Data Brokers: Unregulated Forensic Analysis — No One's Happy

You have a profile. It sits in a commercial database operated by a company you have likely never heard of, available to any business with a cloud subscription — which is, by now, every sizable business.

You already know some of the fields on a common personal data profile. You know the credit bureaus have your loans and the DMV has your tickets. But what you may not know is that the problem is no longer just how much they hold — it is how freely it moves, how accurately it’s combined, and how little law stands between it and the decisions made about you.

Acxiom, just one such data broker, holds files on roughly 260 million Americans. It organizes them into 162 million households and maintains about 1,500 core attributes on each one, drawn from a catalog of more than ten thousand. [1] Acxiom is a subsidiary of Omnicom, the advertising holding company. Their catalog is not hidden; an older edition sits on the Internet Archive [2] and I urge you to glance at it. When the Senate investigated the industry in 2013, Acxiom held about 3,000 “propensities” per consumer; the catalog now exceeds ten thousand attributes. [3]

Acxiom’s catalog reads less like a marketing database and more like a shadow census of American life combined with a financial dossier and a predictive surveillance system. The company tracks life events such as births, marriages, divorces, and home purchases; family-network attributes such as “Potential Inheritor” and “Adult with Wealthy Parent”; health indicators including diabetes, cholesterol, disability, and prescription-drug behavior; and detailed financial estimates covering income, net worth, home equity, mortgages, lender relationships, and borrowing capacity. It doesn’t just record who people are — it attempts to predict their wealth, health, family connections, and future behavior.

The industry claims that data-driven decisions are fairer than the human judgment they replaced. “Fairer decisions, broader access, and lower costs.” A loan officer can dislike a face, and a model cannot. When Berkeley economists examined the pricing of millions of mortgages, lenders charged Black and Latino borrowers nearly eight basis points more in person, and algorithmic lenders discriminated roughly 40 percent less. [4] When the CFPB monitored Upstart’s underwriting model, the model approved 27 percent more applicants than a traditional scorecard, at 16 percent lower average rates, with the gains spread across every race, ethnicity, and sex segment the Bureau tested. [5]

But notice what the case defends. Six months after the Bureau published Upstart’s results, the Student Borrower Protection Center ran its own test: identical hypothetical applicants, a single field varied — the college attended — and the graduate of Howard University was charged $3,499 more over the life of a five-year loan than the same applicant carrying a degree from NYU. [6] The Bureau asked a portfolio question: across all applicants, were approval rates and prices worse for protected groups than under a traditional scorecard? They were not — the model cleared the bar, and the bar was the old model. The audit asked an applicant’s question: hold everything constant, change only the school, and watch the price. It moved $3,499. Not because Howard costs more — because the model graded each school by the average financial outcomes of its alumni and graded each applicant by their school, and the averages of a historically Black university carry the racial wealth gap inside them.

A model can approve more Black borrowers overall and still surcharge the graduates of historically Black colleges, the penalty dissolving into a favorable mean — and the person paying the surcharge experiences no average. Passing the first test does not absolve the second.

The ecosystem

Acxiom is not an outlier. It is one registrant among many: California’s data broker registry — the only meaningful public census of the industry, because brokers must register there or face penalties — passed 575 companies this February, up from 459 a year earlier, and registration is required only of firms whose business is selling data about people they have no relationship with. [7] The number is a floor: when the Privacy Rights Clearinghouse and the Electronic Frontier Foundation merged all five state registries in 2025, they found about 750 unique broker groups. [8]

Every ad-supported page you load broadcasts your advertising ID, location, and IP address to every company eligible to bid on the ad slot. Your car reports home continuously; when Mozilla reviewed 25 car brands in 2023, all 25 failed on privacy — the first time in the guide’s history an entire category failed — because 84 percent share data with brokers, 76 percent reserve the right to sell it, and the margins on a data feed are pure profit on a car already sold. Nissan’s privacy policy listed the collection of sexual activity and genetic data....