Data Brokers quietly buying and selling your personal information
It’s no secret that your personal data is routinely bought and sold by dozens, possibly hundreds, of companies. What’s less known is who those companies are, and what exactly they do.
Thanks to a new Vermont law requiring companies that buy and sell third-party personal data to register with the Secretary of State, we’ve been able to assemble a list of 121 data brokers operating in the U.S. It’s a rare, rough glimpse into a bustling economy that operates largely in the shadows, and often with few rules.
Even Vermont’s first-of-its-kind law, which went into effect last month, doesn’t require data brokers to disclose who’s in their databases, what data they collect, or who buys it. Nor does it require brokers to give consumers access to their own data or opt out of data collection. Brokers are, however required to provide some information about their opt-out systems under the law–assuming they provide one.
If you do want to keep your data out of the hands of these companies, you’ll often have to contact them one by one through whatever opt-out systems they provide; more on that below.
Types of consumer data and data companies. Some companies included in the chart may not be covered by the Vermont law. See a larger version. [Image by Cracked Labs]
The registry is an expansive, alphabet soup of companies, from lesser-known organizations that help landlords research potential tenants or deliver marketing leads to insurance companies, to the quiet giants of data. Those include big names in people search, like Spokeo, ZoomInfo, White Pages, PeopleSmart, Intelius, and PeopleFinders; credit reporting, like Equifax, Experian, and TransUnion; and advertising and marketing, like Acxiom, Oracle, LexisNexis, Innovis, and KBM. Some companies also specialize in “risk mitigation,” which can include credit reporting but also background checks and other identity verification services.
Still, these 121 entities represent just a fraction of the broader data economy: The Vermont law only covers third-party data firms–those trafficking in the data of people with whom they have no relationship–as opposed to “first-party” data holders like Amazon, Facebook, or Google, which collect data directly from users.
What they know
By buying or licensing data or scraping public records, third-party data companies can assemble detailed profiles with thousands of attributes each for billions of people. For decades, companies could buy up lists of magazines subscribers to build targeted advertising audiences. These days, if you use a smartphone or a credit card, it’s not difficult for a company to determine if you’ve just gone through a break-up, if you’re pregnant or trying to lose weight, whether you’re an extrovert, what medicine you take, where you’ve been, and even how you swipe and tap on your smartphone.
In 2017, data giant Acxiom provided up to 3,000 attributes on 700 million people. In 2018, the number was 10,000, on 2.5 billion consumers [Image by Cracked Labs]
All that data can be used to target you with ads, classify the riskiness of your lifestyle, help determine your eligibility for a job. Like the companies themselves, the risks can be hard to see. Apart from the dangers of merely collecting and storing all that data, detailed (and often erroneous) consumer profiles can lead to race or income-based discrimination, in a high-tech version of redlining. Piles of personal data are flowing to political parties attempting to influence your vote and government agencies pursuing non-violent criminal suspects. Meanwhile, people-search websites, accessible to virtually anyone with a credit card, can be a goldmine for doxxers, abusers, and stalkers. (The National Network to End Domestic Violence has assembled a guide to data brokers.)
“Deleting” your data
For companies regulated under the Fair Credit Reporting Act (FCRA), including traditional credit bureaus, you have the right to request your personal data and request corrections of anything that’s wrong.
But for other companies that deal in data, like marketing and people finder companies, U.S. law mostly doesn’t make any such guarantees, though that may change in the future as state and federal legislatures consider further rules. Those could ultimately bring protections like the right-to-be-forgotten and other safeguards granted to European residents under the General Data Protection Regulation (GDPR), probably the strictest international consumer data policy.
- To try to remove yourself from a company’s databases: Click on the name of the broker below, click “Filing History,” and then click “DATA BROKER REGISTRATION.” You’ll get a document in PDF form that contains details from the company on how to opt out–provided the company allows you to opt-out.
- You can also consult various online guides listing opt-out procedures. Griffin Boyce, systems administrator at Harvard University’s Berkman Klein Center for Internet and Society, has compiled one such opt-out guide. Another guide is put together by Joel Winston, an attorney known for his work on data privacy and consumer protection. At Motherboard, Yael Grauer compiled another list of brokers with tips for opting out. If you’re a resident of the European Union, opt-out.eu has a guide to sending GDPR Erasure Requests.
- You can also use the Data & Marketing Association’s DMAchoice program, which is primarily designed for opting out of direct mail and email messages, but is also used by some organizations to remove consumers from their lists entirely. It costs $2 to sign up for the program, and registration lasts two years.
- If you’re concerned about how a company is handling your personal data, you can file a complaint with the Federal Trade Commission, which has issued millions of dollars in penalties over unfair or unlawful behavior by credit agencies and data brokers.
- You can limit data loss by deleting unnecessary apps, adjusting your privacy settings, using privacy tools like a VPN, and limiting what you personallypost online.
In order to control your data, you may need to hand over some basic info to verify that it’s really you. But be careful about what you turn over. As Boyce writes, “other than credit reporting agencies such as Equifax, no one should ask for your Social Security number or tax ID while opting out. When sending a copy of your ID, mark out the ID number and draw a line across the photo.”
The data broker companies
This is a very long list and you should read carefully who they are and I’m confident that all who view the list have come in contact with one of them and most likely several during your financial transactions local, stateside and abroad.
Accudata operates mailing lists and marketing data services.
The data giant’s offerings now encompass “more than 62 countries, 2.5 billion addressable consumers and more than 10,000 attributes—for a comprehensive representation of 68 percent of the world’s online population.” Last year, following the Cambridge Analytica scandal and Facebook’s decision to end partnerships with Acxiom and other third-party data handlers, LiveRamp sold Acxiom to Interpublic Group, one of the world’s largest advertising agencies, for $2.3 billion. LiveRamp continues to operate as a leading “data onboarding” company, helping bring offline data online for marketing purposes.
Advantage Credit resells credit services and data for the mortgage and finance industry.
Advantage offers shopper marketing, retail merchandising, and other services to retailers and manufacturers.
4LegalLeads.com connects law firms and legal professionals across the country to tens of thousands of prospects requesting legal help in real-time via phone or web leads each month.
ALC (American List Counsel) has “become the industry’s leading privately held direct and digital data marketing services provider.”
All Web Leads is an “online lead generation company that sells the highest-quality sales leads to top insurance producers.” (Crunchbase)
Altisource provides information about landlords to businesses that wish to market to them.
AmRent provides tenant screening services and data.
“[T]he first data company to consistently blend cognitive psychology with sophisticated data science to help you understand the who, what and why behind consumers and the decisions they make every day. Their accurate and comprehensive consumer database, PeopleCore, provides access to data attributes you can’t find anywhere else.”
Belardi Wong is “a full service digital & direct marketing agency, relentlessly focused on driving revenue, profit and customer growth.”
Black Knight provides loan and real estate data.
A “supplier of software and services specifically designed for nonprofit organizations. Its products focus on fundraising, website management, CRM, analytics, financial management, ticketing, and education administration.” (Wikipedia)
CBCInnovis provides credit and real estate data.
CDK “provides software and technology solutions for automotive retailers in the United States and internationally.”
CIC provides credit data for the mortgage industry.
Civis is “an Eric Schmidt-backed data science software and consultancy company founded by Dan Wagner in 2013. Wagner served as the chief analytics officer for Barack Obama’s 2012 re-election campaign.” Read more from Fast Company here.
Clarity Services is a unit of Experian focusing on alternative credit data.
Provides specialty lists, data hygiene services, and direct marketing database solutions.
A people search conglomerate that owns Peoplefinders.com, Enformium Inc., PublicRecordsNOW.com, PrivateEye.com and Advanced Background Checks Inc.
CoreLogic Background Data provides “wholesale background data” for screening purposes.
CoreLogic Credco provides credit data to the mortgage industry.
CoreLogic Credco provides credit data to the mortgage industry.
CoreLogic Screening Services provides tenant screening for rental properties.
CoreLogic Solutions processes and provides property records for the real estate and mortgage industries.
Cortera provides credit information about businesses.
Data Facts provides information on consumers for background checks in lending, housing and more
A “data and technology platform that links customer records with their proprietary blend of online, offline, and digital marketing data for highly personalized, one-to-one consumer marketing, regardless of device or channel.” (Crunchbase)
A “leading provider of integrated information, technology and analytics. Datamyx serves customers in industries ranging from banking, credit unions, and mortgage providers to alternative finance, insurance, and others.”
Datastream “provides rich marketing data and real-time sales leads.”
DataX is a unit of Equifax focused on alternative credit data.
“Deploys diversified and data-driven digital media customer acquisition solutions, including performance marketing, digital agency and marketing technology solutions to help achieve the marketing objectives of clients.”
A multi-channel marketing company.
Ad manager and lead generator for social media campaigns.
Dustin Blackman is the head of Drobu Media LLC, a lead generation service. He indicated to Fast Company that he intended to register only the business, not himself.
Edvisors “provides independent advertising-supported platforms for consumers to search compare and apply for private student loans.”
Enformion “aggregates billions of United States public records into one of the largest online people databases.”
Epsilon is one of the largest data management companies in the world, and provides direct marketing and customer relationship management services, sending more than 40 billion e-mails each year.
Incorporated in 1937, Equifax is one of the three major consumer credit reporting agencies. In 2017, the company said it suffered a cyberattack that exposed the data of more than 145.4 million Americans, including their full names, Social Security numbers, birth dates, addresses, and driver license numbers. At least 209,000 consumers’ credit card credentials were also taken in the attack.
A sibling of the giant U.S. credit reporting agency Experian Information Solutions and one of many subsidiaries of the Ireland-based data giant Experian PLC, the company operates Experian RentBureau, a database updated daily with millions of consumers’ “rental payment history data from property owners/managers, electronic rent payment services and collection companies.”
An Experian unit providing a database focusing on fraudulent transactions.
The healthcare division of the credit reporting agency, providing data and analytics for healthcare providers, labs, pharmacies, payers, and other risk-bearing entities.
One of the “big three” credit reporting agencies, Experian also sells data analytics and marketing services, and purports to aggregate information on over one billion people and businesses, including 235 million individual U.S. consumers.
A marketing subsidiary of the credit reporting giant focused on identity-linkage and consumer research.
Factual Data provides credit and other data to mortgage lenders.
DataTree “delivers the current and accurate real estate and property ownership data you need for your business.”
First Direct provides digital & traditional direct marketing.
First Orion provides information on telephone callers, including contact information and the likelihood of a scam.
Forewarn provides background information about potential business associates, including real estate clients.
Fused Leads is “a pipeline to potential clients for the home improvement, auto insurance, auto finance, life insurance, mortgage, and health insurance industries.”
GIS, which recently merged with HireRight, is a background screening company.
Not to be confused with the government insurance portal healthcare.gov, healthcare.com provides consumer marketing for insurance companies.
Funded by the Koch brothers and started by a former adviser to John McCain’s presidential campaign, i360 has built one of the largest data, technology, and analytics platforms for political and commercial clients.
ID Analytics is a unit of Symantec focused on credit and fraud risk mitigation.
IHS Markit is a “global leader in information, analytics and solutions” for various industries.
InCheck is a background check provider.
Inflection helps “companies to make better and faster people decisions about who to hire, who to trust, and to whom they should grant access” using in-house and public data that includes criminal records, sex offender registries, and global watchlists.
A subsidiary of Inflection Risk Solutions.
Infocore “specializes in direct marketing, campaign strategy, and sourcing market data for domestic and multinational clients.”
Infogroup, founded by Vinod Gupta in 1972, “offers real-time data on 245 million individuals and 25 million businesses for customer acquisition and retention,” according to Wikipedia.
Infutor is “the expert in identity management, enabling brands to instantly identify consumers and make informed marketing decisions.”
Innovis is a consumer credit reporting agency.
Instant Checkmate is a people search site that uses public records, including criminal records.
ISO is a unit of Verisk that focuses on insurance risk and fraud identification.
IntelliCorp is a unit of Verisk focusing on employment background checks.
Intellireal is a division of Equifax focusing on real estate analytics and valuation.
Interactive Data provides consumer information for risk mitigation, compliance, and identity verification.
A nationwide data aggregator, IQ Data Systems offers “private investigation, skip tracing, public record maintenance and background screening services,” and provides “FCRA compliant background screening.”
ISO manages insurance companies’ personal injury claims portfolios.
A subsidiary of data giant Verisk Analytics, ISO “is a provider of statistical, actuarial, underwriting, and claims information and analytics; compliance and fraud identification tools” for “insurers, reinsurers, agents and brokers, insurance regulators, risk managers, and other participants in the property/casualty insurance marketplace.”
Equifax-owned IXI analyzes household economics and “offers customer targeting, segmentation, and market tracking solutions and services for financial services and consumer marketing firms.”
WPP-owned data giant KBM offers “marketing strategy and analytics services.”
KnowWho helps “government relations, lobbying firms, advocacy groups, library patrons, and the government itself, connect with elected officials and their staffs for more than 15 years.”
This LexisNexis unit provides and works with data for risk management purposes.
LCI, part of Verisk Financial, provides data on bankruptcy matters.
MCH “provides the highest quality education, healthcare, government, and church data.”
A home improvement contractor marketplace.
“NCTUE is a consumer reporting agency that maintains data such as payment and account history, reported by telecommunication, pay TV, and utility service providers that are members of NCTUE.”
The National Student Clearinghouse verifies where people attended school and the degrees they earned.
Neustar “provides real-time information and analytics for defense, telecommunications, entertainment, and marketing industries,” and provides clearinghouse and directory services to the global communications industries, serving as the domain name registry for .biz, .us, .co, and .nyc top-level domains.
Offers targeted consumer mailing lists.
700 Credit provides credit screening for car dealers.
Data giant “Oracle Data Cloud gives marketers access to 5 billion global IDs, $3 trillion in consumer transactions, and more than 1,500 data partners available through the BlueKai Marketplace. With more than 45,000 prebuilt audiences spanning demographic, behavioral, B2B, online, offline, and transactional data, we bring together more data into a single location than any other solution.”
OwnerIQ “provides online advertising solutions and marketing channels for brands, retailers, and manufacturers” and operates a platform for second party data for marketing.
Parasol Leads is one of the insurance industry’s highest quality leads generation services.
Partners provides credit and background data to mortgage lenders.
Path2Response “collects, aggregates and models consumer information.”
A people search company that owns Intelius and Classmates.com, providing access to criminal records, employee screening, background checks, and identity theft protection services.
Pipl is a people search tool.
A company that builds “engaging, consumer-centric paths and web sites.”
PossibleNOW “is the leader in consumer regulatory compliance and consent solutions, and pioneered the concept of enterprise preference management.”
Project Applecart gathers data on adults in the U.S. “via publicly available sources or via third-party license agreements. It analyzes the data to help advertisers address marketing and other communications to the relevant audience.”
QPC provides analytics and information on policyholders for automobile insurance companies.
Rental Property Solutions is a unit of CoreLogic that provides credit reporting information to landlords.
Reveal “provides location-based marketing & analytics to help companies reach audiences across mobile apps, digital advertising, and social media.”
A marketing firm owned by consumer identity management company Infutor with a focus on travel, tourism, insurance, e-commerce, and education.
SageStream is a consumer credit reporting company.
For skiptracers and investigators.
“Speedeon Data’s goal has been to provide our clients with the highest quality customer contact data…”
Spokeo is a people search giant that purports to provide access to 12 billion public records. In 2012, the Federal Trade Commission fined the company $800,000 and placed it under a 20-year privacy prohibition for marketing information for employment screening purposes without adhering to the Fair Credit Reporting Act, in the first FTC fine involving personal data collected online and sold to potential employers.
Spy Dialer is a people search website providing information on people by name or phone number.
SIR provides background and credit screening to employers, landlords, and lenders.
TALX is a unit of Equifax that provides employment information to companies and landlords through a database called The Work Number. As Fast Company previously reported, the database relies on feeds of detailed employee and salary data provided by the country’s biggest companies and organizations, including Facebook, Amazon, Microsoft, Oracle, Walmart, Twitter, AT&T, Harvard Law School, and the Commonwealth of Pennsylvania. In 2017, a security researcher exposed a breach in which employees’ data could be accessed using only Social Security numbers and dates of birth.
“CoreLogic Teletrack is a consumer reporting agency that provides consumer reports to third parties for the purpose of credit risk assessment and/or other purposes as permitted by law.”
Specializing in quality real-time online insurance leads for auto, home, life, and health.
Refinitiv operates the World-Check database used for financial “know your customer” compliance and identity verification. Non-profit Privacy International has raised concerns about U.S. government contracts with two subsidiaries of Thompson Reuters and three other firms to provide data that “can be used by the [Immigration and Customs Enforcement] agency and others to identify and track people and their families, including for deportation.”
A multichannel marketing firm focused on email.
TransUnion is the smallest of the “big three” credit reporting agencies, alongside Experian and Equifax.
Truthfinder is a people search site that provides background checks and public records search capabilities.
“Twine is a mobile data platform that works with app publishers who generate mobile data & the companies who need data for ad targeting.” (Crunchbase)
Viant, a former Time Inc. and current Meredith subsidiary, is “a premier people-based advertising technology company, enabling marketers to plan, execute, and measure their digital media investments,” with “access to over 250 million registered users in the U.S., infusing accuracy, reach and accountability into cross device advertising.”
A unit of Thomson Reuters, West offers tools for searching public records and legal records. In 2018, the non-profit Privacy International identified it as one of a number of firms hired by Immigration and Customs Enforcement to provide data that “can be used by the agency and others to identify and track people and their families, including for deportation.”
WhitePages provides people search and background information.
Whoodle is a people search and background check service.
A “provider of intelligence-driven predictive marketing solutions.”