This is not a problem when the interests of firms and consumers align, as in the above examples, but, as Calo writes, "it would be highly surprising were every use to which a company placed intimate knowledge of its consumer in fact a win-win." It's where interests diverge, and actual harms are incurred, that the trouble lies.

So where does that trouble lie? What are those actual harms? Calo outlines three distinct types of damages. The first are economic: market failures, not unlike others that the government has decided merit corrective regulatory measures in the past, such as the regulation of cigarette ads. But in the case of digital marketing, Calo says, the inefficiencies aren't going to be such clear cases. Rather, the failures will come in the form of consumers being systematically charged more than they would have been had less information about that particular consumer.

Sometimes, that will mean exploiting people who are not of a particular class, say upcharging men for flowers if a computer recognizes that that he's looking for flowers the day after his anniversary. But other times there could be troubling equity concerns. For example, Calo points to the work of NYU professor Oren Bar-Gill who has shown how companies can use complexity in credit-card contracts, mortgages, and cell-phone contracts to "hinder or distort competition and impose outsized burden on the least sophisticated consumers." Calo says such price-discrimination tactics, applied en masse online, could "lead to regressive distribution effects," also known as preying on the vulnerable.

But perhaps you think those inefficiencies will be balanced out at the level of the aggregate market. Calo says there is still reason to be concerned at the level of the individual. He writes, "Even if we do not believe the economic harm story at the level of the market, the mechanism of harm at the level of the consumer is rather clear: The consumer is shedding information that, without her knowledge or against her wishes, will be used to charge her as much as possible, to sell her a product or service she does not need or needs less of, or to convince her in a way that she would find objectionable were she aware of the practice." There may be nothing particularly embarrassing or personal about my vulnerabilities as a consumer, but I do not especially want to share them with companies so that I can be manipulated for their financial gain. For Calo, that discomfort, the feeling I experience knowing that my vulnerabilities are being tracked in order to be used, is a violation of my privacy, the second area of harm Calo sees.

This is closely related to Calo's third area of concern: autonomy, which in the context of the consumer means, he says, "the absence of vulnerability, i.e., the capacity to act upon the market in our self-interest." When corporations purposely seek out a consumer's vulnerabilities and use them to direct her dollars back to them, that is a violation of that person's autonomy.