Data brokers should give consumers more control over their personal information, and Congress should consider legislation that reins in the ways data brokers can use that information, the U.S. Federal Trade Commission is recommending.
The data-broker industry “largely operates in the dark,” with most U.S. consumers unaware that companies are collecting data about consumers’ place of residence, interests, children, health conditions and income, said FTC Chairwoman Edith Ramirez.
“Most consumers have never heard of the data-broker industry, let alone the names of the largest data brokers,” she added during a news conference. “The industry suffers from a fundamental lack of transparency.”
Data brokers collect consumer data from “extensive” online and offline sources, largely without consumers’ knowledge, with sources including consumer buying data, social-media activity, warranty registrations, magazine subscriptions and religious and political affiliations, according to a 110-page FTC report released Tuesday.
The FTC has concerns about the “sheer breadth and complexity” of the data broker industry, Ramirez said. Data brokers store “billions[b] of data points about nearly every U.S. consumer,” she added.
In addition, many data brokers use “troubling classifications” based on race, health conditions and income to pigeonhole consumers, Ramirez said. A classification focused on a consumer’s income could lead to limited offers for credit and other financial products, she said.
A representative of the Direct Marketing Association, a trade group representing data brokers and other companies using data-collection services, didn’t immediately respond to a request for a comment on the FTC study.
Data shared, but not with users
In many cases, data brokers share information with each other, with consumer data often passing through “multiple layers” of data broker, the report said. Seven of nine data brokers studied by the FTC said they shared information with another broker, the FTC said.
The FTC wants to “lift the veil of secrecy that clouds the data broker industry,” Ramirez said.
Congress should consider legislation requiring data brokers that provide marketing products to create centralized portals where data brokers share information about their practices and provide links to tools where consumers can access their information and opt out of data collection, the FTC report recommended.
Legislation should require data brokers to give consumers access to their data and should require data brokers to disclose the names or categories of their data sources, the FTC said.
Congress should also require retailers and other consumer-facing entities to receive consent from consumers before collecting sensitive personal information and sharing it with data brokers, the FTC recommended.
For brokers providing people-search products, Congress should require data brokers to allow consumers to access their own information and opt out of having the information included in a people-search product, the FTC said. Those data brokers should also disclose the original sources of the information so consumers can correct it, and disclose any limitations of an opt-out feature, the agency recommended.
The FTC report is a “powerful and disturbing privacy wake-up call,” said Jeffrey Chester, executive director of the Center for Digital Democracy, a consumer privacy advocate. “The report reveals the largely invisible Big Data-driven complex that regularly spies on every American, comprehensively following our activities both online and off.”
Unlike a big data report, issued by the White House earlier this month, the FTC study “provides a much more realistic—and chilling—analysis of an out-of-control digital data collection industry,” Chester said by email.
But the FTC’s calls for greater transparency and consumer control are insufficient, without additional legislation, he added. “The real problem is that data brokers—including Google and Facebook—have embraced a business model designed to collect and use everything about us and our friends—24/7,” he said.
The FTC voted in December 2012 to compel nine data brokers to disclose information that was included in the study. The nine data brokers in the study are Acxiom, CoreLogic, Datalogix, eBureau, ID Analytics, Intelius, PeekYou, Rapleaf and Recorded Future.