“low-cost products can be subsidized by privacy-respecting advertising — but privacy-respecting advertising is not as profitable as privacy-invasive advertising”