Rockefeller Puts Data Brokers on Defensive With Report, Hearing

During testimony, self-regulation advocates and one of the largest data brokers resisted Rockefeller’s characterization. Responsible, data-driven marketing lowers barriers to entry for small businesses and prices for consumers, and is already subject to strict industry self-regulation, said Direct Marketing Association Senior Vice President-Government Affairs Jerry Cerasale. “We are trying to empower” consumers by bringing them goods and services they might not be offered otherwise, “not scam them,” said Tony Hadley, senior vice president-government affairs and public policy at Experian, one of the data brokers Rockefeller queried. Data analysis is “the best way” to target some categories of consumers -- new immigrants, recent college graduates -- that would otherwise go unnoticed, yet require goods and services, Hadley said.

Rockefeller intended the study “to help the public understand how [data brokers] collect, use and sell consumer information, specifically for marketing purposes,” said a committee aide. The study found opaque business practices and an unwillingness to disclose information. Data brokers are collecting “a huge volume of detailed information” and turning it into consumer profiles sold to predatory businesses that target “vulnerable consumers” and conduct “differential pricing,” according to the study. For instance, companies selling high-cost loans are targeting groups of people that data brokers determine to be “widows” or “consumers with transitory lifestyles, such as military personnel,” the study said.

Many, if not all, of these practices are undertaken “without consumer permission or knowledge,” the study said. “Data brokers typically amass data without direct interaction with consumers, and a number of the queried brokers perpetuate this secrecy by contractually limiting customers from disclosing their data sources.” Brokers’ obfuscation extended to the committee’s investigation, the report alleged. Three of the largest companies queried -- Acxiom, Experian and Epsilon -- were “secretive with the Committee with respect to their practices, refusing to identify the specific sources of their data or the customers who purchase it,” it said.

"I can’t tell you who our clients are,” Hadley said, when Rockefeller pressed him during questioning. “That’s a proprietary list of ours,” he said. “That’s like our secret ingredient.” Experian would require the Senate to protect the information from Freedom of Information Act requests before disclosing it, Hadley explained. But other companies in the study “gave us the precise information that I want from you,” Rockefeller countered. “We simply can’t do that,” Hadley responded, but said the company did want to work with Rockefeller to encourage more industry transparency.

Hadley generalized Experian’s clients. “Banks and financial services” are interested in consumer profiles to help find “underbanked” individuals that “financial institutions cannot reach,” Hadley said. The sale and use of these profiles is a specific practice Rockefeller’s report said “merits close review.” Different states’ departments of health and human services are also interested in Experian’s data to update their client lists and find individuals to reach out to and offer services, Hadley said. “That’s quite a different kettle of fish than a for-profit, bottom-line oriented company,” Rockefeller said: “This is an oversight committee. We have the feeling people are getting scammed or screwed. It’s up to you” to change that opinion.

Data used for marketing purposes is “inferred information that represents a statistical prediction about consumers” and not “actual characteristics of one consumer,” said Cerasale during the hearing. He likened it to using census data to estimate the average age of a household in one ZIP code area. Marketers for an area businesses -- like a local roofing company -- can then “make offers that are more likely to be valuable to households in that ZIP code,” Cerasale said.

Many hypotheticals presented in Rockefeller’s study are already covered by federal law -- the Fair Credit Reporting Act (FCRA), Cerasale said, which regulates data use for eligibility decisions on credit, insurance or employment. Privacy advocates agree, to an extent. The FCRA “applies in a lot of these circumstances,” Electronic Privacy Information Center Consumer Protection Counsel David Jacobs told us. But the law is not all-encompassing, he said. “If you're providing consumer information for a non-FCRA purpose” -- often the case with data passed on to data brokers -- FCRA doesn’t always apply “because it’s so purpose-specific,” he said. And “marketing, of course, isn’t covered at all,” he said. “It all comes down to the purpose."

Strong industry self-regulation covers many of the gaps, Cerasale said. The DMA offers an icon on advertisements that, when clicked, leads consumers to instructions on how to opt out of receiving advertisements based on information collected online (www.aboutads.info). Millions of people have chosen to opt out, which affects roughly 96 percent of targeted ads, Cerasale said. “I'm very engaged in the world of tech and I didn’t even know there was an opt-out function,” said Sen. Cory Booker, D-N.J. That’s worrisome, he said.

"The first step is very simple, which is there’s really little transparency about data brokers,” said FTC Bureau of Consumer Protection Director Jessica Rich. “Providing that transparency is pretty basic, it’s not a technological issue.” Transparency is not antithetical to growing the data-driven marketing economy, Rich said. A much-referenced, DMA-backed study found legislation limiting the exchange of data could cut as much as 70 percent of data-driven marketing revenue. But it didn’t have anything about how basic transparency and privacy measures “would undermine it,” Rich said, and that’s why the FTC recommended that “data brokers allow consumers access to the information” they maintain, she said. But the details of this are yet to be determined. Perhaps a “centralized website where consumers can go” and see the name of all data brokers, what kind of information they collect and potentially opt out of having that information collected, Rich said.

It’s not possible to put tens of thousands of companies on this website, Hadley said. And the way “data broker” is being defined -- an entity that gathers, exchanges or sells data for marketing purposes -- would encompass too many companies to make any sort of website useful. “That is how the business model of the Internet is,” he said. “How would that be meaningful to a consumer?” Experian wants to work on transparency that is relevant to consumers, Hadley said. “It’s both in consumers’ interests and businesses’ interests to provide more information,” Rich said.