Putting a tax on surveillance marketing is sometimes suggested as a solution to a classic externalities problem—firms benefit from surveillance marketing, but the costs and risks are paid for by the people surveilled. A Pigovian tax is the go-to fix for this situation.

Where to put the tax is the problem. Taxing specific marketing practices probably creates more overhead and risk than it’s worth. Too easy for surveillance marketers to work around. So it seems like the best approach would be to expand the existing “data broker” registration laws to put scaled reporting and tax requirements on any database containing PII. From an economic POV, personal information is digital hazmat, with both potential harms and possible future benefits that a regulator is not in a position to evaluate but the users are.

Just like RCRA resulted in some marginal uses of hazardous materials being phased out, a Pigovian tax would likely cause companies to get rid of some high cost/benefit surveillance marketing data on their own to avoid reporting and taxation.

In general, it is important to tie the tax to the data (and therefore risks) and not to specific practices. Users of the data are best able to decide how to balance the risks and rewards.