“Shopping Surveillance”: A Study of Data Harvesting, Online Behavioral Advertisement (OBA), and Regulatory Responses in the Commodification of Consumer Data

Abstract

You look at a pair of shoes for less than a minute on the website of an online retailer. Immediately afterward, the exact same pair of shoes pops up on your social media feed, with a 15% discount . This seemingly magical convenience is the end product of a pervasive and largely invisible system that now forms the backbone of the digital marketplace. This thesis examines the regulatory architecture governing this system, arguing that existing legal frameworks are structurally inadequate to address the risks associated with algorithmic profiling and its dominant application: online behavioural advertising. Grounded in the theoretical frameworks of behavioural economics and surveillance capitalism, this thesis analyzes how digital platforms exploit cognitive biases and informational asymmetries to manufacture user consent. Through a comparative analysis of three leading privacy regimes: the European Union’s General Data Protection Regulation (GDPR), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), and California’s Consumer Privacy Act (CCPA/CPRA), this research reveals structural limitations in the regulation of algorithmic profiling, transborder data flows, and automated decision-making. The findings demonstrate that the inadequacy of existing regulatory frameworks derives largely from a fundamental mismatch between the territorial logic of national regulation and the deterritorialized nature of the global digital market, which is engineered for jurisdictional arbitrage and regulatory evasion. In response, the thesis calls for a harmonized international framework, either in the form of a Global Data Protection Accord or a Model Law.