It's no exaggeration to say that in some ways data brokers know us better than we know ourselves. The Federal Trade Commission, after an extensive study, says it's time for Congress to impose some transparency and accountability to the system.
“The extent of consumer profiling today means that data brokers often know as much – or even more – about us than our family and friends, including our online and in-store purchases, our political and religious affiliations, our income and socioeconomic status, and more,” said FTC Chairwoman Edith Ramirez. “It’s time to bring transparency and accountability to bear on this industry on behalf of consumers, many of whom are unaware that data brokers even exist.”
The FTC studied nine data brokers, representing a cross-section of the industry, and found that just one of the data brokers studied holds information on more than 1.4 billion consumer transactions and 700 billion data elements and another adds more than 3 billion new data points to its database each month.
The Consumer Federation of America "strongly supports the FTC’s legislative recommendations," said Susan Grant, CFA's Director of Consumer Protection. "Individuals must have the right and the means to know which data brokers have information about them for marketing purposes, see what the data is and how it is categorized, correct the data if necessary, and exercise reasonable control over its collection and use."
Anything & everything
Among the report’s findings:
- Data brokers collect consumer data from extensive online and offline sources, largely without consumers’ knowledge, ranging from consumer purchase data, social media activity, warranty registrations, magazine subscriptions, religious and political affiliations, and other details of consumers’ everyday lives.
- Consumer data often passes through multiple layers of data brokers sharing data with each other. In fact, seven of the nine data brokers in the Commission study had shared information with another data broker in the study.
- Data brokers combine online and offline data to market to consumers online.
- Data brokers combine and analyze data about consumers to make inferences about them, including potentially sensitive inferences such as those related to ethnicity, income, religion, political leanings, age, and health conditions.
- Potentially sensitive categories from the study are “Urban Scramble” and “Mobile Mixers,” both of which include a high concentration of Latinos and African-Americans with low incomes. The category “Rural Everlasting” includes single men and women over age 66 with “low educational attainment and low net worths.” Other potentially sensitive categories include health-related topics or conditions, such as pregnancy, diabetes, and high cholesterol.
Invisible & incomplete
The study found that, to the extent data brokers currently offer consumers choices about their data, the choices are largely invisible and incomplete.
To help rectify a lack of transparency about data broker industry practices, the Commission encourages Congress to consider enacting legislation that would enable consumers to learn of the existence and activities of data brokers and provide consumers with reasonable access to information about them held by these entities.
For data brokers that provide marketing products, the FTC recommends that Congress should consider legislation to establish a centralized Web portal, where data brokers can identify themselves, describe their information collection and use practices, and provide links to access tools and opt- outs.
Other recommendations include:
- Access. Require data brokers to give consumers access to their data, including any sensitive data, at a reasonable level of detail;
- Opt-Outs. Require opt-out tools, that is, a way for consumers to suppress the use of their data;
- Inferences. Require data brokers to tell consumers that they derive certain inferences from from raw data;
- Data Sources. Require data brokers to disclose the names and/or categories of their data sources, to enable consumers to correct wrong information with an original source;
- Notice and Choice. Require consumer-facing entities – such as retailers – to provide prominent notice to consumers when they share information with data brokers, along with the ability to opt-out of such sharing; and
- Sensitive Data. Further protect sensitive information, including health information, by requiring retailers and other consumer-facing entities to obtain affirmative express consent from consumers before such information is collected and shared with data brokers.
The agency also recommended legislation for brokers that provide “risk mitigation” products -- like check-approval services.
When a company uses a data broker’s risk mitigation product to limit a consumers’ ability to complete a transaction, legislation should require the consumer-facing company to tell consumers which data broker’s information the company relied on.
For brokers that provide “people search” products, the FTC said legislation should require the brokers to allow consumers to access their own information, opt-out of having the information included in a people search product, disclose the original sources of the information so consumers can correct it, and disclose any limitations of an opt-out feature.
The nine data brokers in the study are Acxiom, CoreLogic, Datalogix, eBureau, ID Analytics, Intelius, PeekYou, Rapleaf and Recorded Future.