“You may not know them, but data brokers know you,” Federal Trade Commission (FTC) chairwoman Edith Ramirez said at the release of an FTC report about the data broker industry. Data brokers know where you live, what you buy, what medical conditions you have, your background, interests, and even the names of your kids. It sounds like something out of a sci-fi movie, so it is no wonder most Americans have no idea the thriving market for their personal information even exists. Here’s everything you need to know about how data brokers collect your information, what it is used for, and what protection you have.

What are data brokers?

Data brokers are companies that compile and resell or share the personal data of consumers. The FTC released a report on May 27, 2014 examining nine companies in the industry: Acxiom, CoreLogic, Datalogix, eBureau, ID Analytics, Intelius, PeekYou, Rapleaf and Recorded Future. These companies derive a whopping $426 million in annual revenue from their products.

The information set held by these companies is massive. Acxiom estimates it holds roughly 1,500 pieces of data per consumer. Another broker dwarfs Acxiom with 3,000 data points for nearly every U.S. consumer. One broker is said to maintain about 700 billion aggregated data elements and adds more than 3 billion pieces of data each month. Another database has information on 1.4 billion consumer transactions alone, such as credit card purchases. Watch an in-depth look at data brokers by 60 Minutes below.

Where do data brokers find their information?

Contentions with the data broker industry arise from the fact that information gleaned does not come directly from consumers. Data brokers garner a lot of information from publicly available sites. A site relaying U.S. Census data can provide information regarding local demographics and real estate value. These firms get additional information from voter records, tax records, court records, mortgages and property information, driving records, and numerous other avenues. Companies can scour social media sites, such as LinkedIn, for any publicly-available information. Data brokers also gain a lot of information from card loyalty programs, credit cards, and advertising agencies that may follow a user’s online activities. If you recently bought a subscription to Forbes Magazine or purchased a new dress from a catalog sent to your home, these data brokers will know. By compiling all this information, brokers begin to paint a profile of you, including your age, race, income, social security number, religion, political affiliation, criminal history, movie preferences, gun-ownership, gym membership, and hobbies.

What is this data used for?

Individual data points are compiled to form a profile of potential consumers who can then be targeted for specific products. The information allows companies to more accurately target consumers for advertising campaigns and gain information about consumer preferences. The FTC report shows that data brokers usually package data into two forms:

1. Data elements: Age, family, and interests.
2. Data segments: Compilation of interests used to to create a list of people with similar characteristics. Here are some examples of these list segments: “African-American Professional;” “Allergy Sufferer;” “Bible Lifestyle;” “Biker/Hell’s Angels;” “Plus-Size Apparel;” “Twitter User with 250+ friends.” Other categories include people with high cholesterol or those interested in novelty Elvis items.

Data brokers then use this information to create various products in three different categories:

1. Marketing: This includes mail, email, telemarketing, mobile, and TV campaigns. To target consumers, marketers use a process called “onboarding.” Onboarding allows marketers to load offline information, such as magazine subscriptions or store loyalty cards, into cookies that digital advertisers use to target consumers. Cookies are stored in a computer’s browser and allow advertisers to promote their products on numerous Internet services.
2. Risk Mitigation: This includes identity verification. These products use analytics to help banks comply with “know your customer” identity verification requirements under the USA Patriot Act. Products also include fraud detection to track patterns of attempted fraud. For instance, these products can track how long an email address has been used or whether a delivery address matches a listed consumer.
3. People Search: This includes products generally intended for use by individuals. Products can search for someone’s criminal record, ancestry, phone number, telephone history, or social media information. Most come in the form of fee-based search products.

Does the data make our lives easier?

Many people would agree that products that help to verify one’s identity are a good thing. Companies that can link consumer purchases to personal information like an address, phone number, and email drastically reduce chances of fraud. Some also see personalized advertising as a good thing. Say you are a senior citizen. Rather than scrolling through the Internet and seeing ads for baby strollers or discounted student loans, you might see ads for healthcare services. Targeted advertising means you receive information and discounts for things you actually use instead of products with no relevance to your life. Ideally the more information data brokers have about you, the more they can target your individual tastes. While each individual piece of data has little benefit, the aggregation of this data by data brokers is immensely beneficial to companies doing market research to improve and tailor their products.

How are data brokers changing political campaigns?

The use of personal data is not limited to what you buy. In the 2012 elections, campaigns contracted with political data brokers to match voting records with cookies on computers. Voter registration lists have long been used to target voters. Combined with more information, these lists now take a powerful form in the digital arena. Political microtargeting allows campaigns to utilize information from data brokers to deliver a specific message to a target demographic. Data can help campaigns decide which voters are most likely to respond to a specific ad or which groups need to be targeted with a specific message. Candidates can target registered Democrat or Republican voters with online ads and can even target based on how much the individual has donated to campaigns before.

President Obama’s 2012 re-election campaign was among the first to use big data to its advantage. The 2012 team assembled an analytics department five times the size of that in its 2008 campaign. Some insights into the use of data in Obama’s 2012 campaign:

• As TIME describes, the team discovered that East Coast women between 40 and 50 were not donating as much as hoped. This demographic was the most likely to hand over cash for the chance to dine with a gravitational celebrity. The campaign’s solution? A fundraising drive with the prize being a dinner with Sarah Jessica Parker.
• The campaign used data to predict how much money they would get from each fundraising email. They also used demographics to determine which groups would be most responsive to an email signed by either Barack Obama, Michelle Obama, or Joe Biden.
• The campaign bought data from brokers regarding the television-viewing habits of Ohioans. The campaign was able to combine lists of voters with lists of cable subscribers and then coordinate the information of watching habits. Using this information, they targeted campaign ads to specific demographics at the exact time these niche voters were watching TV. This led to the campaign buying airtime in shows like Sons of Anarchy and the Walking Dead rather than traditional news programming. Watch for more on the use of big data during Obama’s reelection campaign below.

Little information is disclosed on just how much data campaigns can access. Inevitably the collection and effective use of data will play a huge role in the 2016 presidential election, but not all consumers are happy with that. The regulation of the use of data for political purposes raises questions of free speech and privacy. Others claim microtargeting actually offers more privacy, since the data does not include names or physical mailing addresses. It may be hard, however, for consumers to opt out of political advertising. Even lists like the National Do Not Call registry have exceptions for political campaign calls. According to a study by the University of Pennsylvania, 86 percent of Americans said they did not want political advertising tailored to their interests.

What are the problems with data brokers?

There is a certain “creepiness” factor to data collection without consumer consent. Target tried to market products to new parents by identifying them even before the baby was born. Data showed that pregnant women purchased products like cocoa butter and calcium tablets. Target began sending targeted mail to these women. But instead of finding it helpful, the women found the fact that Target knew they were pregnant to be unnerving.

Others worry about the effects of outdated data. Consumers have little access to immediately change what information that brokers have on them, such as an address change or marriage. This means people could potentially be prevented from making a purchase solely based on outdated information. Outdated information becomes more offensive when the deceased remain on data broker lists and continue to receive offers in the mail. Some women revealed stories of experiencing a miscarriage yet continuing to receive insensitive mailings from Gerber and American Baby Magazine.

Companies that have such specific information about segments of consumers may take advantage from the data. An example from the FTC looks at the case of a consumer labeled to be a biker enthusiast. This person might get more coupons for motorcycles and gear, but they could also see higher insurance rates if companies use this information to conclude this individual engages in risky behavior. Watch a Congressional hearing on the industry’s issues below.

An Acxiom presentation to the Consumer Marketing Organization in 2013 indicates further issues with potential discrimination. Acxiom placed customers into “customer value segments.” Data showed that while the top 30 percent of customers add 500 percent of value, the bottom 20 percent actually cost 400 percent of value. The bottom 20 percent call customer service numerous times and cost the company in returns. The company would be better off ignoring these customers altogether, and data brokers can help companies to identify these costly customers. These high-cost customers could then face higher prices or poor service without even being aware they are discriminated against.

Do people have any protection?

The problem most people have with the collection of data is that they have no say in it. They are not aware when information is being collected, nor are they in control of what it is used for or if it is correct. The resale and illegal use of the data is prohibited. Data brokers also suppress protected lists such as phone numbers on the Do Not Call Registry.

Some data brokers do try to protect consumers. Some voluntarily remove information regarding children and teens from their data. Others provide ways to edit and review what data the broker has on you. Acxiom uses aboutthedata.com for this very purpose. Epsilon allows consumers to review information, but reviewing the information costs $5 and requests can only be made by postal mail. Trying to review information collected by every broker is extremely time consuming. Watch for more on how to protect yourself below.

No laws require brokers to maintain the privacy of consumer data unless it is used for prohibited purposes. Federal law protects the confidentiality of medical records. The Fair Credit Reporting Act (FCRA) restricts the search of information when determining eligibility for employment, credit, or housing; however, most data does not fall under the scope of FCRA.

What is the FTC pushing for?

The FTC report recognizes the immense value of data brokers to both companies and consumers; however, the FTC has offered the following recommendations to improve the industry and bolster consumer protection:

• Create a central database where consumers can see what information about them was collected. The database should also allow consumers to opt out from the data collection.
• Require brokers to list their data sources.
• Increase industry visibility and consumer awareness.
• Comprehensive legislation to prevent the discriminatory use of data. For instance, some categories infer sensitive statistics. “Metro Parents” are single parents primarily high school-educated handling the stresses of urban life on a small budget. “Timeless Traditions” are immigrants who speak some English but generally prefer Spanish.
• Adopt a series of best practices, including better protection for minors, improving data security, preventing unlawful discrimination, and restricting collection to only needed data.

The Direct Marketing Association (DMA) and other groups attacked the FTC report. In an interview with the Washington Post, Stuart Ingis of the DMA said, “You’d think if there was a real problem, they’d be able to talk about something other than potential” abuses.

The data broker lobby is very powerful. Senators John D. Rockefeller (D-WV) and Edward Markey (D-MA) led the regulatory push by proposing the DATA bill on February 12, 2014, requiring data brokers to be transparent about the information they collect. But considering the fact that political campaigns benefit from data broker information when targeting voters, it is unlikely there will be new legislation on data brokers in the near future. In the meantime, expect data brokers to know much more about you than you know about them.

Resources

Primary

FTC: Data Brokers: A Call for Transparency and Accountability

Ed Markey: Markey, Rockefeller Introduce Data Broker Bill

White House: Big Data: Seizing Opportunities, Preserving Values

Senate: A Review of the Data Broker Industry

Additional

Yahoo: FTC Wants More Transparency for Data Brokers

Data Privacy Minitor: FTC Report Seeks Congressional Review

Privacy and Security Law Blog: “Getting to Know You, Getting to Know All About You”

Washington Post: Brokers Use Billions of Data Points to Profile Americans

ProPublica: Everything We Know About What Data Brokers Know About You

Slate: What Do Data Brokers Know About Me?

CNN: Why Big Companies Buy, Sell Your Data

New York Books: How Your Data are Being Deeply Mined

Pulitzer Center: Consumer Data Privacy in Politics

Time: Inside the Secret World of the Data Crunchers Who Helped Obama Win

ProPublica: Everything We Know So Far About Obama’s Big Data Operation

AdWeek: Confessions of a Data Broker

Alexandra Stembaugh

Alexandra Stembaugh graduated from the University of Notre Dame studying Economics and English. She plans to go on to law school in the future. Her interests include economic policy, criminal justice, and political dramas. Contact Alexandra at staff@LawStreetMedia.com.

The post The Big Business of Big Data appeared first on Law Street.

On December 30, 2013, a class action suit was filed against Facebook for its use of members’ private data. The lawsuit is led by two Facebook users named Michael Hurley and Matthew Campbell, though it purports to represent all Facebook users within the United States.

In 2010, Facebook unveiled a feature that allowed members to send private messages controlled completely by the users. They stressed the privacy features that this new messaging feature allowed. Hypothetically, those messages were just supposed to be viewable by the sender and recipient(s) of the message. Neither Facebook nor any third-party were supposed to have access to the messages.

The suit alleges that this was false. According to an inspection by “independent security researchers” last year, Facebook has been scanning the contents of those messages to use for marketing and other purposes. The suit alleges two main ways in which Facebook has been doing so. The first is when a user sends a private message with a link. For example, suppose someone sent you an article on lawstreetmedia.com, The link will register with Facebook, and the site will follow it to see to where it leads. If it is a site that has a Facebook page, as many do, Facebook registers that as a “like” on that company’s public page. That has a number of troubling implications. For example, I know I’ve definitely sent an article link to a friend before because I disagreed with the article. I definitely wouldn’t want a like to register on that site’s Facebook page as a result. It also means that it would be possible to fabricate likes–a company could make sure its page got linked in messages a lot, and likes would register as a result.

The suit also alleges that Facebook mines that sort of data sent in privates messages for use by either Facebook itself or third parties. It is then used for marketing or advertising purposes.

The suit states that Facebook’s use of private messages in such a way violates the Electronic Communications Privacy Act–an electronic version of the law preventing someone from opening another person’s mail. The argument that Facebook is expected to utilize is that Facebook isn’t reading the messages–just grabbing data from them.

This isn’t the first time that Facebook has been accused of such practices. In 2012, the Wall Street Journal pointed out that Facebook does scan its messages for keywords related to criminal behavior. Google has been the focus of similar allegations. There is a silver lining to Facebook’s use of private messages, however, as they also can sometimes filter out spam or malware before an unsuspecting user opens it. An internet security expert named Graham Cluley added, “[i]f you didn’t properly scan and check links, there’s a very real risk that spam, scams, phishing attacks, and malicious URLs designed to infect recipients’ computers with malware could run rife.”

The suit is demanding an injunction for Facebook to stop its behavior. The two plaintiffs also want Facebook to pay the members of the suit $100 a day for each violation, or $10,000. Given that the suit claims to include all American Facebook users who have had their private messages used in such a way, I would assume that’s a lot of people and could equal a pretty hefty sum.

Honestly, I wasn’t too surprised that Facebook used data in such a way. I pretty much assume that sites track activity always–but maybe I’m just a cynic. One of the best indicators for how this lawsuit will go for Facebook may come from the similar pending lawsuit involving Google. This September it was ruled that the suit would go forward–potentially becoming a big problem for Google. I’m sure we’ll see suits from other social media and communication sites in the months and years to come. Google and Facebook are just the beginning.

—

Anneliese Mahoney (@AMahoney8672) is Lead Editor at Law Street and a Connecticut transplant to Washington D.C. She has a Bachelor’s degree in International Affairs from the George Washington University, and a passion for law, politics, and social issues. Contact Anneliese at amahoney@LawStreetMedia.com.

Featured image courtesy of [Sean MacEntee via Flickr]

Anneliese Mahoney

Anneliese Mahoney is Managing Editor at Law Street and a Connecticut transplant to Washington D.C. She has a Bachelor’s degree in International Affairs from the George Washington University, and a passion for law, politics, and social issues. Contact Anneliese at amahoney@LawStreetMedia.com.

The post Facebook Suit Alleges Privacy Violations appeared first on Law Street.