Data Brokers Are Watching You PDF

news Society | DOI:10.1145/2686740 Gary Anthes Data Brokers Are Watching You You would be surprised by how much they know about you, and what they are doing with your information. A in...

news Society | DOI:10.1145/2686740 Gary Anthes Data Brokers Are Watching You You would be surprised by how much they know about you, and what they are doing with your information. A in data I D ED BY A D VAN CE S dren). More narrowly defined groups science and the increased included “Expectant Parent,” “Diabe- digitization of analog in- Digitization of tes Interest,” and “Cholesterol Focus.” formation, an industry analog data, along It is easy to imagine a financial little known to the public company aiming sub-prime loans at is quietly compiling comprehensive with advances in “Urban Scamblers” while pitching dossiers on millions of Americans. algorithms behind platinum credit cards to “Married So- The companies, called data brokers, phisticates,” privacy advocates warn. say they operate within the law, but data analytics, has Even worse, how can anyone be sure the unprecedented breadth and enabled a dramatic that membership in one of the medical depth of the data files, the difficulty cohorts doesn’t affect one’s insurance in correcting erroneous data, and leap in the ability rates? “The companies see what web- the potential for abuse of personal of data brokers site you visit, then they add offline in- information are raising alarms from formation to that,” said Ed Mierzwin- privacy advocates, consumer groups, to track individuals. ski, program director at U.S. PIRG, the and government officials. federation of state Public Interest Re- Data brokers compile information search Groups. “Then the website you about individuals from a wide variety go to next might look different than it of online and offline sources, includ- otherwise would.” ing email, personal websites, social database of 700 billion data elements The process described by Mierzwin- media posts, U.S. Census records, re- culled from 1.4 billion consumer ski, known as “onboarding,” has drawn tailers’ systems, Department of Mo- transactions; a second had informa- special scrutiny and concern from the tor Vehicles records, and real proper- tion from $1 trillion worth of consum- FTC, Congress, and the White House. ty records. The data is often collected er transactions, and a third said it was In onboarding, a data broker will add without the consent or knowledge of adding three billion new records to its offline information—data from manu- the individuals involved, integrated database each month. al sources or from other systems such and synthesized using advanced an- The FTC has called for legislation as loyalty cards, warranty registrations, alytic tools, then sold to other data that would give consumers greater ac- and stores’ point-of-sale terminals— brokers and businesses for a variety cess to data brokerage practices and into the cookies of computers used by of purposes. more control over their own informa- individuals to access websites moni- “You may not know them, but tion. The agency suggested Congress tored by the broker. Once in place, the data brokers know you,” said Edith should consider requiring brokers to cookies can track the Web activity of Ramirez, chairwoman of the U.S. create a centralized portal where con- the person from place to place, serv- Federal Trade Commission (FTC) in sumers could look at all their data and ing up targeted ads at each site. “Data a statement last May. “They know opt out of having it used. brokers are helping to blur the line where you live, what you buy, your While personal data is sold for a between online and offline behavior,” income, your ethnicity, how old your variety of purposes, many of the bro- said the FTC’s Ramirez. “[They] use kids are, your health conditions, and kers’ customers use the information your offline purchases and informa- your interests and hobbies.” for targeted marketing. The FTC said tion to find and target you online.” Ramirez’ statement accompanied one broker segments consumers into With so much information coming the release of a report, “Data Brokers: handy buckets with labels such as from so many sources, it is inevitable A Call for Transparency and Account- “Urban Scramble” (heavily populated that errors arise in digital dossiers; ability” which, in turn, was based on with low-income Latinos and African moreover, the errors can be difficult or information supplied by nine such Americans), “Rural Everlasting” (single impossible to correct. In a study pub- brokers: Acxiom, CoreLogic, Data- men and women over the age of 66 with lished in 2013, the FTC reported one in logix, eBureau, ID Analytics, Intelius, little education and small net worths), five consumers had an error in one or PeekYou, RapLeaf, and Recorded Fu- and “Married Sophisticates” (upper- more of their credit reports. These er- ture. One of them reported having a middle-class young adults with no chil- rors can lead to an unfairly poor credit 28 COMMUNICATIO NS O F TH E ACM | JA NUA RY 201 5 | VO L. 5 8 | NO. 1  news rating that can prevent someone from getting a much-needed loan. The FTC Flow of consumer data through data brokers to third-party users also found more than 10% of consum- ers saw a change in credit score after getting errors corrected. Many of the gatherers of online information offer ways to correct the consumer personal data they hold, but the meth- ods for doing so are often not well publicized, or are difficult to follow. In any case, consumers often do not know who is collecting or using their Source of data data, and there is no central clearing- Public records Publicly available information Nonpublic information house for verifying all of one’s online Birth records, death records, Information gathered Information gathered from loyalty data. Even the most diligent, tech- property records, tax liens, voter from telephone directories, programs, website registrations, registrations, court records. business directories, classified warranty registrations, contests, savvy people cannot ensure the in- advertisements, newspapers, surveys, questionnaires, tegrity of all their data, anymore than magazines. IP address, browser used, search terms, purchase histories. they can control its use. The rapid increase in the number of available sources of data is especially troubling when it involves the capture of analog information, said Susan Gra- ham, a computer science professor at Data brokers the University of California, Berkeley Collect, aggregate, analyze, repackage and sell. (UC Berkeley). That is because the de- vices that capture this information— surveillance cameras and various kinds of sensors—for valid technical reasons sweep up more data than is Data users needed for the immediate purpose. For Business clients Consumers/general public Other data brokers example, she said, dramatic improve- Retailers, advertising agencies, Usually through the Internet. May combine with other ments in high-resolution digital cam- government, private entities, online data and offline materials eras and facial recognition software nonprofits. for repackaging and reselling. will soon make it possible to identify people gathering at news events or in cars passing traffic law-enforcement cameras. With such abilities come ob- vious possibilities for abuse, she said. Information used for: The digitization of vast amounts of previously analog data, plus advance- Marketing ments in the algorithms behind data analytics, have enabled a dramatic leap Individual reference services in the ability of data brokers to track People search, genealogy, etc and understand the day-to-day activi- ties of individuals, Graham said. “You Directory services can put together very disparate pieces Residential and business listings of information and create a profile of Pursuant to Fair Credit Reporting Act a person. It’s not necessarily correct, Eligibility determinations, legal compliance, fraud prevention, employment screening but you can do it very quickly, and you can do it with information that the in- Source: GAO. dividual may not have provided. That’s a fairly profound shift.” sources and customers only reinforces marketers,” said its members oper- Much of this shift has been hidden the aura of secrecy surrounding the in- ate entirely within the law. Asked if IMAGE COURTESY OF YA H OO F INA NCE from the public, according to a year- dustry,” the committee said in its final the actions of data brokers neverthe- long investigation of data brokers by report in late 2013. less raise legitimate privacy concerns, the U.S. Senate Committee on Com- DMA senior vice president Stephanie merce, Science, and Transportation. Industry Response Miller responded, “No. Marketing data “The refusal by several major data bro- The Direct Marketing Association, used responsibly for marketing pur- ker companies to provide the commit- which calls itself “the world’s larg- poses is a consumer benefit, providing tee complete responses regarding data est trade association for data-driven much of the value in our data-driven JA N UA RY 2 0 1 5 | VO L. 58 | N O. 1 | C OM M U N IC AT ION S OF T HE ACM 29 news lifestyles.” She cited an independent personal data—are ineffective because Trusted Data Format (TDF) for file-level study that showed the “data-driven they are mostly ignored by consumers. tagging and security. marketing economy” contributed Instead, said UC Berkeley’s Gra- Expecting consumers to understand $156 billion to the U.S. economy and ham, government policy as well as and specify their privacy preferences supported 675,000 jobs in 2012. Miller technology should focus more on the may be unrealistic at present, said also said a number of data brokers, as use of personal data, and less on its Mark Gorenberg, managing director well as vendors such as Google and Ya- collection. Her views and those of of Zetta Venture Partners and a mem- hoo, already offer consumers ways to 10 other information technologists, ber of the PCAST working group. “You opt out of targeted marketing. businesspeople, and policy experts need to create a market for this,” he Indeed, the FTC cited a number of appear in a report submitted to Presi- said. “You’d see products and systems benefits that flow from data-driven dent Obama last May, “Big Data and and cloud-based services with usage- marketing. “Data broker products Privacy: A Technological Perspec- based components in them.” If major help to prevent fraud, improve product tive.” In the report, a working group vendors such as Google and Amazon offerings, and deliver tailored adver- of the President’s Council of Advisors began offering file tagging and tracking tisements to consumers,” the FTC said on Science and Technology (PCAST) services, perhaps based on TDF, then in its report. The brokers also foster argued policies that focus on data the public might come to use them, he competition by enabling small busi- “collection, storage, applications, said. If not, Congress would have to de- nesses to pitch innovative products to and analysis” are not scalable, as it cide whether to mandate some kind of consumers they could not otherwise becomes increasingly difficult to as- usage-based controls, he said. reach. The agency also acknowledged certain what personal information “It would be a mistake to stop col- the existence of laws that protect the may be latent in a particular dataset lecting data which, when combined data of consumers in certain indus- or its fusion with other data. Also, with other data, gives much better re- tries, such as finance and health care. PCAST said, policies limiting col- sults to the public,” Gorenberg said. For example, the Fair Credit Re- lection and retention will become “We are at a golden age of being able to porting Act (FCRA) of 1970 regulates increasingly unenforceable by other use data to get better results for com- and restricts the use of consumer than draconian means. panies and individuals.” data when such data may be used for To control use, individuals might Graham sees the glass as half-full. “eligibility” determinations in credit, choose a privacy preference profile of- “Things are becoming technically fea- employment, insurance and housing. fered by third parties, PCAST said. For sible today that would have been crazy Last April, the FTC settled with two example, “Jane” might choose one of- 10 years ago—for the good guys and the data brokers for selling data in viola- fered by the American Civil Liberties bad guys.” tion of the FCRA. The FTC found the Union that gives special weight to pri- companies had sold data to employers vacy, while “John” might prefer one Further Reading and landlords without ensuring the from Consumer Reports that empha- accuracy of the data, or that the buyers sizes economic value to the consumer. U.S. Federal Trade Commission, Data brokers: a call for transparency and had legitimate reasons for wanting the Market forces or government regula- accountability May 2014 information, as required by law. tion would compel the users of person- http://1.usa.gov/1kXR5g0 David LeDuc, a senior director at al data to conform to the profiles. Fertik, Michael the Software & Information Industry Technology is already moving to en- The Rich See a Different Internet Than the Association, said he is not sympathetic able that kind of control. For example, Poor, Scientific American, Jan. 15, 2013 to those calling for legislative reforms commercial privacy systems have been http://bit.ly/1qtmpQt because they find what data brokers do developed by firms such as Booz Allen Executive Office of the President, Big data “creepy.” “We oppose the imposition Hamilton and IBM and are in use by and privacy: a technological perspective, of unnecessary barriers to the collec- a few government agencies, financial President’s Council of Advisors on Science tion and use of data,” he said. “The fo- services firms, and pharmaceutical and Technology, Big Data and Privacy Working Group, May 2014 http://1.usa. cus should be on real harm, not crystal firms. These systems are based on the gov/1ro5aq5 ball gazing about what makes certain Russell, Matthew A. people uncomfortable.” Mining the social web, 2nd edition, O’Reilly Expecting consumers Media, October 2013 Solutions The use of personal information by to understand and http://oreil.ly/1ljlIwX U.S. Senate Committee on Commerce, data brokers and others has become specify their privacy Science, and Transportation, A review of so pervasive that limiting its collection the data broker industry: collection, use, by existing means has become unwork- preferences may be and sale of consumer data for marketing able. Asking consumers to “opt out” unrealistic at present. purposes, Staff report for Chairman Jay Rockefeller, Dec. 18, 2013 of data collection at myriad compa- http://1.usa.gov/1vlVESn nies they have never heard of is unre- alistic, and the existing online “notice Gary Anthes is a technology writer and editor based in Arlington, VA. and consent” forms—in which users “agree” to the collection and use of ©2015 ACM 0001-0782/15/01 $15.00 30 COMM UNICATIO NS O F THE AC M | JA NUA RY 201 5 | VO L. 5 8 | NO. 1