Who's buying your personal data: Disney, GM, your insurer and bank. Here's what they get

The Arkansas-based data broker Acxiom claims it has data on billions of people around the world, including where they live and how they might spend their money. It says it can even deduce their political leanings, weight and interest in medical procedures.

But what exactly does the company know?

For Tracey Reed, a nonprofit worker in Oregon, it knew enough to compile a 58-page dossier charting the purported history of her income, employment and education, not to mention her spending, including everything from her online shopping to charitable giving. Although much of the information was incorrect, she said, the company attempted to log where she lived, complete with latitude and longitude coordinates. And it listed dozens of companies to which it had sold data or inferences about her.

"I think it's pretty gross that people are treated like sources of wealth to be mined," she said. "And that's what these data profiles are, like, 'Here's a guide for how to squeeze this person and get money out of them.'"

Reed obtained her data as part of a project by Consumer Reports' consumer advocacy team to encourage consumers to request their personal information from companies like Acxiom to see how well new state privacy laws are working. By examining the dossiers that come back — more than 100 so far — the nonprofit hopes to better understand what information data brokers are able to collect and to whom they sell it.

(Consumer Reports said that its membership arm uses information derived from data brokers, including Acxiom, to understand consumer interests, including the likelihood of becoming a Consumer Reports member, but does not use the information to set prices for its products or share the information with the brokers.)

Consumer Reports shared its data requests with CalMatters and The Markup. Acxiom is notable among the various brokers in the requests for its size, leading industry role — and because it provided detailed data back to consumers.

Acxiom and its connections to other companies have been subjects of press accounts for years, but the records obtained by Consumer Reports offer granular new details about its practices, including the many particular inferences it makes, some of them remarkably specific.

Across the reports CalMatters and The Markup reviewed, Acxiom uses the data it had collected to make predictions in more than 3,000 distinct categories about people's financial lives and behavior, from the ages and genders of their children, to their estimated "alcohol usage," to how likely they were, on a scale of 1 to 100, to be in the market for a new Tesla Cyber Truck.

The project was enabled by new laws enacted in a handful of states in recent years that allow consumers to get a look at what brokers have on them.

In each of the profiles, Acxiom made detailed — sometimes to the point of bizarre — "inferences" about consumers, attempting to chart the likelihood they'd be associated with various characteristics.

Some of those inferences would clearly be valuable to retailers looking to sell products to new or repeat customers. The data broker estimated for consumers, on a zero to 100 point scale, the likelihood that they would spend money at businesses from Nike to Buffalo Wild Wings to PlayStation, or the likelihood that they owned any of dozens of different car models.

Other inferences went so far as to estimate how likely the person would be to respond to an offer to consolidate a student loan, how likely they'd be to give to charity, or what body mass index percentile they might fall into. Also rated were the chances the person was experiencing food insecurity, had a primary care physician, would get a mammogram, could pay for medical expenses, or showed online interest in the Army.

The most revelatory finding in the Acxiom reports, according to the privacy experts we interviewed, is the list of specific companies that bought consumer data — more than 100 in total.

Several relatively new state privacy laws, including those in Minnesota and Oregon, require companies to disclose not only the types of consumer information they collect but also the other companies to which they are ultimately sold.

Among those in the Acxiom files: several of the nation's largest insurers, banks, and pharmaceutical companies, including GEICO, State Farm, Citi, JPMorgan Chase, US Bank, and Janssen Pharmaceuticals. Big online sellers were frequent customers, too, including General Motors, Hilton, Kohl's, MLB.com, Southwest Airlines, T-Mobile, and the Walt Disney Corporation. And several smaller companies repeatedly fined and sued by federal and state regulators, including several direct-mail companies, showed up in the Acxiom files, including Affinion Benefits Group (now called CXLoyalty/Tenerity), Endurance Warranty Services, and Mailers

Of the more than 100 businesses we found that used Acxiom, only a few large companies responded to requests for comment. Those few responses broadly defended their use of the data as an important marketing tool. CalMatters and The Markup are publishing the remaining responses here.

"We leverage consumer data to help improve the efficiency and effectiveness of our marketing outreach," said Farmers Insurance spokesperson Luis Sahagun, "and are committed to responsible use of any consumer information we may obtain from third parties."

Marketing lists, loan offers, and patient risk scores

Companies often use personal data like Acxiom reports to identify potential new customers and find out about their household finances and key life events, such as the birth of a child or the death of a spouse. In turn, banks, insurers, and pharmaceutical companies can group, or "segment," customers into small buckets — a new parent or widower, for example — and tailor advertisements or offers down to just a handful of people.

Case in point: HealthVerity, a Philadelphia-based venture capital-backed startup that markets itself as the nation's "largest healthcare data ecosystem," was listed as a buyer in every Acxiom report we reviewed. It sells deidentified patient data to companies and government agencies, including the Centers for Disease Control and Prevention and, in several case studies posted on its website, insurers and pharmaceutical companies buy HealthVerity's patient data to find medical research participants, build marketing lists, and link patient health records across different data sources.

But HealthVerity also markets an insurance underwriting product that helps produce "risk scores" and predictions for health, life, disability, and workers' compensation insurers. And as part of its product list, HealthVerity offers another marketing product with more than "1,000 attributes from providers typically not available, such as Acxiom, Epsilon, Adstra and others. With these sources, you gain more granular demographics, including race data, consumer behavior, online activity, socio-economic profiles, lifestyle and digital media preferences."

Acxiom's privacy disclosures clearly state that its data can't be used for insurance underwriting under the federal Fair Credit Reporting Act but HealthVerity's products could fall outside that legal definition, as it's billed as a "healthcare analytics" company, not a credit reporting agency, experts say. HealthVerity didn't respond to a request for comment.

"There are a lot of holes in this Swiss cheese of privacy law," said Ari Ezra Waldman, a professor of law at the University of California, Irvine, who studies the data economy.

U.S. privacy law can protect personal data in some contexts — say, when your FICO score and current debts are used for a credit check. But for certain kinds of health data, those laws can fall short. For example, while the federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, protects most kinds of patient health information, daily measurements of someone's heart rate, step count, and sleep held by a tech company like Apple or Garmin don't have the same restrictions.

Other companies with spotty track records in handling consumer data show up repeatedly in the Acxiom and Epsilon files. OneMain Financial, a subprime personal lender, shows up as a buyer in several reports; in March, OneMain was sued by 13 state attorneys general for allegedly packing its loans with an estimated $826 in hidden fees and interest per borrower.

Centene Corporation, the largest Medicaid managed care company in the world, has been sued by California and several other states for allegedly inflating its pharmacy costs and then overcharging state Medicaid plans.

Janssen Pharmaceuticals, the Johnson & Johnson subsidiary listed in every Acxiom report we reviewed, has paid out billions of dollars in settlements for allegedly violating federal laws regarding off-label drug marketing and physician kickbacks.

When personal data is used to market costly financial products, the effects on vulnerable consumers can be disastrous, such as when personal, home, or auto loans are targeted to those in financial trouble, often with onerous terms, said Lena Cohen, a staff technologist at the nonprofit Electronic Frontier Foundation who has studied the data broker industry.

"The extremely personal data we see in these files doesn't appear out of nowhere," Cohen said. "There is a network of companies and tech that have to share this data for a data broker to collect it. And it can have real harms."

The personal data reports also contain dozens of examples of inaccurate info that data brokers glean from public records. Those errors "poke a hole in the argument that we need these surveillance systems for advertising to work," Cohen said.

Many of the early participants in the Consumer Reports effort are particularly mindful about protecting their privacy, and Reed, the Oregon consumer, is no exception. She is so aware of her personal data that she still uses a flip phone. "I hate marketing and advertising," she said. "I always have ad-block and I try to be conscious of my own data privacy."

That didn't stop Acxiom from attempting to catalog her habits. Some information was wrong, and some was right. Her listed addresses seemed to mix her up with her parents, for one. But the company was correct about her spending habits.

The Acxiom reports also include what critics say are artful examples of the company employing coded language to otherwise describe racial, ethnic, and health information that would otherwise be protected from disclosure and use by federal and state laws. One report scores a consumer's "assimilation level" as "3+ generations in the US." Others rate "health conscientiousness," the "likelihood to be a smoker," and "social setting behavior."

"We don't actually know what goes into these kind of vague terms," Waldman said. The assimilation score is likely "getting at things like race, ethnicity, immigration status, things that we don't normally like to discriminate on." But the vague terms used by data brokers "are there to hide the true nature of what's going on — and to sanitize it, to legitimize it."

Sherry Hamilton, a spokesperson for Acxiom, said in an emailed statement that the company works to ensure "all data is sourced ethically, used responsibly, and protected securely." She said the company works with "data suppliers" credentialed by Acxiom to ensure users are given "appropriate notice and choice" in how their data is collected.

The reports collected by Consumer Reports and viewed by CalMatters and The Markup were furnished to provide unfiltered transparency, she said, while clients the company works with are given a more refined, and accurate, data set.

She added that health-related categories in the data do not indicate a person has an illness but only that they "may be interested in information about a condition, treatment, or product" and that assimilation level is "a household-level score and does not indicate an individual's race, ethnicity, or immigration status." Under the law, she said, companies that purchase Acxiom data may not use it to determine qualification or the price of credit and insurance.

"Acxiom is fundamentally committed to ethical data practices," Hamilton said.

A multi-billion-dollar industry

Acxiom dates its start back to the 1960s, as an American analytics company called Demographics Inc.

According to the New York Times, the company in its early years mined telephone directories to help the Democratic Party find voters' addresses and mail them campaign material. Since then, the company has ballooned into a data-gathering behemoth.

Acxiom's massive data stockpile translates to massive revenue. According to its latest quarterly report, Acxiom's parent company, Interpublic, took in $2.5 billion in one quarter this year.

But Acxiom is just one part of an even-more-sprawling industry harvesting consumer data with little oversight, and one that few people even know about.

The sale of personal information has become common enough that many companies legally qualify as data brokers even if they are not known as such and focus on other activities. They are part of a sector generally valued at hundreds of billions of dollars and expected to grow. Data brokers are now major political players, too, spending big money on lobbying to influence legislation.

To build their databases, data brokers broadly rely on three types of data, according to Justin Sherman, a scholar-in-residence at the Electronic Privacy Information Center who formerly ran a research program on data brokers at Duke University. Those ways are data obtained directly, indirectly, and through inference.

Companies may get data directly by, say, gathering it through an app that they offer their customers, or buying a smaller company and integrating that data into their systems. Some of these companies may resell that data to brokers for their databases as well.

Public information, like property records, marriage certificates, and court filings are some of the means data brokers can use to gather data indirectly. Acxiom itself has acknowledged getting data through these means.

Inferences are the ways a data point might lead a broker to determine something else about a person, Sherman points out. Those inferences can be especially invasive. If a person has a Christian news app, the company might infer their religion, or a gay dating app might lead them to infer a person's sexual orientation. Companies might not be able to collect data on children legally, but they can infer which households might have a toddler.

If a data broker has a person's geolocation data, they might see them visit a military base, or a school, or a medical specialist.

"From that I can derive all kinds of information about other characteristics: finance, health, demographics, religion," Sherman said.

The data a broker obtains can be accurate or not, and may cause problems for the person being profiled either way. If it's accurate, the data can give companies an unsettlingly detailed window into someone's life.

But if it's not accurate, the person might face harmful consequences, too. Faulty data on their driving practices, for example, could lead to unfairly increased insurance rates.

And most consumers have little recourse to stop companies from collecting their data.

Data brokers and the law

Absent a comprehensive federal privacy law, some states have taken measures into their own hands.

Four states — California, Oregon, Vermont, and Texas — have passed transparency laws that require companies to register as data brokers if they meet certain requirements. Some laws, like in California, require data brokers to provide consumers with a way to access and delete their information. California this year rolled out a new website enabling residents to tell hundreds of brokers to stop tracking them and selling their information; CalMatters and The Markup have a guide for how to file that request.

Lawmakers are increasingly worried that personal information collected by brokers and others will fuel discriminatory pricing; at least 30 states this year, including California, have considered bills regulating how companies offer multiple prices for the same product.

But compliance with the regulations is uneven: a report this year by Privacy Rights Clearinghouse and the Electronic Frontier Foundation found that hundreds of companies appeared in one state's database but not others', despite similar registration requirements.

It's not clear how many companies that qualify as data brokers under these laws fail to register in a database at all. "The data broker industry is way underregulated," Sherman said.

The companies' practices, he points out, raise serious questions about the boundaries of privacy rights and civil liberties.

There's little to stop brokers from amassing profiles through more and more invasive means, then passing that data to whoever they see fit. Government agencies, meanwhile, have been known to purchase data from brokers as well. With this method, agencies like the National Security Agency have reportedly been able to bypass getting a warrant for information on a person.

In response to criticism, data brokers argue that their practices are legal, and that they get consent to transfer and sell consumers' data. If you sign up for a store's loyalty program, for example, the fine print might include allowing the company to give your data to outside parties. But as Sherman points out, few people have ever heard of these companies, or could remember agreeing to having their data sold.

"The notion that a data broker gets consent to sell someone's data to clients flies in the face of years of academic peer-reviewed research, polling, news reporting, and people's personal experiences," Sherman said. "People are not actually consenting to this, so that notion is fanciful."

This story is co-reported with Consumer Reports. Derek Kravitz of Consumer Reports contributed reporting and editing to this article.

Distributed by Newsbank, inc.