That’s the takeaway from a new investigation, coreported with Consumer Reports, into Acxiom, the Arkansas-based data broker that claims to hold information on billions of people worldwide — everything from where they live to how they spend money, and even inferences about their political leanings, weight, and interest in certain medical procedures.

For Tracey Reed, a nonprofit worker in Oregon, requesting her file from Acxiom produced a 58-page document tracking her presumed income, education, employment history and spending habits, from online purchases to charitable donations. The company had attempted to pinpoint her home down to latitude and longitude, and listed dozens of businesses that had purchased her data or Acxiom’s inferences about her — though Reed said much of the information was simply wrong.

“I think it’s pretty gross that people are treated like sources of wealth to be mined,” Reed said. “That’s what these data profiles are, like, ‘Here’s a guide for how to squeeze this person and get money out of them.'”

Reed’s experience is one of more than 100 personal data requests gathered by Consumer Reports’ advocacy team as part of an effort to test how well newer state privacy laws are actually working. The nonprofit shared those findings with CalMatters and The Markup, who focused their review on Acxiom specifically — both for its size and outsized role in the data-broker industry, and because it disclosed unusually detailed information in response to consumer requests.

Acxiom’s business dealings have drawn press scrutiny for years, but the newly obtained files reveal specifics that go well beyond what has previously been reported, including thousands of narrow categories the company uses to size up consumers — from the ages and genders of their children to their “alcohol usage” to a 1-100 score estimating how likely they are to buy a Tesla Cybertruck.

The project was made possible by a handful of state laws passed in recent years — including in California, Oregon and Minnesota — that give residents the right to see what data brokers have compiled about them and, in some cases, who bought it.

Sifting through the files, reporters found Acxiom makes predictions in more than 3,000 categories touching on nearly every corner of a person’s financial and personal life. Some of that information is clearly geared toward retail marketing: scores estimating the odds a consumer will shop at Nike, Buffalo Wild Wings or PlayStation, or whether they own particular car models.

But other estimates go much further, rating the likelihood someone would respond to a student loan consolidation offer, donate to charity, or fall into a certain body-mass-index range. Acxiom also scored the probability that individuals faced food insecurity, had a primary care doctor, were due for a mammogram, could afford medical bills, or had shown online interest in joining the Army.

Perhaps the most striking discovery, according to privacy researchers interviewed for this story, was the list of companies that had purchased Acxiom data — more than 100 in total. Laws in states such as Oregon and Minnesota require brokers to disclose not just what data they collect, but who buys it.

Household names turned up repeatedly in the files: insurance giants GEICO and State Farm; banking heavyweights Citi, JPMorgan Chase and US Bank; and pharmaceutical company Janssen. Retailers and consumer brands including General Motors, Hilton, Kohl’s, MLB.com, Southwest Airlines, T-Mobile and the Walt Disney Company also appeared as buyers. So did smaller firms with histories of regulatory trouble, such as Affinion Benefits Group (now CXLoyalty/Tenerity), Endurance Warranty Services and Mailers Haven.

Of the more than 100 companies identified as Acxiom customers, few responded when contacted for comment, and those that did generally defended the practice as a legitimate marketing tool. Farmers Insurance spokesperson Luis Sahagun said the company uses “consumer data to help improve the efficiency and effectiveness of our marketing outreach” and is “committed to responsible use of any consumer information we may obtain from third parties.”

Marketing lists, loan pitches and health “risk scores”

Businesses typically use files like Acxiom’s to identify prospective customers and understand life changes — a new baby, a spouse’s death — that might make someone receptive to a particular pitch. That allows banks, insurers and drug companies to narrow their marketing down to extremely small groups of people.

One company, HealthVerity, a Philadelphia-based startup billed as the country’s “largest healthcare data ecosystem,” appeared as a buyer in every Acxiom file reviewed by reporters. HealthVerity sells deidentified patient data to businesses and government agencies, including the Centers for Disease Control and Prevention, and touts case studies in which insurers and drugmakers use its data to recruit research subjects or build marketing lists.

The company also markets an underwriting tool that generates “risk scores” for health, life, disability and workers’ compensation insurers. Separately, HealthVerity advertises a product built on “more than 1,000 attributes from providers typically not available, such as Acxiom, Epsilon, Adstra and others,” including race, online behavior and lifestyle data.

Acxiom’s own privacy policy states its data cannot be used for insurance underwriting under the federal Fair Credit Reporting Act. But because HealthVerity operates as a “healthcare analytics” firm rather than a credit reporting agency, its products may fall outside that law’s reach, experts say. HealthVerity did not respond to requests for comment.

“There are a lot of holes in this Swiss cheese of privacy law,” said Ari Ezra Waldman, a University of California, Irvine law professor who studies the data economy.

Federal privacy protections can be inconsistent. The Health Insurance Portability and Accountability Act shields most medical records, but data such as heart rate, step counts or sleep patterns collected by devices like Apple Watches or Garmin trackers generally isn’t covered by the same rules.

Several companies with troubled regulatory histories also turned up repeatedly as buyers in the files. OneMain Financial, a subprime lender, was sued in March by 13 state attorneys general over allegations it packed loans with hundreds of dollars in hidden fees per borrower. Centene Corporation, the world’s largest Medicaid managed care company, has faced lawsuits from California and other states accusing it of inflating pharmacy costs. And Janssen Pharmaceuticals, a Johnson & Johnson subsidiary that appeared in every file examined, has paid billions in settlements tied to alleged off-label marketing and physician kickbacks.

When personal data fuels marketing for costly financial products, the consequences for vulnerable consumers can be severe, said Lena Cohen, a staff technologist with the Electronic Frontier Foundation who studies the data broker industry — particularly when high-interest loans are targeted at people already in financial distress.

“The extremely personal data we see in these files doesn’t appear out of nowhere,” Cohen said. “There is a network of companies and tech that have to share this data for a data broker to collect it. And it can have real harms.”

The files also contained numerous errors drawn from public records — inaccuracies Cohen said undercut the industry’s argument that such extensive data collection is necessary for advertising to function.

Reed, who still uses a flip phone and blocks ads out of habit, said Acxiom nonetheless attempted to profile her closely. Some details were wrong — her address history appeared to blend her information with her parents’ — but her spending patterns were accurately captured.

Critics also point to vague terminology in Acxiom’s reports that may serve as a proxy for protected categories such as race or health status. One file rated a person’s “assimilation level” as “3+ generations in the US.” Others scored “health conscientiousness,” “likelihood to be a smoker” and “social setting behavior.”

“We don’t actually know what goes into these kind of vague terms,” Waldman said, adding that “assimilation level” likely reflects “things like race, ethnicity, immigration status, things that we don’t normally like to discriminate on,” dressed up in softer language “to hide the true nature of what’s going on.”

Acxiom spokesperson Sherry Hamilton said in a statement that the company ensures “all data is sourced ethically, used responsibly, and protected securely,” and that its data suppliers are required to give consumers “appropriate notice and choice.” She said the files given to consumers through Consumer Reports’ project were intentionally unfiltered for transparency purposes, while data delivered to paying clients is more refined and accurate.

Hamilton added that health-related categories don’t indicate someone has an illness — only that they “may be interested in information about a condition, treatment, or product” — and that assimilation scores apply to households, not individuals, and don’t indicate race, ethnicity or immigration status. She also said buyers of Acxiom data are barred by law from using it to determine credit or insurance eligibility or pricing.

“Acxiom is fundamentally committed to ethical data practices,” she said.

A sprawling, multibillion-dollar industry

Acxiom traces its roots to the 1960s, when it operated as Demographics Inc., reportedly mining phone directories to help the Democratic Party locate voters for mailers, according to The New York Times. It has since grown into one of the largest data companies in the world. Its parent company, Interpublic, reported $2.5 billion in revenue in a single quarter this year.

Yet Acxiom represents just one piece of a much larger data-broker economy — one worth hundreds of billions of dollars and expanding, according to estimates from Mozilla. The industry also wields significant political influence, spending heavily on lobbying efforts nationwide.

Data brokers typically build their profiles using three types of information, said Justin Sherman, a scholar-in-residence at the Electronic Privacy Information Center who previously led data-broker research at Duke University: information gathered directly, information gathered indirectly, and information generated through inference.

Direct data might come from an app a company operates or from acquiring a smaller business and absorbing its user data. Indirect data often comes from public records — property filings, marriage licenses, court documents — sources Acxiom has acknowledged using.

Inferences, Sherman said, are where things get murkier. A person’s use of a religious news app might suggest their faith; a dating app catering to LGBTQ+ users might reveal sexual orientation; geolocation data showing visits to a school or medical office might reveal details about family life or health. “From that I can derive all kinds of information about other characteristics: finance, health, demographics, religion,” Sherman said.

Whether accurate or not, this information can cause harm. Correct data offers marketers an unsettlingly precise view into someone’s life. Inaccurate data — say, faulty driving records — can unfairly raise insurance costs, according to Consumer Reports.

And most people have little ability to stop their information from being collected in the first place.

How the law treats data brokers

Without a comprehensive federal privacy law, some states have stepped in. California, Oregon, Vermont and Texas all require companies meeting certain thresholds to register as data brokers, and some, including California, mandate that brokers give consumers ways to access or delete their information. California recently launched a website allowing residents to demand hundreds of brokers stop collecting and selling their data — a process CalMatters and The Markup have detailed in a separate guide.

Concerns are also growing that broker-collected data could be used to justify discriminatory pricing; at least 30 states, including California, have considered legislation this year addressing how companies price identical products differently for different customers.

Enforcement, however, remains inconsistent. A report this year from Privacy Rights Clearinghouse and the Electronic Frontier Foundation found hundreds of companies registered in one state’s broker database but missing from others with similar requirements.

It’s unclear how many qualifying data brokers avoid registering altogether. “The data broker industry is way underregulated,” Sherman said, adding that the sector’s practices raise deep questions about privacy rights and civil liberties.

There’s little preventing brokers from continuing to expand their surveillance methods and selling that information widely — including, in some cases, to government agencies. Reports have indicated that agencies such as the National Security Agency have purchased commercially available data as a way to sidestep traditional warrant requirements.

Data brokers typically defend their practices as legal, arguing that consumers consent when they sign up for loyalty programs or accept lengthy terms-of-service agreements that permit data sharing. But Sherman said most people have never heard of these companies, let alone knowingly agreed to have their information sold.

“The notion that a data broker gets consent to sell someone’s data to clients flies in the face of years of academic peer-reviewed research, polling, news reporting, and people’s personal experiences,” Sherman said. “People are not actually consenting to this, so that notion is fanciful.”

Original source: CalMatters

The post Disney, GM, Your Bank and More: Inside the Market for Your Personal Data appeared first on The Hemet & San Jacinto Chronicle.

Assembly Bill 1776, known as the COMPETE Act, would broaden California’s antitrust laws to let individuals and businesses take companies to state court if they believe unfair, monopolistic tactics have caused them harm. Currently, such lawsuits generally require proof that two or more companies conspired to squeeze out competitors. Federal law does allow claims against a single company acting alone, but supporters of the bill argue that federal courts have weakened antitrust protections so significantly that California needs its own, stronger version.

The debate has emerged as one of the more heated fights of this legislative session, drawing battle lines between labor unions and trial attorneys on one side and business and technology lobbying groups on the other. Together, these interests have poured more than $106 million into California campaign coffers since 2000, according to CalMatters’ Digital Democracy database.

Backers of the bill say it would give everyday Californians a legal tool to keep neighborhood grocery stores and pharmacies from being squeezed out, prevent single corporations from controlling entire supply chains that farms and restaurants depend on, and preserve patient choice in health care.

Assembly Majority Leader Cecilia Aguiar-Curry, a Davis Democrat who authored the bill, told the Senate Judiciary Committee last month that more than three-quarters of American industries have grown increasingly consolidated since the late 1990s.

“When companies gain that much power and abuse it, that means higher prices, less choice, fewer opportunities for job creators to start small businesses and suppressed wages for working families,” Aguiar-Curry told the panel.

Business advocates counter that the measure would open the door for opportunistic law firms to target companies with costly lawsuits, regardless of merit. They point to California’s history with other consumer-protection statutes — covering disability access, product warning labels, wage claims and privacy — that critics say have spawned a cottage industry of litigation aimed more at settlements than genuine reform.

The California Chamber of Commerce has been especially vocal in its opposition, going so far as to put up billboards near the state Capitol earlier this year calling out Aguiar-Curry by name. One read: “Cecilia, prices are high enough already. Don’t make life more expensive for California consumers.” A Chamber spokesperson declined to comment further on the billboard campaign.

Rather than quiet the bill’s momentum, though, the public pressure campaign appears to have strengthened support among many Democrats, even as some moderates in the party remain uneasy about the potential impact on businesses operating in the state.

Babette Boliek, a law professor at Pepperdine University and former chief economist for the Federal Communications Commission, said those concerns aren’t unfounded. She argues the bill’s language is too vague, potentially giving judges broad discretion to rule based on sympathy rather than clear evidence of harm — comparing it to enforcing “a speed limit that no one knows exists.”

In response to criticism, Aguiar-Curry’s office added a carve-out meant to shield small, independently owned California businesses — those with 100 or fewer employees and average annual gross revenue under $10 million over the past three years.

Still, Cal Chamber Executive Vice President Ben Golombek argues that thousands of businesses of all sizes would remain exposed to expensive litigation, including lawsuits filed by rival companies. “This unprecedented and massive legal liability for businesses of every size — small, medium, and large — that this bill creates is why we’re so opposed to it,” he said.

On the other side, labor leaders say the measure is overdue. Mark Ramos, president of the United Food and Commercial Workers Western States Council, said increasing consolidation among grocery chains has made it harder for workers to negotiate fair wages, since fewer competitors means less pressure on employers to offer better pay. “With that consolidation has come the larger challenge of not being able to negotiate a contract that allows our members to kind of thrive in their local economy because these grocers no longer have to compete against each other,” Ramos said.

Despite the bill’s momentum, some Democrats remain cautious. Sen. Tom Umberg, a Santa Ana Democrat who chairs the Senate Judiciary Committee, has raised concerns about allowing private citizens and businesses — rather than just government prosecutors — to file these lawsuits. He has pushed for enforcement to rest solely with the state attorney general and local district attorneys, at least for now.

“We want to make sure that we are not stifling competition by virtue of the threat of lawsuits,” Umberg told the committee.

Aguiar-Curry has agreed to make several changes Umberg requested but has stopped short of limiting enforcement power to prosecutors alone. She said she would keep refining the bill to make it “harder to bring a meritless suit” before its next hearing.

The bill cleared the Judiciary Committee, with only Republicans voting against it. However, Umberg abstained rather than casting a “no” vote — a move that carries the same practical effect. He was among 16 Democrats who declined to vote when the bill narrowly passed the Assembly, a common maneuver lawmakers use to avoid publicly opposing legislation backed by powerful allies while still signaling discomfort.

The COMPETE Act is next scheduled to be heard by the Senate Appropriations Committee when the Legislature reconvenes from summer recess in early August.

Supporters are hoping the final version of the bill preserves the right of ordinary Californians to sue over anticompetitive conduct. Lee Hepner, senior legal counsel at the American Economic Liberties Project, an advocacy group focused on curbing corporate monopolies, said allowing private lawsuits is essential to keeping large corporations in check.

Without that option, he warned, companies with deep pockets and political influence could pressure regulators and lawmakers into looking the other way. “The private right of action is a critical backstop to the politicization of antitrust enforcement, which threatens the entire project of policing markets for fairness,” Hepner said.

Original source: CalMatters

The post California Democrats Split Over Proposal Making It Easier to Sue Corporations appeared first on The Hemet & San Jacinto Chronicle.

Since Jan. 1, residents of the Golden State can use a new tool to request removal of their personal information held by more than 500 data brokers.

The Delete Request and Opt-out Platform, or DROP, is a simple-to-use tool that lets people submit requests for their personal data to be scrubbed from databases.

It’s the first system of its kind in the United States, and launched after legislation that expanded consumer privacy rights and added obligations for companies.

Privacy advocates say DROP is a useful for helping people reclaim some of their privacy from the data broker industry, which collects scraps of personal information to sell for marketing and other purposes.

Here’s a guide to how it works:

Submit a request

Go to the official DROP website at privacy.ca.gov/drop. Read through the terms of use before accepting.

You’ll have two ways to verify you’re a California resident and set up your profile, either by filling in your personal information or by using a login.gov account.

Most people will use the first option, which requires name, date of birth and address, and a phone number or email address to receive a verification code.

If you opt to use login.gov, you’ll need to upload a copy of your passport, driver’s license or state ID.

Next, fill out your deletion request with your name, birthdate and ZIP code. You’ll also again need to provide a phone number or an email address, to receive another verification code.

Perhaps you went by a different name previously, such as a maiden name? You can add multiple versions of all the information types, except your birthdate.

“The more information you provide, the more likely your personal data will be deleted,” the DROP website says.

Identifiers

There are also fields to add a “unique identifier,” either in the form of a Mobile Advertising ID for iOS or Android devices, a connected TV ID, or a vehicle identification number, or VIN.

Android identifiers are found in the settings menu. Apple doesn’t allow users to find the code, but it can be turned off in settings. More information is available on the CPPA website.

Most people don’t have these numbers at hand. You can skip this section and add them later.

Timeline

While people can sign up now, data brokers won’t start deleting information until Aug. 1. After that they will process deletion requests every 45 days. Data brokers that fail to comply face fines of $200 a day.

Perhaps you moved to a new house or bought a new phone or car after you filed your request. You can always go back to your profile to update it with more information and submit a fresh deletion request at any time.

Data brokers

Data brokers are shadowy intermediaries that sweep up scraps of personal information about consumers and package them for sale in vast databases with millions of records, often without consent.

They data is bought from businesses that people deal with, scraped from websites or captured with tracking tools on mobile devices.

Buyers could include legit groups such as landlords and insurance companies, or “malicious actors” like fraudsters, hate groups, domestic abusers or hostile foreign governments, the California privacy watchdog says.

“While some of this data is used to provide you with personalized services such as targeted advertising, misuse of this data can lead to identity theft, stalking or other harmful outcomes,” it said.

Types of data

Personal information collected by brokers includes your online purchases, web browsing history, employment data and IP address. It could also include sensitive information like a social security or passport number, driver’s license, precise geolocation and info on health and sexual orientation.

Deletion requests will include any so-called “inferred preferences” — in other words, assumptions about what you might buy based on the data.

What’s not covered

Privacy experts welcomed DROP but noted some blind spots.

It only covers data brokers who are registered in California. Some categories of data are exempt like public records for car and real estate ownership or credit rating info.

Still, “it is a good step for people to take,” said Hayley Tsukayama, director of state affairs at the Electronic Frontier Foundation. She also noted that DROP focuses on deletion and opting out, “which is really important, but the law itself doesn’t address (data) collection that strongly,” in contrast with European Union privacy regulations known as GDPR that spawned browser cookie consent popups.

Benefits

People should see fewer things like spam texts or emails for lists they didn’t subscribe to, said Tsukayama. “That’s kind of my hope, because those are the sorts of things that are getting sold and that’s kind of the most tangible way to grasp what a data broker is.”

Another, less obvious benefit is cutting the amount of location or medical data floating around that could get fed into algorithms.

“For everyone’s privacy, I hope that data brokers would have less access to some of this sensitive information,” said Tsukayama.

The post One Tech Tip: Californians have a new privacy tool for deleting their data appeared first on The Hemet & San Jacinto Chronicle.