A new investigation into Acxiom, one of the nation’s largest data brokers, is shedding light on just how much personal information companies collect about ordinary Americans — and how many well-known corporations are paying for it. The findings, compiled through a joint project by Consumer Reports, CalMatters and The Markup, offer a rare, detailed look inside an industry that operates largely out of public view.

Arkansas-based Acxiom claims to hold data on billions of people worldwide, including where they live, how they spend their money, and even predictions about their political leanings, weight and interest in specific medical procedures. But what does that actually look like for an average person?

For Tracey Reed, a nonprofit worker in Oregon, it meant a 58-page file detailing her supposed income, employment and education history — along with information about her spending habits, from online purchases to charitable donations. Much of it, she said, was inaccurate. The company had even attempted to pinpoint her home using latitude and longitude coordinates, and the file listed dozens of companies that had purchased data or inferences about her.

“It’s disgusting to think of people as just wealth to be extracted,” Reed said. “That’s exactly what these data profiles are — a road map for squeezing money out of a person.”

Reed’s file was one of more than 100 gathered as part of a Consumer Reports initiative encouraging consumers to request their personal data from companies like Acxiom, in order to test how well new state privacy laws are actually working. (Consumer Reports noted that its own membership division uses data from brokers, including Acxiom, to gauge consumer interest — for instance, predicting who might be likely to subscribe — but does not use that data to set prices or share it back with brokers.)

Acxiom stood out among the brokers examined for its sheer size, industry dominance, and the level of detail it provided to consumers who requested their files. The company’s practices have drawn media scrutiny for years, but the newly obtained records offer an unusually granular window into exactly what Acxiom tracks — including inferences that are, in some cases, startlingly specific.

According to the files reviewed by CalMatters and The Markup, Acxiom generates predictions across more than 3,000 categories covering people’s finances and behavior — everything from the ages and genders of their children to their estimated alcohol consumption, to a numeric score, on a 100-point scale, estimating how likely someone is to want a new Tesla Cybertruck.

The project was made possible by newer state laws that require companies to let consumers see what information has been collected about them.

Inside each file, Acxiom made detailed — at times bizarre — predictions about individuals, assigning probability scores to a wide range of traits and behaviors. Some of these are the kind of data retailers might reasonably want, such as the likelihood that a consumer would spend money at Nike, Buffalo Wild Wings or PlayStation, or whether they own a particular car model.

Other inferences went further, estimating the odds that someone would respond to a student loan consolidation offer, donate to charity, or fall into a certain body-mass-index percentile. Files also included estimates on food insecurity, whether a person has a primary care doctor, the likelihood they’ve had a mammogram, whether they can afford medical expenses, and even interest in joining the military.

Perhaps the most revealing part of these reports, according to privacy experts, is the list of companies that purchased consumer data through Acxiom — more than 100 in total. Newer state privacy laws, including those in Minnesota and Oregon, require companies to disclose not just what data they collect, but who ultimately buys it.

Acxiom’s client list includes some of the country’s largest insurers, banks and pharmaceutical companies — GEICO, State Farm, Citi, JPMorgan Chase, US Bank and Janssen Pharmaceuticals among them. Major retailers also appeared repeatedly, including General Motors, Hilton, Kohl’s, MLB.com, Southwest Airlines, T-Mobile and The Walt Disney Company. A number of smaller companies with histories of regulatory fines and lawsuits also turned up in the files, including Affinion Benefits Group (now CXLoyalty/Tenerity), Endurance Warranty Services and Mailers Haven.

Of the more than 100 companies identified as Acxiom customers, only a handful of major firms responded to requests for comment — and those that did generally defended the practice as a legitimate marketing tool.

“We use consumer data to improve the efficiency and effectiveness of our marketing campaigns,” said Luis Sahagun, a spokesperson for Farmers Insurance, “and we are committed to the responsible use of any consumer information we may obtain from third parties.”

Marketing Lists, Loan Offers and Patient Risk Scores

Companies typically use consumer data like Acxiom’s reports to identify potential new customers and understand household finances or major life events — the birth of a child, the death of a spouse. Banks, insurers and drug companies can then sort consumers into narrow groups — new parents, recent widows — and tailor advertising or offers accordingly.

One standout example is HealthVerity, a venture-backed Philadelphia startup that markets itself as the nation’s “largest healthcare data ecosystem.” The company appeared as a buyer in every Acxiom file examined. HealthVerity sells anonymized patient data to businesses and government agencies, including the Centers for Disease Control and Prevention. According to case studies on its own website, insurers and pharmaceutical companies use HealthVerity’s patient data to recruit for medical research, build marketing lists, and link patient records across multiple data sources.

But HealthVerity also markets an insurance underwriting product that helps generate risk scores and predictions for health, life, disability and workers’ compensation insurers. As part of its broader product catalog, the company also offers a marketing tool drawing on more than 1,000 attributes typically unavailable elsewhere, sourced from Acxiom, Epsilon, Adstra and others — including detailed demographic data on race, consumer behavior, online activity, socioeconomic status, lifestyle and media preferences.

Acxiom’s own privacy disclosures state that its data cannot be used for insurance underwriting under the federal Fair Credit Reporting Act. But HealthVerity’s products may fall outside that legal definition, since the company presents itself as a “healthcare data analytics” firm rather than a credit reporting agency, according to experts. HealthVerity did not respond to requests for comment.

“There are a lot of gaps in this patchwork of privacy law,” said Ari Ezra Waldman, a law professor at UC Irvine who studies the data economy.

U.S. privacy law can protect personal data in certain contexts — a FICO score or existing debt used in a credit check, for example. But for many kinds of health-related data, those protections may not apply. While the Health Insurance Portability and Accountability Act shields most medical records, daily measurements like heart rate, step counts or sleep patterns collected by tech companies such as Apple or Garmin are not subject to the same restrictions.

Other companies with troubled histories around consumer data also appeared repeatedly across Acxiom and Epsilon files. OneMain Financial, a subprime personal lender, showed up as a buyer in multiple reports; in March, the company was sued by 13 state attorneys general over allegations it packed loans with an estimated $826 in hidden fees and interest per borrower, on average.

Centene Corporation, the world’s largest manager of Medicaid health plans, has been sued by California and other states over allegations it inflated pharmacy costs and overcharged state Medicaid programs. Janssen Pharmaceuticals, a Johnson & Johnson subsidiary that appeared in every Acxiom file reviewed, has paid billions of dollars in settlements tied to allegations of off-label drug marketing and kickbacks to physicians.

When personal data is used to market costly financial products, the consequences for vulnerable consumers can be severe — particularly when personal loans, mortgages or auto loans are aimed at people already in financial distress, often carrying steep terms, said Lena Cohen, a technologist with the Electronic Frontier Foundation who studies the data broker industry.

“The extremely personal data we see in these files doesn’t come from nowhere,” Cohen said. “There’s a whole web of companies and technologies that have to share this data for a broker to be able to collect it. And that can have real, harmful consequences.”

The personal data reports also contained dozens of inaccuracies pulled from public records — errors that Cohen said undercut the industry’s argument that such extensive data collection is necessary for advertising to function.

Many early participants in the Consumer Reports project were already privacy-conscious, and Reed is no exception — she still uses a flip phone. “I hate marketing and advertising,” she said. “I always use an ad blocker and try to protect my privacy.”

That didn’t stop Acxiom from building a profile on her habits anyway. Some details were wrong — the addresses listed appeared to confuse her with her parents — but the company’s read on her spending habits was accurate.

The reports also included what critics describe as coded language used to describe racial, ethnic and health information that would otherwise be protected from disclosure under federal and state law. One file rated a consumer’s “assimilation level” as “3+ generations in the U.S.” Others assessed “health consciousness,” “likelihood of smoking” and “social behavior.”

“We don’t really know what these vague terms actually mean,” Waldman said. The assimilation score likely reflects “things like race, ethnicity, immigration status — things we’re not supposed to discriminate on.” But the vague terminology used by data brokers, he said, “serves to obscure the true nature of what’s happening, to soften it and make it seem legitimate.”

Sherry Hamilton, a spokesperson for Acxiom, said in an emailed statement that the company works to ensure “all data is ethically sourced, responsibly used and securely protected.” She added that Acxiom works with accredited data providers to ensure consumers receive “notice and choice” regarding how their information is collected.

Hamilton said the files reviewed by Consumer Reports were provided in full, unfiltered detail for transparency purposes, while paying clients receive a more refined dataset. She said health-related categories don’t indicate a diagnosed condition, only that someone “may be interested in information about a condition, treatment or product,” and that the assimilation score is a household-level metric that doesn’t reflect an individual’s race, ethnicity or immigration status. She also said that, by law, companies purchasing Acxiom data cannot use it to determine eligibility or pricing for credit or insurance.

“Acxiom is fundamentally committed to ethical data practices,” Hamilton said.

A Multibillion-Dollar Industry

Acxiom traces its roots to the 1960s, when it operated as a data analytics firm called Demographics Inc. According to The New York Times, the company originally used phone directories to help the Democratic Party locate voters for campaign mailings. It has since grown into one of the largest data collection operations in the country.

That scale translates into significant revenue. Acxiom’s parent company, Interpublic, reported $2.5 billion in revenue in a single quarter this year, according to its latest earnings report.

But Acxiom represents just one piece of a much larger industry that gathers consumer data with minimal oversight — an industry many people have never even heard of. Selling personal information has become so routine that numerous companies legally qualify as data brokers even though that’s not how they’re publicly known. Collectively, the industry is valued at hundreds of billions of dollars and continues to grow. Data brokers have also become significant political players, spending heavily on lobbying efforts.

According to Justin Sherman, a resident fellow at the Electronic Privacy Information Center who previously led a data broker research program at Duke University, brokers typically build their databases using three types of information: data gathered directly, data gathered indirectly, and data derived through inference.

Direct data collection might involve a company gathering information through its own app, or acquiring a smaller company and absorbing its data — some of which may then be resold to brokers. Indirect data often comes from public records such as property deeds, marriage certificates and court filings; Acxiom itself has acknowledged using these sources.

Inferences, Sherman said, are how brokers use one piece of data to deduce something else entirely. These can be especially invasive. Someone using a Christian news app might be assumed to be religious; someone using a dating app for gay users might have their sexual orientation inferred. And while companies can’t legally collect data on minors, they can infer which households are likely to include young children.

If a broker has access to someone’s location data, it might notice that person visiting a military base, a school, or a medical specialist’s office.

“From that, I can infer all sorts of other characteristics — finances, health, demographics, religion,” Sherman said.

Whether accurate or not, the data brokers collect can create problems for the people it describes. Accurate data can give companies an unsettlingly detailed picture of someone’s private life. Inaccurate data can be just as damaging — inaccurate driving records, for instance, have reportedly led to unjustified spikes in auto insurance premiums.

And most consumers have very limited options for preventing companies from collecting their information in the first place.

Data Brokers and the Law

With no comprehensive federal privacy law in place, some states have moved to fill the gap on their own.

Four states — California, Oregon, Vermont and Texas — have passed transparency laws requiring companies that meet certain criteria to register as data brokers. Some laws, including California’s, require brokers to give consumers a way to access and delete their information. Earlier this year, California launched a new website allowing residents to request that hundreds of data brokers stop tracking them and selling their information.

Lawmakers are increasingly concerned that data collected by brokers fuels price discrimination. At least 30 states, including California, have considered legislation this year regulating how companies charge different prices for identical products based on personal data.

Enforcement, however, remains inconsistent. A report released this year by Privacy Rights Clearinghouse and the Electronic Frontier Foundation found hundreds of companies registered in one state’s broker database but missing from others with similar registration requirements.

It remains unclear how many companies that legally qualify as data brokers under these laws haven’t registered anywhere at all. “The data broker industry is very underregulated,” Sherman said.

He argues that current practices raise serious questions about the limits of privacy rights and civil liberties. Little stands in the way of brokers building increasingly invasive profiles and sharing that information with whoever is willing to pay. Government agencies, including reportedly the National Security Agency, have also been known to purchase data from brokers — a workaround that can allow them to sidestep the warrant process typically required to access personal information.

Data broker companies, for their part, maintain that their practices are legal and that consumers consent to having their data collected and sold — often buried in the fine print of loyalty program sign-ups or app terms of service. But as Sherman points out, few people have ever heard of these companies, let alone recall agreeing to have their information sold.

“The idea that a data broker is obtaining consent to sell a person’s data to its customers flies in the face of years of peer-reviewed academic research, surveys, journalism and personal experience,” Sherman said. “People genuinely don’t consent to this. The idea is far-fetched.”

Original source: CalMatters

The post Your Personal Data Is for Sale: Disney, GM, Insurers and Banks Among the Buyers appeared first on The Hemet & San Jacinto Chronicle.

Under privacy laws now on the books in several states, including California, data brokers are required to disclose which companies have purchased a person’s information upon request. To see exactly what that looks like in practice, Consumer Reports recruited volunteers to formally request their personal data files from some of the largest data brokers operating in the country. Hundreds of people took part.

What came back, in many cases, was startling: full names, home addresses, Social Security numbers, and more than a thousand inferences and predictions about each person’s habits, finances and lifestyle.

The findings make clear that this information isn’t simply sitting in a database somewhere. It is constantly updated, endlessly analyzed, and routinely sold — often to more than 100 of the largest corporations in America.

**What’s actually in these files**

The reports reviewed by researchers included details as specific as the last time a person logged into their computer and how much they had spent on clothing, furniture and restaurant meals over recent years.

Companies such as Acxiom and Epsilon routinely gather the digital trail people leave behind and convert it into thousands of data points and assumptions, including:

How many children someone has, along with their ages and genders
Whether a person works a blue-collar or white-collar job
Whether someone has ever been the victim of fraud

Much of this information, however, turns out to be wrong. One report listed six different estimates for a single person’s age — none of them necessarily accurate.

**Your file begins with who you are**

Data brokers maintain files on nearly everyone. Acxiom says it holds profiles on roughly 95% of American adults, while Epsilon claims to have data on virtually every U.S. household with any commercial value.

Brokers build these files by pulling from public records, commercial databases and other data brokers, stitching together a profile that follows a person for life — and, in some cases, even after death.

**Your devices give you away**

A smartphone’s advertising identifier, a smart TV’s tracking number, a home’s IP address, even a vehicle identification number — data brokers can access all of it. These identifiers allow companies to link a person’s online behavior across every phone, tablet, computer, car and television they own.

**You’re assigned a dollar value**

While data brokers typically can’t see into anyone’s actual bank account, they can estimate income, savings and net worth based on modeled behavior — where someone lives, what they’ve purchased in the past, and how similar consumers behave financially.

**Health and identity are inferred, not confirmed**

Without access to real medical records, brokers still make educated guesses about a person’s sleep habits, whether they smoke, their body mass index, and whether they carry health insurance. They also estimate religion, ethnicity, political leanings, and even the precise ages of someone’s children. Those conclusions are then sold to pharmaceutical companies, health care providers and insurers.

**Predicting what you’ll do next**

Data brokers assign probability scores estimating how likely a person is to buy products from hundreds of different brands. They forecast what car someone might buy next, where they prefer to eat, and whether they’re likely to be interested in cryptocurrency investments.

**A “lifetime value” score — and a profit label**

Personal data has become a genuine commodity. A bank might use it to decide whether to offer a better — or worse — credit card sign-up bonus. A homeowners insurer might use it to determine what additional coverage to pitch. A clothing retailer might use it to set a personalized price on a sweater.

Epsilon, for instance, calculates a “customer lifetime value” score that estimates how profitable a person will be, sorting individuals into 26 categories with labels such as “Easy Living,” “Savers” and “Big Spending Parents,” then ranking them by profitability using tags like “Maximum Profit Margin.”

Acxiom similarly assigns a “customer lifetime value” score ranging from 0 to 200,000 for auto, home and health insurers, with higher scores indicating greater expected profitability. On top of that, Acxiom tags consumers with dozens of additional labels — things like “Seniors 64+ with Moderate Ability to Pay Medical Expenses,” “3+ Generations in the U.S.” and “Completed High School.”

**Who’s actually buying your data**

The reports obtained by Consumer Reports didn’t just reveal what information had been collected — they also named the specific companies that had purchased each person’s profile. Researchers identified hundreds of buyers across the reports they reviewed, spanning insurance companies, financial institutions, retailers and marketing firms.

**What buyers do with it**

Once a profile lands in the hands of a corporate buyer, it becomes raw material for decisions that directly affect everyday financial life.

Insurers use the data to evaluate the health profile of a company’s workforce, shaping budgets and premium calculations. Personal loan companies use it to identify people who might need financial help or are shopping for a car — sometimes offering loans with unfavorable terms and steep interest rates. Banks use it to market additional financial products, such as identity theft protection or credit monitoring services, that a consumer may not actually need.

**Opting out isn’t as simple as it sounds**

Most of the information data brokers hold doesn’t come directly from consumers — it comes from other companies. Nobody signed up for this. Whether meaningful consent was ever given in the first place is very much up for debate.

And even when someone does opt out, it only removes their data from one broker’s system. It does nothing to erase the copies of that same information that have already been sold to dozens of other companies down the line.

Original source: CalMatters

The post Data Brokers Have Detailed Files on You — Here’s What They Contain and How It Affects You appeared first on The Hemet & San Jacinto Chronicle.

That’s the takeaway from a new investigation, coreported with Consumer Reports, into Acxiom, the Arkansas-based data broker that claims to hold information on billions of people worldwide — everything from where they live to how they spend money, and even inferences about their political leanings, weight, and interest in certain medical procedures.

For Tracey Reed, a nonprofit worker in Oregon, requesting her file from Acxiom produced a 58-page document tracking her presumed income, education, employment history and spending habits, from online purchases to charitable donations. The company had attempted to pinpoint her home down to latitude and longitude, and listed dozens of businesses that had purchased her data or Acxiom’s inferences about her — though Reed said much of the information was simply wrong.

“I think it’s pretty gross that people are treated like sources of wealth to be mined,” Reed said. “That’s what these data profiles are, like, ‘Here’s a guide for how to squeeze this person and get money out of them.'”

Reed’s experience is one of more than 100 personal data requests gathered by Consumer Reports’ advocacy team as part of an effort to test how well newer state privacy laws are actually working. The nonprofit shared those findings with CalMatters and The Markup, who focused their review on Acxiom specifically — both for its size and outsized role in the data-broker industry, and because it disclosed unusually detailed information in response to consumer requests.

Acxiom’s business dealings have drawn press scrutiny for years, but the newly obtained files reveal specifics that go well beyond what has previously been reported, including thousands of narrow categories the company uses to size up consumers — from the ages and genders of their children to their “alcohol usage” to a 1-100 score estimating how likely they are to buy a Tesla Cybertruck.

The project was made possible by a handful of state laws passed in recent years — including in California, Oregon and Minnesota — that give residents the right to see what data brokers have compiled about them and, in some cases, who bought it.

Sifting through the files, reporters found Acxiom makes predictions in more than 3,000 categories touching on nearly every corner of a person’s financial and personal life. Some of that information is clearly geared toward retail marketing: scores estimating the odds a consumer will shop at Nike, Buffalo Wild Wings or PlayStation, or whether they own particular car models.

But other estimates go much further, rating the likelihood someone would respond to a student loan consolidation offer, donate to charity, or fall into a certain body-mass-index range. Acxiom also scored the probability that individuals faced food insecurity, had a primary care doctor, were due for a mammogram, could afford medical bills, or had shown online interest in joining the Army.

Perhaps the most striking discovery, according to privacy researchers interviewed for this story, was the list of companies that had purchased Acxiom data — more than 100 in total. Laws in states such as Oregon and Minnesota require brokers to disclose not just what data they collect, but who buys it.

Household names turned up repeatedly in the files: insurance giants GEICO and State Farm; banking heavyweights Citi, JPMorgan Chase and US Bank; and pharmaceutical company Janssen. Retailers and consumer brands including General Motors, Hilton, Kohl’s, MLB.com, Southwest Airlines, T-Mobile and the Walt Disney Company also appeared as buyers. So did smaller firms with histories of regulatory trouble, such as Affinion Benefits Group (now CXLoyalty/Tenerity), Endurance Warranty Services and Mailers Haven.

Of the more than 100 companies identified as Acxiom customers, few responded when contacted for comment, and those that did generally defended the practice as a legitimate marketing tool. Farmers Insurance spokesperson Luis Sahagun said the company uses “consumer data to help improve the efficiency and effectiveness of our marketing outreach” and is “committed to responsible use of any consumer information we may obtain from third parties.”

Marketing lists, loan pitches and health “risk scores”

Businesses typically use files like Acxiom’s to identify prospective customers and understand life changes — a new baby, a spouse’s death — that might make someone receptive to a particular pitch. That allows banks, insurers and drug companies to narrow their marketing down to extremely small groups of people.

One company, HealthVerity, a Philadelphia-based startup billed as the country’s “largest healthcare data ecosystem,” appeared as a buyer in every Acxiom file reviewed by reporters. HealthVerity sells deidentified patient data to businesses and government agencies, including the Centers for Disease Control and Prevention, and touts case studies in which insurers and drugmakers use its data to recruit research subjects or build marketing lists.

The company also markets an underwriting tool that generates “risk scores” for health, life, disability and workers’ compensation insurers. Separately, HealthVerity advertises a product built on “more than 1,000 attributes from providers typically not available, such as Acxiom, Epsilon, Adstra and others,” including race, online behavior and lifestyle data.

Acxiom’s own privacy policy states its data cannot be used for insurance underwriting under the federal Fair Credit Reporting Act. But because HealthVerity operates as a “healthcare analytics” firm rather than a credit reporting agency, its products may fall outside that law’s reach, experts say. HealthVerity did not respond to requests for comment.

“There are a lot of holes in this Swiss cheese of privacy law,” said Ari Ezra Waldman, a University of California, Irvine law professor who studies the data economy.

Federal privacy protections can be inconsistent. The Health Insurance Portability and Accountability Act shields most medical records, but data such as heart rate, step counts or sleep patterns collected by devices like Apple Watches or Garmin trackers generally isn’t covered by the same rules.

Several companies with troubled regulatory histories also turned up repeatedly as buyers in the files. OneMain Financial, a subprime lender, was sued in March by 13 state attorneys general over allegations it packed loans with hundreds of dollars in hidden fees per borrower. Centene Corporation, the world’s largest Medicaid managed care company, has faced lawsuits from California and other states accusing it of inflating pharmacy costs. And Janssen Pharmaceuticals, a Johnson & Johnson subsidiary that appeared in every file examined, has paid billions in settlements tied to alleged off-label marketing and physician kickbacks.

When personal data fuels marketing for costly financial products, the consequences for vulnerable consumers can be severe, said Lena Cohen, a staff technologist with the Electronic Frontier Foundation who studies the data broker industry — particularly when high-interest loans are targeted at people already in financial distress.

“The extremely personal data we see in these files doesn’t appear out of nowhere,” Cohen said. “There is a network of companies and tech that have to share this data for a data broker to collect it. And it can have real harms.”

The files also contained numerous errors drawn from public records — inaccuracies Cohen said undercut the industry’s argument that such extensive data collection is necessary for advertising to function.

Reed, who still uses a flip phone and blocks ads out of habit, said Acxiom nonetheless attempted to profile her closely. Some details were wrong — her address history appeared to blend her information with her parents’ — but her spending patterns were accurately captured.

Critics also point to vague terminology in Acxiom’s reports that may serve as a proxy for protected categories such as race or health status. One file rated a person’s “assimilation level” as “3+ generations in the US.” Others scored “health conscientiousness,” “likelihood to be a smoker” and “social setting behavior.”

“We don’t actually know what goes into these kind of vague terms,” Waldman said, adding that “assimilation level” likely reflects “things like race, ethnicity, immigration status, things that we don’t normally like to discriminate on,” dressed up in softer language “to hide the true nature of what’s going on.”

Acxiom spokesperson Sherry Hamilton said in a statement that the company ensures “all data is sourced ethically, used responsibly, and protected securely,” and that its data suppliers are required to give consumers “appropriate notice and choice.” She said the files given to consumers through Consumer Reports’ project were intentionally unfiltered for transparency purposes, while data delivered to paying clients is more refined and accurate.

Hamilton added that health-related categories don’t indicate someone has an illness — only that they “may be interested in information about a condition, treatment, or product” — and that assimilation scores apply to households, not individuals, and don’t indicate race, ethnicity or immigration status. She also said buyers of Acxiom data are barred by law from using it to determine credit or insurance eligibility or pricing.

“Acxiom is fundamentally committed to ethical data practices,” she said.

A sprawling, multibillion-dollar industry

Acxiom traces its roots to the 1960s, when it operated as Demographics Inc., reportedly mining phone directories to help the Democratic Party locate voters for mailers, according to The New York Times. It has since grown into one of the largest data companies in the world. Its parent company, Interpublic, reported $2.5 billion in revenue in a single quarter this year.

Yet Acxiom represents just one piece of a much larger data-broker economy — one worth hundreds of billions of dollars and expanding, according to estimates from Mozilla. The industry also wields significant political influence, spending heavily on lobbying efforts nationwide.

Data brokers typically build their profiles using three types of information, said Justin Sherman, a scholar-in-residence at the Electronic Privacy Information Center who previously led data-broker research at Duke University: information gathered directly, information gathered indirectly, and information generated through inference.

Direct data might come from an app a company operates or from acquiring a smaller business and absorbing its user data. Indirect data often comes from public records — property filings, marriage licenses, court documents — sources Acxiom has acknowledged using.

Inferences, Sherman said, are where things get murkier. A person’s use of a religious news app might suggest their faith; a dating app catering to LGBTQ+ users might reveal sexual orientation; geolocation data showing visits to a school or medical office might reveal details about family life or health. “From that I can derive all kinds of information about other characteristics: finance, health, demographics, religion,” Sherman said.

Whether accurate or not, this information can cause harm. Correct data offers marketers an unsettlingly precise view into someone’s life. Inaccurate data — say, faulty driving records — can unfairly raise insurance costs, according to Consumer Reports.

And most people have little ability to stop their information from being collected in the first place.

How the law treats data brokers

Without a comprehensive federal privacy law, some states have stepped in. California, Oregon, Vermont and Texas all require companies meeting certain thresholds to register as data brokers, and some, including California, mandate that brokers give consumers ways to access or delete their information. California recently launched a website allowing residents to demand hundreds of brokers stop collecting and selling their data — a process CalMatters and The Markup have detailed in a separate guide.

Concerns are also growing that broker-collected data could be used to justify discriminatory pricing; at least 30 states, including California, have considered legislation this year addressing how companies price identical products differently for different customers.

Enforcement, however, remains inconsistent. A report this year from Privacy Rights Clearinghouse and the Electronic Frontier Foundation found hundreds of companies registered in one state’s broker database but missing from others with similar requirements.

It’s unclear how many qualifying data brokers avoid registering altogether. “The data broker industry is way underregulated,” Sherman said, adding that the sector’s practices raise deep questions about privacy rights and civil liberties.

There’s little preventing brokers from continuing to expand their surveillance methods and selling that information widely — including, in some cases, to government agencies. Reports have indicated that agencies such as the National Security Agency have purchased commercially available data as a way to sidestep traditional warrant requirements.

Data brokers typically defend their practices as legal, arguing that consumers consent when they sign up for loyalty programs or accept lengthy terms-of-service agreements that permit data sharing. But Sherman said most people have never heard of these companies, let alone knowingly agreed to have their information sold.

“The notion that a data broker gets consent to sell someone’s data to clients flies in the face of years of academic peer-reviewed research, polling, news reporting, and people’s personal experiences,” Sherman said. “People are not actually consenting to this, so that notion is fanciful.”

Original source: CalMatters

The post Disney, GM, Your Bank and More: Inside the Market for Your Personal Data appeared first on The Hemet & San Jacinto Chronicle.