The Overton Window. How Surveillance Became the Norm

Six steps no one noticed. Because they were not meant to be noticed. There is a thought experiment. Imagine it is 1993. There is almost no internet in homes. Mobile phones — with a handful of people. And onto television comes a serious man in a suit and says the following into the camera. «In the future every inhabitant of the planet will carry in their pocket a device that records their location every second. Records all their conversations — not the content, but the metadata. Knows whom they call, for how long, when and from where. Records what they read. What they buy. Who they communicate with. What photographs they look at. How much time they spend on each page. And all of this — voluntarily. With their own money. People will buy these devices themselves, pay for access to the services themselves, and press the ‘Accept’ button themselves to permit all of this.» The audience’s reaction in 1993 would have been unambiguous. The man would have been taken off the air. He would have been compared to a paranoiac or a provocateur. The editor would have apologised to the viewers. Because what he describes — is a totalitarian dystopia. It is Orwell. It is Big Brother. It is unthinkable in a free society. Thirty years passed. Everything he described — happened. Exactly. Literally. Down to the details. And no one took to the streets. No one declared it totalitarianism. No one refused to buy the device. On the contrary — queues at Apple stores on the day a new model comes out. Billions of downloaded apps. Trillions of pressed «Accept» buttons. How did this happen? Not by force. Not by coercion. Not by deception in the crude sense of the word. By means of a mechanism the American sociologist Joseph Overton described back in the nineties. A mechanism thanks to which any idea — even the most unthinkable — can become a political norm. If you move correctly. Consistently. Patiently. Imperceptibly. Six steps. Thirty years. And now you hold in your hands a device that knows more about you than your closest friend — and you consider this perfectly normal. Let us examine how this happened. Step by step.

What the Overton Window is. Briefly

The essence is simple. At every moment in time there exists a «window» — a range of ideas that society considers acceptable to discuss and implement. Ideas outside the window — unthinkable or unacceptable. Ideas inside the window — discussable, sensible, standard. The window can be moved. Gradually. Through consecutive steps. An idea that today is outside the window — after a few steps ends up in its centre. Not because the idea itself changed, but because the position of the window changed. Six positions in this movement: — unthinkable — radical — acceptable — sensible — standard — political norm. Each step — is not a revolution. A small shift that is not noticed as a shift. And it is precisely in this imperceptibility — that the whole power of the mechanism lies. Let us apply it to the history of digital surveillance. To how the collection of personal data passed through all six steps — and became a norm that most people not only accept, but defend.

Step one. Unthinkable

In the seventies of the last century in the US several events took place that shaped society’s attitude to surveillance for decades ahead. Watergate. President Nixon organised surveillance of political opponents. Wiretapping. Dossiers. Unlawful collection of information. When this came to light — the president was forced to resign. Society was furious. Surveillance of citizens — is a crime. It is an abuse of power. It is the end of a political career. At the same time — the hearings of the Church Committee in Congress. It emerged that the CIA and the FBI had for years conducted unlawful surveillance of citizens. Of activists. Of journalists. Of politicians. Society’s reaction — shock and a demand for laws that would forbid this. In 1974 the Privacy Act was passed. In 1978 — the Foreign Intelligence Surveillance Act. Laws directly aimed at limiting state surveillance of citizens. The idea «companies should collect data on all citizens and sell it» in this context — is unthinkable. Outside any possible discussion. It is not merely unlawful — it is morally monstrous. It is what society had just risen up against. The window is in the position: surveillance is a crime. Full stop. But the window begins to move. The first shift — quiet and technical. In the late eighties companies begin to collect data about purchases through loyalty programmes. Frequent-shopper cards. A discount coupon in exchange for a name and address. This is not called surveillance. It is called marketing. It is convenient. It is mutually beneficial. No one notices that the window has shifted.

Step two. Radical

The internet comes into homes. Slow. Expensive. Delightful. And with it — the first disputes about data. 1994. The Netscape engineer Lou Montulli invents cookies. Small files that a site saves in the user’s browser to remember them. So as not to enter a login every time. So the shopping cart is not cleared. It is convenient. It is practical. But very quickly it becomes clear that cookies can be used not only for convenience. They can be used for tracking. Advertising networks begin to set «third-party cookies» — files that track the user not on one site but on all the sites that are part of the advertising network. The first reaction — a scandal. 1996. The American Federal Trade Commission holds hearings on privacy on the internet. Civil organisations demand a ban on tracking without consent. Journalists write about the threat of a «digital dossier» on every citizen. This sounds radical. Almost paranoid. «Companies are watching you on the internet» — most users perceive this as an exaggeration. The internet is freedom. Information. Opportunities. The industry reacts skilfully. Instead of defending surveillance — it proposes self-regulation. Advertising associations create voluntary codes of conduct. They promise «not to collect sensitive data». They promise «to provide the possibility to opt out». This calms the regulators. Not for long. In parallel — another shift. Amazon launches in 1994. eBay — in 1995. Google — in 1998. Each of these services collects data about users. But presents it as convenience. Amazon remembers what you bought and recommends similar things. Google remembers what you searched for and makes search more precise. This is not surveillance. It is personalisation. It is a service that becomes better the more you use it. The window has shifted: surveillance as surveillance — is radical and unacceptable. But «personalisation based on data» — is already something else. It is convenience. The difference between the first and the second — is only in the name. But the name changes everything.

Step three. Acceptable

The dot-com crash of 2000–2001 kills thousands of internet companies. Those with a working business model survive. And gradually it becomes clear that there is only one working business model on the internet. Advertising. Google in 2000 launches AdWords. Contextual advertising. You search «buy a fridge» — you see advertising for fridges. You search «flu symptoms» — you see advertising for medicine. The advertising is precise because it knows what you are searching for. This is a revolution in advertising. And it is — the normalisation of surveillance through economic logic. Here is the narrative that begins to sound ever louder. «The internet is free. A free service has to earn on something. Advertising is an honest exchange. You get free search, free mail, free news — in return you see advertising. This is fair.» The logic works. Most people accept it. Advertising is acceptable. Personalised advertising — even more acceptable, because it is relevant. No one wants to see advertising for nappies if they have no children. 2004. Facebook. 2005. YouTube. 2006. Twitter. Social networks burst into life and change everything. People voluntarily publish information about themselves. Photographs. Thoughts. Location. Relationships. Political views. Religion. Interests. No one forces them. This is a social need — to be visible, to be part of a community, to share one’s life. But this information is collected. Stored. Analysed. And used for advertising. At this step an important psychological shift happens. People begin to perceive data about themselves as «payment for a service». Not as a violation of privacy. As a fair exchange. «If the product is free — you are the product.» This phrase sounds in this period. But it sounds like a clever joke. Not like a warning. The window has shifted once more: the collection of data in exchange for a free service — is acceptable. It is the market. It is a choice.

Step four. Sensible

2007. Steve Jobs comes onto the stage and shows the iPhone. «Today Apple reinvents the phone.» He does not say: «Today Apple creates a device that will know your location every second, record all your communications, log your purchases, track your health, and transmit all of this to the clouds of American corporations.» But this is exactly what will happen. And the queue at the Apple store on the sales day will stand for several days. The smartphone changes everything. Because it is always with you. A laptop — you open it and close it. A smartphone — always in your pocket. Always on. Always connected. Always collecting data. Geolocation. An app asks permission to access location. «To show nearby restaurants» — sensible. «For navigation to work» — sensible. «So the weather app knows where you are» — sensible. Each of these permissions — is sensible individually. But together they create a map of every step you take. Every day. For years. At the same time — the App Store and Google Play. Millions of apps. Each asks for permissions. Access to contacts — «to find friends». Access to photos — «to share». Access to the microphone — «for voice search». Access to the camera — understandable. Access to health — «for fitness». Access to finances — «for convenience». Each permission — is sensible. Each — it is clear why. But their totality creates something that in 1993 would have been called totalitarian surveillance. And it is precisely at this step that a key rhetorical shift happens. Those who speak of privacy risks begin to look… strange. A little paranoid. A little behind the times. «If you have nothing to hide — you have nothing to fear.» This phrase becomes the main argument. And it works — because most people genuinely do not feel that they «have something to hide». They are not criminals. They are not terrorists. Why worry? The logical flaw of this argument is enormous. Privacy is not about what to hide. It is about who has the right to know. A doctor knows about your health — because you trust them and it is necessary for treatment. This does not mean your employer should know the same. Or an insurance company. Or a data broker you never met. But this argument, at the moment of the fourth step, sounds like tediousness. Like a conspiracy theory. Like an inability to accept modernity. The window has shifted: the collection of data through a smartphone — is sensible. It is convenience. It is progress. People who are against it — are backward.

Step five. Standard

2013. Edward Snowden. A former NSA employee hands journalists thousands of secret documents. The world learns that American intelligence collects data about the communications of hundreds of millions of people around the world. PRISM — a programme of access to the data of the largest technology companies. Metadata — a full picture of who called whom, when and for how long, across the whole country. This is the scandal of the century. The front pages of all the world’s newspapers. Hearings in Congress. An international diplomatic crisis — it emerged that the NSA had wiretapped, among others, the leaders of allied states, including the personal phone of German Chancellor Merkel. It would seem — this is a turning point. Society learned the truth. Now — reaction, laws, restrictions, the end of surveillance. This did not happen. Something else happened. After the initial shock — normalisation. Yes, the government collects data. But — for security. To combat terrorism. After 9/11 — who is ready to argue with security? A powerful narrative appears: surveillance is necessary. Inconvenient. But necessary. Technology companies publicly express indignation that their data was used without their knowledge. Apple, Google, Facebook, Microsoft sign an open letter demanding reforms. This looks like protecting users. But the internal business model does not change. The companies continue to collect the same data. To sell access to it to advertisers. To build the same psychographic profiles. The only difference is who has access — the government or the corporations. The very fact of collecting data ceases to be a question. In parallel — another process. «Smart» devices enter homes. Amazon Echo. Google Home. «Smart» TVs. Voice assistants. Thermostats connected to the internet. Fridges that know what is inside. Each device collects data. And each is sold as convenience. «Alexa, play music.» «Okay Google, what’s the weather tomorrow.» «Siri, call Mum.» A microphone in your home. Constantly on. Constantly listening — at least for the activation word. This is the norm. This is convenience.
2014. Cambridge Analytica. The data of 87 million Facebook users used for psychographic targeting in a presidential campaign. Again a scandal. Again hearings. Zuckerberg in the Senate. And again — normalisation. Not a ban. Regulation. The word «data regulation» appears. This is an important shift in language. Not «a ban on surveillance». «Regulation of data collection». The very fact of collection — is no longer in question. Only the rules are in question.
2015. GDPR takes effect. The European data-protection law — the strictest in the world at that time. Consent to data collection. The right to erasure. The right of access to your data. The obligation of companies to disclose what they collect. This is a good law. But look at what it in fact acknowledges: data is collected. This is a given. The law does not say «do not collect». It says «collect correctly». With consent. With transparency. The window has shifted: the collection of personal data — is the standard. A global norm. The foundation of the digital economy. The question is not whether to collect or not. The question is how to regulate.

Step six. Political norm

We live in the sixth step. Data is the oil of the 21st century. This phrase is said at economic forums. In government reports. In business schools. It asserts: data is a resource. A strategic resource. Like oil for the 20th century. No one asks: but should data about citizens be a «resource» that is extracted and sold at all? This is already outside discussion. This is — a given. The advertising market based on data — is an industry worth more than 600 billion dollars a year. It creates jobs. It funds the free services that billions use. It is — part of the global economy. A person who says «maybe it’s not worth selling citizens’ data» — looks the same as a person who in the 1970s said «maybe oil dependence is a bad thing». Correct. But impractical. But the system is already built. States enter the race for data. China builds a social-credit system — openly, without apologies. The US collects data through the NSA and through technology companies. Europe tries to regulate — but to regulate, not to forbid. Citizens’ data is a political resource. An economic resource. An instrument of influence. A subject of international negotiations. An object of sanctions and trade wars. Schrems II — the EU Court ruling that forbade the transfer of European citizens’ data to the US on the old grounds. The reason — American intelligence services have access to the data of American companies. This violates the rights of European citizens. The answer? Negotiations. A new agreement — the EU-US Data Privacy Framework. A compromise. The data continues to be transferred. Just with new guarantees. Which critics consider insufficient. A person who says «actually it’s strange that corporations can sell data about all the citizens of the planet» — looks naive. An idealist. Not understanding the real world. The window has completed its movement: the mass collection of personal data — is a political norm. An economic reality. Part of the infrastructure of modern civilisation. Thirty years. Six steps.

How the window moved. The technology of the shift

Now — the most important thing. Not what happened. How exactly the window was moved. Because it did not move by itself. It was moved. Methodically. Professionally. With enormous resources. Instrument one — renaming. At each step — surveillance received a new name. «Data-based marketing». «Personalisation». «Smart technology». «Relevant advertising». «Improving the user experience». The word «surveillance» was never used. Because surveillance is bad. It is unlawful. It is what society rose up against in Watergate. «Personalisation» — is good. It is care. It is a service. The content is the same. The word is different. The word changes perception. Instrument two — convenience as a Trojan horse. Every step of surveillance was packaged in convenience. Cookies — so as not to enter a password every time. Geolocation — for navigation to work. The microphone — for voice search to work. Analysis of purchases — for recommendations to be precise. The convenience is real. Genuine. People really do save time. Really do get a better service. But behind every convenience — the collection of data. And convenience made the price imperceptible. Instrument three — economic logic. «A free service has to earn on something.» This logic works because it is true. Gmail is free. Facebook is free. Google Search is free. YouTube is free. But «free» does not mean «without a price». The price — is data. And this price is hidden in the user agreement that no one reads because it is written over thirty pages in legal language deliberately. Economic logic normalised the exchange: data in exchange for a service. Fair? At first glance — yes. But people do not know exactly what they are giving away and how much it costs. This is not a free market. It is a market with a radical asymmetry of information. Instrument four — gradualness. The most important thing. Not one step was a revolution. Cookies in 1994 — a small technical detail. Third-party cookies — a little more. Geolocation — for convenience. Analysis of behaviour — for improvement. A psychographic profile — for personalisation. Each step is small. The difference between step four and step five — is imperceptible in the moment. Visible only if you look at the whole distance. This is the mechanism of the Overton Window. Not one big leap that everyone notices and rises up against. Many small steps each of which individually seems sensible. Instrument five — discrediting the opponents. At each step those who spoke of the risks — looked worse than their opponents. In the nineties — paranoiacs and Luddites who do not accept progress. In the 2000s — those who do not understand simple things: a free service has to earn on something. After Snowden — idealists who do not understand the realities of security. Today — extremists and conspiracy theorists if you say that systemic data collection is problematic. Each generation of surveillance opponents was discredited through a label of inadequacy. Not through a refutation of the arguments. Through the marginalisation of those who carry the arguments. Instrument six — creating dependence before the laws. This is the subtlest instrument. By the time legislators began seriously to discuss regulation — the system was already built. Google — the largest advertising platform. Facebook — the infrastructure of the social connections of two billion people. Amazon — logistics and commerce. Apple — an ecosystem of devices. To regulate a system on which the whole economy hinges — is politically almost impossible. Because it would affect everyone. Because the work of millions of people depends on this system. Because government services moved to these platforms. The dependence was created before regulation began. And this dependence limits what regulation is possible. GDPR — is a serious law. But it does not forbid the collection of data. It requires consent, transparency, storage rules. The system continues to work. Just with a larger number of cookie banners.

Where we are now. The sixth step from the inside

But this is not the nature of things. It is the result of a thirty-year movement of the window. Here are several signs of the sixth step that are visible if you look from the right angle. Sign one — defenders of the system among ordinary people. When an ordinary user says «if you have nothing to hide — you have nothing to fear» or «so what if they collect data, I don’t care» — they defend the interests of the corporations that use them as a resource. This is a classic sign of the sixth step. The idea is not merely accepted — it is defended by those at whose expense it is implemented. This is the highest point of normalisation. Sign two — GDPR as a symbol of victory. GDPR is perceived by many as an achievement. A law that protects. And it really does protect — better than nothing. But from the standpoint of the Overton Window — GDPR is the legislative consolidation of the sixth step. It does not say «surveillance is unlawful». It says «surveillance must be carried out by the rules». The very fact of surveillance — is accepted as a given at the legislative level. Sign three — new technologies are already beyond the next window. While we sort out cookies and targeting — the movement goes further. Face recognition in public space. Neurointerfaces that read brain activity. Voice analysis to determine emotional state. Predictive analytics that determines the probability of illness, crime, leaving a job — before it has happened. All of this is now at the first or second step for most people. Unthinkable or radical. But the window moves. It is already moving. And in ten to twenty years someone will write the same kind of text. About how neurointerfaces travelled the path from unthinkable to political norm.

Can the window be stopped

The question that arises inevitably. It can. But it is difficult. And you need to understand exactly how. The window cannot be stopped by coercion. A ban that is not accepted by society — is circumvented technologically or rolled back legislatively. History shows this many times over. The window can be stopped only through a change of perception. Through a return to the first step — but with an evidence base. Through a demonstration that what seems a norm — is a violation, which has concrete consequences for concrete people. This is precisely why public audits of sites with HAR files — are not merely technical documents. They are an instrument for moving the window backwards. Each audit shows: here is a concrete fact. Here is a concrete violation. Here is concrete data that went out without your consent. This is not abstract surveillance. It is a real transfer of your data to a real company at a real moment in time. Every complaint to a regulator — is a legal consolidation of the fact that a norm has been violated. The regulator issues an order — and this sets a precedent. A precedent — is what a new movement of the window begins with. Cambridge Analytica — was the moment when for part of society the window shifted backwards. From «sensible» to «radical». People saw what psychographic targeting means in practice. That their emotional profiles are used for political manipulation. This did not stop the system, but it changed the perception of part of the people. It is precisely part of the people — that is the driving force. The window is not moved by the majority. It moves through the consecutive actions of a minority that understands the mechanism.

What knowledge of the mechanism does

You have read this text. Now you know the mechanism. This does not mean you have left the system. You are in it. Your data is collected. Your pauses are recorded. Your emotional map is built. But knowledge of the mechanism changes your position within it. You see that «this is normal» — is not an argument. «Normal» — is simply the current position of the window. Which shifted over thirty years. And can shift back. You see that «convenience» — is packaging. Inside — a price that was not shown to you at the moment when you pressed «accept». You see that a cookie banner with a small grey «reject» button — is not an accident of design. It is step four of the Overton Window in action. Data collection is sensible — so «accept» is green and big. Refusal — is an extreme position that has to be searched for. And you see that one person with an evidence base and the right tools — can influence the position of the window. Not shift it alone, but create pressure that makes the next shift possible. Gonzalo Fuentes did not shift the window alone. But his complaint became a precedent. The precedent became part of the narrative. The narrative changed perception. Perception created pressure on legislators. Legislators consolidated the right to be forgotten. This is how the movement of the window in the reverse direction works. Slowly. Through concrete actions. Without revolutions. Sun Tzu wrote: the wise win without entering into military action. The Overton Window was moved for thirty years by small steps. Imperceptibly. Without declaring war. To move it back — by the same method. By small steps. By concrete actions. By documented facts. One site audit at a time. One complaint to a regulator at a time. One publication that will be read and understood — at a time. The window moves in both directions.