The Data Brokers: Selling your personal information

The following script is from "The Data Brokers" which aired on March 9, 2014. Steve Kroft is the correspondent. Graham Messick and Maria Gavrilovic, producers.

Over the past six months or so, a huge amount of attention has been paid to government snooping, and the bulk collection and storage of vast amounts of raw data in the name of national security. What most of you don't know, or are just beginning to realize, is that a much greater and more immediate threat to your privacy is coming from thousands of companies you've probably never heard of, in the name of commerce.

Companies and marketing firms have been gathering information about customers and potential customers for years, collecting their names and addresses, tracking credit card purchases, and asking them to fill out questionnaires, so they can offer discounts and send catalogues. But today we are giving up more and more private information online without knowing that it's being harvested and personalized and sold to lots of different people...our likes and dislikes, our closest friends, our bad habits, even your daily movements, both on and offline. Federal Trade Commissioner Julie Brill says we have lost control of our most personal information.

Steve Kroft: Are people putting this together and making dossiers?

Julie Brill: Absolutely.

Steve Kroft: With names attached to it? With personal identification?

Julie Brill: The dossiers are about individuals. That's the whole point of these dossiers. It is information that is individually identified to an individual or linked to an individual.

Steve Kroft: Do you think most people know this information is being collected?

Julie Brill: I think most people have no idea that it's being collected and sold and that it is personally identifiable about them, and that the information is in basically a profile of them.

It's much harder for Americans to get information on Acxiom. The company declined our request for an interview and is fairly vague about the methods it uses to collect information and who its customers are.

Tim Sparapani: It's not about what we know we're sharing, it's about what we don't know is being collected and sold about us.

And Tim Sparapani says it's a lot. He has been following the data broker industry for years, first as a privacy lawyer for the American Civil Liberties Union, then as Facebook's first director of public policy. He's currently advising tech companies and app makers. Sparapani thinks people would be stunned to learn what's being compiled about them and sold, and might end up in their profiles; religion, ethnicity, political affiliations, user names, income, and family medical history. And that's just for openers.

Steve Kroft: What about medications?

Tim Sparapani: Certainly. You can buy from any number of data brokers, by malady, the lists of individuals in America who are afflicted with a particular disease or condition.

"It's not about what we know we're sharing, it's about what we don't know is being collected and sold about us."

Steve Kroft: Alcoholism?

Tim Sparapani: Yes. Absolutely.

Steve Kroft: Depression?

Tim Sparapani: Certainly.

Steve Kroft: Psychiatric problems?

Tim Sparapani: No question.

Steve Kroft: History of genetic problems?

Tim Sparapani: Yes. Cancer, heart disease, you name it, down to the most rare and, and most unexpected maladies.

Steve Kroft: Sexual orientation?

Tim Sparapani: Of course.

Steve Kroft: How do they determine that?

Tim Sparapani: Well, based on a series of other data points they bought and sold. What clubs you may be frequenting what bars and restaurants you're making purchases at, what other products you may be buying online.

Steve Kroft: And all of this can end up in a file somewhere that's being sold maybe to a prospective employer.

Tim Sparapani: Yeah, not only can it, it is, Steve.

Steve Kroft: With all this information and your name attached to it?

Tim Sparapani: Yes. Exactly.

Sparapani says data brokers have been flying under the radar for years, preferring that people know as little as possible about the industry and the information that's being collected and sold. But the evidence is there if you know where to look.

We were able to go online and find all sorts of companies peddling sensitive personalized information. A Connecticut data broker called "Statlistics" advertises lists of gay and lesbian adults and "Response Solutions" -- people suffering from bipolar disorder.

"Paramount Lists" operates out of this building in Erie, Pa., and offers lists of people with alcohol, sexual and gambling addictions and people desperate to get out of debt.

A Chicago company, "Exact Data," is brokering the names of people who had a sexually transmitted disease, as well as lists of people who have purchased adult material and sex toys.

Tim Sparapani: No one has ever looked into these lists. In fact, most of this has been completely opaque until just recently. The depths of this industry, the really darkest corners, have yet to be exposed to any light whatsoever.

Every piece of data about us now seems to be worth something to somebody. And lots more people are giving up information about people they do business with, from state Departments of Motor Vehicles, to pizza parlors.

Tim Sparapani: Most retailers are finding out that they have a secondary source of income, which is that the data about their customers is probably just about as valuable, maybe even more so, than the actual product or service that they're selling to the individual. So, there's a whole new revenue stream that many companies have found.

That data becomes much more valuable when it's married up to the much more personal information that's being volunteered on the Internet. "Take 5 Solutions," a data broker in Boca Raton, Fla., runs 17 websites like "GoodParentingToday.com" and "T5 HealthyLiving.Com," where people can share stories about their families and health. What web visitors don't realize is that "Take 5's" real business is collecting and selling the information.

Steve Kroft: There's all sorts of people coming on now.

Ashkan Soltani: That's right.

Steve Kroft: What's this stuff?

Ashkan Soltani: So when you visit the New York Times homepage, there's a number of companies on the page that are essentially tracking your visits.

When we clicked on "NewYorkTimes.com," the software revealed the presence of more than a dozen third parties that the website had allowed in to observe our movements.

Ashkan Soltani: These are all companies that either place ads or measure people's behaviors on that site.

Steve Kroft: So as you are going thru the web, and doing your searching, you've got a whole crowd following you?

Ashkan Soltani: That's right.

There were ad networks and marketing and analytics companies, measuring traffic and page views and cataloging our interests.

Steve Kroft: And some of this information, you think is going to data brokers?

Ashkan Soltani: Oh, definitely.

Steve Kroft: Wow, look at that.

We found the same thing going on at the 60 Minutes website. They are everywhere.

Steve Kroft: A lot of them.

Steve Kroft: So, they're really inside your computer?

Ashkan Soltani: They're inside your browser usually, or your mobile device. Yes.

Steve Kroft: And you haven't necessarily invited them in?

Ashkan Soltani: You've not invited them in. And most computers or browsers allow them in by default is the way to think about it.

Steve Kroft: Do companies collect your web browsing history?

Ashkan Soltani: Yes. Absolutely. Yeah, this is the primary piece of data collected online. As you click through the web and view car sites or read about the news, companies, these third parties, will collect your click stream, as you click from site to site to site, to see what you may be reading, what you may be interested in, what types of things you might buy.

And almost all of it is for sale, especially any personal information that you might volunteer. The more companies know about us, they say, the more efficient they can make the advertising. You are looking at one of the commercial pillars of the Internet. Soltani took us to an online dating site called "OkCupid," which asks visitors for all sorts of personal information.

Ashkan Soltani: Are you a vegetarian or vegan? Do you drink? What's your relationship with marijuana? And what people don't realize that, so, you know, here you're seeing all the third parties that are present on this site.

"As you click through the web and view car sites or read about the news, companies, these third parties, will collect your click stream, as you click from site to site to site, to see what you may be reading, what you may be interested in, what types of things you might buy."

Steve Kroft: So all these people are getting the information?

Ashkan Soltani: They're getting some of this information.

The website doesn't require users to give their real name. But the IP address and the computer ID number are recorded and it is not difficult for data brokers to match that information with other online identifiers. There are firms that specialize in doing it.

Steve Kroft: So you can combine this data with other data that's available and figure out who someone is?

Ashkan Soltani: That's right.

Steve Kroft: By name, by email?

Ashkan Soltani: That's right. That's right.

The only way you would have known that is by going to the legal section of "OkCupid's" website, presuming you could find it, then you'd have to scroll through three pages of terms and conditions before finding the privacy policy, which says, "You should appreciate that all information submitted on the Website might potentially be publicly accessible."

Julie Brill: Your smartphones are basically little mini tracking devices. And it's collecting information about where you are traveling through the day as it's on in your pocket or in your purse.

Federal Trade Commissioner Julie Brill says geo-location data on individuals has become a hot commodity.

Steve Kroft: How sensitive is that information?

Julie Brill: It's the kind of information that really talks about who you are on a day to day basis. Where you go and who you might be visiting with, what shops you may frequent. What time you come home. What time you leave.

And that's not all, the iPhone app for "Path Social," which was designed to help young people share photos and memories with friends, was caught sneaking into users' digital address books and filching their contact information.

Steve Kroft: This app was going into people's phones and collecting that information without their knowledge?

Julie Brill: Right. It was downloading their contact list off of their phone, their smartphone. Right.

Steve Kroft: You say information from the address book. What does that or contact information, what does that include?

Julie Brill: It could include, and did in this case, include things like Facebook usernames, Twitter usernames, birth dates. So it can be fairly detailed in personal information that is contained within a contact list or address book.

The FTC, which is one of the few agencies with any jurisdiction over data brokers, fined the company $800,000 dollars for deceptive trade practices. Commissioner Brill is pushing for more oversight and transparency. She says people should be able to see the information the companies have on them, be able to challenge it if it's incorrect, and opt out of the system if they don't want personal data collected.

Julie Brill: Consumers don't know who the data brokers are. They don't know the names of these companies. They have no way to know, "What -- well, what website am I supposed to go to? Who do I call? What letter do I write?"

The Senate Commerce Committee and its chairman, Jay Rockefeller, have proposed legislation that would do just that. The committee has been investigating the industry for more than a year and Sen. Rockefeller says he is being stonewalled by three of its biggest players: Axciom, Epsilon and Experian.

[Jay Rockefeller: I am putting these three companies on notice today that I'm not satisfied with their responses and I'm considering further steps.]

Steve Kroft: Sen. Rockefeller called companies like Epsilon "the dark underside of American life."

Bryan Kennedy: Yeah, that's an interesting phrase. And one I would take offense at.

Bryan Kennedy is chairman and CEO of Epsilon, which claim to have "the world's largest cooperative database" including more than 8 billion consumer transactions, combined with an extensive network of online sources. He doesn't like the term "data broker," and says Epsilon is a marketing firm that uses data.

Bryan Kennedy: You can go on our website today and we offer a method by which we can show you the kind of information that we have about you.

Steve Kroft: The kind of information.

Bryan Kennedy: Right.

Steve Kroft: Not all the information.

Bryan Kennedy: What we've done is we've collected the data into categories, into the basic information that is meaningful and understandable to a consumer.

Kennedy says Epsilon has provided the Senate Commerce Committee with binders full of information and calls the hearings political theater. He sees no need for more oversight or regulation of one of the fastest-growing sectors of the economy.

Bryan Kennedy: If there are abuses out there, we don't believe those happen within our company. And we would be the first to raise our hand and say if there are specific uses of data that are problematic, then the government should focus on those particular uses of data. Not attempt to regulate the entire industry in a way that could cripple our economy. That's our concern in the debate.

Steve Kroft: You're saying that any kind of regulation on this could cripple the economy?

Bryan Kennedy: I am.

Steve Kroft: And this should be left to industry groups? To self-enforce?

Bryan Kennedy: We think that self-regulation has been very effective. What we're hearing today is a lot of discussion in Washington. We're not hearing a lot of discussion, frankly, from consumers. It's one of the odd things. So, consumers are rushing to the Internet to provide more information about themselves than, you know, we would've ever imagined.

Steve Kroft: That surprise you?

Bryan Kennedy: It does surprise me. I don't do it myself. I'm a consumer, like, like you are.

Steve Kroft: So, you think it's imprudent?

Bryan Kennedy: I think that consumers ought to understand that the Internet is an advertising medium.

This is also the position of the Direct Marketing Association, which is one of the most powerful lobbying groups in Washington. Its members include Google and Facebook, the two companies that probably know more about us than anyone else. They were not mentioned in our story because they don't sell the information they gather about us. They keep it all to themselves.