That’s the takeaway from a new investigation, coreported with Consumer Reports, into Acxiom, the Arkansas-based data broker that claims to hold information on billions of people worldwide — everything from where they live to how they spend money, and even inferences about their political leanings, weight, and interest in certain medical procedures.

For Tracey Reed, a nonprofit worker in Oregon, requesting her file from Acxiom produced a 58-page document tracking her presumed income, education, employment history and spending habits, from online purchases to charitable donations. The company had attempted to pinpoint her home down to latitude and longitude, and listed dozens of businesses that had purchased her data or Acxiom’s inferences about her — though Reed said much of the information was simply wrong.

“I think it’s pretty gross that people are treated like sources of wealth to be mined,” Reed said. “That’s what these data profiles are, like, ‘Here’s a guide for how to squeeze this person and get money out of them.'”

Reed’s experience is one of more than 100 personal data requests gathered by Consumer Reports’ advocacy team as part of an effort to test how well newer state privacy laws are actually working. The nonprofit shared those findings with CalMatters and The Markup, who focused their review on Acxiom specifically — both for its size and outsized role in the data-broker industry, and because it disclosed unusually detailed information in response to consumer requests.

Acxiom’s business dealings have drawn press scrutiny for years, but the newly obtained files reveal specifics that go well beyond what has previously been reported, including thousands of narrow categories the company uses to size up consumers — from the ages and genders of their children to their “alcohol usage” to a 1-100 score estimating how likely they are to buy a Tesla Cybertruck.

The project was made possible by a handful of state laws passed in recent years — including in California, Oregon and Minnesota — that give residents the right to see what data brokers have compiled about them and, in some cases, who bought it.

Sifting through the files, reporters found Acxiom makes predictions in more than 3,000 categories touching on nearly every corner of a person’s financial and personal life. Some of that information is clearly geared toward retail marketing: scores estimating the odds a consumer will shop at Nike, Buffalo Wild Wings or PlayStation, or whether they own particular car models.

But other estimates go much further, rating the likelihood someone would respond to a student loan consolidation offer, donate to charity, or fall into a certain body-mass-index range. Acxiom also scored the probability that individuals faced food insecurity, had a primary care doctor, were due for a mammogram, could afford medical bills, or had shown online interest in joining the Army.

Perhaps the most striking discovery, according to privacy researchers interviewed for this story, was the list of companies that had purchased Acxiom data — more than 100 in total. Laws in states such as Oregon and Minnesota require brokers to disclose not just what data they collect, but who buys it.

Household names turned up repeatedly in the files: insurance giants GEICO and State Farm; banking heavyweights Citi, JPMorgan Chase and US Bank; and pharmaceutical company Janssen. Retailers and consumer brands including General Motors, Hilton, Kohl’s, MLB.com, Southwest Airlines, T-Mobile and the Walt Disney Company also appeared as buyers. So did smaller firms with histories of regulatory trouble, such as Affinion Benefits Group (now CXLoyalty/Tenerity), Endurance Warranty Services and Mailers Haven.

Of the more than 100 companies identified as Acxiom customers, few responded when contacted for comment, and those that did generally defended the practice as a legitimate marketing tool. Farmers Insurance spokesperson Luis Sahagun said the company uses “consumer data to help improve the efficiency and effectiveness of our marketing outreach” and is “committed to responsible use of any consumer information we may obtain from third parties.”

Marketing lists, loan pitches and health “risk scores”

Businesses typically use files like Acxiom’s to identify prospective customers and understand life changes — a new baby, a spouse’s death — that might make someone receptive to a particular pitch. That allows banks, insurers and drug companies to narrow their marketing down to extremely small groups of people.

One company, HealthVerity, a Philadelphia-based startup billed as the country’s “largest healthcare data ecosystem,” appeared as a buyer in every Acxiom file reviewed by reporters. HealthVerity sells deidentified patient data to businesses and government agencies, including the Centers for Disease Control and Prevention, and touts case studies in which insurers and drugmakers use its data to recruit research subjects or build marketing lists.

The company also markets an underwriting tool that generates “risk scores” for health, life, disability and workers’ compensation insurers. Separately, HealthVerity advertises a product built on “more than 1,000 attributes from providers typically not available, such as Acxiom, Epsilon, Adstra and others,” including race, online behavior and lifestyle data.

Acxiom’s own privacy policy states its data cannot be used for insurance underwriting under the federal Fair Credit Reporting Act. But because HealthVerity operates as a “healthcare analytics” firm rather than a credit reporting agency, its products may fall outside that law’s reach, experts say. HealthVerity did not respond to requests for comment.

“There are a lot of holes in this Swiss cheese of privacy law,” said Ari Ezra Waldman, a University of California, Irvine law professor who studies the data economy.

Federal privacy protections can be inconsistent. The Health Insurance Portability and Accountability Act shields most medical records, but data such as heart rate, step counts or sleep patterns collected by devices like Apple Watches or Garmin trackers generally isn’t covered by the same rules.

Several companies with troubled regulatory histories also turned up repeatedly as buyers in the files. OneMain Financial, a subprime lender, was sued in March by 13 state attorneys general over allegations it packed loans with hundreds of dollars in hidden fees per borrower. Centene Corporation, the world’s largest Medicaid managed care company, has faced lawsuits from California and other states accusing it of inflating pharmacy costs. And Janssen Pharmaceuticals, a Johnson & Johnson subsidiary that appeared in every file examined, has paid billions in settlements tied to alleged off-label marketing and physician kickbacks.

When personal data fuels marketing for costly financial products, the consequences for vulnerable consumers can be severe, said Lena Cohen, a staff technologist with the Electronic Frontier Foundation who studies the data broker industry — particularly when high-interest loans are targeted at people already in financial distress.

“The extremely personal data we see in these files doesn’t appear out of nowhere,” Cohen said. “There is a network of companies and tech that have to share this data for a data broker to collect it. And it can have real harms.”

The files also contained numerous errors drawn from public records — inaccuracies Cohen said undercut the industry’s argument that such extensive data collection is necessary for advertising to function.

Reed, who still uses a flip phone and blocks ads out of habit, said Acxiom nonetheless attempted to profile her closely. Some details were wrong — her address history appeared to blend her information with her parents’ — but her spending patterns were accurately captured.

Critics also point to vague terminology in Acxiom’s reports that may serve as a proxy for protected categories such as race or health status. One file rated a person’s “assimilation level” as “3+ generations in the US.” Others scored “health conscientiousness,” “likelihood to be a smoker” and “social setting behavior.”

“We don’t actually know what goes into these kind of vague terms,” Waldman said, adding that “assimilation level” likely reflects “things like race, ethnicity, immigration status, things that we don’t normally like to discriminate on,” dressed up in softer language “to hide the true nature of what’s going on.”

Acxiom spokesperson Sherry Hamilton said in a statement that the company ensures “all data is sourced ethically, used responsibly, and protected securely,” and that its data suppliers are required to give consumers “appropriate notice and choice.” She said the files given to consumers through Consumer Reports’ project were intentionally unfiltered for transparency purposes, while data delivered to paying clients is more refined and accurate.

Hamilton added that health-related categories don’t indicate someone has an illness — only that they “may be interested in information about a condition, treatment, or product” — and that assimilation scores apply to households, not individuals, and don’t indicate race, ethnicity or immigration status. She also said buyers of Acxiom data are barred by law from using it to determine credit or insurance eligibility or pricing.

“Acxiom is fundamentally committed to ethical data practices,” she said.

A sprawling, multibillion-dollar industry

Acxiom traces its roots to the 1960s, when it operated as Demographics Inc., reportedly mining phone directories to help the Democratic Party locate voters for mailers, according to The New York Times. It has since grown into one of the largest data companies in the world. Its parent company, Interpublic, reported $2.5 billion in revenue in a single quarter this year.

Yet Acxiom represents just one piece of a much larger data-broker economy — one worth hundreds of billions of dollars and expanding, according to estimates from Mozilla. The industry also wields significant political influence, spending heavily on lobbying efforts nationwide.

Data brokers typically build their profiles using three types of information, said Justin Sherman, a scholar-in-residence at the Electronic Privacy Information Center who previously led data-broker research at Duke University: information gathered directly, information gathered indirectly, and information generated through inference.

Direct data might come from an app a company operates or from acquiring a smaller business and absorbing its user data. Indirect data often comes from public records — property filings, marriage licenses, court documents — sources Acxiom has acknowledged using.

Inferences, Sherman said, are where things get murkier. A person’s use of a religious news app might suggest their faith; a dating app catering to LGBTQ+ users might reveal sexual orientation; geolocation data showing visits to a school or medical office might reveal details about family life or health. “From that I can derive all kinds of information about other characteristics: finance, health, demographics, religion,” Sherman said.

Whether accurate or not, this information can cause harm. Correct data offers marketers an unsettlingly precise view into someone’s life. Inaccurate data — say, faulty driving records — can unfairly raise insurance costs, according to Consumer Reports.

And most people have little ability to stop their information from being collected in the first place.

How the law treats data brokers

Without a comprehensive federal privacy law, some states have stepped in. California, Oregon, Vermont and Texas all require companies meeting certain thresholds to register as data brokers, and some, including California, mandate that brokers give consumers ways to access or delete their information. California recently launched a website allowing residents to demand hundreds of brokers stop collecting and selling their data — a process CalMatters and The Markup have detailed in a separate guide.

Concerns are also growing that broker-collected data could be used to justify discriminatory pricing; at least 30 states, including California, have considered legislation this year addressing how companies price identical products differently for different customers.

Enforcement, however, remains inconsistent. A report this year from Privacy Rights Clearinghouse and the Electronic Frontier Foundation found hundreds of companies registered in one state’s broker database but missing from others with similar requirements.

It’s unclear how many qualifying data brokers avoid registering altogether. “The data broker industry is way underregulated,” Sherman said, adding that the sector’s practices raise deep questions about privacy rights and civil liberties.

There’s little preventing brokers from continuing to expand their surveillance methods and selling that information widely — including, in some cases, to government agencies. Reports have indicated that agencies such as the National Security Agency have purchased commercially available data as a way to sidestep traditional warrant requirements.

Data brokers typically defend their practices as legal, arguing that consumers consent when they sign up for loyalty programs or accept lengthy terms-of-service agreements that permit data sharing. But Sherman said most people have never heard of these companies, let alone knowingly agreed to have their information sold.

“The notion that a data broker gets consent to sell someone’s data to clients flies in the face of years of academic peer-reviewed research, polling, news reporting, and people’s personal experiences,” Sherman said. “People are not actually consenting to this, so that notion is fanciful.”

Original source: CalMatters

The post Disney, GM, Your Bank and More: Inside the Market for Your Personal Data appeared first on The Hemet & San Jacinto Chronicle.

A new investigation, conducted jointly by CalMatters and Consumer Reports, pulled back the curtain on what these companies actually know about ordinary people — including many Southern California residents whose digital habits, purchases and even health guesses are being bought and sold without their knowledge.

Reporters asked for volunteers to formally request their personal data files from some of the country’s largest data brokers, firms such as Acxiom and Epsilon. Newer privacy laws in several states now require brokers to reveal which companies purchased a person’s information, making these requests possible. Hundreds of people stepped forward, and the resulting files paint a startling picture of just how much is tracked, guessed at and monetized.

What’s actually in these files

The reports obtained by volunteers were extensive — containing names, home addresses, Social Security numbers and, in many cases, more than a thousand inferred details about personal habits and characteristics. The files aren’t static, either. They’re constantly updated and sold to more than 100 major U.S. corporations, according to the investigation.

Among the data points found in these profiles: the last time someone logged into their computer, how much they’ve spent on clothing, furniture or restaurants over several years, how many children they have and those children’s ages and genders, whether someone is considered “blue collar” or “white collar,” and even whether a person has ever been the victim of fraud.

Not all of it is accurate. In one case, a single report contained six conflicting guesses about a person’s age.

A file that starts with your identity — and outlives you

Data brokers maintain records on nearly every American adult. Acxiom claims to have profiles covering roughly 95% of U.S. adults, while Epsilon says it holds data on nearly every “marketable” household in the country. These companies compile information from public records, commercial databases and other data brokers, building a profile that can follow someone from childhood well into old age — and even after death, according to the investigation.

Your gadgets are quietly reporting on you

The report also found that identifiers tied to a person’s phone, smart TV, home internet connection and even their car’s vehicle identification number are collected and cross-referenced by brokers. These identifiers allow companies to link a person’s behavior across multiple devices — meaning a search on a laptop, a habit tracked on a smart TV, and driving patterns from a connected vehicle can all be merged into a single profile.

You’re assigned a dollar value

While brokers typically don’t have direct access to bank accounts, they estimate income, savings and net worth using “modeled” predictions based on someone’s neighborhood, past purchases and the financial profiles of similar consumers.

Health and identity: educated guesses, not medical records

Without access to actual medical files, brokers infer sleep habits, smoking status, body mass index and whether someone carries health insurance. They also estimate religion, ethnicity, political leanings and the precise ages of a person’s children. These inferences are frequently sold to pharmaceutical companies, healthcare organizations and insurers.

Predicting your next move

Beyond describing who you are, brokers try to predict what you’ll do next — estimating the likelihood a person will buy a particular brand’s product, what type of car they might purchase, where they’re likely to dine, or whether they’re considering investing in cryptocurrency.

You’ve been assigned a “value” and a “profit” label

Perhaps most striking, some brokers assign consumers scores meant to estimate their financial usefulness to companies. Epsilon, for instance, sorts people into 26 “NICHES” categories with labels like “Easy Street,” “Mid Life Munchkins” and “Big Spender Parents,” and separately ranks how profitable a person might be to a business using tags such as “Best Profit Margin.”

Acxiom, meanwhile, calculates something it calls a “lifetime value score” — a number ranging from 0 to 200,000 used by auto, home and health insurers to estimate how profitable a customer might be. Acxiom then layers on additional labels, describing people as, for example, “Seniors ages 64+ years, with a medium ability to pay for medical expenses,” or “3+ Generations in the US.”

Who’s actually buying this information

The reports didn’t just reveal what was collected — they identified the specific companies that purchased people’s profiles. Investigators found hundreds of buyers across the files reviewed, spanning banks, insurers, retailers and lenders.

What happens once your data is sold

Once a profile lands in a company’s hands, it can shape real financial outcomes. Insurers use the data to evaluate the health risk of a company’s workforce when preparing quotes and premiums. Personal lenders use it to flag consumers who might need quick cash or are shopping for a vehicle — sometimes steering them toward loans with unfavorable terms and high interest rates. Banks use similar profiles to market extra financial products, such as identity theft protection or credit monitoring services, that a customer may not actually need.

Why opting out doesn’t solve the problem

Because most data brokers obtain information from other companies rather than directly from consumers, there’s no clear moment when someone agreed to share their information — and no simple way to undo it. Opting out of one broker’s database removes a person’s data from that single company, but it does nothing to erase the copies already sold and duplicated across dozens of other firms.

For now, experts say, the best defense consumers have is awareness — understanding that nearly every online interaction, purchase and device ping is quietly feeding a profile that’s being bought, sold and used to make decisions about their lives, often without their knowledge.

Original source: CalMatters

The post Data Brokers Are Building Detailed Profiles on You — Here’s What They Know and Why It Matters appeared first on The Hemet & San Jacinto Chronicle.