In the absence of a federal data privacy law and despite multiple state privacy regulations, the multibillion-dollar data broker industry is collecting and selling extensive personal data on Americans, including physical and mental health information on the elderly, veterans and kids.
Rep. Morgan Griffith, R-Virginia, chair of the House Energy and Commerce Subcommittee on Oversight and Investigations, speaks Feb. 8 during a hearing on Capitol Hill in Washington.
“A staggering amount of information is collected on Americans every day, frequently without their knowledge or consent,” Rep. Morgan Griffith, R-Virginia, chair of the House Energy and Commerce Subcommittee on Oversight and Investigations, said at a recent hearing. “This data then gets shared, analyzed, combined with other data sets, bought and sold.”
The privacy abuses and sale of sensitive information is hurting vulnerable adults, “including the elderly, veterans and people of color,” said Rep. Kathy Castor, D-Florida, the subcommittee’s ranking member. “But there are few things more concerning to me than the ways Big Tech, including data brokers, have proliferated the surveillance and targeting of our kids.”
Lawmakers of both parties are eyeing legislation that would advance federal data privacy as well as measures that would address children’s online privacy.
Congress didn’t pass a national data privacy measure last year after key members, including former Speaker Nancy Pelosi, D-California, objected to a bill they deemed to be less stringent than privacy standards enacted by California.
Colorado, Connecticut, Utah and Virginia have also passed privacy laws. Five other states are considering similar measures.
Castor said she planned to reintroduce legislation that would restrict data collection on children and teenagers. Her previous proposal aimed to expand federal law that applies to data collection on kids under 13.
Citing widespread abuses of privacy and scams targeting the elderly and those with Alzheimer’s disease, experts who testified before the committee urged Congress to ban the sale of data in sensitive categories, including health and location, and severely restrict collection and sale of data to foreign governments.
While several members of Congress are alarmed at apps such as TikTok potentially allowing Beijing to access American users’ data, one expert who testified before the committee said it was easy to access data even without such apps. TikTok is owned by the Chinese company ByteDance Ltd.
Justin Sherman, a senior fellow at the Data Brokerage Project at Duke University’s Sanford School of Public Policy in North Carolina, told lawmakers that his team was able to buy individually identifiable information on U.S. military servicemembers from a data broker “with almost no vetting and (for) as low as 12.5 cents a servicemember.”
At a separate hearing by the Senate Veterans’ Affairs Committee, James Rice, assistant director at the Consumer Financial Protection Bureau, told lawmakers that his agency is examining practices of data brokers.
“Earlier this year, we issued a request for information on data broker practices that may be putting military consumers’ privacy at risk,” Rice told lawmakers. “We have also undertaken a similar effort for credit cards and auto loans.”
Data brokers include companies like Experian PLC, a consumer credit reporting company; Oracle Corp.; Acxiom LLC; and others that collect data from a wide variety of sources, including publicly available information, Sherman said in an interview.
“As potential federal legislation takes shape, Acxiom will continue prioritizing the responsible use of data in all our engagements,” Erin Tomaski, a spokesperson for Acxiom, said in an email. “We remain unwavering in our commitment to data protection, privacy, and confidentiality, and we stand ready to support thoughtful legislative changes that balance these values while advancing innovation.”
Acxiom is part of the Interpublic Group Inc. The other companies didn’t respond to a request for comment.
The industry likely ranges in size from tens of billions of dollars in annual sales to potentially hundreds of billions, Sherman said, adding that more precise figures aren’t available.
He and Laura Moy, director of Georgetown Law’s Center on Privacy and Technology, told lawmakers that government records, location data obtained from smartphone apps, information on retail purchases such as over-the-counter medications and alcohol, health information from wearable devices and tracking information on visits to doctors’ offices may all be sources of the information.
Using the data, brokers infer characteristics about individuals, Moy testified, and target products and services to people.
A February 2023 report by Duke University’s Technology Policy Lab found that data brokers were willing to sell highly sensitive mental health data on users, collected via smartphone apps that typically are not covered by the law known as the Health Insurance Portability and Accountability Act.
That means health apps, “wearables, social media platforms, and many other technology companies … can most often legally share, license, and sell users’ health data (in addition to other data) to third parties without users’ knowledge or consent,” author Joanne Kim wrote in the report.
Although states have attempted to control data brokers through privacy laws that create registries of the brokers and allow consumers and users to opt out of data collection, the industry has not been deterred, Sherman said in the interview.
“This is why ‘do not sell my data’ provisions are not a real solution to data brokerage,” he said. Such provisions require users to sift through hundreds of registered data brokers and use individual forms to opt out of tracking and sale of data by each company, he said.
Congress should “flip that on its head” and create a process that would require brokers to seek users’ permission to collect and sell data, Sherman said.
How data privacy laws vary by state
How data privacy laws vary by state
Updated
Consumer privacy feels more vital than ever, but very few states have laws on the books that protect consumer privacy in a relatable way. Following the 2018 passage of the California Consumer Privacy Act, other states rushed to draft their own versions of this wide-ranging consumer protection law. The singular goal of almost all these pieces of legislation is to increase consumer awareness and empowerment in the face of data collection and sales.
Referencing data from the International Association of Privacy Professionals (IAPP) and the National Conference for State Legislatures (NSCL), Zapproved compiled laws and bills relating to data privacy across the United States. Bills that failed or were delayed indefinitely are not included in this list. The bills are quite similar but have some small variations and differences, from their scope to whom is exempt—such as organizations that handle medical data subject to HIPAA and those who report credit information for financial institutions.
If your state is among those on this list, take heart that you may soon be protected from the unwitting sale of your data to third parties you’re unaware of. Many of these bills have experienced bipartisan support because of the evergreen popularity of the American ideal of privacy, along with rights like the Bill of Rights' first and fifth amendments.
Keep reading to discover if your state is among those considering this legislation.
California
Updated
- SB 1121: California Consumer Privacy Act of 2018
- Proposition 24: California Privacy Rights Act of 2020
- Status: Signed
The California Consumer Privacy Act of 2018 enacts several important privacy goalposts, including limiting companies in how much data they can gather and save about website visitors. If a company violates children’s privacy, in particular, that business can be fined. The law further created a new agency to oversee privacy.
There is one catch: The law’s language specifies only companies that buy or sell 100,000 households’ worth of data each year must comply.
Colorado
Updated
- SB 190
- Status: Signed
Colorado’s 2021 law is similar to California’s, including its protections on consumer data as well as the ability to delete your data from company records. But Colorado’s SB 190 law goes a step further, allowing consumers to change the data that companies keep. It also allows consumers to request copies of their saved data.
The law further dictates that companies aren’t able to “profile” consumers. This is, for example, how Twitter forms a marketable “guess” about facts like a person's age, interests, health, income, and more based on their online activity.
Maine
Updated
- LD 946: An Act To Protect the Privacy of Online Customer Information
- Status: Signed
Like the similar laws of California and Colorado, Maine’s 2019 privacy law focuses on allowing consumers to make informed decisions about how companies use their data. The law, which was approved unanimously by Maine’s Senate, very specifically applies to internet service providers (ISPs) barring them from keeping or selling data related to consumer information. The law also prohibits ISPs from incentivizing customers to offer their data for sale, effectively restricting discounts or other savings in exchange for giving over data rights.
Massachusetts
Updated
- SD 1726: Massachusetts Information Privacy Act
- Status: In committee
Massachusetts’ comprehensive privacy law act, filed in March 2021, goes a step further than most of the similar legislation in the works. The law extends privacy into the workplace, preventing employers from recording or monitoring employee data, except when it makes sense to do for reasons like safety. It further bars employers from monitoring employees outside of work.
Some state privacy laws make exemptions for institutions that monitor and report consumer credit, but Massachusetts’ law doesn’t make those exceptions. This could present some thorny situations for those in the credit business.
Minnesota
Updated
- HF 1492: Minnesota Consumer Data Privacy Act
- Status: In committee
Minnesota’s consumer privacy omnibus law, introduced in February 2021, includes many of the same provisions seen in those of other states. The law applies to specific companies, though, which could create a loophole-like situation for many other businesses. For the law to apply, companies must handle the data of at least 100,000 consumers each year. They also must earn at least 25% of their overall revenue from the sale or use of data. As in Maine, consumers will be able to request and correct their information in addition to deleting it.
Nevada
Updated
- SB 220
- Status: Signed
Where some states are reaching further into people’s lives in order to extend privacy rights, Nevada’s consumer privacy law, signed into law in 2019, is a bit more reserved. Consumers may request the removal of their information from company data, and companies must comply within 60 days. There’s a wrinkle, though: The companies must have actual plans to sell that data in order to be subject to the law. This could lead to workarounds or loopholes where companies do things like “trade” rather than sell data.
New York
Updated
- A 680: New York Privacy Act
- S 6701: New York Privacy Act
- A 6042: Digital Fairness Act
- SB 567
- Status: In committee
New York’s consumer privacy laws, still in committee, would allow consumers to see what data companies have saved about them. Companies would be required to inform consumers of these rights so they can opt out if they wish, and would be barred from retaliating against customers who choose to opt out of data collection. A 680 would additionally require express written permission from customers before data can be sold. That’s true even for those who don’t opt out of the collection of data in the first place.
North Carolina
Updated
- SB 569: Consumer Privacy Act
- Status: In committee
North Carolina’s consumer privacy law seeks to expand on the state’s existing body of law protecting consumers from data and identity theft. With the new legislation, consumers will be able to know who is holding their data—and it will be possible to correct or delete data companies keep. Consumers will additionally be able to totally opt out of data gathering for applicable companies and have the right to bring civil lawsuits against companies that don’t comply with the law.
Ohio
Updated
- SB 376: Ohio Personal Privacy Act
- Status: Introduced
Ohio’s consumer protection law, introduced in July 2021, affords consumers the opportunity to access and even request deletion of their personal data from applicable companies. They may also opt out of the sale of their data altogether. However, there are many exemptions and exceptions in this law. For example, business-to-business (B2B) transactions are not subject to the law—ironic since this is where many data sales take place.
Pennsylvania
Updated
- HB 1126
- Status: In committee
Under Pennsylvania’s proposed consumer privacy law, consumers would be given certain rights as far as disclosure and approval of what happens to their data. The law also makes the state attorney general responsible for enforcing the law, meaning consumers would be able to sue in civil court and potentially cause companies to be fined for violating the law. The passage of this kind of law typically leads to a huge increase in lawsuits that could start immediately upon the bill’s adoption.
Virginia
Updated
- SB 1392: Consumer Data Protection Act
- Status: Signed
Virginia’s consumer data law, passed unanimously by the state senate in February 2021, follows the passage of California’s similar law and hopes to enact many of the same ideas for Virginia. The legislation allows consumers to confirm their data is being held and potentially sold. They will also be able to correct that data, which must be available to them in a portable format that can be carried and passed on to another provider readily. Think of this like closing your bank account: You leave the bank with your money, ready to carry to a different bank.
This story originally appeared on Zapproved and was produced and distributed in partnership with Stacker Studio.
