D3sign | Moment | Getty Images
Data brokers have long operated in the shadows of the internet, quietly amassing unprecedented amounts of personal information on billions of people across the globe, but few realize just how deep this data collection really goes.
In an age where every move you make online — every click, every purchase, every “like” — is meticulously harvested, packaged, and sold for profit, aggregated personal data has become a valuable commodity, and the global data broker industry is proof of that.
The rise of artificial intelligence tools poses the risk of even more personal information being scraped from the internet and an already opaque world of data brokering becoming even more aggressive, and that is heightening data privacy concerns. A 2023 study from Pew Research found that the American public increasingly says it does not understand what companies do with their data. According to Pew, 67% of Americans say they “understand little to nothing about what companies are doing with their personal data, up from 59% in its previous survey on the subject in 2019. A majority of Americans (73%) think they have “little to no control” over what companies do with their data.
Many people are unaware that something as simple as their phone number can be used by data brokers and bad actors to uncover highly sensitive information, including a Social Security number, address, email, and even family details, said Arjun Bhatnagar, co-founder and CEO of Cloaked, an app that disguises your personal information by generating a unique “identity” for each online account you have.
According to Roger Grimes, an expert at cybersecurity education firm KnowBe4, while many data brokers —especially the more well-known players — sell information responsibly, some of the smaller, unknown brokerages skirt regulations, push ethical boundaries, and exploit data in ways that can lead to misuse or harm. This is partly due to the hazy regulation landscape around data brokerage, which makes it easier for these practices to go unchecked.
Some of the largest providers of data brokerage services include Experian, Equifax, TransUnion, LexisNexis, Epsilon (formerly Acxiom), and CoreLogic, according to a ranking from OneRep, an online personal data management service. People-search services Spokeo and Intelius are also among the top data brokers, according to OneRep. These companies operate across multiple industries, handling both publicly available information and more sensitive consumer data. They offer various services, ranging from marketing analytics to credit scoring and background checks, and all of them have processes for requesting your data or asking for it to be deleted. However, depending on the state you live in, they may not have to comply.
Experian, Equifax and TransUnion are a good place to begin to understand how much the data industry has grown. While many consumers know these companies for their credit services, those are now just one piece of the revenue pie, with broader digital marketing of data increasingly important, according to Jeff Chester, founder and executive director of the Center for Digital Democracy, a Washington, D.C.,-based consumer privacy advocate. And data collection spans much farther across the economy, with companies from grocery stores offering discount programs to streaming video services amassing data that others will pay for. “Today, everyone is a data broker. Having the ability to reach someone online and target has become a core part of business,” Chester said.
“I try to lock down everything as much as I can, but I’m also aware that even though I’m a security expert, I’m probably overexposed,” said Bruno Kurtic, president and CEO of data security firm Bedrock Security.
As a basic step to limit financial risks, he recommends that all individuals freeze their credit reports as a proactive measure against identity theft and to prevent malicious actors from opening new accounts or loans in their name.
Inside data brokers’ massive vault
Cybersecurity experts estimate that data brokers collect an average of 1,000 data points on each individual with an online presence.
“It behooves them to collect as much as humanly possible about you, because the larger the information pool about you and the more specific they can get, the higher the cost of that data,” said Chris Henderson, senior director of threat operations at Huntress, a cybersecurity company founded by former National Security Agency personnel.
Here’s a breakdown of the types of information data brokers typically collect, according to privacy experts interviewed by CNBC:
- Basic identifiers. Full name, address, phone number, and email.
- Financial data. Credit scores and payment history.
- Purchase history. What you search for online, what you buy, where you buy it, and how often you buy certain products.
- Health data. Your medications, medical conditions, and your interactions with health-related apps or websites.
- Behavioral data. Insights into your likes, dislikes, and the types of ads you’re likely to click on.
- Real-time location data. GPS data from apps that track your commute, where you shop, and how often you visit certain places.
- Inferred characteristics. Based on you’re your browsing and media consumption — the websites you visit, articles you read, videos you watch, data brokers draw insights about your lifestyle, income, preferences, religious or political beliefs, hobbies, and even your likelihood of charitable giving.
- Relationships with family, friends, and colleagues. By analyzing your network of friends, followers, and connections on social media and messaging apps, data brokers can map out your relationships and even track how frequently you interact with certain individuals to determine the depth of your bonds.
Little oversight around data privacy
The lack of comprehensive regulation around data privacy allows data brokers to operate with little oversight, unlike the General Data Protection Regulation (GDPR) in the European Union.
“There is no comprehensive federal privacy law that specifically regulates the industry, which makes it hard to combat them,” said Chelsea Magnant, adjunct instructor of cyber leadership at NYU’s Center for Global Affairs and a director at corporate consulting firm Brunswick. “We essentially have a patchwork of state laws with varying privacy protections that these companies know how to navigate.”
California was the first to enact comprehensive legislation in 2018 with the California Consumer Privacy Act, giving residents more control over their personal data. In 2020, California voters approved an expansion of the CCPA, called the California Privacy Rights Act, which took effect in 2023. It offers the most extensive protections in the U.S., including data correction, limiting the use of sensitive information, and requiring businesses to honor opt-out preference signals. It also imposes stricter data-protection obligations on companies, such as minimizing data collection.
Since then, about 20 other U.S. states have followed suit; however, the specific rights and thresholds for which companies must comply vary widely between states.
“Different states have different business environments, economies, and viewpoints. This lack of a unified approach, something that protects all citizens across the country, leaves us vulnerable to data brokers,” said Rob Hughes, chief information security officer at RSA.
Even in states where the privacy laws are strict, there is skepticism that smaller companies on the margins of the data brokerage industry will follow them. “They have extremely sensitive data sets under their management, and they have to essentially behave like the most sensitive enterprises. And we know that some of these data brokers just don’t operate businesses like that,” Kurtic said.
How to take control of your data
To start protecting your privacy, it’s important to rethink how much personal information is shared on a daily basis, says Cloaked’s Bhatnagar. While we can’t fully hide, consumers need to develop new habits and tools to limit what we expose, from turning off permissions that track your location to saying no to cookies and refraining from posting personal details online. Additionally, using tools like secure browsers, VPNs, and tracker blockers can help.
Some of the largest technology companies in our daily lives, such as Apple, are continually updating and adding to privacy options, such as on the new iPhone and latest iOS update.
An Equifax spokeswoman said U.S. consumers can opt out of their personal information being shared in accordance with U.S. state privacy laws. On average, she said, opt-out requests made through the Equifax Privacy Preference Center are processed in less than one business day and consumers are informed of a successful submission through the company’s Preference Center. Consumers can also review the types of third-parties that companies such as Equifax share personal data within its privacy section.
Opt-out links and instructions are readily available for most of the major data brokers:
But data privacy experts says reclaiming or deleting your data from brokers can be a deliberately complex process that is not only time-consuming but frustrating. Each broker has its own opt-out requirements, and even after you’ve removed your data, it often reappears, sourced from other places.
“Removing your data from their systems impacts their bottom line, so they are disincentivized to make this easy for you,” said Henderson. “Ultimately, if you remove the information, they can’t sell that. So the more people who request their information be removed, the less attractive of a broker they are to the advertisers.”
There are data-removal services, such as DeleteMe, Kanary, OneRep, and PrivacyDuck, which charge a fee to manage these ongoing tasks, and are becoming increasingly popular. In October, Consumer Reports launched Permission Slip, a free app that helps you control which companies can collect, store and sell your personal data. It relies on donations to keep it going, either through the app or the Consumer Reports website.
For those opting for the DIY approach, here’s what the data privacy experts interviewed by CNBC recommend to get started:
Identify the brokers collecting your data. As already stated, this can be a daunting task, as many operate behind the scenes. However, there are a few methods you can use to track them down, says Henderson. One is to conduct a Google search using your name, phone number, and email address and see which brokers pop up. You’ll most likely find your name on sites like Spokeo, Whitepages, or MyLife. Another strategy is to visit the websites of the largest data brokers and search your information.
Submit opt-out requests. If you live in a state with data privacy regulations, you can submit a request to delete your data on the opt-out page of these companies’ websites, including at the links listed above, so they cannot share your data with third-party companies. It’s important to note that each broker may have different processes for handling these requests and state laws vary when it comes to what types of data are covered. Some data brokers may also require you to provide identification or verify your identity.
Check your results. After submitting opt-out requests, revisit the data brokers’ sites periodically to ensure your data has been removed. It may take several weeks or months for your request to be processed.
Engage in digital hygiene practices. Regularly reviewing and updating your online security practices is essential. Secure passwords, two-factor authentication, and encryption tools can help protect your information. Using virtual identities, such as alternative email addresses and phone numbers, can further safeguard your personal information.
Seek legal recourse if necessary. If a data broker refuses to comply with a deletion request, you may be able to file a formal complaint with regulatory authorities such as the Federal Trade Commission, which has brought cases against the industry.
However, it’s important to understand that not every state provides the same level of protection. Consult a privacy attorney if you believe your rights have been violated.
‘The future is unfortunately dark’
Experts say deleting the data is an imperfect solution, “a Band-Aid to address a gaping wound,” according to Chester.
“Consumers have been placed in a bad position,” he said. “Data is now a form of payment,” he added, referring to cases where the consumer wants a discount in the grocery store or pharmacy. “This is a comprehensive privacy problem which requires Congress or the FTC. The idea an individual can take care of their privacy … you can shut down a tiny bit of it, but you would need to spend a great deal of time, and once you opt-in to get a discount at a store, it all starts over again.”
The future of the data broker industry looks both promising and troubling as technological advancements continue. Javad Abed, assistant professor of information systems at Johns Hopkins Carey Business School, warns that data brokers will continue to evolve as AI and machine learning advance.
“With AI, data brokers will create even more detailed and predictive profiles, incorporating everything from biometric data to behavioral tracking,” Abed said. “The problem will increase, and things are going to become more complicated.”
Abed sees potential in blockchain and privacy-enhancing technologies, which could disrupt the data brokerage model by increasing transparency and giving individuals more control over their digital identities. However, he remains skeptical: “The future is unfortunately dark. It needs to be collaborative work. I don’t see the motivation right now from the main actors for a collaborative change.”
“Telling our grandmothers or a child to configure settings on their social media and their browsers and search engines is not a winning proposition,” Kurtic said. “It’s going to take a combination of regulation, technology on the vendor side, and know-how on our own personal side.”
Until regulation steps in, data brokers will continue to collect as much data as possible. “These are revenue streams for companies that might not have other recurring revenue streams,” Henderson said. “And given there’s no regulation stopping businesses from selling information about you, I don’t see the practice stopping, especially given how lucrative it is.”
Technology
Meta’s potential exit from Delaware had governor worried enough to call special weekend meetings
Meta CEO, Mark Zuckerberg and Tesla and SpaceX CEO, Elon Musk
Manuel Orbegozo | Chip Somodevilla | Reuters
After news broke on the last day of January that Meta might follow Elon Musk’s lead in exiting Delaware to incorporate in another state, Democratic Governor Matt Meyer sprung into action.
Delaware has long been the dominant state for U.S. companies to incorporate due to its flexible corporate code and expert judiciary. More than 20% of the state’s tax revenue, amounting to more than $1 billion a year, has historically come from corporate franchise fees, so state lawmakers can ill afford to preside over a mass exodus, or what’s been dubbed a “DExit.”
On Saturday, Feb. 1, a day after the Wall Street Journal published its story on Meta considering a Delaware departure, Gov. Meyer, who was brand new to the job, convened an online meeting with attorneys from law firms that have represented Meta, Musk, Tesla and others in shareholder disputes in the state, according to public records obtained by CNBC. Other attendees included members of the Delaware legislature.
The purpose of the meeting was to have a “Discussion re: Corporate Franchise,” one memo said.
The following day, records show, Meyer invited a second group to meet with him and new Secretary of State Charuni Patibanda-Sanchez. That invitation went to Kate Kelly, Meta’s corporate secretary, and to Dan Sachs, the company’s senior national director of state and local policy.
The invite also went to James Honaker, an attorney with Morris Nichols, a firm that’s represented Meta in federal court in Delaware, and to William Chandler, former chancellor of the Delaware Court of Chancery, who is now part of Wilson Sonsini’s Delaware litigation practice.
Roughly two weeks later, Delaware lawmakers were being asked to vote on a a bill, known as SB 21, that, if enacted, would overhaul the state’s corporate law in a manner that could favor Musk, Zuckerberg and other controlling shareholders of large companies.
Among other things, SB21 would alter how companies can use independent directors to ensure the deals they’ve made will not be subject to court scrutiny, and would limit the records that shareholders can obtain from companies when investigating possible breaches of fiduciary duty.
Late last week, the state Senate voted to pass an amended version of SB 21. If Delaware’s House of Representatives follows suit, in a vote expected as soon as Thursday, the bill would head to the governor’s desk to be signed into law.
That could remove a major overhang for Zuckerberg and Meta.
Meta has been the subject of “books and records” investigations in Delaware in recent months, according to two people directly involved in the matter who asked not to be named in order to discuss non-public investigations. Under current law, shareholders behind those probes could file cases alleging that Zuckerberg or other Meta directors caused billions of dollars in damages, according to the people and Delaware records viewed by CNBC.
If SB 21 passes, any claims filed after Feb. 17, the day the bill was brought to the assembly, would be considered under the new law. That means shareholders wouldn’t have the benefit of the current law, and investor protections that come with it, when their new claims are considered in Delaware court.
A Meta spokesperson declined to comment.
Mila Myles, a spokeswoman for Gov. Meyer, said in a statement that the governor has spent his first few weeks on the job meeting with “plaintiffs attorneys, Delaware corporate attorneys and countless Delaware incorporated companies,” adding that he is not “doing the bidding of any billionaire.”
Cozying up to Trump
Musk drew national attention to Delaware’s corporate law in 2024 after a judge there ruled that his $56 billion Tesla pay package from 2018 was illegally granted and should be rescinded. He wrote on X, “Never incorporate your company in the state of Delaware,” and subsequently moved Tesla to Texas while accusing the judge behind the ruling of “absolute corruption.“
Musk also became a top donor to Donald Trump’s presidential campaign, and is now a lead adviser to his White House, running the so-called Department of Government Efficiency.
Zuckerberg, who had a notably rocky relationship with Trump during the president’s first term, has been publicly currying favor this go-round. He’s taken measures like ending Meta’s diversity, equity and inclusion (DEI) programs, getting rid of third-party factcheckers in favor of a “Community Notes” model used by Musk’s X platform, and adding Dana White, CEO of the Ultimate Fighting Championship and a longtime friend of Trump, to his company’s board weeks before the new administration began.
Meta also agreed in January to pay $25 million to settle a four-year-old lawsuit over the company’s decision to suspend Trump’s accounts after the Jan. 6 Capitol riot.
News that Zuckerberg was considering a move out of Delaware landed a little over a week after President Donald Trump’s inauguration, which the Meta CEO attended along with other tech leaders.
Mark Zuckerberg arrives before the inauguration of Donald Trump as the 47th president of the United States takes place inside the Capitol Rotunda of the U.S. Capitol building in Washington, D.C., Monday, Jan. 20, 2025.
Kenny Holston | Via Reuters
Meta hasn’t publicly commented on whether it plans to reincorporate outside of the state.
As CNBC previously reported, authors of SB 21 included Richards, Layton & Finger, a corporate defense firm that counts Musk and Tesla as clients. It was co-written by Delaware Law School professor Lawrence Hamermesh, as well as Chandler, the ex-chancellor, and former Delaware Supreme Court Justice Leo Strine.
Strine works for Wachtell, Lipton, Rosen and Katz, which is representing Zuckerberg in a separate matter tied to the company’s involvement in the 2018 Cambridge Analytica scandal. In 2019, Meta agreed to pay a $5 billion fine to settle related charges with the FTC.
SB 21 was introduced to Delaware’s General Assembly on Feb. 17, by Senate Majority Leader Bryan Townsend, who had attended the first of the two meetings held by Gov. Meyer. The process of drafting the bill didn’t follow Delaware’s traditional practice of changing corporate law, which typically involves writing and review by the state’s bar association, and a committee within it called the Corporation Law Council.
Reforms outlined in SB 21 have been supported by corporate defense firms and attorneys, including those who helped draft the bill. They’ve been vociferously opposed by shareholders’ attorneys and investment groups, including CalPERS and ICGN, who say they want to ensure that controlling shareholders don’t make self-interested deals or decisions that go against the wishes and rights of the broader investor base.
On Feb. 2, Myles from the governor’s communications office shared a memo with legislators and attorneys who had attended the weekend meetings. It included a list of talking points in defense of SB21.
The memo, obtained by CNBC, said Delaware prides itself on serving as “home to the world’s leading companies,” having the “best law and jurisprudence” for businesses, and remains the “premier destination in America for business formation.”
“Whenever an entity — regardless of size — exits Delaware for one of our sister jurisdictions, our goal is to earn their business back,” the memo said. “In many cases, companies that reincorporate out of Delaware return to Delaware.”
Read the public records here:
The Wiz logo on a smartphone arranged in New York, US, on Tuesday, July 16, 2024.
Gabby Jones | Bloomberg | Getty Images
Seven months ago, Alphabet lost a marquee case against the Biden administration’s Justice Department, which accused the company of maintaining an illegal monopoly in search. Weeks earlier, Google’s pursuit of cybersecurity vendor Wiz, in what would have been its largest deal ever, fizzled in part because of antitrust concerns.
With Donald Trump’s return to the White House, Alphabet is back on the offensive.
Alphabet on Tuesday agreed to buy Wiz for $32 billion in cash, almost $10 billion more than the proposed price in mid-2024, and said it expects the deal to close next year, subject to regulatory approvals.
Wiz will sit in Google’s cloud division, which is far from the company’s dominant search business. Google is behind Amazon and Microsoft in cloud infrastructure, a standing that would make the regulatory case against a tie-up challenging for any administration.
The Federal Trade Commission under Lina Khan was notoriously prickly with respect to tech deals, aggressively scuttling transactions in ways that frustrated even notable Democrat supporters like Reid Hoffman and Mark Cuban. Google’s pursuit of Wiz may be the first big test for new FTC Chair Andrew Ferguson, as the tech industry gauges how Trump 2.0 will treat the industry that houses the six biggest U.S. companies by market value.
“It’s going to be a great litmus test and bellwether for M&A in 2025,” said Brad Haller, senior partner for mergers and acquisitions at consulting firm West Monroe. “This happening relatively early on this year means it can be used as a measuring stick.”
As a venture-backed company, the deal would be a major windfall for Silicon Valley venture capital firms, which have struggled to generate returns since the initial public offering market mostly shut down in early 2022 and large M&A went dormant. After peaking at $780 billion in 2021, VC exit value plummeted to $89.2 billion the following year and to $71.6 billion in 2023, according to an October report from PitchBook and the National Venture Capital Association. In the third quarter of 2024, the number hit a five-quarter low.
“Large acquisition strategy is back on the menu for VC-backed companies,” Haller said.
Index Ventures is the largest outside investor in Wiz, followed by firms including Sequoia Capital, Insight Partners and Cyberstarts.
In walking away from a deal with Google in July, Wiz co-founder Assaf Rappaport wrote in a memo to employees that the company would instead pursue an IPO. There are some signs that the IPO market is heating up, as artificial intelligence infrastructure company CoreWeave, digital health startup Hinge Health and buy now, pay later lender Klarna have all filed prospectuses recently with the SEC.
Economic uncertainty represents the biggest headwind, as President Trump’s imposition of tariffs on top trading partners like China, Mexico and Canada, as well as massive cuts in government spending, have led to extreme market volatility and raised concerns about business and consumer confidence. The Nasdaq is on pace for its fifth straight weekly drop and worst quarterly performance since 2022.
For Google, the allure of acquiring Wiz appears to be worth the potential regulatory risk. Reuters reported, citing a source, that Wiz agreed to a termination fee of over $3.2 billion, which the publication called “one of the highest fees in M&A history.”
Google declined to comment.
Founded in 2020 Wiz hit $100 million in annual recurring revenue after just 18 months. The company’s cloud security products include prevention, active detection and response, and they’ve become increasingly essential as rapid advancements in AI have made attacks more sophisticated and potentially more damaging.
“That price tag tells us that Google was almost desperate to boost its security bona fides before the adoption of AI gathers even more speed,” Gordon Haskett analysts wrote in a Tuesday note.
Google said in a statement on Tuesday announcing the deal that, “The increased role of AI, and adoption of cloud services, have dramatically changed the security landscape for customers, making cybersecurity increasingly important in defending against emergent risks and protecting national security.”
In Wiz’s blog post, Rappaport said that, “Becoming part of Google Cloud is effectively strapping a rocket to our backs.”
The deal will face regulatory scrutiny, but “Google, in our view, would have a stronger case compared to consumer-focused acquisitions,” analysts at Bank of America wrote in a note after the announcement. The firm said Google has less than 15% of the cloud services market.
Industrywide scrutiny
Google’s biggest acquisition during the Biden presidency was its $5.4 billion purchase of cybersecurity company Mandiant. The search giant wasn’t the only Big Tech company feeling the regulatory heat.
For Microsoft to eventually close its $69 billion acquisition of video game publisher Activision Blizzard in late 2023, the company had to endure a 21-month battle with regulators, including an injunction effort by the FTC. The agency also sued to block Meta’s acquisition of virtual reality company Within, though a California district court scuttled the FTC’s efforts.
Beyond dealmaking challenges, Meta, Apple, Amazon and Microsoft have all been accused of monopolistic practices by either the Justice Department or the FTC. In Google’s case, both agencies pursued actions.
Khan told CNBC’s “Squawk Box” in January that she hoped the incoming Trump administration wouldn’t let Amazon and Meta off the hook from pending antitrust suits with a “sweetheart deal.” Her comments came after numerous tech execs and companies, including Google, pledged money towards Trump’s inauguration fund.
Ferguson has suggested that his FTC will keep a keen eye on tech, though he hasn’t offered much by way of specifics. During Trump’s first administration, the president had a particularly hostile relationship with the industry, routinely slamming Amazon founder Jeff Bezos, notably for his ownership of The Washington Post, as well as taking aim at Meta and Google for their alleged biases towards his administration.
Those former foes have made extra efforts to change the tone this time around, whether that means ending diversity, equity and inclusion programs or trekking to Washington for Trump’s inauguration after previously making visits to his Mar-a-Lago resort in Florida.
In an interview on “Squawk Box” last week, Ferguson said “Big Tech is one of the main priorities” of the administration.
“President Trump appointed me to protect Americans in the marketplace,” Ferguson said. “And I’ve said since day one, Big Tech is one of our main priorities, and that remains true.”
Jonathan Kanter, former assistant attorney general for the Department of Justice’s antitrust division under Biden, said on CNBC’s “Power Lunch” on Tuesday that a hefty regulatory review is likely on the way for the Google-Wiz deal. He said it’s not just about Google’s position in cloud, but also the amount of data the company controls.
“I don’t think the Wiz deal is going to ease on down the road to quick approval,” said Kanter, who is now a CNBC contributor. “It’s going to be a long road. They’re going to have to look at a lot of documents, a lot of data and understand whether it’s really going to entrench Google’s market power in a lot of different markets.”
— CNBC’s Jordan Novet and Samantha Subin contributed to this report.
-
Sports2 years ago‘Storybook stuff’: Inside the night Bryce Harper sent the Phillies to the World Series
-
Sports12 months agoStory injured on diving stop, exits Red Sox game
-
Sports1 year agoGame 1 of WS least-watched in recorded history
-
Sports2 years agoMLB Rank 2023: Ranking baseball’s top 100 players
-
Sports3 years ago
Team Europe easily wins 4th straight Laver Cup
-
Environment2 years agoJapan and South Korea have a lot at stake in a free and open South China Sea
-
Environment2 years agoGame-changing Lectric XPedition launched as affordable electric cargo bike
-
Business2 years agoBank of England’s extraordinary response to government policy is almost unthinkable | Ed Conway