No self-regulation for you, the Federal Trade Commission appears to be telling the data broker segment. While the FTC has seemingly encouraged the online ad targeting industry to police itself in
recent years, the newly released report “Data Brokers: A Call for Transparency and Accountability” takes a very different tack.
The report dug deep into nine providers: Acxiom, CoreLogic, Datalogix, eBureau, ID Analytics, Intelius, PeekYou, Rapleaf and Recorded Future. The findings were quite direct and accusatory, arguing that the ways in which data are used “pose risks to consumers, such as unanticipated uses of data.” One example: segmentation of consumers, which could be used by one client to target ads and by an insurance provider as a way of inferring a consumer's risky behavior.
FTC officials are scheduled to speak to reporters today about details, and the full report is not yet accessible. But in an outline statement announcing the report, the FTC’s criticism of the data brokerage field is unambiguous. The commission claims major firms are harvesting user data from every conceivable corner without consumer knowledge. Most of these firms are also sharing data. They are making “potentially sensitive inferences” about consumers that include ethnicity, income, religious affiliation, political leaning, and health conditions like pregnancy, diabetes and high cholesterol.
The FTC seemed taken aback by the kinds of segmentation they discovered among the brokers. They cited the “Urban Scramble” and “Mobile Mixers” categories as highly concentrated with African-Americans and Latinos who also had lower incomes. A “Rural Everlasting” category was profiled as singles over age 66 with low income and low net worth.
In addition to noting that some companies are storing data indefinitely, raising security concerns, the FTC also made clear it felt consumer choices and controls on how their data was used “are largely invisible and incomplete.”
The FTC considers the risk and lack of transparency profound enough to merit legislation, and it recommends that Congress enact laws on a number of points. For one, the FTC advises a centralized data portal where brokers both explain their practices and give consumers access to their profiles and opt-outs. The FTC went further, however, in asking for disclosure of how data are being interpreted and sourced. What inferences are companies making from the data? As well, the commission wants data broker clients to ask specific permission before using sensitive and health information for any purpose. Consumers also should get a trail of where a risk mitigation product was used to limit a transaction. Consumers should know which broker provided the data so they can track back to the profile to correct or manage their own data.
While we have to look
at the report itself when available and hear the tone of the FTC officials in their briefing, this strikes me as an important moment in the long story of digital data and consumer privacy. Apart from
the initial COPPA regulations many years ago, I cannot recall a time when a government agency came down this strongly and quickly on the side of legislation.
Those of us covering the online privacy story for many years have always wondered where the third rail of this issue would be. There was a time when using search behavior in a user profile seemed to be crossing a red line for some. And many of us thought mobility and its location tracking would spark real concern and resistance.
I suspect that what we are seeing in this FTC report is less about data collection and more about data use. When people begin to feel that they are being cut off from opportunities, their identities pigeonholed and restricted by data, then the issue comes up against a real hair trigger: limited freedom and unequal treatment.
Argue all you like that companies like health and insurance providers have been making these sorts of risk assessments for years. Arguably, it is the precision of this generation of data collection, mining and targeting in combination with the pervasiveness of its application that distinguishes contemporary data brokerage from anything that preceded it.