Executive Summary Despite laws such as the California Consumer Privacy Act (CCPA) empowering consumers to take control of their personal information, less than 1 percent of Californians exercised these rights with major data brokers in 2023, according to a Consumer Watchdog analysis of California data broker reporting requirements that went into effect this summer.
Consumer Watchdog broke down the opt out numbers of some of the biggest data brokers in the world: Experian (opens in new tab), Acxiom (opens in new tab) and LiveRamp. (opens in new tab) Per the CCPA, data brokers operating in California must now annually report the number of requests1 to delete, correct, access, limit and opt out of data.
Data brokers may have a lower profile than other companies that vacuum up data2 like Facebook or Google, but they know more about us. For example, these brokers keep detailed profiles on me spanning hundreds of pages of inferences about my net worth, political affiliation, down to how likely I am to get a vaccine or subscribe to a streaming service. They knew my social security number. Data brokers dissect your finances, family situation, eating, exercising, travel and entertainment habits. If there’s a well-known brand, chances are its hands are in your data. From most tech companies—Amazon, Netflix, Google and Uber—to auto manufacturers— Toyota, Nissan, Chevy—to fast food chains—McDonalds, Starbucks and Subway —data brokers make predictions about you for virtually every popular brand. One data broker, LiveRamp, specifically said it sends data to Amazon, Disney, Fox, Comcast, Google, Uber and Warner Bros, among other companies. Companies want to know every detail about you with the hopes of keeping you glued to your phone and buying their products.
This summer, the data broker National Public Data was subject to what may have been the biggest hack (opens in new tab) in history, exposing 2.7 billion pieces of data, including millions of email addresses and social security numbers that were posted publicly online. This exposes another issue with data brokers: they simply hold too much sensitive information, making them more attractive in the eyes of hackers and exposing us all to identity theft. And when hacks happen most people don’t even know that these companies have their personal information, so they don’t know12 they’re at risk. Identity theft and financial fraud is a bigger problem because of data brokers.
Data brokers collect information via cookies, pixels, Software Development Kits (SDKs), on websites and apps, as well as from public sources. These are different types of code that send data back and forth to data brokers. We found they share or sell data to regulatory bodies, law enforcement, the financial services industry, as well as tech, insurance and energy companies.
But data brokers’ information is riddled with “junk inferences.” They made a bunch of incorrect assumptions about my ethnicity, finances and consumer preferences. And they have downstream effects on how people get jobs, mortgages, and health care, as their data is foundational to algorithms and artificial intelligence.
And despite having the strongest data privacy law in the U.S., opting out for Californians is still a time-consuming task. In California, close to 500 data brokers are in operation, and requests must be made individually if you want them to stop trafficking in your most personal details.
However, new enhancements to the CCPA are shedding a crucial light on these shadowy data brokers that will make it much easier to opt out. Thanks to a new law Californians can right now look up a list of data brokers, see what categories of personal information they collect, and access ways to opt out.
View California’s data broker registry here: https://cppa.ca.gov/data_broker_registry/ (opens in new tab) Starting in 2026, Californians will be able to delete all the data a broker collects about them in one step.
Data brokers collect and sell dossiers on hundreds of millions of consumers and make billions in profit. Experian has data on 300 million people and makes $7 billion in profit. Equifax has data on 800 million people and makes $5 billion in profit. Acxiom has data on 190 million individuals and makes $617 million in revenue. These brokers pop up a lot if you decide to look through who gets their hands on your personal information. (opens in new tab) Acxiom, LiveRamp and Experian all send data to the biggest tech companies, including Facebook.
The following contains details on reports I requested about me from a few of the biggest data brokers, and directions for consumers to do the same.
have downstream effects on how people get jobs, mortgages, and health care, as their data is foundational to algorithms and artificial intelligence. And despite having the strongest data privacy law in the U.S., opting out for Californians is still a time-consuming task. In California, close to are in operation, and requests must be made individually if you want them to stop trafficking in your most personal details. However, new enhancements to the CCPA are shedding a crucial light on these shadowy data brokers that will make it much easier to opt out. Thanks to a new law Californians can right now look up a list of data brokers, see what categories of personal information they collect, and access ways to opt out. View California’s data broker registry here: https://cppa.ca.gov/data_broker_registry/ Starting in 2026, Californians will be able to delete all the data a broker collects about them in one step.
These brokers pop up a lot if you decide to look through who gets their hands on your personal information. Acxiom, LiveRamp and Experian all send data to the biggest tech companies, including Facebook. The following contains details on reports I requested about me from a few of the biggest data brokers, and directions for consumers to do the same.
These reports are not the same as a credit report; they instead contain specific pieces of personal information gathered about me. This report is intended to show you how much these incognito data brokers know—and how much they get wrong —serving as a sort of siren song to get Californians to use their opt out rights. Top 5 Data BrokersAmount of Consumer DataRevenue3 Experian1 billion people$7 billion4 Equifax800 million people$5 billion5 Epsilon250 million people$1.9 billion6 LiveRamp700 million people$660 million7 Acxiom190 million people$617 million WHAT DO THEY KNOW?
Experian Experian says it has data on 95 percent of the American population, with the ability “to convert sensitive PII [personally identifiable information] data into8 actionable insights.”
The company shot out a 72-page report on me, a deep assessment of my consumer buying habits, broken down by retail categories and the likelihood of purchasing something on a scale of “extremely unlikely” to “extremely likely.”345678
| Top 5 Data Brokers | Amount of Consumer Data | Revenue |
|---|---|---|
| Experian | 1 billion people | $7 billion 3 |
| Equifax | 800 million people | $5 billion 4 |
| Epsilon | 250 million people | $1.9 billion 5 |
| LiveRamp | 700 million people | $660 million 6 |
| Acxiom | 190 million people | $617 million 7 |
For cars alone, I had about 400 inferences, or predictions as to how likely I would be to spend money on an item. Other categories list my interest in and willingness to spend on travel, entertainment, and dining.
In addition, Experian knows my age, ethnicity, IP address, political beliefs, home address, and my purchase history. It also claimed to know my net worth and propensity to invest. The categories of personal information collected about me include geolocation, education, employment, transaction and personal identifiers. For example, Experian keeps track of “impulse shoppers,” something I scored as “below average.” According to Experian, it’s “highly unlikely” that I would be a Black Friday shopper.
On its website, Experian pitches its services by saying, “With our industry-leading data, gain an accurate and deeper understanding of consumers, their patterns, and their journey with your brand.”
But there is a lot Experian got wrong about me. My net worth is higher than it predicted. And Experian said I was “unlikely” to use Spotify, Instagram, Twitter, or Netflix, despite using these platforms constantly. It got my marital status wrong. And even though I own a Toyota Prius, Experian concluded it’s “extremely unlikely” that I would buy one.
The report also held two seemingly contradictory (and false) inferences about me. While they described me as an “investment leader” who is “far above average,” I was “far below average” for a “smart investor.”
Experian doesn’t disclose specifically from what entities it collects data, instead disclosing categories. It says it sources its geolocation data from apps on your phone, and discloses it to “regulatory authorities,” “law enforcement,” and “public institutions,” among others. It says it gets its “personal and online identifiers” from consumer survey companies, lifestyle and interest product companies, public records, and telecommunications companies.
Experian also shares data with “financial service companies,” “Energy and utility companies” “insurance companies,” and “technology companies.”
Experian received about 550 requests to delete, 6 requests to correct, and 1200 requests to opt out of the sale and sharing of data from Californians in 2023.The data broker said it denied zero requests, and took on average six days to respond to consumers. Tapad, a company which is owned by Experian and gives marketers a more detailed consumer profile, received the most requests to opt out: over 14 million.
Why would an unknown company have such a high number of opt out requests? It could be because the company allows for consumers to simply press a button in order to opt out, compared to filling out a series of forms.
Experian CCPA requests Jan. 1-Dec. 31, 2023.
A Sample of Inferences by Experian, Most of Them Incorrect.
A Sample of How Experian Gets its Data and Who it Shares it With
Source: Experian.com.
Acxiom The data broker sent me a report that totaled over 100 pages, the majority of it pertaining to inferences on flights, movie theaters, crypto currency, exercise equipment, and streaming services. Virtually every category is covered, from individual demographics, family characteristics, to financial data and consumer spending. It knows my occupation, martial situation, if I have children, even my move history. It has inferences on my net worth, income, investment probability, and my buying habits in virtually all categories: automotive, restaurants, homes, exercise, and media. Guesses were also made as to how likely I was to shop on every holiday, and about which food delivery apps I would use. My inferences for fast food contained virtually every fast-food chain.
Acxiom also got information wrong about me. While the report correctly said that I’m Caucasian, it also said that I’m an African-American. It also incorrectly said that I am Protestant, and that I have a low likelihood of getting a flu shot. It said I have a very low likelihood (3/100) of purchasing food from the burger chain In N Out, even though I eat there regularly. And even though I have never used DoorDash for groceries in my life, I scored a 99/100 placing me very likely to use the app.
In the past, Acxiom has admitted to maintaining inaccurate profiles on people. “We want to be as accurate as possible, but our inferences, all they are, are informed guesses,” said Acxiom’s chief privacy officer Jordan Abbott.
“If we tend to guess wrong in the immediate…my hope is it doesn’t have any sort9 of consequences [for] denial of benefits or eligibility for credit.”
Acxiom reported receiving about 3,200 requests to delete, and about 73,000 requests to opt out. It takes about 2 days to respond to a deletion request, according to the company. The company also reported 184 requests to access data.9 A Sample of Incorrect Inferences by Acxiom, Including Likelihood of Getting Vaccinated and Ethnicity.
Source: Acxiom.com.
LiveRamp10 LiveRamp sells data pertaining to about 700 million people, and for the fiscal year 2023-24 made $660 million in revenue, putting the value of each person’s data at less than a $1. That means your most personal details are being sold for virtually nothing.
LiveRamp disclosed that it sends my data to 63 third parties, including Amazon, Disney, Comcast, Google, Uber, Fox, and Warner Bros.
LiveRamp knows my phone number, email, and the addresses of all the places I’ve lived (it also listed addresses of places I’ve never even been to, such as Missouri and Texas).
It also says it collects driver’s license numbers and social security numbers, although the company says it does not share or sell the information, and I saw no reference to mine.
Its datasets are collected from credit card transactions and location data, email11 service providers, and ad networks.
LiveRamp controversially uses what is called an “identity graph system,” which constantly updates records on people, including their names, addresses, devices, phone numbers and emails.
“LiveRamp assigns every person a unique proprietary identifier which is tied to other identifying information about the person and serves as a “universal identifier”12 in the broader data and adtech industry,” according to a report by Cracked Labs. Businesses then use this information track people across their digital lives. LiveRamp listed no inferences, or what it calls “segments,” on me.
LiveRamp reported receiving about 100 requests to know, 160 requests to delete, and 430 requests to opt out. It took on average of two weeks to delete personal information.101112
LiveRamp CCPA requests Source: LiveRamp.com.
Third Parties that receive personal data from LiveRamp: How to Opt Out Californians can act right now against data brokers. Thanks to a law that passed in 2023 and has begun to come into effect this year—Senate Bill 362 (Becker) or the Delete Act—data brokers must disclose the types of personal information they collect, register with the state, and pay a fee.
In addition, as of July 1, 2024, data brokers must annually disclose statistics about the number of consumer requests received under the CCPA, including: Requests to delete personal information; Requests to know or access what personal information the data broker was collecting; oRequests to know what personal information the data broker was selling or sharing and to whom; Requests to opt out of sale or sharing of personal information; and Requests to limit the data broker’s use and disclosure of sensitive personal information.
Data brokers must also disclose if they collect and sell information related to minors, healthcare, and geolocation. LiveRamp doesn’t collect data on these categories, while Experian and Acxiom collect data on minors and geolocation. To look up a data broker, go to https://cppa.ca.gov/data_broker_registry/ (opens in new tab). You can search, or scroll through a list of nearly 500 data brokers, and access their email contact or website.
You can see if they collect data on minors, healthcare and geolocation. On the right-hand side, you can also click “view,” and see more detailed information, such as links to a company’s privacy policy. The privacy policies instruct users on how to obtain, limit, delete and stop the sale/sharing of personal information. Users typically need to enter date of birth, address and email to exercise data privacy rights. Requests typically take a few days to be completed. To access your data from Experian, go to: https://consumerprivacy.experian.com/ (opens in new tab)
How to Opt Out of Your Data on Experian In order to exercise your rights with Acxiom, go to: https://privacyportal.onetrust.com/webform/342ca6ac-4177-4827- b61e-19070296cbd3/7229a09c-578f-4ac6-a987-e0428a7b877e (opens in new tab) Opting out with Acxiom is easy
LiveRamp’s opt out page You can request your data from LiveRamp and delete it here: https:// (opens in new tab)
liveramp.com/privacy/my-privacy-choices/ (opens in new tab) If you think your rights are being violated, you can submit a complaint to the California Privacy Protection Agency here. (opens in new tab) Alternatively, Privacy Rights Clearinghouse maintains a bigger data broker registry in the state of California, as well as in other states. Their registry can be viewed here: https://privacyrights.org/data-brokers (opens in new tab) New Protections Coming Filling out nearly 500 privacy forms is an absurd task, but starting in 2026, Californians will be able to tell all data brokers that possess personal information on them, whether directly or indirectly, to delete the data, through a single request. Every 45 days—at least—brokers will have to process all deletion requests. This will solve the headache of having to visit over 500 data broker websites and ask them to delete your data, one by one.
In 2028, brokers will have to undergo a third-party audit every three years for compliance with the law. And the report will have to be furnished to the California privacy agency upon request.
That rule-making has not begun yet.
In addition, the California Privacy Protection Agency is currently undergoing rule-making for databrokers. Notably, it has expanded the definition of what is considered a data broker by including businesses who have collected info on someone, but have not interacted with said person for more than three years: “Direct relationship” means that a consumer intentionally interacts with a business for the purpose of obtaining information about, accessing, purchasing, using, or requesting the business’s products or services within the preceding three years.
A data broker also consists of a business that has collected information indirectly from someone: A business is still a data broker if it has a direct relationship with a consumer but also sells personal information about the consumer that the business did not collect directly from the consumer. Once California passes AB 3048 (opens in new tab) to allow consumers to globally opt of data collection, and finalizes regulations for data brokers, Californians will be able to cast a privacy net over businesses who directly and indirectly collect data on them. With more awareness and better tools to take control of data, Californians will be on track to better engage with their data privacy rights, and take control of their digital lives.
