A report released Tuesday by the Federal Trade Commission finds the data broker industry often uses "potentially sensitive categories" in collecting and analyzing consumer data by making "inferences" on their backgrounds.
Such categories include "Urban Scramble" and "Mobile Mixers," both of which include a high concentration of Latinos and African-Americans with low incomes. The category "Rural Everlasting" includes single men and women over age 66 with "low educational attainment and low net worths."
Other sensitive categories include health-related topics or conditions, such as pregnancy, diabetes and high cholesterol. A category such as "Biker Enthusiasts" could be used to offer discounts on motorcycles to a consumer, but also could be used by an insurance provider as a sign of risky behavior.
The FTC is asking Congress to consider legislation making data broker practices more visible to consumers and to give consumers greater control over their personal information that is collected and shared by data brokers.
The report, "Data Brokers: A Call for Transparency and Accountability," is the result of a study of nine data brokers, meant to be a cross-section of the data broker industry. The companies are Acxiom, CoreLogic, Datalogix, eBureau, ID Analytics, Intelius, PeekYou, Rapleaf and Recorded Future.
In December 2012, the FTC voted to issue orders requiring the companies to produce the information used in the study. Congress originally called for a
Data brokers obtain and share consumer information, sometimes without consumer knowledge. They sell information for marketing campaigns and fraud prevention and while consumers benefit from practices that help consumers find products and services they prefer, some practices also raise privacy concerns.
The report revealed that data brokers collect and store billions of data elements covering nearly every U.S. consumer. Just one of the data brokers studied holds information on more than 1.4 billion consumer transactions and 700 billion data elements and another adds more than 3 billion new data points to its database each month.
Among the reports findings:
Data brokers collect consumer data from extensive online and offline sources, largely without consumers knowledge, ranging from consumer purchase data, social media activity, warranty registrations, magazine subscriptions, religious and political affiliations and other details of consumers everyday lives.
Consumer data often passes through multiple layers of data brokers sharing data with each other. In fact, seven of the nine data brokers in the study had shared information with another data broker in the study.
Data brokers combine online and offline data to market to consumers online.
- Data brokers combine and analyze data about consumers to make inferences about them, including potentially sensitive inferences such as those related to ethnicity, income, religion, political leanings, age and health conditions.
"The extent of consumer profiling today means that data brokers often know as much or even more about us than our family and friends, including our online and in-store purchases, our political and religious affiliations, our income and socioeconomic status, and more," said FTC Chairwoman Edith Ramirez. "Its time to bring transparency and accountability to bear on this industry on behalf of consumers, many of whom are unaware that data brokers even exist."
The report found some data brokers unnecessarily store data about consumers indefinitely, which may create security risks.
For brokers that provide risk mitigation products, the FTC recommends legislation that would include:
When a company uses a data brokers risk mitigation product to limit a consumers ability to complete a transaction, require the consumer-facing company to tell consumers which data brokers information the company relied on;
- Require the data broker to allow consumer access to the information used and the ability to correct it, as appropriate.
For data brokers that offer marketing products, the FTC recommends Congress should consider legislation to require:
The creation of a centralized mechanism, such as an Internet portal, where data brokers can identify themselves, describe their information collection and use practices and provide links to access tools and opt-outs;
Data brokers to give consumers access to their data, including any sensitive data, at a reasonable level of detail;
Opt-out tools, that is, a way for consumers to suppress the use of their data;
Data brokers to tell consumers that they derive certain inferences from from raw data;
Data brokers to disclose the names and/or categories of their data sources, to enable consumers to correct wrong information with an original source;
- Consumer-facing entities such as retailers to provide prominent notice to consumers when they share information with data brokers, along with the ability to opt-out of such sharing.
