That’s the takeaway from a new investigation, coreported with Consumer Reports, into Acxiom, the Arkansas-based data broker that claims to hold information on billions of people worldwide — everything from where they live to how they spend money, and even inferences about their political leanings, weight, and interest in certain medical procedures.

For Tracey Reed, a nonprofit worker in Oregon, requesting her file from Acxiom produced a 58-page document tracking her presumed income, education, employment history and spending habits, from online purchases to charitable donations. The company had attempted to pinpoint her home down to latitude and longitude, and listed dozens of businesses that had purchased her data or Acxiom’s inferences about her — though Reed said much of the information was simply wrong.

“I think it’s pretty gross that people are treated like sources of wealth to be mined,” Reed said. “That’s what these data profiles are, like, ‘Here’s a guide for how to squeeze this person and get money out of them.'”

Reed’s experience is one of more than 100 personal data requests gathered by Consumer Reports’ advocacy team as part of an effort to test how well newer state privacy laws are actually working. The nonprofit shared those findings with CalMatters and The Markup, who focused their review on Acxiom specifically — both for its size and outsized role in the data-broker industry, and because it disclosed unusually detailed information in response to consumer requests.

Acxiom’s business dealings have drawn press scrutiny for years, but the newly obtained files reveal specifics that go well beyond what has previously been reported, including thousands of narrow categories the company uses to size up consumers — from the ages and genders of their children to their “alcohol usage” to a 1-100 score estimating how likely they are to buy a Tesla Cybertruck.

The project was made possible by a handful of state laws passed in recent years — including in California, Oregon and Minnesota — that give residents the right to see what data brokers have compiled about them and, in some cases, who bought it.

Sifting through the files, reporters found Acxiom makes predictions in more than 3,000 categories touching on nearly every corner of a person’s financial and personal life. Some of that information is clearly geared toward retail marketing: scores estimating the odds a consumer will shop at Nike, Buffalo Wild Wings or PlayStation, or whether they own particular car models.

But other estimates go much further, rating the likelihood someone would respond to a student loan consolidation offer, donate to charity, or fall into a certain body-mass-index range. Acxiom also scored the probability that individuals faced food insecurity, had a primary care doctor, were due for a mammogram, could afford medical bills, or had shown online interest in joining the Army.

Perhaps the most striking discovery, according to privacy researchers interviewed for this story, was the list of companies that had purchased Acxiom data — more than 100 in total. Laws in states such as Oregon and Minnesota require brokers to disclose not just what data they collect, but who buys it.

Household names turned up repeatedly in the files: insurance giants GEICO and State Farm; banking heavyweights Citi, JPMorgan Chase and US Bank; and pharmaceutical company Janssen. Retailers and consumer brands including General Motors, Hilton, Kohl’s, MLB.com, Southwest Airlines, T-Mobile and the Walt Disney Company also appeared as buyers. So did smaller firms with histories of regulatory trouble, such as Affinion Benefits Group (now CXLoyalty/Tenerity), Endurance Warranty Services and Mailers Haven.

Of the more than 100 companies identified as Acxiom customers, few responded when contacted for comment, and those that did generally defended the practice as a legitimate marketing tool. Farmers Insurance spokesperson Luis Sahagun said the company uses “consumer data to help improve the efficiency and effectiveness of our marketing outreach” and is “committed to responsible use of any consumer information we may obtain from third parties.”

Marketing lists, loan pitches and health “risk scores”

Businesses typically use files like Acxiom’s to identify prospective customers and understand life changes — a new baby, a spouse’s death — that might make someone receptive to a particular pitch. That allows banks, insurers and drug companies to narrow their marketing down to extremely small groups of people.

One company, HealthVerity, a Philadelphia-based startup billed as the country’s “largest healthcare data ecosystem,” appeared as a buyer in every Acxiom file reviewed by reporters. HealthVerity sells deidentified patient data to businesses and government agencies, including the Centers for Disease Control and Prevention, and touts case studies in which insurers and drugmakers use its data to recruit research subjects or build marketing lists.

The company also markets an underwriting tool that generates “risk scores” for health, life, disability and workers’ compensation insurers. Separately, HealthVerity advertises a product built on “more than 1,000 attributes from providers typically not available, such as Acxiom, Epsilon, Adstra and others,” including race, online behavior and lifestyle data.

Acxiom’s own privacy policy states its data cannot be used for insurance underwriting under the federal Fair Credit Reporting Act. But because HealthVerity operates as a “healthcare analytics” firm rather than a credit reporting agency, its products may fall outside that law’s reach, experts say. HealthVerity did not respond to requests for comment.

“There are a lot of holes in this Swiss cheese of privacy law,” said Ari Ezra Waldman, a University of California, Irvine law professor who studies the data economy.

Federal privacy protections can be inconsistent. The Health Insurance Portability and Accountability Act shields most medical records, but data such as heart rate, step counts or sleep patterns collected by devices like Apple Watches or Garmin trackers generally isn’t covered by the same rules.

Several companies with troubled regulatory histories also turned up repeatedly as buyers in the files. OneMain Financial, a subprime lender, was sued in March by 13 state attorneys general over allegations it packed loans with hundreds of dollars in hidden fees per borrower. Centene Corporation, the world’s largest Medicaid managed care company, has faced lawsuits from California and other states accusing it of inflating pharmacy costs. And Janssen Pharmaceuticals, a Johnson & Johnson subsidiary that appeared in every file examined, has paid billions in settlements tied to alleged off-label marketing and physician kickbacks.

When personal data fuels marketing for costly financial products, the consequences for vulnerable consumers can be severe, said Lena Cohen, a staff technologist with the Electronic Frontier Foundation who studies the data broker industry — particularly when high-interest loans are targeted at people already in financial distress.

“The extremely personal data we see in these files doesn’t appear out of nowhere,” Cohen said. “There is a network of companies and tech that have to share this data for a data broker to collect it. And it can have real harms.”

The files also contained numerous errors drawn from public records — inaccuracies Cohen said undercut the industry’s argument that such extensive data collection is necessary for advertising to function.

Reed, who still uses a flip phone and blocks ads out of habit, said Acxiom nonetheless attempted to profile her closely. Some details were wrong — her address history appeared to blend her information with her parents’ — but her spending patterns were accurately captured.

Critics also point to vague terminology in Acxiom’s reports that may serve as a proxy for protected categories such as race or health status. One file rated a person’s “assimilation level” as “3+ generations in the US.” Others scored “health conscientiousness,” “likelihood to be a smoker” and “social setting behavior.”

“We don’t actually know what goes into these kind of vague terms,” Waldman said, adding that “assimilation level” likely reflects “things like race, ethnicity, immigration status, things that we don’t normally like to discriminate on,” dressed up in softer language “to hide the true nature of what’s going on.”

Acxiom spokesperson Sherry Hamilton said in a statement that the company ensures “all data is sourced ethically, used responsibly, and protected securely,” and that its data suppliers are required to give consumers “appropriate notice and choice.” She said the files given to consumers through Consumer Reports’ project were intentionally unfiltered for transparency purposes, while data delivered to paying clients is more refined and accurate.

Hamilton added that health-related categories don’t indicate someone has an illness — only that they “may be interested in information about a condition, treatment, or product” — and that assimilation scores apply to households, not individuals, and don’t indicate race, ethnicity or immigration status. She also said buyers of Acxiom data are barred by law from using it to determine credit or insurance eligibility or pricing.

“Acxiom is fundamentally committed to ethical data practices,” she said.

A sprawling, multibillion-dollar industry

Acxiom traces its roots to the 1960s, when it operated as Demographics Inc., reportedly mining phone directories to help the Democratic Party locate voters for mailers, according to The New York Times. It has since grown into one of the largest data companies in the world. Its parent company, Interpublic, reported $2.5 billion in revenue in a single quarter this year.

Yet Acxiom represents just one piece of a much larger data-broker economy — one worth hundreds of billions of dollars and expanding, according to estimates from Mozilla. The industry also wields significant political influence, spending heavily on lobbying efforts nationwide.

Data brokers typically build their profiles using three types of information, said Justin Sherman, a scholar-in-residence at the Electronic Privacy Information Center who previously led data-broker research at Duke University: information gathered directly, information gathered indirectly, and information generated through inference.

Direct data might come from an app a company operates or from acquiring a smaller business and absorbing its user data. Indirect data often comes from public records — property filings, marriage licenses, court documents — sources Acxiom has acknowledged using.

Inferences, Sherman said, are where things get murkier. A person’s use of a religious news app might suggest their faith; a dating app catering to LGBTQ+ users might reveal sexual orientation; geolocation data showing visits to a school or medical office might reveal details about family life or health. “From that I can derive all kinds of information about other characteristics: finance, health, demographics, religion,” Sherman said.

Whether accurate or not, this information can cause harm. Correct data offers marketers an unsettlingly precise view into someone’s life. Inaccurate data — say, faulty driving records — can unfairly raise insurance costs, according to Consumer Reports.

And most people have little ability to stop their information from being collected in the first place.

How the law treats data brokers

Without a comprehensive federal privacy law, some states have stepped in. California, Oregon, Vermont and Texas all require companies meeting certain thresholds to register as data brokers, and some, including California, mandate that brokers give consumers ways to access or delete their information. California recently launched a website allowing residents to demand hundreds of brokers stop collecting and selling their data — a process CalMatters and The Markup have detailed in a separate guide.

Concerns are also growing that broker-collected data could be used to justify discriminatory pricing; at least 30 states, including California, have considered legislation this year addressing how companies price identical products differently for different customers.

Enforcement, however, remains inconsistent. A report this year from Privacy Rights Clearinghouse and the Electronic Frontier Foundation found hundreds of companies registered in one state’s broker database but missing from others with similar requirements.

It’s unclear how many qualifying data brokers avoid registering altogether. “The data broker industry is way underregulated,” Sherman said, adding that the sector’s practices raise deep questions about privacy rights and civil liberties.

There’s little preventing brokers from continuing to expand their surveillance methods and selling that information widely — including, in some cases, to government agencies. Reports have indicated that agencies such as the National Security Agency have purchased commercially available data as a way to sidestep traditional warrant requirements.

Data brokers typically defend their practices as legal, arguing that consumers consent when they sign up for loyalty programs or accept lengthy terms-of-service agreements that permit data sharing. But Sherman said most people have never heard of these companies, let alone knowingly agreed to have their information sold.

“The notion that a data broker gets consent to sell someone’s data to clients flies in the face of years of academic peer-reviewed research, polling, news reporting, and people’s personal experiences,” Sherman said. “People are not actually consenting to this, so that notion is fanciful.”

Original source: CalMatters

The post Disney, GM, Your Bank and More: Inside the Market for Your Personal Data appeared first on The Hemet & San Jacinto Chronicle.