7 ms·

The data brokers quietly buying and selling your personal information

138 points by KoftaBob 5y ago

andersco 5y ago
Vermont’s law is a great first step, but also a very kid gloves approach. It appears their disclosure requirements are minimal, basically that the company exists and how to opt out. What I would love to see is a requirement to notify the party that their data is being sold. Yeah, that might be a pain, but they are after all selling something that arguably is not theirs. Does anyone know if other similar laws are in place for other states? Or are in the works?
- user3939382 5y ago
  Isn’t California’s even better? You can tell them not to sell your data and on request, to delete it.
  - jrnichols 5y ago
    I don't know.. voter rolls seem to be how my fairly new California information got onto most of these people search websites. Getting it off is not easy. First, there are so many of them. Second, half the ones I've found want you to register with them first and verify that it's you... which doesn't seem to fit the spirit of the law, but that's how it is. It has been a long and frustratingly uphill battle to get my current name, address, phone number, etc removed from literally dozens of these data broker websites. and I've tried to be careful. :/
prepend 5y ago
Is there a “opterouter” project that just spiders all these and opt outs? Navigating the dark patterns of one site is a pain, much less 120+. But seems like a good opportunity for 120 to script one path each. Hard to do a service as I don’t want to enter my private info into another third party.
- chris_f 5y ago
  As an exercise I once went through the process of manually requesting my information removed from most of the top brokers. It would be difficult to automate because the opt-out processes usually aren't straightforward like unsubscribing from an email list. Many sites make it purposely difficult and involve going through multiple steps, providing verification like a drivers license, and email confirmations. Here is a really good check list of different brokers: https://inteltechniques.com/data/workbook.pdf https://inteltechniques.com/data/workbook.pdf
  - OminousWeapons 5y ago
    I also tried to do this manually using the same resources from Bazzell and eventually just got tired of dealing with it and paid for Deleteme. To their credit, they did a pretty solid job removing my public data from data broker sites.
  - unishark 5y ago
    Any online process that endeavors to be secure will be indistinguishable from a malicious system that tries to make your task purposefully difficult. I just got refused by a govt site recently because of the six different forms to info they wanted in order to sign in again, one of them wasn't accepted. Namely my cell phone number was prepaid which apparently isn't acceptable anymore. So now I need to mail in forms and wait for return mail taking weeks.
  - fartcannon 5y ago
    And youre not worried that all youve done is fill in the gaps of their data with your drivers license, etc? "Delete" is a boolean tag in a databse that never actually gets deleted.
    - meowster 5y ago
      And if your information is truely deleted, then when they come across your information again, they'll have no record of you, so they'll just fill in the missing gaps. For them not to share your information, they need to know what information not to share.
ashneo76 5y ago
And yet here we are with the site (fastcompany) itself loading something like 10-14 trackers/ external scripts
- bdcravens 5y ago
  While HN doesn't have tracking, YC has plenty of alums who are part of that industry (like Segment and Mixpanel)
  - eli 5y ago
    Segment and Mixpanel help companies track their own visitors on their own sites. Feels unfair to lump them in with data brokers.
    - bdcravens 5y ago
      I was referring to the comment about FastCompany's trackers. That said, where do you think data brokers get their data? Private companies sell info on their customers all the time.
- jeffbee 5y ago
  See, that’s the problem with cheap, disposable takes that preclude critical thinking. You’ve conflated “tracking” online with the actual privacy-invasive industry the article is talking about. These guys are selling your real private data: your credit card transactions, your phone’s location data, your real name and address, your life events. This industry is very happy that nerds confuse them and Google.
- bertil 5y ago
  I know this might seem like a niche argument, but I feel like asking my browser to store information is something that I can prevent. It’s annoying, and there’s less financial incentive to build detailed tools to help — but compared to taking information from my bank, without my consent; from electoral lists, without my consent; to infer my political opinion from photos of my car on the curb. I understand that people who don’t know how a browser works see it the other way around: they understand electoral lists (although I’m not sure they can change their details); they might not know how to “delete cookies”.
neptunedesert 5y ago
Related to this, everyone should also be aware of the Fourth Amendment is Not For Sale Act, or H.R. 2738 and S.1265, bills that have recently been put before the Senate and Congress. https://www.eff.org/deeplinks/2021/04/tell-congress-support-fourth-amendment-not-sale-act https://www.eff.org/deeplinks/2021/04/tell-congress-support-...
- amluto 5y ago
  That act is all backwards. The problem isn’t that the government can acquire data they oughtn’t have access to. The problem is that anyone can acquire this data. The bill needs to be turned around. Ban the sale of this data. Preferably also ban the possession and use of this data.
  - javajosh 5y ago
    So, eliminate voter registration. It's possible, but you have to check citizenship at some point in the process, like at the poll. Which is a political firebrand! Although it would kind of make sense to me to use a federal id, like a social security card, to cast a vote. And doing it in advance solves a few important logistical problems - not least of which is giving states a chance to do sanity checks on results.
    - amluto 5y ago
      Huh? Voter registration isn’t a problem. Trafficking in voter registration is data is a problem. If a state wants to use voter registration data for voting, fine. If a broker wants to sell voter registration to a client so the client can use it for marketing, surveillance, or most anything else, not fine.
hash872 5y ago
As someone who's interfaced with the data brokers professionally, I can tell you that the ultimate starting point for their dataset is usually a state voter registration database. A lot of states pretty openly sell their data, like from the DMV, but every data broker is starting by figuring out a way to get that voter registration data- some states just give it, in some states (like say Maryland) you have to at least pretend to be an election researcher, etc. I'm sure for more restrictive states it gets passed around on the grey market. But if you're anti-data broker (I certainly am!), it starts with regulating your own state
- dominotw 5y ago
  > I can tell you that the ultimate starting point for their dataset is usually a state voter registration database. Right on the money. I worked for a company that sold this data to whoever paid them .
  - dominik-2020 5y ago
    This is only valid for the U.S. though.
  - zzleeper 5y ago
    What would be the best way to access this data for research? I do academic research (mostly focusing on credit) and it might be quite useful to write a paper that cross references this with loan data for a paper with a political angle.
- _rs 5y ago
  Giving my phone number on my voter registration form is definitely one of my biggest regrets. I'm sure a lot of my spam calls/texts come from that, but even campaigns texting me to vote for their candidates has become a huge annoyance every election season (despite me moving and unregistering to vote in that state - once a data company has bought the list I don't think there is any escape)
  - hash872 5y ago
dominik-2020 5y ago
In case anyone is interested, I started a company which deletes your data from these data brokers gosauber.com - I hope I'm allowed to post this...
- mcint 5y ago
  Self-promo, especially on-topic, is fine. You’re also fine to post as stories your homepage, or blog posts. People here would be interested. Trying to make the world better, with some money involved. See FAQ and Guidelines in footer for other questions.
- _rs 5y ago
  I've seen these types of services before but I am hesitant - now I have to trust my information to yet another party. I say this as someone probably in your target demographic - your website feels very cookie-cutter and doesn't inspire confidence.
  - dominik-2020 5y ago
    Hi, I can understand your hesitation that giving data to get data deleted is suboptimal, but it's the only way unfortunately. The value is in the service, not the design of the website - I'll take your feedback though.
    - _rs 5y ago
      Sure, but your website needs to make me trust you over other similar services, and also needs to give me a good reason to use your service instead of going and requesting removal myself at the numerous data brokers directly. I forgive poor design when there is lots of technical detail present instead, but your website lacks that too.
- brookside 5y ago
  Great idea for a service and I am interested! Couple questions and observations: What are you asking for in the "Linked Profile URL" field. "https://gosauber.com/register https://gosauber.com/register" A link to one's profile on truepeoplesearch or the like? It isn't clear. (And it also might imply a user's info would only be removed from that site). The navigation links on the top ("features, "how does it work", "plans", etc) only work at the root url of your page. They don't function on /register or similar because they point to html IDs on the landing page, not a full or relative url path. Again, great idea!
loudmax 5y ago
My feeling is that David Brin's notion of a transparent society is probably a more sensible policy than trying to maintain privacy: https://www.davidbrin.com/transparentsociety.html https://www.davidbrin.com/transparentsociety.html In the twentieth century world most of us were born into, there was an assumption of privacy through anonymity simply because it was hard to keep track of everyone. Unless you were a wanted felon, moving to a new town essentially meant a new start in life. But with the amount of information that's collected and processed today, that simply isn't the case. Even if you keep a low profile on social media, you're still going to be tracked by a banks, credit card companies, and a multitude of private corporations and government agencies. We can make laws against the buying and selling of personal information, but these are going to be hard to enforce. For example, a small retail chain might build up a private database of their customers. What happens if this chain is simply bought by a larger company? Can this company hold onto the customer database or are they forced to destroy this information? What if they split the company into retail and wholesale operations? To be fair, saying that laws are hard isn't a reason not to make laws, it's just that we should have a clear understanding of how difficult it's going to be to maintain privacy in an era of cheap cameras, facial recognition software and ubiquitous computing. We can make it difficult for individuals to have access to this information, but it's going to be really hard to prevent deep pocketed organizations from collecting this information. The danger is that privacy laws will ensure that the public doesn't have access to information that large corporations and government agencies have access to. We really need to consider what type of personal information is private and what ought to be understood as public. For example, if I own a house, is that information private or public? If you think that should be private, you have to make the argument that we're better off living in a society in which it's difficult for members of the public to find out who a piece of property belongs to. What about a car? If I inherit a million dollars, should I be able to keep that information private? What about who I marry or divorce, or who my children are? Certainly there are some things that should be private. Encryption works, and we should be able to hold private conversations. One could make a strong case that medical records ought to be private. But we need to have a clear understanding of how we're going to keep these things private, and what are the costs and possible consequences of keeping things out of the public sphere.
- 5y ago
m463 5y ago
> "Here are the data brokers quietly buying and selling your personal information" ...literally - my ad blocker prevented 42 ad/tracking objects/sites from loading

138 points by KoftaBob 5y ago

Vermont’s law is a great first step, but also a very kid gloves approach. It appears their disclosure requirements are minimal, basically that the company exists and how to opt out. What I would love to see is a requirement to notify the party that their data is being sold. Yeah, that might be a pain, but they are after all selling something that arguably is not theirs. Does anyone know if other similar laws are in place for other states? Or are in the works?

user3939382 5y ago
Isn’t California’s even better? You can tell them not to sell your data and on request, to delete it.
- jrnichols 5y ago
  I don't know.. voter rolls seem to be how my fairly new California information got onto most of these people search websites. Getting it off is not easy. First, there are so many of them. Second, half the ones I've found want you to register with them first and verify that it's you... which doesn't seem to fit the spirit of the law, but that's how it is. It has been a long and frustratingly uphill battle to get my current name, address, phone number, etc removed from literally dozens of these data broker websites. and I've tried to be careful. :/

prepend 5y ago

Is there a “opterouter” project that just spiders all these and opt outs? Navigating the dark patterns of one site is a pain, much less 120+. But seems like a good opportunity for 120 to script one path each. Hard to do a service as I don’t want to enter my private info into another third party.

chris_f 5y ago
As an exercise I once went through the process of manually requesting my information removed from most of the top brokers. It would be difficult to automate because the opt-out processes usually aren't straightforward like unsubscribing from an email list. Many sites make it purposely difficult and involve going through multiple steps, providing verification like a drivers license, and email confirmations. Here is a really good check list of different brokers: https://inteltechniques.com/data/workbook.pdf https://inteltechniques.com/data/workbook.pdf
- OminousWeapons 5y ago
  I also tried to do this manually using the same resources from Bazzell and eventually just got tired of dealing with it and paid for Deleteme. To their credit, they did a pretty solid job removing my public data from data broker sites.
- unishark 5y ago
  Any online process that endeavors to be secure will be indistinguishable from a malicious system that tries to make your task purposefully difficult. I just got refused by a govt site recently because of the six different forms to info they wanted in order to sign in again, one of them wasn't accepted. Namely my cell phone number was prepaid which apparently isn't acceptable anymore. So now I need to mail in forms and wait for return mail taking weeks.
- fartcannon 5y ago
  And youre not worried that all youve done is fill in the gaps of their data with your drivers license, etc? "Delete" is a boolean tag in a databse that never actually gets deleted.
  - meowster 5y ago
    And if your information is truely deleted, then when they come across your information again, they'll have no record of you, so they'll just fill in the missing gaps. For them not to share your information, they need to know what information not to share.

ashneo76 5y ago

And yet here we are with the site (fastcompany) itself loading something like 10-14 trackers/ external scripts

bdcravens 5y ago
While HN doesn't have tracking, YC has plenty of alums who are part of that industry (like Segment and Mixpanel)
- eli 5y ago
  Segment and Mixpanel help companies track their own visitors on their own sites. Feels unfair to lump them in with data brokers.
  - bdcravens 5y ago
    I was referring to the comment about FastCompany's trackers. That said, where do you think data brokers get their data? Private companies sell info on their customers all the time.
jeffbee 5y ago
See, that’s the problem with cheap, disposable takes that preclude critical thinking. You’ve conflated “tracking” online with the actual privacy-invasive industry the article is talking about. These guys are selling your real private data: your credit card transactions, your phone’s location data, your real name and address, your life events. This industry is very happy that nerds confuse them and Google.
bertil 5y ago
I know this might seem like a niche argument, but I feel like asking my browser to store information is something that I can prevent. It’s annoying, and there’s less financial incentive to build detailed tools to help — but compared to taking information from my bank, without my consent; from electoral lists, without my consent; to infer my political opinion from photos of my car on the curb. I understand that people who don’t know how a browser works see it the other way around: they understand electoral lists (although I’m not sure they can change their details); they might not know how to “delete cookies”.

neptunedesert 5y ago

Related to this, everyone should also be aware of the Fourth Amendment is Not For Sale Act, or H.R. 2738 and S.1265, bills that have recently been put before the Senate and Congress. https://www.eff.org/deeplinks/2021/04/tell-congress-support-fourth-amendment-not-sale-act https://www.eff.org/deeplinks/2021/04/tell-congress-support-...

amluto 5y ago
That act is all backwards. The problem isn’t that the government can acquire data they oughtn’t have access to. The problem is that anyone can acquire this data. The bill needs to be turned around. Ban the sale of this data. Preferably also ban the possession and use of this data.
- javajosh 5y ago
  So, eliminate voter registration. It's possible, but you have to check citizenship at some point in the process, like at the poll. Which is a political firebrand! Although it would kind of make sense to me to use a federal id, like a social security card, to cast a vote. And doing it in advance solves a few important logistical problems - not least of which is giving states a chance to do sanity checks on results.
  - amluto 5y ago
    Huh? Voter registration isn’t a problem. Trafficking in voter registration is data is a problem. If a state wants to use voter registration data for voting, fine. If a broker wants to sell voter registration to a client so the client can use it for marketing, surveillance, or most anything else, not fine.

hash872 5y ago

As someone who's interfaced with the data brokers professionally, I can tell you that the ultimate starting point for their dataset is usually a state voter registration database. A lot of states pretty openly sell their data, like from the DMV, but every data broker is starting by figuring out a way to get that voter registration data- some states just give it, in some states (like say Maryland) you have to at least pretend to be an election researcher, etc. I'm sure for more restrictive states it gets passed around on the grey market. But if you're anti-data broker (I certainly am!), it starts with regulating your own state

dominotw 5y ago
> I can tell you that the ultimate starting point for their dataset is usually a state voter registration database. Right on the money. I worked for a company that sold this data to whoever paid them .
- dominik-2020 5y ago
  This is only valid for the U.S. though.
- zzleeper 5y ago
  What would be the best way to access this data for research? I do academic research (mostly focusing on credit) and it might be quite useful to write a paper that cross references this with loan data for a paper with a political angle.
_rs 5y ago
Giving my phone number on my voter registration form is definitely one of my biggest regrets. I'm sure a lot of my spam calls/texts come from that, but even campaigns texting me to vote for their candidates has become a huge annoyance every election season (despite me moving and unregistering to vote in that state - once a data company has bought the list I don't think there is any escape)
- hash872 5y ago

dominik-2020 5y ago

In case anyone is interested, I started a company which deletes your data from these data brokers gosauber.com - I hope I'm allowed to post this...

mcint 5y ago
Self-promo, especially on-topic, is fine. You’re also fine to post as stories your homepage, or blog posts. People here would be interested. Trying to make the world better, with some money involved. See FAQ and Guidelines in footer for other questions.
_rs 5y ago
I've seen these types of services before but I am hesitant - now I have to trust my information to yet another party. I say this as someone probably in your target demographic - your website feels very cookie-cutter and doesn't inspire confidence.
- dominik-2020 5y ago
  Hi, I can understand your hesitation that giving data to get data deleted is suboptimal, but it's the only way unfortunately. The value is in the service, not the design of the website - I'll take your feedback though.
  - _rs 5y ago
    Sure, but your website needs to make me trust you over other similar services, and also needs to give me a good reason to use your service instead of going and requesting removal myself at the numerous data brokers directly. I forgive poor design when there is lots of technical detail present instead, but your website lacks that too.
brookside 5y ago
Great idea for a service and I am interested! Couple questions and observations: What are you asking for in the "Linked Profile URL" field. "https://gosauber.com/register https://gosauber.com/register" A link to one's profile on truepeoplesearch or the like? It isn't clear. (And it also might imply a user's info would only be removed from that site). The navigation links on the top ("features, "how does it work", "plans", etc) only work at the root url of your page. They don't function on /register or similar because they point to html IDs on the landing page, not a full or relative url path. Again, great idea!

loudmax 5y ago

My feeling is that David Brin's notion of a transparent society is probably a more sensible policy than trying to maintain privacy: https://www.davidbrin.com/transparentsociety.html https://www.davidbrin.com/transparentsociety.html In the twentieth century world most of us were born into, there was an assumption of privacy through anonymity simply because it was hard to keep track of everyone. Unless you were a wanted felon, moving to a new town essentially meant a new start in life. But with the amount of information that's collected and processed today, that simply isn't the case. Even if you keep a low profile on social media, you're still going to be tracked by a banks, credit card companies, and a multitude of private corporations and government agencies. We can make laws against the buying and selling of personal information, but these are going to be hard to enforce. For example, a small retail chain might build up a private database of their customers. What happens if this chain is simply bought by a larger company? Can this company hold onto the customer database or are they forced to destroy this information? What if they split the company into retail and wholesale operations? To be fair, saying that laws are hard isn't a reason not to make laws, it's just that we should have a clear understanding of how difficult it's going to be to maintain privacy in an era of cheap cameras, facial recognition software and ubiquitous computing. We can make it difficult for individuals to have access to this information, but it's going to be really hard to prevent deep pocketed organizations from collecting this information. The danger is that privacy laws will ensure that the public doesn't have access to information that large corporations and government agencies have access to. We really need to consider what type of personal information is private and what ought to be understood as public. For example, if I own a house, is that information private or public? If you think that should be private, you have to make the argument that we're better off living in a society in which it's difficult for members of the public to find out who a piece of property belongs to. What about a car? If I inherit a million dollars, should I be able to keep that information private? What about who I marry or divorce, or who my children are? Certainly there are some things that should be private. Encryption works, and we should be able to hold private conversations. One could make a strong case that medical records ought to be private. But we need to have a clear understanding of how we're going to keep these things private, and what are the costs and possible consequences of keeping things out of the public sphere.

5y ago

m463 5y ago

> "Here are the data brokers quietly buying and selling your personal information" ...literally - my ad blocker prevented 42 ad/tracking objects/sites from loading