Somewhere, in a database you have never seen, you may be sorted into a category. In 2014 the US Federal Trade Commission studied nine companies that buy and sell personal information. One of them held about 3,000 pieces of information on nearly every consumer in the country. Their customer categories included labels such as "Expectant Parent," "Diabetes Interest" and groupings that tracked income and ethnicity. None of the people described had ever signed up with these firms. Most had never heard their names.
What data brokers do
Data brokers are companies that collect and sell personal information about people they have no direct relationship with. They gather it from public records such as property deeds, court filings and voter rolls; from retailers and loyalty cards; from apps and websites; and from other brokers. They combine it into profiles and sell or license those profiles for marketing, credit and identity checks, fraud prevention, background screening and more.
Many of these uses are ordinary and some are useful. Fraud checks protect bank customers, and background checks help landlords and employers. But the same records also power "people search" websites that list home addresses and relatives for anyone willing to pay a few dollars. In July 2020 a gunman who had found the home address of a New Jersey federal judge, Esther Salas, went there and killed her son. Congress later passed a law letting federal judges shield their personal information. Most people have no such protection.
Another concern is that government agencies can sometimes buy data they would need a warrant to demand. Investigations have shown agencies purchasing location data from commercial brokers. Critics call this a loophole; agencies respond that the data is commercially available to anyone.
How the ad economy runs on data
Most free websites and apps are paid for by advertising, and much of that advertising is targeted using personal data. When you open a web page, a process called real-time bidding often runs in the fraction of a second before the page appears: information about you and your device is sent out to many advertising companies, which bid in an automatic auction for the chance to show you an ad. Even the companies that lose the auction may receive the data.
The social psychologist Shoshana Zuboff named this system surveillance capitalism in a 2019 book. Her argument is that technology companies treat human experience as free raw material, turning records of behavior into predictions of what people will do next and selling those predictions to businesses. The ultimate product, she argues, is not information about us but the ability to shape what we do.
Cambridge Analytica
The best known scandal came in 2018. A researcher had built a personality quiz on Facebook. Around 270,000 people took it, but the app also gathered data on their friends, so the political consulting firm Cambridge Analytica obtained data from up to 87 million Facebook users, mostly gathered through friends of people who took a quiz. Most of those people had never used the app. In 2019 the FTC fined Facebook $5 billion for privacy violations. Whether the firm's "psychographic" targeting actually changed votes is doubtful: many researchers think its claims were inflated. The deeper lesson was about consent. Your data can be exposed by choices your friends make.
Arguments on both sides
Defenders of the data economy make real points. Free search, maps, email and video reach billions of people, including the poor, because advertising pays for them. Targeted ads can be more useful than random ones, and they help small businesses reach customers they could not otherwise afford to find. Users agree to terms of service, and many say they prefer free services with ads to paid services without them.
Critics answer that the system of notice and consent is a fiction. A 2008 study estimated that reading every privacy policy a typical American encountered would take about 200 hours a year. Policies are vague, change often, and offer no real choice: refuse and you cannot use the service. Consent also cannot cover people who never clicked anything, like the friends of quiz takers. And the harms fall unevenly. Profiles can be used to target vulnerable people with payday loans or gambling ads at the moments they are weakest.
Worked example: a free weather app
Marcus installs a free weather app and taps "Allow" when it asks for his location. The app includes code from a data company that records his precise position many times a day and sells it.
Within weeks, a broker's profile shows where Marcus sleeps, where he works, which gym he uses and which church he attends on Sundays. He is placed in segments for "fitness enthusiast" and "likely new parent," because he has started visiting a pediatric clinic. Each time he opens a news site, real-time bidding sends parts of this picture to dozens of firms. Some of the buyers are advertisers; one might be a government agency that would otherwise need a warrant.
Did Marcus consent? Technically yes. But he agreed to share his location for a forecast, not to have his daily life mapped and sold. Contextual integrity explains the wrong more precisely than the word "consent" does. A defender would point out that he paid nothing for a useful app. A critic would reply that he paid with something worth far more than he knew.