Selling off User Privacy at Auction