If I understand correctly, youre saying my entire purchase history is shared with random third party marketing companies. Full transaction data, PII included, no anonymization.
How is that even remotely OK?
There is at least one company that has built technology that will monitor most all these purchases, monitor the IP's from them and the browser profile to identify a specific machine that you use. Then when you go to work, or are on your mobile they also will tag that traffic as you too. They have gotten so good they can serve ads that are relevant to your wife if she happens to be on your computer surfing the web for shoes say, but serve you different ads if you are on the same computer. They use data feeds from many sources, but ecommerce transactions, credit card transactions and companies like acxiom that let them match those with real people, incomes and household details make it very powerful.
In marketing we use Axiom and others a lot, their data used to be more vague and educated guesses about people. Now though, they have gotten it down pretty well, including how many animals, kids and your income/debt etc. They collect data from tax collectors offices, county records, city records, plus companies that will sell transaction data and other pieces so they can get a full picture. They of course work with Equifax, TransUnion etc too so they can build a whole economic profile on a person.
These companies are also what allow marketers to send you an email about their product/company after all you have done is visited their website. You don't have to enter anything or click on anything, but they will know who you are, who you work for and whether you fit their market profile in general. Poorly done it is extremely creepy, correctly done it can be an amazing conversion booster.
I am from Brazil, and I am openly dissident of our government, and here assassinations (And other unpleasant things) DO happen to dissidents (example: in the last year a couple anti-government bloggers all in the same region where "murdered", the police claim it was just normal murder, but the coincidence is too great to be just normal murder, they were obviously assassinated).
What happen, if some day the government decide to assassinate me? They can just waltz in with a market company, offer a lot of money (or if they refuse, a lot of pain), get my data, and know all that stuff about me.
Then, they can do with me, what they did with Toninho and Celso Daniel: intercept them on the street, kill them, and pretend it was a robbery gone wrong.
Toninho case was very obvious: He was intercepted while fetching some suits he had bought before, using the tech you mentioned, assassins would know for certain that he was there, since they could know he would need to eventually fetch the suits, and that once inside the building, you could intercept him at the exit, indeed as he was exiting the shopping mall that had the clothing store, another car drove by, shot him (not "at his direction", but at him, directly, Toninho died instantly because of direct hits), and sped away. The police claimed it was a random incident where random criminals randomly passing by got pissed off at him cutting them off in the traffic and killed him, beside all that being unlikely, Toninho had some days earlier said to the press that should "something happen" to him, stuff were already set for his successor.
So what matters to me is: How I don't get tracked, unless I go "off grid survivalist style" ?
That said, there are things people can do with companies like Acxiom to help reduce the data collection. At least in the US (not sure overseas) if you as a consumer submit a request to be removed from their lists they must honor your request and remove you, many US states have strict laws about this and I believe the Federal laws also have strict restrictions. The catch 22 to this is that you can wind up back in the collection at a later date because of activity you take or because of a timeout period (from what I understand). You can read about Acxiom's policy and opt-out here: https://isapps.acxiom.com/optout/optout.aspx
As a point too, you may check out the data collection from Acxiom, as I believe they actively collect and use data in your home country, as they do in many counties. Equifax, Experian and TransUnion all also work in the US and overseas and collect/sell vast amounts of data on individuals. The very fact they collect so much data does make people (including me) nervous because I personally feel they do not take security of the data nearly serious enough, as recent security issues have shown at most of them. But that I guess is a different issue/post.
I don't use facebook but do use a credit card. Hard to opt out of that in the modern world. God these people are filth.
And all that for a cheaper (and cheap) bread-knife.
When I pay with cash, I usually don't present a card as well.
Been buying too much sugar? Dental insurance up. Too much butter? Health insurance up. Bought three times the median amount of headache tablets? That's a paddlin'. Bought more alcohol than normal? Car insurance up.
Opt out to keep off their radar? They assume the worst and charge you double?
Thinking from first principles lets us see incentives and probable outcomes before they are "substantiated" (adopted by the media).
I personally don't think shopper data is affecting insurance policies quite yet. But the groundwork is there (Acxiom etc), and the "great" thing about data is it stays around forever!
I'd guess a timeframe of 10 years, but does it really matter as to when?
Is this a response to my comment? I would guess that the answer is "nothing but the temporary protection of the law", but, assuming that protection is eventually revoked, it makes it all the more worrisome for me to have a random stranger's data taken as my own.
I'm not a tin foil hat type, but I really don't like filling my wallet with tracking cards and can't be bothered to claim the miniscule compensatory benefits provided in return for proffering my purchase (and also location, hygiene, etc.) information.
Saying 'no' is almost more hassle than simply submitting, however, which is probably exactly what the company would like to hear. Suggestions welcome for brushing off this nuisance without a) Avoiding their shops entirely (not practical) or b) Being rude to cashiers.
PII is not available, it is anonymized. There are laws around this. Purchase data itself is usually grouped into major purchase types, not amounts or actual goods purchased.
For that detail, it would be the CRM/ERP systems of the manufacturer that has that information tied to a serial number and this is why they ask you to register your product when you buy it. Some manufacturers might work with data providers to exchange this data (serial numbers in exchange for purchase histories) but it's rarely done at scale because of cost, complexity, legal/security risk and lack of options to benefit from it.
But we've seen how useless even apparently well meaning anonymisation is—think of the AOL search results. I can't imagine how utterly useless it becomes when it is done by people in whose interest it is to do it poorly, while remaining just within the law.
The protection of the law does add to the security. Also anonymization of the PII (scrubbing into just a serial number) combined with the dilution of purchases into larger categories provides lots of protection. Your google search history is lot more detailed and granular than most of the purchase data you can buy through data markets. You might be able to figure out a basic "profile" and maybe use lookalike modeling but it would be incredibly difficult to actually distill that to a discrete person.
There's also been a push to buy "insights" rather than just data to get more ROI with less effort/cost so instead of buying purchase histories you would just buy a segment of people interested in buying washing machines for example.
Lumping Apple with Google in terms of data gathering is misleading at best.