Data brokers are in the business of selling your online information

Whether it’s Facebook or Google or smart speakers that may be overhearing every word you say, there are lots of companies that pose a risk to your privacy. And there are also hundreds of companies you haven’t heard of making billions of dollars buying and selling detailed dossiers — about everybody. Host Molly Wood talked about the data broker business with Michelle Richardson, director of the Data and Privacy Project at the Center for Democracy and Technology. The following is an edited transcript of their conversation.

Wood: There’s this idea that if we regulate Facebook and Google, but don’t regulate data brokers, then we’ve barely scratched the surface. Is that a fair characterization?

Richardson: That’s right. A lot of the media now focuses on Facebook or Google because they’re household names, but the system is really so complex. The data brokers are operating at a level below that, a level consumers don’t see or interact with.

Wood: We’ve built a model where everyone takes everything, just in case. It seems like it would be a large philosophical, legal and financial shift to say, “no, companies, you’ve got to work with the minimum viable amount.” But, I wonder, how hard is this?

Richardson: It’s unprecedented in the U.S. I don’t want to underplay how difficult it is, because this is going to require a change in mindset, legal structures and consequences for people. Not everything we do online has to be done in exchange for free services, sharing data or helping someone build their next product.

Wood: I was talking to a climatologist recently about climate change who said, “I used to tell people to take these individual actions. At this point, I’m telling them, that’s not going to help. You need to come up with something that your whole city can do.” It feels like we’re there with our own data footprints, too. Even if you and I tried to turn off the hose, don’t get an Amazon Echo or don’t use these various products, deprive ourselves of existing in the modern world, that it doesn’t even matter.

Richardson: That’s right. Information is collected about you passively, everywhere you go. It’s everything from these stories about how you can now walk into a retail store and they are taking pictures of your face to see what you’re looking at, are you smiling, what you buy. All that stuff is able to be reassociated to a real live human being and that’s just because you walked in to buy a soda out of a CVS. Even if you want to be a lean data person and choose to opt out of some of the big names that we know to be bad actors, there’s just no way out of this now, not in 2019. We just need to accept that and expect better from our private sector and how they handle our data.

Wood: I could imagine companies saying, “We need this information to conduct our business,” or that consumers really like those targeted ads. Are there downsides of data brokers not having this level of information?

Richardson: There are a lot of different advertising activities out there. You do not have to get this granular to serve people ads that are relevant to their lives. The idea that it’s an on or off switch, we either have advertising or not, is probably a little too simplistic. You could, for example, say that because someone is visiting a sports website, they might want to see ads for tickets for the local football team or something relevant to that website. That would be one way to do it. You don’t actually have to track people for many years, across devices and services and behaviors to come up with a way to understand what they might want to see more of. That middle road would be a way to keep advertising and advertising models alive without the creep factor and the intrusive information tracking.

Related links: more insight from Molly Wood

Data brokers are almost completely unregulated. A law that went into effect last month in Vermont is the first to make third-party data brokers register with the state. Fast Company has a piece on the 121 companies who have registered in Vermont so far.

Another Fast Company piece takes a look at the law itself, which privacy advocates say is still missing some pretty big elements around actual privacy. While it does require companies to register and it does require that data be stored securely, it doesn’t give consumers any way to opt out of having their information collected. It also doesn’t have a way to review what information is stored, correct it or know where it came from.

And — if you follow me on Twitter, you’ll know I had some strong words in response to an essay that Facebook CEO Mark Zuckerberg posted yesterday outlining his vision for more privacy-oriented social networking. It said that people “increasingly” want to connect privately in the digital equivalent of the living room. Then it said, “Now, with all the ways people also want to interact privately, there’s also an opportunity to build a simpler platform that’s focused on privacy first.”

I have a couple of things to say about that.

First, if you are thinking of trying to build a simple platform that’s focused on privacy first as a way to try to compete with Facebook, Mark Zuckerberg just announced that he plans to co-opt your idea and possibly acquire you. Please don’t think this isn’t about scooping the competition, because it is.

Secondly, we probably preferred this all along. In fact, it’s what we kept trying to accomplish with Facebook, except that the product kept pushing us in the direction of more sharing, more public sharing, more connections with people with only the vaguest possible connection to our actual lives, a place for news, our friends and friends of friends on offer for all kinds of apps and services and advertisers.

I might buy that this is a sincere pivot to privacy and a realization that this is a good way to communicate, if it weren’t for the fact that Mark Zuckerberg himself seems to have known for all of his adult life that this is a good way to communicate. This is a guy who mocked his users in college for sharing their personal information. This is a guy who covers his own laptop microphone and camera with tape. This is a guy who bought up all the property around his house so he could have more privacy. This is a guy who granted himself disappearing messages on Facebook when no one else had them. If your measure of trusting someone is based on how they act and not based on what they say, which I find is a good rule in life, then approach this new embrace of privacy for what it is: it’s not philosophy, it’s business.

Stories You Might Like

The EU doesn’t trust its citizens’ data in the hands of the U.S.

The U.S. is talking, and the EU is regulating. Is any of it slowing down Big Tech?

Google is changing the way ad tracking works

The FTC gets serious about data privacy with new lawsuit

When a tech columnist digs into the secret life of his data

Big Tech is prepping for California’s tough new privacy law