause about using data for “research.” The research community erupted in protest; the incident demonstrated that hundreds of millions of users were, routinely and without awareness, participants in behavioral experiments designed to optimize the platform’s engagement mechanics.

Cambridge Analytica: The Moment It Became Politically Visible

For most of surveillance capitalism’s history, its operations were invisible to the people being surveilled. The Cambridge Analytica scandal in March 2018 made the consequences viscerally concrete.

Cambridge Analytica, a political consulting firm founded in 2013 with funding from hedge fund billionaire Robert Mercer and strategic direction from Steve Bannon, had obtained psychographic profiles of approximately 87 million Facebook users constructed from data harvested through a personality quiz app. The firm applied these profiles to target political advertising for the Brexit Leave campaign and the Trump 2016 presidential campaign — identifying persuadable voters and targeting them with content calibrated to their psychological profiles.

The fundamental data collection mechanism had been explicitly permitted under Facebook’s 2014-era platform policies. The scandal was not a hack; it was an app operating within the rules Facebook had written. The rules had been written to encourage app development and maximize Facebook’s advertising ecosystem. The possibility of political misuse had not been a primary consideration.

Facebook’s stock fell 10% in the week following the revelations. Mark Zuckerberg testified before Congress. The FTC investigation that followed resulted in a $5 billion fine — larger than any previous privacy enforcement action, and smaller than the amount Facebook earned in advertising revenue in those same weeks.

GDPR: Europe’s Response

The European Union’s General Data Protection Regulation (GDPR), which entered into force on May 25, 2018, was the most ambitious attempt by any jurisdiction to constrain surveillance capitalism through law.

GDPR’s key provisions included: a right to know what data is collected and why; a right to data portability (receiving your own data in a usable format); a right to erasure (“right to be forgotten”); strict requirements for consent that must be freely given, specific, informed, and unambiguous; and fines of up to 4% of global annual revenue for violations.

The practical impact was significant but partial. Companies were required to post cookie consent notices — the ubiquitous “accept cookies” popups — which gave users nominal control but in practice trained them to click “accept” reflexively to reach desired content. The largest fines — Meta €1.2 billion (2023), Amazon €746 million (2021), Google Ireland €150 million (2022) — established that enforcement was real, but the fines remained modest relative to the revenues the practices generated.

GDPR also created a trans-Atlantic regulatory tension: US companies operating in Europe faced compliance costs and operational constraints that their domestic market did not impose, creating competitive pressure for US regulatory convergence that has been slow to materialize.

Apple’s ATT: Privacy as Competitive Weapon

In April 2021, Apple introduced App Tracking Transparency (ATT) — a requirement that iOS apps explicitly request permission before tracking users across apps and websites. The default setting was to deny tracking; users had to actively opt in.

The stated justification was user privacy. The practical effect was devastating for Meta: approximately 80% of iOS users opted out of tracking, collapsing the precision of behavioral targeting for Facebook and Instagram ads on Apple devices. Meta estimated the revenue loss at approximately $10 billion in 2022.

Apple itself collects extensive behavioral data from its users — for its own advertising platform, for improving its services — but it controls the hardware, operating system, and app distribution channel, meaning it can enforce tracking restrictions on competitors while operating its own less-constrained data collection.

Zuboff’s analysis frames ATT as self-interested privacy: Apple positioned privacy protection as a competitive advantage against Google and Meta, not from altruistic concern for users, but because Apple’s business model (selling premium hardware) made it strategically advantageous to differentiate from advertising-dependent competitors. The gesture reduced surveillance capitalism for others while leaving Apple’s own practices largely unexamined.

Zuboff’s Argument and Its Critics

Zuboff’s central claim is that surveillance capitalism is not capitalism’s natural evolution — not simply what markets do with new technology — but a mutation requiring democratic response. The market in behavioral futures could not have developed without (a) the internet’s architectural affordances for behavioral monitoring, (b) regulatory failure to constrain data collection in the critical 2000–2015 window when the business model was being built, and (c) the network effects that created winner-take-all dynamics in social media and search.

The democratic threat, in her framing, is not merely privacy loss — it is the development of systems that can predict and modify human behavior at scale, concentrating an unprecedented form of power in private hands. She draws an analogy to industrial capitalism and the labor movement: the response to industrial capitalism’s exploitation of human bodies was democratic mobilization — labor unions, regulation, welfare states. The response to surveillance capitalism’s exploitation of human experience requires equivalent mobilization.

Critics have raised several counterarguments:

The “free service” defense: Users receive genuine value from Google Search, Gmail, Facebook, and similar services without paying money. The data exchange might be a fair bargain, particularly if made transparent. Zuboff’s response is that the exchange is not transparent — it cannot be transparent, because the systems are designed to obscure the nature and scale of data collection — and that consent under conditions of information asymmetry is not meaningful consent.

The “it’s not that powerful” challenge: Behavioral prediction is probabilistic, not deterministic. Advertising is effective but not all-controlling. Cambridge Analytica’s actual influence on election outcomes is disputed. Zuboff’s response is that the concern is not current power but trajectory: the same algorithmic infrastructure that is currently used for advertising was demonstrated in 2016 to be usable for political manipulation, and it will only become more powerful.

The technology determinism critique: Some scholars argue that Zuboff’s framework overstates the novelty of surveillance capitalism, ignoring long histories of commercial data collection, credit scoring, and insurance actuarialism that also monetize human behavior. The difference, proponents respond, is one of scale, granularity, and the integration of prediction with behavioral modification through platform design.

The Spreading Model

Surveillance capitalism’s logic has spread beyond the advertising sector it originated in.

Insurance companies use behavioral data from smartphone apps, connected vehicles, and wearables to vary premiums based on individual behavior. The model moves insurance from collective risk pooling toward individual behavioral surveillance.

Employment screening uses social media data, facial recognition, and algorithmic resume screening that incorporates behavioral proxies. Several jurisdictions have found that these systems replicate historical discrimination while providing a technical justification for it.

Credit scoring has expanded from financial history to behavioral indicators. In China’s social credit system, a government-operated behavioral monitoring infrastructure extends surveillance capitalism’s logic into state control — scoring citizens on their behavior across social, commercial, and political domains.

Zuboff’s framework insists these extensions are not coincidences or abuses of a neutral technology; they are the natural expansion of a logic that treats human experience as raw material for commercial and governmental exploitation.

For the privacy implications, see The Privacy War. For the platforms that implement surveillance capitalism, see Google: From Dorm Room to Digital Infrastructure and Mark Zuckerberg and Facebook: The Social Network That Rewired Society. For the psychological mechanisms of engagement engineering, see The Attention Economy. For the Snowden disclosures that revealed government surveillance, see Edward Snowden and the NSA.