The Limits of Price Discrimination Under Privacy Constraints

Price discrimination has long been a topic of considerable interest in economics and computer science. At its core, price discrimination involves a seller’s ability to charge different prices to different consumers for the same product or service. This strategy, underpinned by the seller’s understanding of consumer preferences, can lead to maximized profits and a more efficient allocation of resources. While economically rational from a business perspective, price discrimination raises complex questions regarding fairness, market power, and consumer welfare.

Simultaneously, consumer privacy has become a growing concern in the digital age. With the increasing ability of companies to collect, analyze, and utilize vast amounts of personal data, the protection of consumer privacy has become a major issue for consumers, companies, and regulators. Privacy concerns are not just limited to the safeguarding of personal information but also encompass how this information is used in market practices, including pricing strategies.

Thus, the intersection of price discrimination and consumer privacy is a timely and intriguing topic. One might initially assume that these two concepts are at odds. Price discrimination, by its very nature, relies on detailed information about consumers to tailor prices effectively. In contrast, an emphasis on consumer privacy could limit the ability of sellers to implement price discrimination strategies. However, consumers can benefit from price discrimination, and thus, this intersection warrants a more nuanced examination. Understanding how privacy constraints affect the ability of firms to engage in price discrimination helps in understanding existing market dynamics and also aids in shaping policies that protect consumer interests.

Our study of the intersection of price discrimination and privacy builds on prior work of Bergemann et al. [2015]. Let us first describe their model and then explain how things change if we consider consumers’ privacy concerns. Consider a monopolist who is selling a product to a continuum of consumers. If the producer knows the values of consumers, then they could engage in first-degree price discrimination to maximize their utility, while the utility of consumers would be reduced to zero. On the other hand, if the producer has no information besides a prior distribution about the value of consumers, then they can only enact uniform pricing. This leads to two pairs of producer utilities and consumer utilities. Bergemann et al. [2015] delineate the set of all possible pairs by using different segmentations. Let us clarify this approach with an example. Imagine a producer aiming to set a product’s price for its customers across the United States. In this context, the aggregated market is defined as the entire US market, meaning the distribution of consumers’ valuations nationwide. Each zip code within the US represents its own market, which is basically the distribution of the consumers’ values in that zip code. Segmentation, in this case, refers to the division of the aggregated US market into these specific markets. Generally speaking, a segmentation involves breaking down the aggregated market into smaller markets, under the condition that these smaller markets must add up to the aggregated market. Bergemann et al. [2015] establish that the set of all possible pairs of consumer and producer utilities is a triangle as depicted in Figure 1. The point $Q$ corresponds to the first-degree price discrimination, and the line $TR$ represents all possible consumer utilities when the producer utility is at its minimum, equating to the utility derived from the uniform pricing.

For a given market, knowing the underlying distribution of consumers’ values reveals information about the consumers in that market. Take, for instance, the consumers residing in a certain zip code. Knowing the distribution of the consumers in that zip code induces privacy costs for a multitude of reasons, including potential profiling, harmful targeting, potential manipulation, and unfair business practices. In this paper, we aim to explore how limiting information disclosure about the market affects the potential combinations of consumer and seller utilities. We conceptualize privacy leakage as the extent to which revealing a message about the value distribution within a market segment reveals the actual distribution of values of consumers in that segment. This measure quantifies the change in our understanding of a segment’s distribution following the receipt of a specific message. More precisely, we require that the distribution of consumer values in each market must go through a privacy mechanism that masks the true market and outputs a uniformly sampled market with some probability $\beta$ and outputs the true market with the complementary probability $1-\beta$. Our privacy mechanism is motivated by a market-level randomized response mechanism—where randomized response is a well-known technique in the privacy literature, commonly utilized for the privatization of discrete-valued data [see, e.g., Warner, 1965, Greenberg et al., 1969]. Additionally, as we will highlight in the next section when presenting our model, our privacy mechanism is methodology used in practice in technology companies and government agencies when aggregate statistics such as histograms are published in a manner that provides privacy guarantees Desfontaines [2021]. These methods ensure that a function reported over users’ data does not significantly depend on any individual user’s data, thereby safeguarding personal privacy Dwork et al. [2014].

In this paper, we operate within a Bayesian setting where we assume that the producer holds a prior for every market and updates it after observing the output of the privacy mechanism. To avoid any unaccounted privacy loss, it is important to choose the least informative prior. Intuitively, under the principle of indifference, a reasonable choice of prior belief for the producer would be the uniform distribution over the entire space of market distributions. Indeed, the question of selecting an uninformative prior has been the subject of extensive literature in Bayesian analysis, where reference priors are a leading framework Bernardo [1979]. As we will demonstrate, the uniform distribution is the reference prior in our setting. Given this Bayesian framework, we ask the following question:

Given the privacy constraint, what set of consumer and producer utility pairs can be attained through all possible market segmentations?

Notice that by increasing $\beta$, we strengthen the privacy guarantees. The case of $\beta=1$ corresponds to a fully private setting in which the producer has no information about each segment or the aggregated market. It is worth emphasizing that in our setting, unlike in Bergemann et al. [2015], the producer does not know the aggregated market. This assumption is crucial when studying privacy loss, as having additional knowledge about the aggregated market would constitute unaccounted information leakage. Consider, for example, a setup with two possible values where each consumer’s value is either low or high. If the aggregated market indicates that everyone’s value is high with a probability of one, then the producer would know every segment’s market, even if $\beta=1$ (which is supposed to deliver a full privacy guarantee). Lastly, the case of $\beta=0$ reduces our setting to the non-private case, where the producer can see all segments without any perturbation, and hence can deduce the aggregated market as well.

Both our analysis and our results are different in significant ways from those of the non-private case. In particular, since the aggregated market is no longer known to the producer, there is no guarantee that the producer’s surplus is at least as high as profits under the uniform monopoly price (i.e., at or above the line $TR$ in Figure 1). Moreover, our results allow us to resolve the question of whether the privacy constraint always benefits the consumer. In more detail, our main results and insights are as follows.

First, in the setting of two consumer values, we are able to fully characterize the space of all consumer and producer utilities. Moreover, we are able to identify nuances in this setting that we later explore in a more general setting. In particular, we establish that the set of all consumer and producer utilities is a triangle, similar to the non-private case, but the triangle takes different shapes depending on the consumer values, the aggregate market distribution, and the privacy parameter. Figure 2 illustrates our characterization for two cases that display qualitative differences compared to the setting without privacy constraints. In this figure, the set of possible producer and consumer utilities under the privacy mechanism is depicted by the blue triangle $ABC$. The triangle $TQR$, marked by red dashed lines, represents the non-private case for the corresponding set of values and the aggregated market. We see that the privacy mechanism impacts the limits of price discrimination through a direct effect and an indirect effect. Let us describe these effects and explain how they shape the set of all possible consumer and producer utilities.

The direct effect arises because the producer observes a random market instead of the true market, with probability $\beta$, as a consequence of the privacy mechanism. This means that with probability $\beta$, the consumer and producer utilities are independent of the segment’s markets. The direct effect implies a shift in the space of consumer and producer utilities. Considering Figure 2, the direct effect implies that the minimum consumer utility, as opposed to the non-private case, is no longer zero; instead, there is a non-zero lower bound on the consumer utility (line AB versus line QT). It also implies that the sum of consumer and producer utilities is smaller than that of the non-private case (line BC versus line QR).

To understand the indirect effect, notice that with probability $1-\beta$, the producer observes the true market. However, the producer does not know whether or not this observed market is the truth and, therefore, adopts a different pricing strategy compared to the non-private case. The indirect effect refers to this change in the producer pricing strategy. Notably, the producer’s pricing strategy is optimal from their perspective, taking into account the privacy mechanism, but it does not correspond to the optimal pricing strategy in the non-private case. To better illustrate the impact of this indirect effect, let us revisit the non-private case (as depicted by the triangle $TQR$ in Figure 2). Imagine a segmentation for which the producer is indifferent between several prices for certain segments. In such a case, although different price choices do not alter the producer’s utility, they can lead to different consumer utility. For example, every point along the line $TR$ represents the same level of utility for the producer. However, selecting various prices can minimize or maximize the consumer utilities (corresponding to points $T$ and $R$, respectively). In the private setting, however, various pricing options that make the producer indifferent ex-ante (i.e., yielding the same expected utility when considering the privacy mechanism) might actually result in different ex-post producer utilities. Consequently, opting for different prices alters both the consumer and producer utilities. This is the reason why, with privacy constraints, the line $AC$ is no longer parallel to the x-axis. This difference is more pronounced as we consider $K>2$ values (see Figure 3) where the lower limit of the set of all possible consumer and producer utilities, in sharp contrast to the non-private case, is not a straight line.

The above effects and the corresponding set of all possible consumer and producer utilities are visualized in Figure 2: the triangle $ABD$ represents the non-private triangle $TQR$ after undergoing the scaling and shifting attributable to the direct impact of privacy. The discrepancy between triangles $ABC$ and $ABD$ thus precisely indicates the indirect effect that arises from the change in the producer’s pricing policy due to the privacy mechanism.

Second, our characterization yields the following insights.

Insight 1: Imposing the privacy constraint hurts the producer by decreasing both its minimum and maximum utility across all segmentations. This is intuitive because after adopting the privacy mechanism, the producer knows less about the consumer’s values and, therefore, cannot extract as much surplus as in the non-private case.

Insight 2: Imposing the privacy constraint helps the consumers by increasing their minimum utility. However, interestingly, it can hurt consumers by decreasing their maximum utility (compare, for example, the consumer utility in points $C$ and $R$ in the two panels of Figure 2). This first phenomenon aligns with the direct impact of the privacy mechanism, as previously elaborated. Because the producer does not always observe the true market, they may sometimes choose a suboptimal price, resulting in a positive expected utility for consumers. The second phenomenon is more nuanced. We observe that the introduction of a privacy mechanism can influence the producer’s market pricing strategy, leading to more conservative or riskier decisions depending on the consumers’ values. This effect arises because the privacy mechanism reduces the informativeness of the market observed by the producer. On one hand, in cases where there is a significant gap between high and low consumer values, the producer finds the risk of setting higher prices justified. This shift towards riskier pricing strategies is the indirect impact of privacy we discussed earlier. Under such circumstances, if the actual market includes many low-value consumers, selecting higher prices could detrimentally affect consumer utility. On the other hand, when consumer values are relatively similar, the producer might opt for a lower, safer pricing strategy, avoiding “unnecessary” risks. Now, if the true market is composed largely of high-value consumers, this conservative approach can lead to increased utility for consumers compared to the non-private case, thereby increasing maximum consumer utility.

Insight 3: As we discussed above, imposing a privacy constraint decreases both the minimum and maximum producer utility while it increases the minimum consumer utility. One may conjecture that these changes amplify as the privacy parameter increases. However, interestingly, we prove that an increase in the privacy parameter $\beta$ does not necessarily decrease the producer’s maximum utility and, similarly, does not necessarily increase the minimum consumer utility. Put differently, while imposing the privacy constraint always reduces the maximum producer utility, more privacy does not necessarily lead to a more reduction in this utility. Similarly, although the privacy mechanism ensures a non-zero minimum utility for the consumer, this minimum does not always increase with a higher privacy parameter. The intuition behind these nuanced non-monotonicities is similar to Insight 2, discussed above.

Third, we establish that our main insights carry over to the general setting with $K>2$ consumer values. Notably, the set of all consumer and producer utilities pairs is no longer a triangle, in sharp contrast to that of the non-private case. Instead, it is a convex polygon (see Figure 3 illustration for one example and how it differs from the non-private case). Similar to the case of $K=2$, we identify that the privacy mechanism introduces both direct and indirect effects on the set of possible consumer and producer utilities. The direct impact implies a combination of scaling and shifting, transforming the triangle $TQR$ into triangle $ABD$ as depicted in Figure 3. The indirect effect of privacy, however, changes the shape of the utility set from a triangle to a convex polygon. More precisely, we illustrate that this set can be represented as a linear mapping of a convex polytope in $\mathbb{R}^{K^{2}}$ into a 2-dimensional space. This representation enables us to extend all the insights above from the case with $K=2$ to the general case with $K\geq 2$. Our analysis also provides the construction of a segmentation to achieve any feasible point for consumer and producer utilities.

Furthermore, our characterization allows us to identify several key properties of the polygon that delineate the limits of price discrimination under privacy constraints. One that we highlight here is regarding the impact of privacy on first-degree price discrimination. In the non-private scenario, point $Q$ in Figure 3 represents perfect discrimination utilities, where each segment contains consumers of identical value. Now, let us consider the same segmentation and see how the privacy mechanism impacts the producer’s utility (i.e., point B in Figure 3). First, notice that because of the direct impact of the privacy mechanism (that masks segments with probability $\beta$), the producer’s utility decreases to another point. The question arises: does the indirect effect of privacy further decrease the producer’s utility? In other words, the question is whether the privacy mechanism can influence the producer’s pricing strategy to such an extent that, even when they observe a market comprising consumers with similar values, they set a different price for that market. Interestingly, we show that this scenario is indeed possible. We specifically identify a threshold for the privacy parameter $\beta$. Once this threshold is surpassed, it prompts the producer to avoid using certain values for market pricing, as other values yield higher expected utility. Below this threshold, however, the indirect effect of privacy does not further decrease the producer’s utility.

From a technical point of view, to characterize the set of all possible consumer and producer utilities under privacy constraints, we need novel techniques and analysis compared to the existing ones in the literature. Notably, the analysis in Bergemann et al. [2015] relies heavily on the premise that producer utility is bounded below by optimal uniform pricing. This assumption, however, does not hold under privacy constraints since the aggregated market remains undisclosed to the producer. Furthermore, their argument is built on characterizing extremal markets—markets wherein the producer is indifferent between choosing any value within the support of the distribution of the consumer values. In contrast, our argument employs a merging technique, effectively simplifying the problem to an examination of segmentations where, for each value, no more than one segment is priced at that value. This approach not only makes our analysis applicable to the private case but also builds a framework that easily extends to the general setting with multiple consumer values.

We build our model upon the one proposed by Bergemann et al. [2015]. In particular, we consider a producer’s problem of pricing a product for a continuum of consumers represented by the interval $\Omega:=[0,1]$. We normalize the cost of production to zero and assume that each consumer’s value for the product belongs to the set $\mathcal{V}:=\{v_{1},v_{2},\cdots,v_{K}\}$ for some $K\in\mathbb{N}$, where $v_{K}>\cdots>v_{2}>v_{1}>0$. The value of a consumer is denoted by a random variable $V:\Omega\to\mathcal{V}$. We assume that a consumer purchases the product if the offered price is lower than or equal to their value.

We begin by examining the simpler scenario where the consumer’s valuation is limited to two values, i.e., $K=2$, to gain insights into the limits of price discrimination under privacy constraints. In this scenario, the set of all markets, $\mathcal{X}$, is, in fact, the set of Bernoulli distributions, which can be parameterized by the probability of the high value, $v_{2}$, denoted by $\alpha\in[0,1]$. Throughout this section, we use $x$ and $\alpha$ interchangeably to represent the market. In particular, $\alpha^{*}$ denotes the probability of the high value for the aggregated market $x^{*}$. We also define $\eta$ as the ratio of the lower value to the higher value, i.e.,

We first characterize the optimal price conditioning on the observed market $\hat{x}$.

Note that when $2\eta\leq\beta$, this lemma implies that the optimal price becomes $v_{2}$, regardless of the observation $\hat{x}$. Similarly, when $\beta\geq 2(1-\eta)$, the optimal price is $v_{1}$. Note that when the producer sets the price to the high value $v_{2}$, only consumers with the high value will purchase the product, resulting in their expected utility being zero due to the absence of consumer surplus. Conversely, when the producer opts for the low value $v_{1}$ as the price, all consumers—regardless of their valuation—will purchase the product. This pricing strategy allows consumers with the high value to achieve a positive expected surplus, as they gain the difference between their valuation and the lower price. Therefore, if $\beta\geq 2\eta$, we have

and if $\beta\geq 2(1-\eta)$, then we have

We next focus on the more interesting scenario in which the following assumption holds.

As established in Lemma 1, in this case, the optimal pricing rule sets the price to $v_{1}$ for observations $\hat{\alpha}<t^{*}$ and $v_{2}$ for $\hat{\alpha}>t^{*}$. The following proposition analyzes the effects of privacy mechanism on the set $\mathcal{S}$, distinguishing between the direct and the indirect effects of privacy.

This result shows that the set $\mathcal{S}$ undergoes three distinct changes as $\beta$ varies. First, the set $\mathcal{S}^{\prime}$ is scaled by a factor $1-\beta$. Second, its location in the plane shifts due to the vector $\beta\Big{[}t^{*}\alpha^{*}(v_{2}-v_{1}),~{}t^{*}v_{1}+(1-t^{*})\alpha^{*}v_{2}\Big{]}^{\top}$ added to it. These two changes are because the producer observes a completely random market with probability $\beta$ and sets the price based on this random market, resulting in a constant expected utility that is independent of the true market. Lastly, the shape of $\mathcal{S}$ evolves due to the corresponding changes in the shape of $\mathcal{S}^{\prime}$. Notice that the shape of $\mathcal{S}^{\prime}$ is influenced by $t^{*}$, which represents the producer’s threshold for the proportion of high-value customers in order to choose the higher price. In fact, substituting $t^{*}$ in the definition of $\mathcal{S}^{\prime}$ with $\eta$ (the optimal threshold in the non-private case) aligns $\mathcal{S}^{\prime}$ precisely with the set $\mathcal{S}$ in the absence of privacy constraints. This last change can be interpreted as the indirect impact of the privacy mechanism, which is rooted in the producer adjusting its pricing strategy due to the noisy observation.

Also, notice that Proposition 3 suggests that it suffices to focus only on segmentations with two markets $(1-\alpha_{1},\alpha_{1})$ and $(1-\alpha_{2},\alpha_{2})$ with probabilities $\gamma_{1}$ and $\gamma_{2}$, respectively. Moreover, the first segment’s fraction of high values, i.e., $\alpha_{1}$, is less than or equal to $t^{*}$, and the other’s (i.e., $\alpha_{2})$ is greater than or equal to $t^{*}$.

In the appendix, we characterize the set $\mathcal{S}^{\prime}$ and show that it takes the form of a triangle, with its shape changing as $\beta$ varies. That said, we next formally characterize the set $\mathcal{S}$, taking into account all these three factors.

To better understand this characterization, recall that, as we discussed earlier, the effect of the privacy mechanism can be decomposed into two components: a direct one and an indirect one. The direct effect is due to the market being masked with probability $\beta$ and the producer choosing the price based on pure noise observation. This results in a constant term in utilities that is independent of the true market, captured by the term $\beta\bm{c}$ in Equation $\eqref{eqn:ABC}$.

The indirect effect of privacy arises from changes in the producer’s pricing strategy and is represented by the difference between triangle $A’B’C’$ and the non-private case $TQR$ in Figure 1. Specifically, the lines $A’B’$ and $B’C’$ are analogous to the corresponding lines $QT$ and $QR$ in the non-private case, where the first represents the condition that consumer utility is non-negative, and the second shows that the sum of consumer and producer utilities is less than the maximum possible surplus. However, line $A’C’$ is where the indirect effect of privacy is observed. In the non-private case, the line $TR$ is parallel to the x-axis, since the producer utility is lower bounded by the utility obtained from uniform pricing. In the presence of a privacy constraint, this line is no longer parallel to the x-axis. Moreover, this indirect effect of privacy becomes more pronounced when considering $K>2$ values, as this lower boundary of the set $\mathcal{S}$ is no longer a straight line but becomes piece-wise linear.

Here, we turn our focus to the general case with $K>2$ values. As we establish, once we consider the general case, the fundamental difference between our characterization and that of Bergemann et al. [2015] without privacy becomes more apparent. In particular, the set of possible consumer and producer utilities is no longer a triangle and instead is a more nuanced polytope that we will characterize. However, we establish that many of the insights that we derived in the special case of $K=2$ continue to hold in the general setting as well.

We make use of the following notation that enables driving the analogue of Lemma 1 in the general case. For any $i\in[K]$, let $\mathcal{X}_{i}^{\beta}\subseteq\mathcal{X}$ be the set of (observed) markets for which $v_{i}$ is an optimal price, i.e.,

where $\mathcal{U}_{p}(\cdot|\hat{x})$ is defined in (6). Going back to the case $K=2$, $\mathcal{X}_{1}^{\beta}$ and $\mathcal{X}_{2}^{\beta}$ corresponds to $\alpha\in[0,t^{*}]$ and $\alpha\in[t^{*},1]$, respectively. The following result establishes the necessary and sufficient condition for $\mathcal{X}_{k}^{\beta}$ to be non-empty.

Note that $\beta\geq\bar{\beta}_{i}$ implies that price $v_{i}$ is not optimal for any observed market, thereby precluding the producer from choosing $v_{i}$. To better understand this, recall that the expected utility of the producer, given an observed market $\hat{x}$ and upon choosing price $v_{i}$, denoted as $\mathcal{U}_{p}(v_{i}|\hat{x})$, is given by

Essentially, the expected utility of the producer can be viewed as a convex combination of their utility in the fully observed market scenario (analogous to the non-private case) and their utility under complete uncertainty, where they rely on a uniform prior over markets. As $\beta$ increases, indicating a noisier observed market, the weight the producer places on their utility from a uniform prior grows. Consequently, they may opt not to select certain prices that would result in lower utility when the market is drawn from a uniform distribution.

Specifically, for the case when $K=2$, one can verify $\bar{\beta}_{1}=2(1-\eta)$ and $\bar{\beta}_{2}=2\eta$. This is the rationale behind imposing Assumption 2 in the previous section, which guarantees that in the scenario where $K=2$, both prices are viable options. If this were not the case, only one pricing option would remain, causing the set $\mathcal{S}$ to reduce to a single point.

Our next result extends Proposition 3 to this general case.

This result shows that, in the general case, and similar to the case when $K=2$, the set $\mathcal{S}$, which depicts the limits of price discrimination under privacy mechanisms, is influenced by three factors: a constant shift $\beta\bm{c}$, a scaling factor $1-\beta$, and the set $\mathcal{S}^{\prime}$ that determines its shape. Consequently, the insights derived for $K=2$ based on this characterization extend to the general case. In particular, the shift $\beta\bm{c}$ indicates that, in contrast to the non-private case, the consumers’ minimum utility is not zero. Moreover, the scaling factor $1-\beta$ suggests that market segmentation generally becomes less impactful as the privacy factor $\beta$ increases.

Our primary goal now is to specify the set $\mathcal{S}^{\prime}$. As we discussed in the case of $K=2$, the set $\mathcal{S}^{\prime}$ captures the indirect impact of privacy, as it illustrates the effects of the change in the producer’s pricing strategy, given that they know the privacy mechanism is applied. More specifically, $\mathcal{S}^{\prime}$ is the set of potential pairs of utilities for the consumer and producer when the producer accurately perceives the segmented markets (as in the non-private case) but adopts the pricing rule from the private case (associated with sets $\{\mathcal{X}_{k}^{\beta}\}_{k}$) rather than the optimal pricing rule for the non-private scenario. In fact, in the non-private case with $\beta=0$, this set aligns with $\mathcal{S}$.

Proposition 4 also suggests that our analysis can be limited to segmentations where, for any value $v_{k}$, there is at most one segment whose optimal corresponding price is $v_{k}$. This effectively broadens the insights of Proposition 3 from the case of $K=2$ and simplifies the characterization of $\mathcal{S}^{\prime}$. As we stated in the previous section, the set $\mathcal{S}^{\prime}$ is a triangle for $K=2$. In general, we next establish that it is a convex polygon.