A new investigation into Acxiom, one of the nation’s largest data brokers, is shedding light on just how much personal information companies collect about ordinary Americans — and how many well-known corporations are paying for it. The findings, compiled through a joint project by Consumer Reports, CalMatters and The Markup, offer a rare, detailed look inside an industry that operates largely out of public view.

Arkansas-based Acxiom claims to hold data on billions of people worldwide, including where they live, how they spend their money, and even predictions about their political leanings, weight and interest in specific medical procedures. But what does that actually look like for an average person?

For Tracey Reed, a nonprofit worker in Oregon, it meant a 58-page file detailing her supposed income, employment and education history — along with information about her spending habits, from online purchases to charitable donations. Much of it, she said, was inaccurate. The company had even attempted to pinpoint her home using latitude and longitude coordinates, and the file listed dozens of companies that had purchased data or inferences about her.

“It’s disgusting to think of people as just wealth to be extracted,” Reed said. “That’s exactly what these data profiles are — a road map for squeezing money out of a person.”

Reed’s file was one of more than 100 gathered as part of a Consumer Reports initiative encouraging consumers to request their personal data from companies like Acxiom, in order to test how well new state privacy laws are actually working. (Consumer Reports noted that its own membership division uses data from brokers, including Acxiom, to gauge consumer interest — for instance, predicting who might be likely to subscribe — but does not use that data to set prices or share it back with brokers.)

Acxiom stood out among the brokers examined for its sheer size, industry dominance, and the level of detail it provided to consumers who requested their files. The company’s practices have drawn media scrutiny for years, but the newly obtained records offer an unusually granular window into exactly what Acxiom tracks — including inferences that are, in some cases, startlingly specific.

According to the files reviewed by CalMatters and The Markup, Acxiom generates predictions across more than 3,000 categories covering people’s finances and behavior — everything from the ages and genders of their children to their estimated alcohol consumption, to a numeric score, on a 100-point scale, estimating how likely someone is to want a new Tesla Cybertruck.

The project was made possible by newer state laws that require companies to let consumers see what information has been collected about them.

Inside each file, Acxiom made detailed — at times bizarre — predictions about individuals, assigning probability scores to a wide range of traits and behaviors. Some of these are the kind of data retailers might reasonably want, such as the likelihood that a consumer would spend money at Nike, Buffalo Wild Wings or PlayStation, or whether they own a particular car model.

Other inferences went further, estimating the odds that someone would respond to a student loan consolidation offer, donate to charity, or fall into a certain body-mass-index percentile. Files also included estimates on food insecurity, whether a person has a primary care doctor, the likelihood they’ve had a mammogram, whether they can afford medical expenses, and even interest in joining the military.

Perhaps the most revealing part of these reports, according to privacy experts, is the list of companies that purchased consumer data through Acxiom — more than 100 in total. Newer state privacy laws, including those in Minnesota and Oregon, require companies to disclose not just what data they collect, but who ultimately buys it.

Acxiom’s client list includes some of the country’s largest insurers, banks and pharmaceutical companies — GEICO, State Farm, Citi, JPMorgan Chase, US Bank and Janssen Pharmaceuticals among them. Major retailers also appeared repeatedly, including General Motors, Hilton, Kohl’s, MLB.com, Southwest Airlines, T-Mobile and The Walt Disney Company. A number of smaller companies with histories of regulatory fines and lawsuits also turned up in the files, including Affinion Benefits Group (now CXLoyalty/Tenerity), Endurance Warranty Services and Mailers Haven.

Of the more than 100 companies identified as Acxiom customers, only a handful of major firms responded to requests for comment — and those that did generally defended the practice as a legitimate marketing tool.

“We use consumer data to improve the efficiency and effectiveness of our marketing campaigns,” said Luis Sahagun, a spokesperson for Farmers Insurance, “and we are committed to the responsible use of any consumer information we may obtain from third parties.”

Marketing Lists, Loan Offers and Patient Risk Scores

Companies typically use consumer data like Acxiom’s reports to identify potential new customers and understand household finances or major life events — the birth of a child, the death of a spouse. Banks, insurers and drug companies can then sort consumers into narrow groups — new parents, recent widows — and tailor advertising or offers accordingly.

One standout example is HealthVerity, a venture-backed Philadelphia startup that markets itself as the nation’s “largest healthcare data ecosystem.” The company appeared as a buyer in every Acxiom file examined. HealthVerity sells anonymized patient data to businesses and government agencies, including the Centers for Disease Control and Prevention. According to case studies on its own website, insurers and pharmaceutical companies use HealthVerity’s patient data to recruit for medical research, build marketing lists, and link patient records across multiple data sources.

But HealthVerity also markets an insurance underwriting product that helps generate risk scores and predictions for health, life, disability and workers’ compensation insurers. As part of its broader product catalog, the company also offers a marketing tool drawing on more than 1,000 attributes typically unavailable elsewhere, sourced from Acxiom, Epsilon, Adstra and others — including detailed demographic data on race, consumer behavior, online activity, socioeconomic status, lifestyle and media preferences.

Acxiom’s own privacy disclosures state that its data cannot be used for insurance underwriting under the federal Fair Credit Reporting Act. But HealthVerity’s products may fall outside that legal definition, since the company presents itself as a “healthcare data analytics” firm rather than a credit reporting agency, according to experts. HealthVerity did not respond to requests for comment.

“There are a lot of gaps in this patchwork of privacy law,” said Ari Ezra Waldman, a law professor at UC Irvine who studies the data economy.

U.S. privacy law can protect personal data in certain contexts — a FICO score or existing debt used in a credit check, for example. But for many kinds of health-related data, those protections may not apply. While the Health Insurance Portability and Accountability Act shields most medical records, daily measurements like heart rate, step counts or sleep patterns collected by tech companies such as Apple or Garmin are not subject to the same restrictions.

Other companies with troubled histories around consumer data also appeared repeatedly across Acxiom and Epsilon files. OneMain Financial, a subprime personal lender, showed up as a buyer in multiple reports; in March, the company was sued by 13 state attorneys general over allegations it packed loans with an estimated $826 in hidden fees and interest per borrower, on average.

Centene Corporation, the world’s largest manager of Medicaid health plans, has been sued by California and other states over allegations it inflated pharmacy costs and overcharged state Medicaid programs. Janssen Pharmaceuticals, a Johnson & Johnson subsidiary that appeared in every Acxiom file reviewed, has paid billions of dollars in settlements tied to allegations of off-label drug marketing and kickbacks to physicians.

When personal data is used to market costly financial products, the consequences for vulnerable consumers can be severe — particularly when personal loans, mortgages or auto loans are aimed at people already in financial distress, often carrying steep terms, said Lena Cohen, a technologist with the Electronic Frontier Foundation who studies the data broker industry.

“The extremely personal data we see in these files doesn’t come from nowhere,” Cohen said. “There’s a whole web of companies and technologies that have to share this data for a broker to be able to collect it. And that can have real, harmful consequences.”

The personal data reports also contained dozens of inaccuracies pulled from public records — errors that Cohen said undercut the industry’s argument that such extensive data collection is necessary for advertising to function.

Many early participants in the Consumer Reports project were already privacy-conscious, and Reed is no exception — she still uses a flip phone. “I hate marketing and advertising,” she said. “I always use an ad blocker and try to protect my privacy.”

That didn’t stop Acxiom from building a profile on her habits anyway. Some details were wrong — the addresses listed appeared to confuse her with her parents — but the company’s read on her spending habits was accurate.

The reports also included what critics describe as coded language used to describe racial, ethnic and health information that would otherwise be protected from disclosure under federal and state law. One file rated a consumer’s “assimilation level” as “3+ generations in the U.S.” Others assessed “health consciousness,” “likelihood of smoking” and “social behavior.”

“We don’t really know what these vague terms actually mean,” Waldman said. The assimilation score likely reflects “things like race, ethnicity, immigration status — things we’re not supposed to discriminate on.” But the vague terminology used by data brokers, he said, “serves to obscure the true nature of what’s happening, to soften it and make it seem legitimate.”

Sherry Hamilton, a spokesperson for Acxiom, said in an emailed statement that the company works to ensure “all data is ethically sourced, responsibly used and securely protected.” She added that Acxiom works with accredited data providers to ensure consumers receive “notice and choice” regarding how their information is collected.

Hamilton said the files reviewed by Consumer Reports were provided in full, unfiltered detail for transparency purposes, while paying clients receive a more refined dataset. She said health-related categories don’t indicate a diagnosed condition, only that someone “may be interested in information about a condition, treatment or product,” and that the assimilation score is a household-level metric that doesn’t reflect an individual’s race, ethnicity or immigration status. She also said that, by law, companies purchasing Acxiom data cannot use it to determine eligibility or pricing for credit or insurance.

“Acxiom is fundamentally committed to ethical data practices,” Hamilton said.

A Multibillion-Dollar Industry

Acxiom traces its roots to the 1960s, when it operated as a data analytics firm called Demographics Inc. According to The New York Times, the company originally used phone directories to help the Democratic Party locate voters for campaign mailings. It has since grown into one of the largest data collection operations in the country.

That scale translates into significant revenue. Acxiom’s parent company, Interpublic, reported $2.5 billion in revenue in a single quarter this year, according to its latest earnings report.

But Acxiom represents just one piece of a much larger industry that gathers consumer data with minimal oversight — an industry many people have never even heard of. Selling personal information has become so routine that numerous companies legally qualify as data brokers even though that’s not how they’re publicly known. Collectively, the industry is valued at hundreds of billions of dollars and continues to grow. Data brokers have also become significant political players, spending heavily on lobbying efforts.

According to Justin Sherman, a resident fellow at the Electronic Privacy Information Center who previously led a data broker research program at Duke University, brokers typically build their databases using three types of information: data gathered directly, data gathered indirectly, and data derived through inference.

Direct data collection might involve a company gathering information through its own app, or acquiring a smaller company and absorbing its data — some of which may then be resold to brokers. Indirect data often comes from public records such as property deeds, marriage certificates and court filings; Acxiom itself has acknowledged using these sources.

Inferences, Sherman said, are how brokers use one piece of data to deduce something else entirely. These can be especially invasive. Someone using a Christian news app might be assumed to be religious; someone using a dating app for gay users might have their sexual orientation inferred. And while companies can’t legally collect data on minors, they can infer which households are likely to include young children.

If a broker has access to someone’s location data, it might notice that person visiting a military base, a school, or a medical specialist’s office.

“From that, I can infer all sorts of other characteristics — finances, health, demographics, religion,” Sherman said.

Whether accurate or not, the data brokers collect can create problems for the people it describes. Accurate data can give companies an unsettlingly detailed picture of someone’s private life. Inaccurate data can be just as damaging — inaccurate driving records, for instance, have reportedly led to unjustified spikes in auto insurance premiums.

And most consumers have very limited options for preventing companies from collecting their information in the first place.

Data Brokers and the Law

With no comprehensive federal privacy law in place, some states have moved to fill the gap on their own.

Four states — California, Oregon, Vermont and Texas — have passed transparency laws requiring companies that meet certain criteria to register as data brokers. Some laws, including California’s, require brokers to give consumers a way to access and delete their information. Earlier this year, California launched a new website allowing residents to request that hundreds of data brokers stop tracking them and selling their information.

Lawmakers are increasingly concerned that data collected by brokers fuels price discrimination. At least 30 states, including California, have considered legislation this year regulating how companies charge different prices for identical products based on personal data.

Enforcement, however, remains inconsistent. A report released this year by Privacy Rights Clearinghouse and the Electronic Frontier Foundation found hundreds of companies registered in one state’s broker database but missing from others with similar registration requirements.

It remains unclear how many companies that legally qualify as data brokers under these laws haven’t registered anywhere at all. “The data broker industry is very underregulated,” Sherman said.

He argues that current practices raise serious questions about the limits of privacy rights and civil liberties. Little stands in the way of brokers building increasingly invasive profiles and sharing that information with whoever is willing to pay. Government agencies, including reportedly the National Security Agency, have also been known to purchase data from brokers — a workaround that can allow them to sidestep the warrant process typically required to access personal information.

Data broker companies, for their part, maintain that their practices are legal and that consumers consent to having their data collected and sold — often buried in the fine print of loyalty program sign-ups or app terms of service. But as Sherman points out, few people have ever heard of these companies, let alone recall agreeing to have their information sold.

“The idea that a data broker is obtaining consent to sell a person’s data to its customers flies in the face of years of peer-reviewed academic research, surveys, journalism and personal experience,” Sherman said. “People genuinely don’t consent to this. The idea is far-fetched.”

Original source: CalMatters

The post Your Personal Data Is for Sale: Disney, GM, Insurers and Banks Among the Buyers appeared first on The Hemet & San Jacinto Chronicle.

Under privacy laws now on the books in several states, including California, data brokers are required to disclose which companies have purchased a person’s information upon request. To see exactly what that looks like in practice, Consumer Reports recruited volunteers to formally request their personal data files from some of the largest data brokers operating in the country. Hundreds of people took part.

What came back, in many cases, was startling: full names, home addresses, Social Security numbers, and more than a thousand inferences and predictions about each person’s habits, finances and lifestyle.

The findings make clear that this information isn’t simply sitting in a database somewhere. It is constantly updated, endlessly analyzed, and routinely sold — often to more than 100 of the largest corporations in America.

**What’s actually in these files**

The reports reviewed by researchers included details as specific as the last time a person logged into their computer and how much they had spent on clothing, furniture and restaurant meals over recent years.

Companies such as Acxiom and Epsilon routinely gather the digital trail people leave behind and convert it into thousands of data points and assumptions, including:

How many children someone has, along with their ages and genders
Whether a person works a blue-collar or white-collar job
Whether someone has ever been the victim of fraud

Much of this information, however, turns out to be wrong. One report listed six different estimates for a single person’s age — none of them necessarily accurate.

**Your file begins with who you are**

Data brokers maintain files on nearly everyone. Acxiom says it holds profiles on roughly 95% of American adults, while Epsilon claims to have data on virtually every U.S. household with any commercial value.

Brokers build these files by pulling from public records, commercial databases and other data brokers, stitching together a profile that follows a person for life — and, in some cases, even after death.

**Your devices give you away**

A smartphone’s advertising identifier, a smart TV’s tracking number, a home’s IP address, even a vehicle identification number — data brokers can access all of it. These identifiers allow companies to link a person’s online behavior across every phone, tablet, computer, car and television they own.

**You’re assigned a dollar value**

While data brokers typically can’t see into anyone’s actual bank account, they can estimate income, savings and net worth based on modeled behavior — where someone lives, what they’ve purchased in the past, and how similar consumers behave financially.

**Health and identity are inferred, not confirmed**

Without access to real medical records, brokers still make educated guesses about a person’s sleep habits, whether they smoke, their body mass index, and whether they carry health insurance. They also estimate religion, ethnicity, political leanings, and even the precise ages of someone’s children. Those conclusions are then sold to pharmaceutical companies, health care providers and insurers.

**Predicting what you’ll do next**

Data brokers assign probability scores estimating how likely a person is to buy products from hundreds of different brands. They forecast what car someone might buy next, where they prefer to eat, and whether they’re likely to be interested in cryptocurrency investments.

**A “lifetime value” score — and a profit label**

Personal data has become a genuine commodity. A bank might use it to decide whether to offer a better — or worse — credit card sign-up bonus. A homeowners insurer might use it to determine what additional coverage to pitch. A clothing retailer might use it to set a personalized price on a sweater.

Epsilon, for instance, calculates a “customer lifetime value” score that estimates how profitable a person will be, sorting individuals into 26 categories with labels such as “Easy Living,” “Savers” and “Big Spending Parents,” then ranking them by profitability using tags like “Maximum Profit Margin.”

Acxiom similarly assigns a “customer lifetime value” score ranging from 0 to 200,000 for auto, home and health insurers, with higher scores indicating greater expected profitability. On top of that, Acxiom tags consumers with dozens of additional labels — things like “Seniors 64+ with Moderate Ability to Pay Medical Expenses,” “3+ Generations in the U.S.” and “Completed High School.”

**Who’s actually buying your data**

The reports obtained by Consumer Reports didn’t just reveal what information had been collected — they also named the specific companies that had purchased each person’s profile. Researchers identified hundreds of buyers across the reports they reviewed, spanning insurance companies, financial institutions, retailers and marketing firms.

**What buyers do with it**

Once a profile lands in the hands of a corporate buyer, it becomes raw material for decisions that directly affect everyday financial life.

Insurers use the data to evaluate the health profile of a company’s workforce, shaping budgets and premium calculations. Personal loan companies use it to identify people who might need financial help or are shopping for a car — sometimes offering loans with unfavorable terms and steep interest rates. Banks use it to market additional financial products, such as identity theft protection or credit monitoring services, that a consumer may not actually need.

**Opting out isn’t as simple as it sounds**

Most of the information data brokers hold doesn’t come directly from consumers — it comes from other companies. Nobody signed up for this. Whether meaningful consent was ever given in the first place is very much up for debate.

And even when someone does opt out, it only removes their data from one broker’s system. It does nothing to erase the copies of that same information that have already been sold to dozens of other companies down the line.

Original source: CalMatters

The post Data Brokers Have Detailed Files on You — Here’s What They Contain and How It Affects You appeared first on The Hemet & San Jacinto Chronicle.