A Look at the Different Types of Data Brokers
Data brokers are companies that we don’t have a direct relationship with — and likely have never even heard of — that collect data from various offline and online sources. These sources range from property records to purchase history to social media profiles to online web and mobile app activity tracking. Data brokers then aggregate our data and then either sell or share our data with third parties.
Data brokers have been making a lot of headlines of late as it relates to these companies selling and sharing very sensitive personal data such as our location (e.g., people going to/from abortion clinics), what types of healthcare apps we have installed (e.g., pregnancy trackers), our religion (e.g., people who have a Muslim prayer app installed), our sexuality (e.g., if you are using a gay/bi dating app), etc. There have been various legislative attempts to better regulate them (including my failed attempt with California Senate Bill 1059).
I often see that many people lump data brokers as all the same. But data brokers offer products in these categories: financial information, risk mitigation, marketing and advertising, people search, and personal health. In this blog post I will look at the various types of data brokers with the understanding that a given data broker may be in multiple categories.
Generated by DALL-E: "A data broker selling my location"
Financial Information Brokers
Financial information brokers are primarily comprised of the big three (Experian, Equifax, and Transunion) national credit reporting agencies. Credit reporting agencies compile consumer reports and generate credit scores to determine creditworthiness. The Financial information brokers’ underlying data is collected from thousands of lenders and credit card companies and public records such as bankruptcies. They also gather delinquent account reports from collections agencies plus payment data on cell phone bills, utility bills, and rent payments.[1]
The products assist banks, credit card companies, mortgage lenders, and insurance companies in decision-making — which has become increasingly automated. The three companies must comply with the Fair Credit Reporting Act (FCRA), limiting how they disclose credit report information and letting consumers view and correct their credit files.
The Fair Isaac Corporation maintains the formula for scoring to create what are known as FICO scores. It is somewhat ambiguous how FICO scores are created but are based on a calculation that considers payment history, amounts owed, length of credit history, new credit applications, and types of credit used. FICO scores are utilized in over 90% of all credit decisions in the United States.[2] And scoring has been in use for decades — even as early as 1999 that at large banks that “no [human being] even looks at any [credit request] for $50,000 or less.”[3]
Risk Mitigation Brokers
Data brokers in this category offer products to verify customers’ identities and detect fraudulent purchase patterns. For example, LexisNexis Risk Solutions claims it processes over 270 million transactions per hour.[4]
Other companies in this category provide background checks for employment and tenant screening. For example, employment screening companies “provide background and verification information such as credit history, employment, salary, and education and professional license verification to employers and others including non-profit volunteer organizations.” Examples of employment screening companies include ADP, backgroundcheck.com, and Checkr. Tenant screening companies include RealPage, Rent Grow, and Transunion. Some screening companies must comply with FCRA based on whether they analyze credit histories. In addition, they typically will provide copies of background or tenant screening reports to consumers upon request.[5]
Marketing and Advertising Brokers
These companies have various products and services that help businesses engage in targeted marketing. For example, they will segment and categorize consumers based on demographics or behavior and offer up these buckets of consumers to be targeted by advertisers. They will also provide “append” services. This is when a business may have partial information about a consumer (e.g., an email address), and the data broker will add additional information to the consumer profile, such as address or purchasing history. Data brokers in this category can also help third parties with market analysis. [6]
A recent FTC report highlighted how Internet Service Providers (ISPs) use data brokers and is illustrative of the products that data brokers can offer in this category. For example, an ISP used data brokers’ data to market products to new customers by getting lists of new homeowners in a particular geography. The ISP also bought additional data on their existing customers by sending their customer names and addresses to the data broker. The data brokers would “append with demographic information (e.g., gender, age-range, race and ethnicity information, marital status, parental status) and interest data (e.g., hiking, biking, gardening, bodybuilding, high-end spirits) for those subscribers.” They also used data broker data combined with their data to create their custom segmentation of customers to market to, which often revealed sensitive data about their customers. Examples of segments developed include “viewership-gay,” “pro-choice,” “African American,” “Assimilation or Origin Score,” “Jewish,” “Asian Achievers,” “Gospel and Grits,” “Hispanic Harmony,” “working class,” “unlikely voter,” “tough times,” “investor high-value,” and “seeking medical care.”[7]
Acxiom, Epsilon, and Oracle are some of the more significant players in this category. In addition, a new set of data brokers have emerged around providing location data to advertisers and marketers. The Markup has identified at least 47 location data firms, including the three previously mentioned.[8] One example is Veraset, which offers a product called “Movement” that “delivers the most granular and frequent GPS signals available in a third-party dataset.” In addition, they claim that “unlike other data providers who rely on one SDK, we source from thousands of apps and SDKs to avoid a biased sample.”[9] Others include Safegraph and Placer.AI, both of which generated controversy in the Spring of 2022 when reporters were able to purchase data from them that could track phones going to and from Planned Parenthood.[10]
While location brokers may not provide the names of users associated with the location data, many of the location brokers will provide the Mobile Advertising IDs (MAIDs) associated with the phone location data. In researching this blog post, I exercised my California “right to know” privacy rights with a few large data brokers in this category. For example, one of the data brokers had a profile on me that showed my name, address, email, and phone number and 31 MAIDs linked to phones associated with my family and me. So, it would be straightforward to connect location data with my profile using the MAID as the shared link, enabling the third party to track my family and me.
People Search Brokers
People search data brokers provide websites that enable searches for information about consumers. The FTC says that “users can use these products to research corporate executives and competitors, find old friends, look up a potential love interest or neighbor, network, or obtain court records or other information about consumers.”[11]
Some are designed like a phone directory, allowing you to view consumer data by name, mailing address, phone number, or email address. They can also do reverse phone lookups to map who owns a phone number. But because they also collect data from government records, social media, and commercial sources, the information is much more detailed than a phone book. For example, it can show relationships between family members even though they may not be living at the same address or share the same last name. They will also publish your age.
In addition, even though you may have opted out to be published in a telephone directory or specified in the FTC’s Do Not Call Registry to not be telemarketed to, these sites will still publish your address and phone number.
The people search websites will also offer, for a fee, a “full” background check. This will include arrest and criminal records, misdemeanors and felonies, warrants and police records, evictions and foreclosures, professional licenses, marriage and divorce records, birth and death records, and more.
In researching this blog post, information about me appeared on 66 different people search websites. They published the names of my sisters- and brothers-in-law, the age of my father-in-law and mother-in-law, and my son’s email. They also listed the address of where I lived as a child over 40 years ago, all the cell phone numbers of my family members, all our email addresses, the University I attended, and my year of graduation.
Well-known data brokers in this space include Spokeo, ZoomInfo, White Pages, PeopleSmart, Intelius, PeopleFinders, BeenVerified, and PeekYou.
Personal Health Brokers
These data brokers collect, share and sell consumer’s health data to pharmaceutical and health insurance companies. Data collected includes purchases of over-the-counter drugs, geriatric supplies and weight loss supplements, contact lenses, and health-related magazine subscriptions. Other data elements include if a consumer buys disability or supplemental insurance, and any online searches related to a specific ailment.
Data brokers will also collect purchase history or reported interest in particular health topics, including allergies, arthritis, cholesterol, diabetes, and senior needs.[12] For example, the data broker firm Epsilon claims they track over 100 medical conditions, procedures, or ailments, including colitis, depression, or anorexia.[13] As these data providers are not “covered entities” under the Health Insurance Portability and Accountability Act (HIPAA), there is no restriction on the collecting and selling of this highly sensitive data.
Consumers are further segmented and scored based on their health conditions. For example, LexisNexis Risk Solutions “provides a health scoring product that calculates health risks, as well as expected healthcare costs for individuals, based on vast amounts of consumer data, including purchase activities.”[14]
Companies that offer products in this category include Experian Health Inc., Healthcare.com, Oracle, Acxiom, and Epsilon. As you can see from the last three, the larger Market and Advertising brokers are also in this market segment.
Conclusion
The data broker industry has become a big market — many analysts estimate there are over 4,000 data brokers globally. It is estimated that the global data broker market was valued at $233 billion in 2019 and is expected to grow to $345 billion in 2026.[15] They have been getting a lot of bad press, and justifiably so, but it is important to understand there are different types out there.
[1] Consumer Financial Protection Bureau, “What is Credit Reporting Company,” https://www.consumerfinance.gov/ask-cfpb/what-is-a-credit-reporting-company-en-1251/. Investopedia, “Credit Reporting Agency,” https://www.investopedia.com/terms/c/credit-reporting-agency.asp,
[2] Investopedia, “FICO Scores,”February 9, 2021, https://www.investopedia.com/terms/f/ficoscore.asp.
[3] Aaron Riecke et al., “Data Brokers in an Open Society,” Open Society Foundations, November 2016, https://www.opensocietyfoundations.org/publications/data-brokers-open-society.
[4] LexisNexis Risk Solutions, “Technology,” https://risk.lexisnexis.com/our-technology.
[5] Consumer Financial Protection Bureau, “List of Consumer Reporting Companies (2022),” https://www.consumerfinance.gov/consumer-tools/credit-reports-and-scores/consumer-reporting-companies/companies-list/.
[6] Aaron Riecke et al., “Data Brokers in an Open Society,” Open Society Foundations, November 2016.
[7] Federal Trade Commission (FTC), “A Look At What ISPs Know About You: Examining the Privacy Practices of Six Major Internet Service Providers,” October 21, 2021, https://www.ftc.gov/system/files/documents/reports/look-what-isps-know-about-you-examining-privacy-practices-six-major-internet-service-providers/p195402_isp_6b_staff_report.pdf.
[8] Jon Keegan and Alfred Ng, “There’s a Multibillion-Dollar Market for Your Phone’s Location Data,” The Markup, September 30, 2021, https://themarkup.org/privacy/2021/09/30/theres-a-multibillion-dollar-market-for-your-phones-location-data.
[9]Bennett Cyphers and Gennie Gebhart, “SafeGraph’s Disingenuous Claims About Location Data Mask a Dangerous Industry,” Electronic Frontier Foundation (EFF), May 6, 2022, https://www.eff.org/deeplinks/2022/05/safegraphs-disingenuous-claims-about-location-data-mask-dangerous-industry.
[10] Joseph Cox, “Location Data Firm Provides Heat Maps of Where Abortion Clinic Visitors Live,” Vice, May 5, 2022, https://www.vice.com/en/article/g5qaq3/location-data-firm-heat-maps-planned-parenthood-abortion-clinics-placer-ai.
[11] Federal Trade Commission, “Data Brokers: A Call for Transparency and Accountability,” 2014, https://www.ftc.gov/system/files/documents/reports/data-brokers-call-transparency-accountability-report-federal-trade-commission-may-2014/140527databrokerreport.pdf.
[12] Federal Trade Commission, “Data Brokers: A Call for Transparency and Accountability,” 2014.
[13] Atlas Privacy, “Does Starbucks Know If I Wet the Bed,”February 9, 2022.
[14] Wolfie Christl, “Corporate Surveillance in Everyday Life,” Cracked Labs, June 2017.
[15] WebFX, “What Are Data Brokers – And What Is Your Data Worth?” March 16, 2020, https://www.webfx.com/blog/internet/what-are-data-brokers-and-what-is-your-data-worth-infographic/. Knowledge Sourcing Intelligence, “Global Data Broker Market Size,” June 2021, https://www.knowledge-sourcing.com/report/global-data-broker-market.