Surveillance Capitalism Inside the SaaS Stack

May 9, 2026 | Surveillance

In this article:

Surveillance capitalism, as Shoshana Zuboff defines it, is the economic logic of converting human behavioral data into predictions that are sold to advertisers and other third parties. The consumer internet runs almost entirely on this model. The B2B SaaS stack that agencies and businesses use runs a variant of it that is less visible but structurally similar.

How Does Shoshana Zuboff's Surveillance Capitalism Apply to SaaS

Zuboff identifies the core move of surveillance capitalism as the appropriation of behavioral surplus: the data generated as a byproduct of using a product, which is then processed and sold without the user's meaningful awareness or consent. The product is the mechanism for data collection. The data is the product sold to the actual customer.

In consumer applications, the user is the data subject and the advertiser is the customer. In B2B SaaS, the business is the data subject and the customers of that data include the platform's market intelligence team, its product team, and in many cases third parties who purchase aggregated market data.

What Behavioral Data Does a SaaS Subscription Actually Collect

A business using a SaaS platform hands over its operational patterns in the form of workflow data. It hands over its competitive intelligence in the form of the integrations it runs and the comparisons it makes. It hands over its market knowledge in the form of the customers it manages and the industries it serves.

It also hands over its behavioral data: which features it uses, how frequently, at what scale, in which sequences. That behavioral data is predictive. It tells the platform what businesses value, what they will pay for, and when they are likely to churn. The platform uses that prediction to optimize extraction, not to optimize product quality.

How Does the Monthly Subscription Mask the Surveillance Model

The monthly subscription gives the business the experience of being a customer who pays for a service. Zuboff's framework clarifies what is actually happening: the business is both a customer paying for access and a data subject whose behavioral surplus is being extracted and used for the platform's benefit.

The product works because businesses use it. Businesses use it because it solves real problems. The data generated by solving those problems is the valuable asset. The subscription fee is a rounding error compared to the compounding value of a behavioral dataset covering thousands of businesses and millions of operational records.

Frequently Asked Questions

What is behavioral surplus and how does SaaS collect it?

Behavioral surplus is Zuboff's term for the data generated as a byproduct of using a product: which features you use, when, in what sequence, at what scale. This data exceeds what the platform needs to deliver its service. The excess is processed into predictive models used to optimize pricing, retention, and extraction.

Is B2B SaaS a form of surveillance capitalism?

Yes, structurally. Consumer internet surveillance capitalism sells behavioral predictions to advertisers. B2B SaaS sells similar predictions internally: churn probability, willingness to pay, feature valuation. The extraction mechanism is the same. what the terms of service you signed actually authorized the platform to collect.

What data does a SaaS platform collect that goes beyond its stated purpose?

Beyond the operational data the platform needs to deliver its service, most SaaS platforms collect: usage patterns across all users to benchmark behavior, feature interaction sequences to identify what users value most, churn signals to predict when retention actions are needed, and integration data that reveals the broader tool stack you operate.

References

Zuboff, Shoshana. The Age of Surveillance Capitalism. PublicAffairs, 2019.

Electronic Frontier Foundation. eff.org.

Surveillance by Terms of Service: What You Agreed To

May 4, 2026 | Surveillance

In this article:

Surveillance by terms of service is the mechanism by which platforms obtain legal authorization for data practices that users would not consent to if those practices were described plainly. The terms of service are the legal architecture of surveillance capitalism. They are designed to be accepted without being read.

What Do SaaS Data Clauses Actually Authorize in Plain Language

The data processing clauses in standard SaaS terms of service typically include provisions that authorize the platform to collect usage data, to use aggregated and anonymized data for product development and market analysis, and to share data with third parties under defined conditions. The provisions are accurate. They describe what the platform actually does. They are written in legal language that obscures the operational meaning of what is being authorized.

Collected usage data means behavioral surveillance: which features you use, when, how often, and in what sequences. Used for market analysis means your operational intelligence contributes to the platform's competitive intelligence products. Shared with third parties means the conditions under which your data leaves the platform are defined by the platform, not by you.

Why Does Clicking Agree Not Constitute Informed Consent

Zuboff's analysis of surveillance capitalism identifies the consent problem as structural, not incidental. Terms of service are not designed to produce informed consent. They are designed to produce legal authorization for practices that informed consent would refuse. The length, the legal language, and the click-to-agree mechanism are features of a system optimized for authorization, not understanding.

A business that clicked through a SaaS terms of service agreement without reading it did not consent to surveillance in any meaningful sense. It provided the legal authorization the platform needed to conduct surveillance. Those are different things.

What Would You Decide Differently If You Read the Terms First

Reading the actual terms of major SaaS platforms reveals a consistent pattern: broad data collection authorization, aggregated data use provisions that cover competitive intelligence, and third-party data sharing conditions defined unilaterally by the platform. The surveillance architecture is described in plain text. The description is just buried in language optimized for acceptance rather than comprehension.

The business that reads its SaaS terms of service and understands what it has authorized is in a position to make a different decision. Most have not read them. The platforms are aware of this.

Frequently Asked Questions

What do SaaS terms of service actually say about your data?

Standard SaaS terms authorize: collection of all usage data generated while using the platform, use of aggregated and anonymized data for product development and market analysis, and sharing of data with third parties under conditions the platform defines unilaterally. These are standard clauses in most major SaaS agreements, not edge cases.

Is clicking agree on a SaaS terms of service legally meaningful consent?

Legally, yes. Courts have generally upheld clickwrap agreements. Meaningfully, no. Zuboff's analysis identifies the consent problem as structural: terms of service are designed to produce legal authorization for practices that informed consent would refuse, not to produce informed consent.

What should you look for in SaaS terms of service before signing up?

Look specifically for these four clauses:

  • The data use clause: defines how your operational data can be used beyond service delivery, including whether it feeds into market intelligence or AI training
  • The aggregation clause: authorizes using your data in aggregate with other customers' data, effectively making your usage patterns part of the platform's competitive intelligence
  • The third-party sharing clause: defines who else receives your data and under what conditions
  • The data retention clause: defines what happens to your data after you cancel and how long you have to retrieve it

References

Zuboff, Shoshana. The Age of Surveillance Capitalism. PublicAffairs, 2019.

Electronic Frontier Foundation. eff.org.

Zuboff, Shoshana. "You Are Now Remotely Controlled." The New York Times. January 2020.

Surveillance Capitalism and the Censorship of Palestinian Voices

Apr 30, 2026 | Surveillance

In this article:

Surveillance capitalism is not politically neutral. The same platform architecture that collects behavioral data from businesses to optimize advertising revenue is the architecture that decides which political speech is visible and which is suppressed. These are not separate systems. They are the same system serving different functions for the same owners.

What Has 7amleh Documented About Platform Suppression of Palestinian Content?

7amleh, the Arab Center for the Advancement of Social Media, has systematically documented the suppression of Palestinian voices across major platforms. Meta, Google, TikTok, and Twitter have each been shown to apply content moderation policies in ways that disproportionately restrict Palestinian content, Arabic-language speech, and coverage of events in occupied territories.

The documentation is not anecdotal. 7amleh's research covers systematic patterns of account suspension, content removal, hashtag restriction, and reduced algorithmic distribution that affect Palestinian users, journalists, and human rights organizations at rates that do not apply to comparable content from other political contexts.

How Is the Surveillance Architecture and the Censorship Architecture the Same System?

The behavioral surveillance architecture that tracks which features businesses use, which integrations they run, and when they are likely to churn is built on the same infrastructure that decides which political content gets distributed and which gets suppressed. The algorithm that optimizes advertising revenue is the algorithm that controls political visibility.

This is not a coincidence of technical architecture. It is the logical consequence of building public communication infrastructure as a private surveillance capitalist enterprise. The platform that owns the infrastructure makes the decisions about whose speech amplifies and whose diminishes.

What Does Platform Suppression Mean for Business Infrastructure Decisions?

A business owner who objects to the suppression of Palestinian voices and continues to build their operational stack on Meta, Google, and TikTok infrastructure is participating in the system they object to. This is not an argument for individual purity. It is an observation about what the infrastructure relationship means.

The surveillance capitalism architecture that extracts value from business workflows is the same architecture that makes political censorship at scale possible and profitable. Recognizing the connection between those two things is the first step toward making different infrastructure decisions for different reasons.

Frequently Asked Questions

What is 7amleh and what has it documented about platform censorship?

7amleh is the Arab Center for the Advancement of Social Media. It has documented systematic suppression of Palestinian content across Meta, Google, TikTok, and Twitter: account suspensions, content removal, hashtag restriction, and reduced algorithmic distribution affecting Palestinian users and human rights organizations at rates that do not apply to comparable content in other political contexts.

How does Meta's advertising surveillance connect to its suppression of Palestinian content?

Both functions run on the same infrastructure. The algorithm that optimizes advertising revenue by tracking behavioral data is the algorithm that controls content distribution. These are not separate systems. how Tech for Palestine is building the infrastructure alternative.

Should agencies stop using Meta and Google tools because of Palestinian content suppression?

That is a decision each practitioner makes based on their own values and context. What is worth naming clearly is that the surveillance capitalism architecture that extracts value from business workflows and the architecture that suppresses Palestinian voices are the same infrastructure governed by the same incentive structures.

References

7amleh. 7amleh.org.

Zuboff, Shoshana. The Age of Surveillance Capitalism. PublicAffairs, 2019.

Electronic Frontier Foundation. eff.org.

AI SaaS Is Enshittification With a Better Pitch Deck

Mar 5, 2026 | Surveillance

In this article:

AI SaaS tools occupy a specific position in the enshittification cycle: they arrive in phase one with an unusually compelling value proposition, they build lock-in faster than any previous category of SaaS, and the behavioral surplus they extract is more valuable than anything the previous generation of SaaS platforms collected. The pitch deck is better. The extraction model is worse. Both of these things are true simultaneously.

The genuinely useful parts of AI SaaS tools should be named rather than dismissed. An AI writing assistant that helps a small team produce more content with fewer resources is delivering real value (like this blog that you're reading, where I gathered the topics I wanted to talk about but also cited the resources I'm backing my arguments with).

An AI analysis tool that identifies patterns in operational data faster than manual review is solving a real problem. An AI customer service layer that handles routine inquiries without human time is reducing a genuine operational cost. The tools work. The extraction model attached to the tools is the problem, not the tools themselves.

What Makes AI SaaS Extraction Different From Conventional SaaS Surveillance

Shoshana Zuboff's surveillance capitalism framework identifies behavioral surplus as the core extraction mechanism: the data generated as a byproduct of using a product, appropriated by the platform and converted into predictions sold to third parties. AI SaaS extracts behavioral surplus more aggressively than conventional SaaS because the product is the model, and the model improves when it trains on your data.

When you use a ChatGPT Enterprise or similar AI assistant inside your business, you are generating training data. The prompts you write, the outputs you accept or reject, the corrections you make, the use patterns you establish: these are behavioral surplus in Zuboff's sense, and they are additionally training data that improves the model's performance for the platform's other users. You are paying a subscription fee for a product that simultaneously trains on your proprietary operational intelligence to become better for your competitors.

The terms of service vary by platform and have evolved in response to user and regulatory pressure. OpenAI's enterprise terms offer opt-out provisions for training data use. Google's Gemini for Workspace has similar provisions. The existence of opt-out provisions is not the same as the absence of extraction: default settings, the friction of the opt-out process, and the complexity of what is and is not covered by the opt-out all affect whether the opt-out produces meaningful data sovereignty. And this is where it's already smelling like caca.

How Does Fine-Tuning Create a New Lock-In Architecture

Conventional SaaS lock-in accumulates through operational data: the workflow history, the audit trails, the baseline comparisons that make leaving expensive because you lose what you built. AI SaaS adds a second lock-in mechanism: model fine-tuning. An AI tool that has been trained on your specific operational language, your client communication patterns, your industry terminology, and your content style produces outputs that are calibrated to your context. A generic AI tool does not. The longer you use a fine-tuned AI tool, the larger the gap between its outputs and what you would get from a generic alternative, and the higher the switching cost becomes.

This fine-tuning lock-in is more durable than operational data lock-in because it is less visible and harder to export. You can export your operational data in CSV format even if the export is incomplete. You cannot export the fine-tuning that has been applied to a proprietary model. The intelligence that the platform has developed about how to serve your specific context is proprietary to the platform. When you cancel, you lose not just your data but the model calibration that made the tool specifically useful to you.

How Do Salesforce Einstein and Google Gemini Extract From Existing SaaS Lock-In

Proprietary AI SaaS vs. self-hosted open source AI: what you trade for the capability
AttributeProprietary AI SaaS (OpenAI, Gemini, Salesforce Einstein)Self-Hosted Open Source (Ollama + Open WebUI)
Training data opt-outOptional; depends on tier, settings, and what counts as training data under their definitionsNot applicable: model runs entirely on your infrastructure; nothing leaves
Fine-tuning lock-inYes: model calibration to your context is proprietary to the platform and cannot be exportedNo: model weights are open; calibration stays on your infrastructure
Data leaves your infraYes: prompts and outputs processed on vendor serversNo: all inference runs locally or on your VPS
Capability ceilingFrontier models: highest available capabilityLower than frontier; gap is closing rapidly with Llama, Mistral, Gemma
Monthly cost$20–$60+ per user depending on tier and usageHosting cost only: ~$20–$40/month for a VPS with GPU access
Behavioral extractionUsage patterns, prompt structures, feature interactions all collectedNone: no vendor has access to your inference activity

Salesforce Einstein and Google Gemini for Workspace represent the most visible integration of AI capability into existing SaaS lock-in architectures. Both are offered as additions to existing platform subscriptions, at additional cost, and both are designed to deepen the data integration between the AI layer and the underlying platform data.

Salesforce Einstein processes your CRM data to generate predictions about customer behavior, sales outcomes, and service issues. The value proposition is genuine: predictive analytics built on your operational history is useful. The extraction consequence is that your CRM data, which already lives inside Salesforce's infrastructure, is now also training an AI system that Salesforce sells to its entire customer base. The competitive intelligence embedded in your sales data is contributing to a model that your competitors, if they are also Salesforce customers, benefit from.

Google Gemini for Workspace processes your email, documents, calendar, and communication data to generate summaries, drafts, and recommendations. The integration is deep by design: the AI layer is useful precisely because it has access to your complete operational context inside Google's infrastructure. That depth of access is also the depth of the extraction. Every business document you generate, every email thread you manage, every calendar pattern you establish is now accessible to an AI system that Google operates across all of its enterprise customers.

What Open Source AI Alternatives Run on Infrastructure You Control

The alternative to AI SaaS extraction is not the absence of AI tools. It is AI tools that run on infrastructure you control, trained on data that stays in your possession, producing outputs that do not contribute to a proprietary model owned by a platform with its own interests.

Ollama is an open source tool for running large language models locally on your own hardware. It supports a growing library of open source models including Llama, Mistral, and Gemma. Running a model locally means that the prompts you submit and the outputs you receive stay on your machine. Nothing leaves your infrastructure. The model does not train on your data. The extraction model is absent because the infrastructure relationship is absent.

Open WebUI provides a browser-based interface for locally-run models that approximates the user experience of ChatGPT without the extraction architecture. Combined with Ollama, it provides a self-hosted AI assistant that runs on a reasonably modern laptop or on a VPS with GPU access. The capability is narrower than the frontier models available through SaaS platforms. The data sovereignty is complete.

For businesses that need more capability than a locally-run open source model provides, running AI inference on infrastructure you control through providers like Hetzner or Vultr with GPU instances is more expensive than a SaaS subscription but maintains the data sovereignty that SaaS AI tools do not. The cost premium is real. The extraction cost of the SaaS alternative is also real, and it is not on the invoice.

What Does the EU AI Act Require From AI SaaS Platforms

The European Union's AI Act, which entered into force in 2024, imposes transparency and data governance requirements on AI systems that process personal data. The act's requirements include disclosure of training data sources, limitations on the use of personal data for AI training without explicit consent, and rights for individuals to contest AI-generated decisions that affect them. These requirements apply to AI SaaS platforms operating in the EU, which includes most of the major platforms through their European operations.

The regulatory pressure is moving in the direction of data sovereignty, but regulatory compliance is not the same as data sovereignty in practice. A platform that complies with the EU AI Act's disclosure requirements is telling you what it extracts. It is not stopping the extraction. The opt-out provisions that regulatory pressure has produced at OpenAI and Google reduce but do not eliminate the behavioral surplus extraction model. The only complete solution is the same solution that applies to conventional SaaS: infrastructure you control, with data that does not leave it.

Frequently Asked Questions

Does using ChatGPT or Claude for business mean my data is being used to train AI models?

It depends on the product and your settings. OpenAI's enterprise tier and API usage are opted out of training by default. The consumer ChatGPT product historically trained on conversations unless opted out. The relevant question is whether your specific tier and settings exclude your operational data from training.

What is the open source alternative to AI SaaS tools?

Ollama allows running open source language models locally on your own hardware or VPS. Open WebUI provides a browser interface approximating ChatGPT. Models including Llama, Mistral, and Gemma run locally with no data leaving your infrastructure. The data sovereignty is complete. the full self-hosted stack that local AI infrastructure fits inside.

How does AI fine-tuning create stronger lock-in than conventional SaaS?

Conventional SaaS lock-in accumulates through operational data. AI fine-tuning adds a second lock-in layer: the model's calibration to your specific language, context, and content style. That calibration is proprietary to the platform. You cannot export the fine-tuning. When you cancel, you lose not just your data but the model intelligence built from it.

References

Zuboff, Shoshana. The Age of Surveillance Capitalism. PublicAffairs, 2019.

Zuboff, Shoshana. "You Are Now Remotely Controlled." The New York Times. January 2020.

Varoufakis, Yanis. Technofeudalism: What Killed Capitalism. Bodley Head, 2023.

Doctorow, Cory. Pluralistic. pluralistic.net.

OpenAI. "ChatGPT Enterprise." openai.com/enterprise.

Google. "Gemini for Workspace." workspace.google.com.

Salesforce. "Einstein AI." salesforce.com.

European Union. "EU Artificial Intelligence Act." Official Journal of the European Union. 2024.

Ollama. ollama.com.