The data brokers quietly buying and selling your personal information | Hacker News Reader

The data brokers quietly buying and selling your personal information

fastcompany.com

138 pointsKoftaBob40 comments

As someone who's interfaced with the data brokers professionally, I can tell you that the ultimate starting point for their dataset is usually a state voter registration database. A lot of states pretty openly sell their data, like from the DMV, but every data broker is starting by figuring out a way to get that voter registration data- some states just give it, in some states (like say Maryland) you have to at least pretend to be an election researcher, etc. I'm sure for more restrictive states it gets passed around on the grey market.

But if you're anti-data broker (I certainly am!), it starts with regulating your own state

> I can tell you that the ultimate starting point for their dataset is usually a state voter registration database.

Right on the money. I worked for a company that sold this data to whoever paid them .

This is only valid for the U.S. though.

What would be the best way to access this data for research? I do academic research (mostly focusing on credit) and it might be quite useful to write a paper that cross references this with loan data for a paper with a political angle.

Giving my phone number on my voter registration form is definitely one of my biggest regrets. I'm sure a lot of my spam calls/texts come from that, but even campaigns texting me to vote for their candidates has become a huge annoyance every election season (despite me moving and unregistering to vote in that state - once a data company has bought the list I don't think there is any escape)

Sooooo much this. I did it once and received multiple spam texts from various campaigns, was just a terrible decision.

While politicians in a few states have cracked down a bit on data brokers recently, I don't think there's too much danger that they're going to strongly regulate ones that service political campaigns....

Interestingly, on my phone # that I've had since the early 80s, I get election spam for me, my brother (who, amusingly, generally votes for the party I don't) and occasionally my mother. I actually get less spam than my brother does, and neither party seems to know who we vote for, so I get spam addressed to my brother from the party I generally vote for.

Apparently, these data brokers suck at their job.

Related to this, everyone should also be aware of the Fourth Amendment is Not For Sale Act, or H.R. 2738 and S.1265, bills that have recently been put before the Senate and Congress.

https://www.eff.org/deeplinks/2021/04/tell-congress-support-...

That act is all backwards. The problem isn’t that the government can acquire data they oughtn’t have access to. The problem is that anyone can acquire this data.

The bill needs to be turned around. Ban the sale of this data. Preferably also ban the possession and use of this data.

So, eliminate voter registration. It's possible, but you have to check citizenship at some point in the process, like at the poll. Which is a political firebrand! Although it would kind of make sense to me to use a federal id, like a social security card, to cast a vote.

And doing it in advance solves a few important logistical problems - not least of which is giving states a chance to do sanity checks on results.

Huh? Voter registration isn’t a problem. Trafficking in voter registration is data is a problem. If a state wants to use voter registration data for voting, fine. If a broker wants to sell voter registration to a client so the client can use it for marketing, surveillance, or most anything else, not fine.

Is there a “opterouter” project that just spiders all these and opt outs?

Navigating the dark patterns of one site is a pain, much less 120+.

But seems like a good opportunity for 120 to script one path each.

Hard to do a service as I don’t want to enter my private info into another third party.

As an exercise I once went through the process of manually requesting my information removed from most of the top brokers.

It would be difficult to automate because the opt-out processes usually aren't straightforward like unsubscribing from an email list. Many sites make it purposely difficult and involve going through multiple steps, providing verification like a drivers license, and email confirmations.

Here is a really good check list of different brokers: https://inteltechniques.com/data/workbook.pdf

And youre not worried that all youve done is fill in the gaps of their data with your drivers license, etc?

"Delete" is a boolean tag in a databse that never actually gets deleted.

They key is to only submit information that they already have, not anything new. For documents that need to be uploaded in some cases, the options are either to use a heavily redacted real document with everything blacked out except for the essential info, or just upload a random file because most of the time no one checks and it is just a required field to submit a form.

You are correct it is not actually "deleted", but it will stop your information from showing up on the website.

IMO, the "best" free people search is https://www.truepeoplesearch.com/. Their opt-out process is also pretty easy.

And if your information is truely deleted, then when they come across your information again, they'll have no record of you, so they'll just fill in the missing gaps.

For them not to share your information, they need to know what information not to share.

Any online process that endeavors to be secure will be indistinguishable from a malicious system that tries to make your task purposefully difficult.

I just got refused by a govt site recently because of the six different forms to info they wanted in order to sign in again, one of them wasn't accepted. Namely my cell phone number was prepaid which apparently isn't acceptable anymore. So now I need to mail in forms and wait for return mail taking weeks.

I also tried to do this manually using the same resources from Bazzell and eventually just got tired of dealing with it and paid for Deleteme. To their credit, they did a pretty solid job removing my public data from data broker sites.

Yes, check out https://privacybot.io It's a graduate student project from the University of California, Berkeley. It's open source project and you execute its code from your own computer so you can have confidence in it keeping your data private. It was also written up in Consumer Reports[1].

1. https://digital-lab.consumerreports.org/2021/05/12/new-open-...

edit: Privacybot was also previously discussed on hn: https://news.ycombinator.com/item?id=27146828

Vermont’s law is a great first step, but also a very kid gloves approach. It appears their disclosure requirements are minimal, basically that the company exists and how to opt out. What I would love to see is a requirement to notify the party that their data is being sold. Yeah, that might be a pain, but they are after all selling something that arguably is not theirs. Does anyone know if other similar laws are in place for other states? Or are in the works?

Isn’t California’s even better? You can tell them not to sell your data and on request, to delete it.

I don't know.. voter rolls seem to be how my fairly new California information got onto most of these people search websites.

Getting it off is not easy. First, there are so many of them. Second, half the ones I've found want you to register with them first and verify that it's you... which doesn't seem to fit the spirit of the law, but that's how it is.

It has been a long and frustratingly uphill battle to get my current name, address, phone number, etc removed from literally dozens of these data broker websites.

and I've tried to be careful. :/

In case anyone is interested, I started a company which deletes your data from these data brokers gosauber.com - I hope I'm allowed to post this...

Great idea for a service and I am interested!

Couple questions and observations:

What are you asking for in the "Linked Profile URL" field. "https://gosauber.com/register" A link to one's profile on truepeoplesearch or the like? It isn't clear. (And it also might imply a user's info would only be removed from that site).

The navigation links on the top ("features, "how does it work", "plans", etc) only work at the root url of your page. They don't function on /register or similar because they point to html IDs on the landing page, not a full or relative url path.

Again, great idea!

Thanks for the feedback. LinkedIn profile would be the URL of your LinkedIn profile, not truepeoplesearch. This makes it easier for data traders to find your profile and delete it. Let me know if you have any questions!

Ah, I see "linked" profile not "linkedIn" profile as the input label.

I've seen these types of services before but I am hesitant - now I have to trust my information to yet another party. I say this as someone probably in your target demographic - your website feels very cookie-cutter and doesn't inspire confidence.

Hi, I can understand your hesitation that giving data to get data deleted is suboptimal, but it's the only way unfortunately. The value is in the service, not the design of the website - I'll take your feedback though.

Sure, but your website needs to make me trust you over other similar services, and also needs to give me a good reason to use your service instead of going and requesting removal myself at the numerous data brokers directly. I forgive poor design when there is lots of technical detail present instead, but your website lacks that too.

Self-promo, especially on-topic, is fine.

You’re also fine to post as stories your homepage, or blog posts. People here would be interested.

Trying to make the world better, with some money involved. See FAQ and Guidelines in footer for other questions.

> "Here are the data brokers quietly buying and selling your personal information"

...literally - my ad blocker prevented 42 ad/tracking objects/sites from loading

And yet here we are with the site (fastcompany) itself loading something like 10-14 trackers/ external scripts

While HN doesn't have tracking, YC has plenty of alums who are part of that industry (like Segment and Mixpanel)

Segment and Mixpanel help companies track their own visitors on their own sites. Feels unfair to lump them in with data brokers.

I was referring to the comment about FastCompany's trackers. That said, where do you think data brokers get their data? Private companies sell info on their customers all the time.

I know this might seem like a niche argument, but I feel like asking my browser to store information is something that I can prevent. It’s annoying, and there’s less financial incentive to build detailed tools to help — but compared to taking information from my bank, without my consent; from electoral lists, without my consent; to infer my political opinion from photos of my car on the curb.

I understand that people who don’t know how a browser works see it the other way around: they understand electoral lists (although I’m not sure they can change their details); they might not know how to “delete cookies”.

See, that’s the problem with cheap, disposable takes that preclude critical thinking. You’ve conflated “tracking” online with the actual privacy-invasive industry the article is talking about. These guys are selling your real private data: your credit card transactions, your phone’s location data, your real name and address, your life events. This industry is very happy that nerds confuse them and Google.

My feeling is that David Brin's notion of a transparent society is probably a more sensible policy than trying to maintain privacy: https://www.davidbrin.com/transparentsociety.html

In the twentieth century world most of us were born into, there was an assumption of privacy through anonymity simply because it was hard to keep track of everyone. Unless you were a wanted felon, moving to a new town essentially meant a new start in life. But with the amount of information that's collected and processed today, that simply isn't the case. Even if you keep a low profile on social media, you're still going to be tracked by a banks, credit card companies, and a multitude of private corporations and government agencies.

We can make laws against the buying and selling of personal information, but these are going to be hard to enforce. For example, a small retail chain might build up a private database of their customers. What happens if this chain is simply bought by a larger company? Can this company hold onto the customer database or are they forced to destroy this information? What if they split the company into retail and wholesale operations?

To be fair, saying that laws are hard isn't a reason not to make laws, it's just that we should have a clear understanding of how difficult it's going to be to maintain privacy in an era of cheap cameras, facial recognition software and ubiquitous computing. We can make it difficult for individuals to have access to this information, but it's going to be really hard to prevent deep pocketed organizations from collecting this information. The danger is that privacy laws will ensure that the public doesn't have access to information that large corporations and government agencies have access to.

We really need to consider what type of personal information is private and what ought to be understood as public. For example, if I own a house, is that information private or public? If you think that should be private, you have to make the argument that we're better off living in a society in which it's difficult for members of the public to find out who a piece of property belongs to. What about a car? If I inherit a million dollars, should I be able to keep that information private? What about who I marry or divorce, or who my children are?

Certainly there are some things that should be private. Encryption works, and we should be able to hold private conversations. One could make a strong case that medical records ought to be private. But we need to have a clear understanding of how we're going to keep these things private, and what are the costs and possible consequences of keeping things out of the public sphere.

that's a very naive view that fails to realize this information can serve humans do evil things - scammers, "cancel culture", revenges, genocide, stalking kids, kidnappers, burglers, telemarketing, and so on.

Privacy is an illusion. The only hope we have is to try to reduce people's willingness to harm others.

Reply on news.ycombinator.com