Data Brokers: Go Broke or Snitch

$200BN data industry faces life decisions about what it wants to be when it grows up

Do Sell My Info: Brokerage Business Model

If closed platforms like Google don’t sell your data, who does? Data brokers are in the business of collecting and selling data to other parties. They aggregate information from public (e.g. property records, marriage licenses, etc.) and private sources (e.g. credit card companies) before cleaning, packaging and selling the user level data.

The data brokerage industry spans a lot of categories and companies. It includes all those credit score companies (e.g. Experian), fraud detection companies (e.g. LexisNexis), marketing database companies (e.g. Oracle Data Cloud), and people search databases (e.g. Whitepages). Under the new privacy laws from California, data brokers have had to register with the state, revealing over 300 companies that are collectively worth about $200BN thanks to people’s data.

Do Not Sell My Info: Brokerage Breaking Down

Data brokers increasingly face existential threats on both the data collection and data selling fronts.

Data Collection Limits

Laws such as GDPR and platform changes such as Apple’s new iOS privacy framework (“iGDPR”) are essentially blocking unauthorized data collection and downstream data usage without user consent. 

For example, in modern digital advertising, ad tech companies working on behalf of an advertiser to bid on a publisher’s page can see information such as a cookie, IP address, and webpage, which can reveal who the user is, where the user is, and what the user is interested in. Even if an advertiser doesn’t end up bidding or winning the auction, the ad tech firms could theoretically save that information to inform future bidding/targeting or sell that data to data brokers who can then help other advertisers reach desired users. 

On one hand, publishers hate this unintended data leakage since it diminishes the value proposition of buying ads from them. On the other hand, other publishers purposely profit from selling the data; for example, apps such as WeatherBug and GasBuddy historically would sell your mobile phone location data.

GDPR and iGDPR now make this practice much more difficult without user opt-in, which will undercut supply to data brokers. At the same time, the new California Consumer Privacy Act (CCPA), which begins enforcement in July 2020, now undercuts the ability to sell what little data is left. 

Data Selling Limits

All those “do not sell my personal information” links you’re seeing across the internet are due to CCPA requiring businesses to allow consumers to opt-out of sales of their individual data to 3rd-parties. Historically, 10-20% of users have gone out of their way to opt out of data tracking, and it likely won’t be different for CCPA data sales. 

Buying Government Protection

So who do you turn to when the law is putting you out of business? Enter the lawman and the data broker’s future as a criminal informant. 

The Wall Street Journal recently revealed that the IRS began buying from data brokers to track down suspects. Historically, law enforcement needed a warrant to compel companies to share user information, but buying that same data when available faces no court challenges. Fortunately, the tech companies with the largest, most accurate data such as Google, Facebook and Apple aren’t in the business of selling data and so actually are protectors of user privacy from the government. 

Even more recently, data brokers have powered government efforts to surveil citizens’ movements and contain COVID-19’s spread by monitoring legal compliance. CCPA in fact seems to broadly carve out public interest protections that prevent users from opting out of their data from being deleted or sold by firms doing business with the government. 

Consequently, selling data to the government may provide the industry a lifeline and source of growth going forward. 

The Future That Never Was

In the dystopian science fiction HBO series Westworld, the richest man in the world made his wealth by controlling a data broker called Incite. This company controlled humanity through an AI that used all the data brokered on each human to predict and chart their paths. Incite was able to get this point because in this sci-fi world, Congress waited too long to pass the Privacy Act of 2039. 

In the all too real 2020, the California Consumer Privacy Act (CCPA) enforcement begins today. As a result, it’s a lot less likely the data broker of today becomes the most valuable company in the world, and it’s a lot more likely it goes broke.