Most people know, in a fuzzy way, that companies track what they buy and click. It's easy to shrug that off because you never actually see the file. A recent project changed that for hundreds of people, and what they found is worth your attention.
How people got their files
Consumer Reports asked volunteers to use new state privacy laws to request their records from data brokers, the companies that collect personal information and sell it. Hundreds signed up, and more than 100 files have come back so far. CalMatters and The Markup went through them, focusing mostly on Acxiom, an Arkansas company that says it has data on billions of people and was one of the few brokers to send back real detail. Files from Epsilon, another big broker, turned up too.
One woman in Oregon who works at a nonprofit got a 58-page file. It covered her supposed income, jobs, education, online shopping and charity donations, plus an attempt to pin down where she lived using map coordinates. She's careful about privacy. She uses a flip phone and blocks ads. It didn't matter. Some of the file was wrong (it seemed to confuse her with her parents), but it got her spending habits right. It also listed dozens of companies that had bought information about her.
It starts with who you are
These companies have files on nearly everyone. Acxiom says it covers about 95% of American adults. Epsilon says it has data on basically every household worth marketing to.
The base layer is the boring stuff: your name, past and current addresses, even your Social Security number. It comes from public records, commercial databases and other brokers. Once a file exists, it follows you for life, and it doesn't necessarily disappear when you die.
Then come your devices. Brokers can hold your phone's advertising ID, your smart TV's tracking ID, your home IP address and your car's VIN. That lets their clients connect you to what you do on every screen you own, and in some cases your car. One file even showed the last time the person had logged into their computer.
Thousands of guesses about you
The collected facts are one thing. The predictions are stranger.
Across the files, Acxiom scored people in more than 3,000 categories, mostly on a 0 to 100 scale. Some are normal marketing stuff: how likely you are to shop at Nike, eat at Buffalo Wild Wings, or own a certain car. Which car you'll buy next. Whether you're thinking about crypto. One category rated interest in a Tesla Cybertruck. Files also tracked years of spending on clothes, furniture and eating out.
Others go a lot further. Estimates of how much someone drinks, how well they sleep, and their body mass index percentile. Whether they're going hungry, have health insurance, have a regular doctor, can afford medical bills, or are likely to get a mammogram. Whether they smoke. Whether they've been a victim of fraud. Whether they're blue collar or white collar. Their religion, politics and ethnicity. The ages and genders of their kids.
None of this comes from your medical records or your bank. It's guessed from where you live, what you've bought, and what people who look like you on paper tend to do. And it's often wrong. One person's file had six different guesses for their age.
One score stood out to critics: an "assimilation level," with values like "3+ generations in the US." A UC Irvine law professor told reporters that labels like this probably stand in for race, ethnicity or immigration status, things companies generally aren't supposed to use against you, and that the vague wording helps make it look harmless.
Acxiom's response was that health categories only mean someone might be interested in information about a condition, not that they have it, and that the assimilation score describes a household, not a person's race or immigration status. The company also said the files consumers received were raw and unfiltered, and that paying clients get a cleaner, more accurate version. It said buyers can't legally use its data to decide who qualifies for credit or insurance, or what they pay.
You have a price tag
Brokers can't see your bank account, but they'll still estimate what you earn, what you've saved and what you're worth. Then they estimate what you're worth to a company.
Acxiom gives people a "lifetime value score," basically a prediction of how much profit you'll bring a business over time. For car, home and health insurers, that score runs from 0 all the way to 200,000. Higher means you're a more profitable customer. On top of that come labels like seniors over 64 with a medium ability to pay medical bills, or people who finished high school.
Epsilon sorts people into 26 life-stage groups with names like "Easy Street" and "Big Spender Parents," and tags some people with labels about how profitable they are.
That price tag gets used. A bank can decide how good a credit card sign-up bonus you see. An insurer can decide which add-on coverage to push at you. A clothing store could, in theory, set the price of a sweater just for you.
Who's buying it
Privacy experts said the most revealing part wasn't the scores. It was the list of buyers.
Laws in states like Minnesota and Oregon now require brokers to name who they sold data to. That's how we know more than 100 companies show up in the Acxiom files alone, and hundreds across all the reports. Insurers like GEICO, State Farm and Farmers. Banks like Citi, JPMorgan Chase and US Bank. Janssen, the Johnson & Johnson drug company. General Motors, Disney, Hilton, Kohl's, T-Mobile, Southwest Airlines.
Some buyers have rough track records. OneMain Financial, a subprime lender, was sued this year by 13 state attorneys general over allegedly hidden fees. Centene, the giant Medicaid insurer, has been sued by several states over alleged overcharging. Janssen has paid billions in settlements over past marketing and kickback allegations. A handful of direct-mail and warranty companies that regulators have repeatedly gone after were on the list too.
The one that raises the most questions is HealthVerity, a Philadelphia health data startup that showed up as a buyer in every Acxiom file reviewed. It sells deidentified patient data to insurers, drug companies and government agencies. It also sells a product that helps health, life and disability insurers build risk scores, and it advertises marketing data that draws on brokers like Acxiom, including race and income profiles.
Acxiom says its data can't be used for insurance underwriting under federal credit reporting law. But experts pointed out that HealthVerity calls itself a health analytics company, not a credit bureau, so it may sit outside those rules. HealthVerity didn't comment.
What they do with it
Once your profile lands with a buyer, it starts shaping decisions about your money.
Insurers use it to size up how healthy a company's workforce is before quoting health plans and premiums. Personal lenders use it to spot people who look like they need money fast or are shopping for a car, and those loans often come with ugly terms and high interest. Banks use it to sell extras most people don't need, like identity protection and credit monitoring.
A digital rights technologist who studies brokers pointed out that people in financial trouble are exactly who gets targeted with expensive loans. She also argued that all the errors in these files undercut the industry's claim that this level of surveillance is needed for ads to work.
Why the law doesn't stop this
The short answer is that American privacy law is a patchwork. The law professor described it as "Swiss cheese."
Your credit report is covered by real rules. Your hospital records are protected by HIPAA. But the heart rate, sleep and step data sitting on a fitness tracker company's servers isn't covered the same way. And a guess about your health, made from your shopping habits, falls into an even blurrier zone.
Brokers build their files three ways, according to a researcher who used to study the industry at Duke. Data they collect directly, like through an app. Data they pick up indirectly, like property records, marriage licenses and court filings. And inference, which is where it gets invasive. A religious news app on your phone suggests your religion. A dating app suggests your sexuality. Location data showing trips to a military base or a specialist's office suggests a lot more.
Wrong guesses hurt too. Bad data about your driving could push up your insurance, and you'd probably never know why.
The money and the "consent" argument
This is a huge business. Acxiom's parent company, Interpublic, pulled in $2.5 billion in a single quarter this year, and the wider broker industry is valued in the hundreds of billions. Brokers spend heavily on lobbying. Government agencies buy from them too, which has reportedly let some skip getting a warrant.
The industry's defense is that it's legal and people agreed to it, usually buried in the fine print of a loyalty program or app signup. Researchers aren't buying that. Most of this data comes from other companies, not from you. You never signed up with the broker. Almost nobody has heard of these companies, and nobody remembers agreeing to have their lives scored and sold.
What you can actually do
Four states, California, Oregon, Vermont and Texas, make brokers register publicly. Some, like California, also let you see and delete your data, and California now has a state website where you can tell hundreds of brokers at once to stop selling your information. Compliance is spotty, though. A report this year found hundreds of companies registered in one state but missing from others.
Opting out also has a catch. It removes you from one broker. The copies already sold to dozens of other companies stay where they are.
Still, if you live somewhere with these rights, request your file at least once. Most people are surprised by how much is there. They're usually more surprised by how much is wrong.