That’s the takeaway from a new investigation, coreported with Consumer Reports, into Acxiom, the Arkansas-based data broker that claims to hold information on billions of people worldwide — everything from where they live to how they spend money, and even inferences about their political leanings, weight, and interest in certain medical procedures.

For Tracey Reed, a nonprofit worker in Oregon, requesting her file from Acxiom produced a 58-page document tracking her presumed income, education, employment history and spending habits, from online purchases to charitable donations. The company had attempted to pinpoint her home down to latitude and longitude, and listed dozens of businesses that had purchased her data or Acxiom’s inferences about her — though Reed said much of the information was simply wrong.

“I think it’s pretty gross that people are treated like sources of wealth to be mined,” Reed said. “That’s what these data profiles are, like, ‘Here’s a guide for how to squeeze this person and get money out of them.'”

Reed’s experience is one of more than 100 personal data requests gathered by Consumer Reports’ advocacy team as part of an effort to test how well newer state privacy laws are actually working. The nonprofit shared those findings with CalMatters and The Markup, who focused their review on Acxiom specifically — both for its size and outsized role in the data-broker industry, and because it disclosed unusually detailed information in response to consumer requests.

Acxiom’s business dealings have drawn press scrutiny for years, but the newly obtained files reveal specifics that go well beyond what has previously been reported, including thousands of narrow categories the company uses to size up consumers — from the ages and genders of their children to their “alcohol usage” to a 1-100 score estimating how likely they are to buy a Tesla Cybertruck.

The project was made possible by a handful of state laws passed in recent years — including in California, Oregon and Minnesota — that give residents the right to see what data brokers have compiled about them and, in some cases, who bought it.

Sifting through the files, reporters found Acxiom makes predictions in more than 3,000 categories touching on nearly every corner of a person’s financial and personal life. Some of that information is clearly geared toward retail marketing: scores estimating the odds a consumer will shop at Nike, Buffalo Wild Wings or PlayStation, or whether they own particular car models.

But other estimates go much further, rating the likelihood someone would respond to a student loan consolidation offer, donate to charity, or fall into a certain body-mass-index range. Acxiom also scored the probability that individuals faced food insecurity, had a primary care doctor, were due for a mammogram, could afford medical bills, or had shown online interest in joining the Army.

Perhaps the most striking discovery, according to privacy researchers interviewed for this story, was the list of companies that had purchased Acxiom data — more than 100 in total. Laws in states such as Oregon and Minnesota require brokers to disclose not just what data they collect, but who buys it.

Household names turned up repeatedly in the files: insurance giants GEICO and State Farm; banking heavyweights Citi, JPMorgan Chase and US Bank; and pharmaceutical company Janssen. Retailers and consumer brands including General Motors, Hilton, Kohl’s, MLB.com, Southwest Airlines, T-Mobile and the Walt Disney Company also appeared as buyers. So did smaller firms with histories of regulatory trouble, such as Affinion Benefits Group (now CXLoyalty/Tenerity), Endurance Warranty Services and Mailers Haven.

Of the more than 100 companies identified as Acxiom customers, few responded when contacted for comment, and those that did generally defended the practice as a legitimate marketing tool. Farmers Insurance spokesperson Luis Sahagun said the company uses “consumer data to help improve the efficiency and effectiveness of our marketing outreach” and is “committed to responsible use of any consumer information we may obtain from third parties.”

Marketing lists, loan pitches and health “risk scores”

Businesses typically use files like Acxiom’s to identify prospective customers and understand life changes — a new baby, a spouse’s death — that might make someone receptive to a particular pitch. That allows banks, insurers and drug companies to narrow their marketing down to extremely small groups of people.

One company, HealthVerity, a Philadelphia-based startup billed as the country’s “largest healthcare data ecosystem,” appeared as a buyer in every Acxiom file reviewed by reporters. HealthVerity sells deidentified patient data to businesses and government agencies, including the Centers for Disease Control and Prevention, and touts case studies in which insurers and drugmakers use its data to recruit research subjects or build marketing lists.

The company also markets an underwriting tool that generates “risk scores” for health, life, disability and workers’ compensation insurers. Separately, HealthVerity advertises a product built on “more than 1,000 attributes from providers typically not available, such as Acxiom, Epsilon, Adstra and others,” including race, online behavior and lifestyle data.

Acxiom’s own privacy policy states its data cannot be used for insurance underwriting under the federal Fair Credit Reporting Act. But because HealthVerity operates as a “healthcare analytics” firm rather than a credit reporting agency, its products may fall outside that law’s reach, experts say. HealthVerity did not respond to requests for comment.

“There are a lot of holes in this Swiss cheese of privacy law,” said Ari Ezra Waldman, a University of California, Irvine law professor who studies the data economy.

Federal privacy protections can be inconsistent. The Health Insurance Portability and Accountability Act shields most medical records, but data such as heart rate, step counts or sleep patterns collected by devices like Apple Watches or Garmin trackers generally isn’t covered by the same rules.

Several companies with troubled regulatory histories also turned up repeatedly as buyers in the files. OneMain Financial, a subprime lender, was sued in March by 13 state attorneys general over allegations it packed loans with hundreds of dollars in hidden fees per borrower. Centene Corporation, the world’s largest Medicaid managed care company, has faced lawsuits from California and other states accusing it of inflating pharmacy costs. And Janssen Pharmaceuticals, a Johnson & Johnson subsidiary that appeared in every file examined, has paid billions in settlements tied to alleged off-label marketing and physician kickbacks.

When personal data fuels marketing for costly financial products, the consequences for vulnerable consumers can be severe, said Lena Cohen, a staff technologist with the Electronic Frontier Foundation who studies the data broker industry — particularly when high-interest loans are targeted at people already in financial distress.

“The extremely personal data we see in these files doesn’t appear out of nowhere,” Cohen said. “There is a network of companies and tech that have to share this data for a data broker to collect it. And it can have real harms.”

The files also contained numerous errors drawn from public records — inaccuracies Cohen said undercut the industry’s argument that such extensive data collection is necessary for advertising to function.

Reed, who still uses a flip phone and blocks ads out of habit, said Acxiom nonetheless attempted to profile her closely. Some details were wrong — her address history appeared to blend her information with her parents’ — but her spending patterns were accurately captured.

Critics also point to vague terminology in Acxiom’s reports that may serve as a proxy for protected categories such as race or health status. One file rated a person’s “assimilation level” as “3+ generations in the US.” Others scored “health conscientiousness,” “likelihood to be a smoker” and “social setting behavior.”

“We don’t actually know what goes into these kind of vague terms,” Waldman said, adding that “assimilation level” likely reflects “things like race, ethnicity, immigration status, things that we don’t normally like to discriminate on,” dressed up in softer language “to hide the true nature of what’s going on.”

Acxiom spokesperson Sherry Hamilton said in a statement that the company ensures “all data is sourced ethically, used responsibly, and protected securely,” and that its data suppliers are required to give consumers “appropriate notice and choice.” She said the files given to consumers through Consumer Reports’ project were intentionally unfiltered for transparency purposes, while data delivered to paying clients is more refined and accurate.

Hamilton added that health-related categories don’t indicate someone has an illness — only that they “may be interested in information about a condition, treatment, or product” — and that assimilation scores apply to households, not individuals, and don’t indicate race, ethnicity or immigration status. She also said buyers of Acxiom data are barred by law from using it to determine credit or insurance eligibility or pricing.

“Acxiom is fundamentally committed to ethical data practices,” she said.

A sprawling, multibillion-dollar industry

Acxiom traces its roots to the 1960s, when it operated as Demographics Inc., reportedly mining phone directories to help the Democratic Party locate voters for mailers, according to The New York Times. It has since grown into one of the largest data companies in the world. Its parent company, Interpublic, reported $2.5 billion in revenue in a single quarter this year.

Yet Acxiom represents just one piece of a much larger data-broker economy — one worth hundreds of billions of dollars and expanding, according to estimates from Mozilla. The industry also wields significant political influence, spending heavily on lobbying efforts nationwide.

Data brokers typically build their profiles using three types of information, said Justin Sherman, a scholar-in-residence at the Electronic Privacy Information Center who previously led data-broker research at Duke University: information gathered directly, information gathered indirectly, and information generated through inference.

Direct data might come from an app a company operates or from acquiring a smaller business and absorbing its user data. Indirect data often comes from public records — property filings, marriage licenses, court documents — sources Acxiom has acknowledged using.

Inferences, Sherman said, are where things get murkier. A person’s use of a religious news app might suggest their faith; a dating app catering to LGBTQ+ users might reveal sexual orientation; geolocation data showing visits to a school or medical office might reveal details about family life or health. “From that I can derive all kinds of information about other characteristics: finance, health, demographics, religion,” Sherman said.

Whether accurate or not, this information can cause harm. Correct data offers marketers an unsettlingly precise view into someone’s life. Inaccurate data — say, faulty driving records — can unfairly raise insurance costs, according to Consumer Reports.

And most people have little ability to stop their information from being collected in the first place.

How the law treats data brokers

Without a comprehensive federal privacy law, some states have stepped in. California, Oregon, Vermont and Texas all require companies meeting certain thresholds to register as data brokers, and some, including California, mandate that brokers give consumers ways to access or delete their information. California recently launched a website allowing residents to demand hundreds of brokers stop collecting and selling their data — a process CalMatters and The Markup have detailed in a separate guide.

Concerns are also growing that broker-collected data could be used to justify discriminatory pricing; at least 30 states, including California, have considered legislation this year addressing how companies price identical products differently for different customers.

Enforcement, however, remains inconsistent. A report this year from Privacy Rights Clearinghouse and the Electronic Frontier Foundation found hundreds of companies registered in one state’s broker database but missing from others with similar requirements.

It’s unclear how many qualifying data brokers avoid registering altogether. “The data broker industry is way underregulated,” Sherman said, adding that the sector’s practices raise deep questions about privacy rights and civil liberties.

There’s little preventing brokers from continuing to expand their surveillance methods and selling that information widely — including, in some cases, to government agencies. Reports have indicated that agencies such as the National Security Agency have purchased commercially available data as a way to sidestep traditional warrant requirements.

Data brokers typically defend their practices as legal, arguing that consumers consent when they sign up for loyalty programs or accept lengthy terms-of-service agreements that permit data sharing. But Sherman said most people have never heard of these companies, let alone knowingly agreed to have their information sold.

“The notion that a data broker gets consent to sell someone’s data to clients flies in the face of years of academic peer-reviewed research, polling, news reporting, and people’s personal experiences,” Sherman said. “People are not actually consenting to this, so that notion is fanciful.”

Original source: CalMatters

The post Disney, GM, Your Bank and More: Inside the Market for Your Personal Data appeared first on The Hemet & San Jacinto Chronicle.

For Gytahnna Loffgren, whose family runs a small solar panel installation business, the letter that arrived in May felt like a nightmare. Her company was being sued for more than $35,000 over claims that its website violated California privacy law.

“We were completely blindsided,” Loffgren told CalMatters. “I’ve never been sued before… you instantly feel like you’ve done something terribly wrong.”

Loffgren’s case is one of thousands filed under the California Invasion of Privacy Act, a decades-old wiretapping law originally written to stop people from tapping telephone lines. Today, it’s being used against small businesses across the state over how their websites track visitors.

The California Legislature passed a bill Friday aimed at curbing these lawsuits, sending it to Gov. Gavin Newsom’s desk. Senate Bill 690 is being pitched as relief for beleaguered small-business owners who say they’ve been targeted by opportunistic lawyers. But critics say the legislation is something else entirely: a carefully engineered effort by Silicon Valley to escape accountability, dressed up as a favor to Main Street.

Backing the bill is a lineup of major tech companies, including Meta, Amazon, Google and X. Opposing it are some of the country’s most prominent privacy watchdogs, including the ACLU, the Tech Oversight Project and the National Consumer Law Center.

Those opponents argue that SB 690 is a Trojan horse, built on real frustration from small-business owners but shaped by tech industry lobbyists to serve a much larger purpose — eliminating the ability of everyday consumers to sue tech companies over data tracking violations. In its final form, the bill would strip individuals of the right to sue over these issues, leaving enforcement solely to the state attorney general’s office. It also includes a retroactivity provision that critics warn could unravel major ongoing privacy lawsuits against tech giants.

A spokesperson for the bill’s author, Sen. Anna Caballero, a Merced Democrat, said the goal has always been to stop what she considers frivolous lawsuits.

“Our bill accomplishes what we were able to achieve this year and reflects where we could come to a consensus,” the spokesperson said. “We recognize there is more work to do, and the Legislature will likely need to revisit this issue in a future session to address the remaining concerns.”

How a 1967 wiretapping law became a modern legal weapon

The California Invasion of Privacy Act dates back to 1967, when it was designed to prevent illegal phone-line eavesdropping. A 2015 amendment expanded the law to bar unauthorized use of devices that log routing or signaling information — a provision written with old-school “pen registers” and “trap and trace” devices in mind.

That update inadvertently opened the door for a wave of modern litigation. Attorneys have argued that everyday website tools — cookies, analytics trackers, even the Meta Pixel — function like digital pen registers because they log visitor information such as IP addresses. Over the past four years, lawyers representing targeted businesses estimate more than 4,000 lawsuits have been filed, with thousands more warning letters sent to business owners across the state.

“This is modern ambulance chasing, but it’s worse because at least with ambulance chasing, someone was harmed,” said Jim Monagle, an attorney with Mullen Coughlin who has defended healthcare clients against these claims. “Nobody’s really screaming out about the fact that a portion of their IP address was turned into a different unique ID… It doesn’t affect anyone.”

What makes the law so costly is its built-in penalty: $5,000 per violation, regardless of whether any real harm occurred. For small businesses running standard tools like Google Analytics, that can add up fast, often pressuring owners into costly settlements just to make the lawsuits go away.

Larger companies aren’t immune either. Earlier this year, the Los Angeles Times settled a similar class-action case for $3.85 million. Amazon and Meta are both fighting ongoing CIPA-related lawsuits tied to online tracking.

Even federal judges have criticized how the law is being applied. In an October 2025 ruling, U.S. District Judge Vince Chhabria — who oversees cases in the Bay Area — called the 1967 statute a “total mess” when stretched to cover modern internet technology, urging state lawmakers to rewrite the law from scratch.

Supporters of SB 690 say it answers that call, arguing that California’s existing privacy law, the California Consumer Privacy Act, already offers sufficient protection. But legislative analysts have pushed back on that claim. A report prepared for the Assembly Public Safety Committee found that the 2018 consumer privacy law doesn’t allow individuals to sue over routine tracking at all, leaving enforcement to an attorney general’s office that doesn’t have the staffing to monitor every website in the state.

Behind the scenes: a campaign built to look grassroots

Tracing the money behind SB 690 isn’t easy. California’s lobbying disclosure rules require organizations to report quarterly spending, but not how much goes toward any single bill — making it difficult to see exactly who is funding what.

One exception is the Alliance for Legal Fairness, a group created in 2024 specifically to push for changes to the wiretapping law and, eventually, to get SB 690 passed. It was founded by Andrew Kingman, a privacy attorney and lobbyist who also serves as general counsel for the State Privacy and Security Coalition, an influential industry group backed by companies including Amazon, Meta, Google and Mastercard that lobbies on data privacy issues nationwide.

In just two legislative quarters this year, Kingman’s Alliance spent more than $234,000 solely to advance the bill through the Capitol.

To build public support, the coalition identified small-business owners caught up in these lawsuits and encouraged them to testify in Sacramento. Supporters of the bill say it simply restores reasonable limits, pointing out that even some privacy advocacy groups use similar tracking tools on their own websites. But opponents argue the strategy is more calculated than that — using sympathetic small-business stories to build political cover while tech companies avoid direct scrutiny.

The financial muscle behind the bill goes well beyond one advocacy group. Companies including Meta, X Corp, Amazon, Chipotle, Mastercard and Chick-fil-A have collectively spent millions on lobbying in Sacramento this year, with a portion specifically earmarked for shaping SB 690.

Matt Schwartz, a policy analyst with Consumer Reports, said his organization has watched Kingman use a similar approach in privacy fights across “dozens and dozens” of states, making it difficult for lawmakers — let alone the public — to understand who is actually driving the legislation.

“These Big Tech companies rarely come into state legislatures with lobbyists saying that they’re from Meta or Google or Amazon and testify at the committee level with those affiliations out front,” Schwartz said. “Their own brand as giant companies might be too toxic to be out front, so they use smaller organizations as the mouthpiece. At the end of the day, it distorts the process — and it makes it almost impossible for lawmakers to see who’s actually pulling the strings until it’s too late.”

Kingman declined to comment on the record when asked whether his coalition is acting as a proxy for tech industry interests.

What’s really at stake: enforcement power and a retroactive clock

As originally written, SB 690 offered blanket protection for commercial tracking tools against both wiretapping and pen-register claims. After pushback from labor and privacy groups, Caballero narrowed the bill to focus only on pen-register claims, which involve metadata like IP addresses rather than the content of communications.

But as the bill moved through the Legislature, Caballero also added a retroactivity clause and altered how the law would be enforced — changes privacy advocates see as significant victories for the tech industry. They also warn that exempting metadata tracking altogether opens a serious loophole.

“California should be leading on tech regulation, but SB 690 does the exact opposite; it makes it easier for companies to spy on us,” said Jenna Sherman, campaign director at the women’s advocacy group Ultraviolet.

Ultraviolet joined the opposition largely because of the bill’s two-year retroactivity window, which could affect major ongoing cases — including Frasco v. Flo Health Inc., in which a San Francisco jury unanimously found Meta liable for improperly collecting sensitive reproductive health data, including details about users’ menstrual cycles and sexual activity, from the Flo Health period-tracking app without consent.

A judge overseeing that case has signaled Meta could owe as much as $8 billion in damages. The company has appealed the ruling and declined to comment when contacted by CalMatters.

Attorneys for the plaintiffs in that case say that if SB 690 had been law when they filed, they never would have been allowed to bring it — enforcement would have rested solely with the state.

That’s the outcome privacy advocates fear most. If Newsom signs SB 690, the five-year legal fight waged by the Flo Health plaintiffs may end up being remembered not as a turning point in data privacy law, but as one of the last times ordinary Californians were able to hold a tech giant accountable in front of a jury.

Original source: CalMatters

The post Silicon Valley Tapped Into Small Business Frustration to Fight California Privacy Law appeared first on The Hemet & San Jacinto Chronicle.