Who’s mining the store? 9 top takeaways, legislative recommendations, and some straight talk for industry from the FTC’s data broker report
Type “big data” into a search engine and you’ll get more than 300 million results. Consider the amount of personal information actually in the hands of data brokers and add a string of zeroes to that. There are lots of valid purposes for using that data – verifying identity and detecting fraud, to name just two – but let’s face it: It’s an industry that operates primarily behind closed doors. To shed light on what’s going on, the FTC conducted an in-depth study of nine data brokers. What do they collect? How do they slice, dice, and market it? Read Data Brokers: A Call for Transparency and Accountability to find out what we found out when we pulled back the curtain on this sector of the information industry.
The FTC’s concerns about transparency date back for decades. The opaque nature of how companies used consumer data to make determinations about credit, housing, employment, etc., led to the passage of the Fair Credit Reporting Act in 1970. While the FTC has brought more than 100 FCRA law enforcement actions since then, huge swathes of the business fall outside the statute. That’s why we conducted a study of the industry, using nine companies – Acxiom, Corelogic, Datalogix, eBureau, ID Analytics, Intelius, PeekYou, Rapleaf, and Recorded Future – as a sample.
We learned that brokers collect information from lots of sources. Some of it is raw data (name, address, age, home ownership, etc.). But the industry also combines that with other information to make inferences about people – for example, that someone who subscribes to “Wired” magazine is a tech type.
Based on what we learned from the study, the products data brokers offer fall into three categories. First, marketing products. Five of the companies we studied sell marketing lists, information about customers’ interests, analytics tools, or marketing scores. Here’s just one for-instance: A broker might analyze a client’s customer data to suggest where they should concentrate their advertising budget (say, online vs. newspapers) and in what areas of the country. For the most part, consumers don’t have much opportunity to see what companies are saying about them. Two brokers we looked at let people correct inaccurate information and four allow them to opt out. But it’s not clear how people would even know how to exercise those options.
Another major component: risk mitigation products. Four of the companies we studied sell products that clients use to verify customers’ identities or detect fraud. For example, a lender might use the data to double-check that a person who wants to open an account is who she says she is. That’s an example where inaccurate information can have a particularly negative impact on consumers, but the process happens behind their backs – and only one company gives them a chance to correct their information.
A third piece of the puzzle: people search products. People use them for doing corporate research – or for scoping out a crush. Consumers can generally access their information through the same free or fee-based products data brokers sell to their customers. The companies allow varying degrees of information correction and opt-out.
You’ll want to read the report for the details, but here’s our summary of the summary:
What we learned about the industry
- Data brokers collect consumer information from lots of sources, largely without consumers’ knowledge.
- The industry is complex, with layer upon layer of brokers providing information to each other.
- Data brokers collect and store billions of data elements covering pretty much everyone in the U.S.
- They combine and analyze data to make inferences about people – including potentially sensitive inferences about income, ethnicity, age, health, etc.
- They combine internet data with offline information to market to consumers online.
What we learned about the benefits and risks
- Consumers benefit from a lot of what data brokers do in the form of risk mitigation, tailored ads, open and innovative markets for small business – and the ability to find out what your prom date is up to now.
- That said, what data brokers do poses risks to consumers, including denial of opportunities based on inaccurate information, public revelation of stuff many consumers consider private (health issues, for example), or even something as sinister as stalking.
- Storing data indefinitely may create security risks.
What we learned about consumer choice
- To the extent data brokers offer consumers any choice about their information, the tools are hard for people to find, understand, and use.
Now for what the FTC recommends. As the Report states, “In light of these findings, the Commission unanimously renews its call for Congress to consider enacting legislation that would enable consumers to learn of the existence and activities of these data brokers and provide consumers with reasonable access to information held about them by these entities.” With respect to brokers that sell marketing products, a majority of the Commission had four specific suggestions for Congress:
- Consider giving consumers a way to easily identify which brokers have data about them and where they can go to access it or opt out. One way to do that: A central online portal.
- Consider whether data brokers should have to clearly disclose that they not only collect raw data, but also combine it with other information to draw inferences about people. That’s especially important when it comes to sensitive topics like health conditions.
- Consider requiring data brokers to reveal more about their sources. That would make it easier for consumers to track down and correct the source of inaccurate information (for example, a mistake in a public record).
- Consider whether consumer-facing businesses should have to clearly disclose that they share information with data brokers and to give consumers choices, including opting out. For sensitive data – health information is one example – the FTC is asking Congress to consider legislation to require consumer-facing sources to get people’s affirmative express consent before they collect it in the first place.
The Report also recommends that Congress consider legislation to make things more transparent when a company’s use of risk mitigation products has adverse impacts on a consumer. As for those people search products, the FTC is asking Congress to consider similar reforms to foster transparency and consumer choice.
The Report finishes with three let’s-get-real recommendations for the data broker industry: Implement privacy by designs, come up with better ways to stop collecting information from children and teens, and take reasonable precautions to ensure downstream data users don’t use it for illegal purposes.
So pour yourself a cold beverage and dive into the Report. There couldn’t be a hotter topic and as government documents go, it’s a page-turning beach read – really.