Who is buying your personal information? The answer might surprise you — and it likely includes companies you already do business with, from your insurance provider to your favorite airline.
A new investigation into Acxiom, one of the nation’s largest data brokers, is shedding light on just how much personal information companies collect about ordinary Americans — and how many well-known corporations are paying for it. The findings, compiled through a joint project by Consumer Reports, CalMatters and The Markup, offer a rare, detailed look inside an industry that operates largely out of public view.
Arkansas-based Acxiom claims to hold data on billions of people worldwide, including where they live, how they spend their money, and even predictions about their political leanings, weight and interest in specific medical procedures. But what does that actually look like for an average person?
For Tracey Reed, a nonprofit worker in Oregon, it meant a 58-page file detailing her supposed income, employment and education history — along with information about her spending habits, from online purchases to charitable donations. Much of it, she said, was inaccurate. The company had even attempted to pinpoint her home using latitude and longitude coordinates, and the file listed dozens of companies that had purchased data or inferences about her.
“It’s disgusting to think of people as just wealth to be extracted,” Reed said. “That’s exactly what these data profiles are — a road map for squeezing money out of a person.”
Reed’s file was one of more than 100 gathered as part of a Consumer Reports initiative encouraging consumers to request their personal data from companies like Acxiom, in order to test how well new state privacy laws are actually working. (Consumer Reports noted that its own membership division uses data from brokers, including Acxiom, to gauge consumer interest — for instance, predicting who might be likely to subscribe — but does not use that data to set prices or share it back with brokers.)
Acxiom stood out among the brokers examined for its sheer size, industry dominance, and the level of detail it provided to consumers who requested their files. The company’s practices have drawn media scrutiny for years, but the newly obtained records offer an unusually granular window into exactly what Acxiom tracks — including inferences that are, in some cases, startlingly specific.
According to the files reviewed by CalMatters and The Markup, Acxiom generates predictions across more than 3,000 categories covering people’s finances and behavior — everything from the ages and genders of their children to their estimated alcohol consumption, to a numeric score, on a 100-point scale, estimating how likely someone is to want a new Tesla Cybertruck.
The project was made possible by newer state laws that require companies to let consumers see what information has been collected about them.
Inside each file, Acxiom made detailed — at times bizarre — predictions about individuals, assigning probability scores to a wide range of traits and behaviors. Some of these are the kind of data retailers might reasonably want, such as the likelihood that a consumer would spend money at Nike, Buffalo Wild Wings or PlayStation, or whether they own a particular car model.
Other inferences went further, estimating the odds that someone would respond to a student loan consolidation offer, donate to charity, or fall into a certain body-mass-index percentile. Files also included estimates on food insecurity, whether a person has a primary care doctor, the likelihood they’ve had a mammogram, whether they can afford medical expenses, and even interest in joining the military.
Perhaps the most revealing part of these reports, according to privacy experts, is the list of companies that purchased consumer data through Acxiom — more than 100 in total. Newer state privacy laws, including those in Minnesota and Oregon, require companies to disclose not just what data they collect, but who ultimately buys it.
Acxiom’s client list includes some of the country’s largest insurers, banks and pharmaceutical companies — GEICO, State Farm, Citi, JPMorgan Chase, US Bank and Janssen Pharmaceuticals among them. Major retailers also appeared repeatedly, including General Motors, Hilton, Kohl’s, MLB.com, Southwest Airlines, T-Mobile and The Walt Disney Company. A number of smaller companies with histories of regulatory fines and lawsuits also turned up in the files, including Affinion Benefits Group (now CXLoyalty/Tenerity), Endurance Warranty Services and Mailers Haven.
Of the more than 100 companies identified as Acxiom customers, only a handful of major firms responded to requests for comment — and those that did generally defended the practice as a legitimate marketing tool.
“We use consumer data to improve the efficiency and effectiveness of our marketing campaigns,” said Luis Sahagun, a spokesperson for Farmers Insurance, “and we are committed to the responsible use of any consumer information we may obtain from third parties.”
Marketing Lists, Loan Offers and Patient Risk Scores
Companies typically use consumer data like Acxiom’s reports to identify potential new customers and understand household finances or major life events — the birth of a child, the death of a spouse. Banks, insurers and drug companies can then sort consumers into narrow groups — new parents, recent widows — and tailor advertising or offers accordingly.
One standout example is HealthVerity, a venture-backed Philadelphia startup that markets itself as the nation’s “largest healthcare data ecosystem.” The company appeared as a buyer in every Acxiom file examined. HealthVerity sells anonymized patient data to businesses and government agencies, including the Centers for Disease Control and Prevention. According to case studies on its own website, insurers and pharmaceutical companies use HealthVerity’s patient data to recruit for medical research, build marketing lists, and link patient records across multiple data sources.
But HealthVerity also markets an insurance underwriting product that helps generate risk scores and predictions for health, life, disability and workers’ compensation insurers. As part of its broader product catalog, the company also offers a marketing tool drawing on more than 1,000 attributes typically unavailable elsewhere, sourced from Acxiom, Epsilon, Adstra and others — including detailed demographic data on race, consumer behavior, online activity, socioeconomic status, lifestyle and media preferences.
Acxiom’s own privacy disclosures state that its data cannot be used for insurance underwriting under the federal Fair Credit Reporting Act. But HealthVerity’s products may fall outside that legal definition, since the company presents itself as a “healthcare data analytics” firm rather than a credit reporting agency, according to experts. HealthVerity did not respond to requests for comment.
“There are a lot of gaps in this patchwork of privacy law,” said Ari Ezra Waldman, a law professor at UC Irvine who studies the data economy.
U.S. privacy law can protect personal data in certain contexts — a FICO score or existing debt used in a credit check, for example. But for many kinds of health-related data, those protections may not apply. While the Health Insurance Portability and Accountability Act shields most medical records, daily measurements like heart rate, step counts or sleep patterns collected by tech companies such as Apple or Garmin are not subject to the same restrictions.
Other companies with troubled histories around consumer data also appeared repeatedly across Acxiom and Epsilon files. OneMain Financial, a subprime personal lender, showed up as a buyer in multiple reports; in March, the company was sued by 13 state attorneys general over allegations it packed loans with an estimated $826 in hidden fees and interest per borrower, on average.
Centene Corporation, the world’s largest manager of Medicaid health plans, has been sued by California and other states over allegations it inflated pharmacy costs and overcharged state Medicaid programs. Janssen Pharmaceuticals, a Johnson & Johnson subsidiary that appeared in every Acxiom file reviewed, has paid billions of dollars in settlements tied to allegations of off-label drug marketing and kickbacks to physicians.
When personal data is used to market costly financial products, the consequences for vulnerable consumers can be severe — particularly when personal loans, mortgages or auto loans are aimed at people already in financial distress, often carrying steep terms, said Lena Cohen, a technologist with the Electronic Frontier Foundation who studies the data broker industry.
“The extremely personal data we see in these files doesn’t come from nowhere,” Cohen said. “There’s a whole web of companies and technologies that have to share this data for a broker to be able to collect it. And that can have real, harmful consequences.”
The personal data reports also contained dozens of inaccuracies pulled from public records — errors that Cohen said undercut the industry’s argument that such extensive data collection is necessary for advertising to function.
Many early participants in the Consumer Reports project were already privacy-conscious, and Reed is no exception — she still uses a flip phone. “I hate marketing and advertising,” she said. “I always use an ad blocker and try to protect my privacy.”
That didn’t stop Acxiom from building a profile on her habits anyway. Some details were wrong — the addresses listed appeared to confuse her with her parents — but the company’s read on her spending habits was accurate.
The reports also included what critics describe as coded language used to describe racial, ethnic and health information that would otherwise be protected from disclosure under federal and state law. One file rated a consumer’s “assimilation level” as “3+ generations in the U.S.” Others assessed “health consciousness,” “likelihood of smoking” and “social behavior.”
“We don’t really know what these vague terms actually mean,” Waldman said. The assimilation score likely reflects “things like race, ethnicity, immigration status — things we’re not supposed to discriminate on.” But the vague terminology used by data brokers, he said, “serves to obscure the true nature of what’s happening, to soften it and make it seem legitimate.”
Sherry Hamilton, a spokesperson for Acxiom, said in an emailed statement that the company works to ensure “all data is ethically sourced, responsibly used and securely protected.” She added that Acxiom works with accredited data providers to ensure consumers receive “notice and choice” regarding how their information is collected.
Hamilton said the files reviewed by Consumer Reports were provided in full, unfiltered detail for transparency purposes, while paying clients receive a more refined dataset. She said health-related categories don’t indicate a diagnosed condition, only that someone “may be interested in information about a condition, treatment or product,” and that the assimilation score is a household-level metric that doesn’t reflect an individual’s race, ethnicity or immigration status. She also said that, by law, companies purchasing Acxiom data cannot use it to determine eligibility or pricing for credit or insurance.
“Acxiom is fundamentally committed to ethical data practices,” Hamilton said.
A Multibillion-Dollar Industry
Acxiom traces its roots to the 1960s, when it operated as a data analytics firm called Demographics Inc. According to The New York Times, the company originally used phone directories to help the Democratic Party locate voters for campaign mailings. It has since grown into one of the largest data collection operations in the country.
That scale translates into significant revenue. Acxiom’s parent company, Interpublic, reported $2.5 billion in revenue in a single quarter this year, according to its latest earnings report.
But Acxiom represents just one piece of a much larger industry that gathers consumer data with minimal oversight — an industry many people have never even heard of. Selling personal information has become so routine that numerous companies legally qualify as data brokers even though that’s not how they’re publicly known. Collectively, the industry is valued at hundreds of billions of dollars and continues to grow. Data brokers have also become significant political players, spending heavily on lobbying efforts.
According to Justin Sherman, a resident fellow at the Electronic Privacy Information Center who previously led a data broker research program at Duke University, brokers typically build their databases using three types of information: data gathered directly, data gathered indirectly, and data derived through inference.
Direct data collection might involve a company gathering information through its own app, or acquiring a smaller company and absorbing its data — some of which may then be resold to brokers. Indirect data often comes from public records such as property deeds, marriage certificates and court filings; Acxiom itself has acknowledged using these sources.
Inferences, Sherman said, are how brokers use one piece of data to deduce something else entirely. These can be especially invasive. Someone using a Christian news app might be assumed to be religious; someone using a dating app for gay users might have their sexual orientation inferred. And while companies can’t legally collect data on minors, they can infer which households are likely to include young children.
If a broker has access to someone’s location data, it might notice that person visiting a military base, a school, or a medical specialist’s office.
“From that, I can infer all sorts of other characteristics — finances, health, demographics, religion,” Sherman said.
Whether accurate or not, the data brokers collect can create problems for the people it describes. Accurate data can give companies an unsettlingly detailed picture of someone’s private life. Inaccurate data can be just as damaging — inaccurate driving records, for instance, have reportedly led to unjustified spikes in auto insurance premiums.
And most consumers have very limited options for preventing companies from collecting their information in the first place.
Data Brokers and the Law
With no comprehensive federal privacy law in place, some states have moved to fill the gap on their own.
Four states — California, Oregon, Vermont and Texas — have passed transparency laws requiring companies that meet certain criteria to register as data brokers. Some laws, including California’s, require brokers to give consumers a way to access and delete their information. Earlier this year, California launched a new website allowing residents to request that hundreds of data brokers stop tracking them and selling their information.
Lawmakers are increasingly concerned that data collected by brokers fuels price discrimination. At least 30 states, including California, have considered legislation this year regulating how companies charge different prices for identical products based on personal data.
Enforcement, however, remains inconsistent. A report released this year by Privacy Rights Clearinghouse and the Electronic Frontier Foundation found hundreds of companies registered in one state’s broker database but missing from others with similar registration requirements.
It remains unclear how many companies that legally qualify as data brokers under these laws haven’t registered anywhere at all. “The data broker industry is very underregulated,” Sherman said.
He argues that current practices raise serious questions about the limits of privacy rights and civil liberties. Little stands in the way of brokers building increasingly invasive profiles and sharing that information with whoever is willing to pay. Government agencies, including reportedly the National Security Agency, have also been known to purchase data from brokers — a workaround that can allow them to sidestep the warrant process typically required to access personal information.
Data broker companies, for their part, maintain that their practices are legal and that consumers consent to having their data collected and sold — often buried in the fine print of loyalty program sign-ups or app terms of service. But as Sherman points out, few people have ever heard of these companies, let alone recall agreeing to have their information sold.
“The idea that a data broker is obtaining consent to sell a person’s data to its customers flies in the face of years of peer-reviewed academic research, surveys, journalism and personal experience,” Sherman said. “People genuinely don’t consent to this. The idea is far-fetched.”
Original source: CalMatters
