New Vermont Law Requires Data Brokers to Register, Paving Eventual Pathway to Protecting Consumers Nationwide

NEW YORK - Data brokers - companies that routinely buy and sell public, personal data obtained through various sources for the purpose of creating targeted ad campaigns - have for years been a secretive bunch. 21st century laws have not yet caught up with this practice, and as a result it's not often known who these companies are, or what it is exactly that they do with the disturbing level of personal information they cull from countless public sources.

However, one state is finally making a stand for consumers' rights. Vermont has recently passed a law that requires companies to register with their Secretary of State if they conduct in the buying and selling of third-party personal data. This law represents the first time any state has attempted to assign some degree of culpability to an industry that largely operates under the radar and without rules.

However, some critics are complaining that the law, while opening up these companies to some degree of public scrutiny, nonetheless does not provide the level of transparency that some people wish. While data brokers do have to register with Vermont Secretary of State – publicly identifying themselves as data brokers – they however do not have to reveal the individuals in their databases, the specific types of data they collect, or who they sell it to. Likewise, data brokers are not required to offer opt-out procedures for members of the public who wish not to have their personal information harvested for advertising purposes. However, if they choose to provide opt-out procedures of their own volition, they are required to provide public information regarding it. But seriously, what company in this unscrupulous field would really feel the need to offer an opt-out procedure voluntarily, without any law dictating that they do so?

Today, the Vermont data broker database is comprised of 121 different companies that run the gamut from organizations that assist landlords in doing background checks on potential tenants and analyzing marketing leads for insurance companies to assisting numerous credit reporting and background check agencies as well as companies deeply embedded in the advertising and marketing Industries. 

But the Vermont law only applies to third-party data firms – independent companies that gather information to sell to other, larger companies – and as a result, these 121 companies are merely the tip of the iceberg. So-called first-party data holders – representing large retail and tech firms such as Google, Facebook, Amazon, and the like – also harvest their own share of personal data as well, which is then converted and fed into their own marketing and advertising practices.

Data harvesting can happen in a number of different ways; information available and any standard White Pages search – such as name, phone number, address, age, and more – are often cannibalized by data brokers, who will plunder any and every public record they can get their hands on. This allows them to assemble digital profiles chronicling the attributes of millions – even billions – of different people, and that information is a valuable commodity that they will then sell to any number of companies for a variety of purposes. If you've ever registered with website or to vote, or used a smartphone app, or purchase something online, you've most likely supplied data brokers with a wide portrait of information regarding your likes, dislikes, voting history, and general behavior that can then can be used to tailor advertising campaign specifically for you and your interests.

For example, in 2017 one data broker was noted to have provided approximately 3000 separate, identifiable attributes on 700 million people in the United States, in 2018, the number of attributes ballooned to 10,000, spread out amongst 2.5 billion people. Truly disturbing, and this reality has convinced Americans that they currently have little-or-no control over the degree of data that is being collected on them by unknown entities. According to a survey conducted by Pew Research Center, only 9 percent of Americans believe they have "great control" over the data that is collected on them. The vast majority of those polled, however, insisted that it should be very important for them to be in control of their data, including who can – or cannot – have access to it.

If this is an issue that concerns you – and by all rights, it certainly should – then you should make every effort to contact your local state representatives and pressure them to draft up a bill similar to the one passed in Vermont recently. In fact, you would even do well to encourage them to better that bill, by not only forcing data mining companies to identify themselves, but to also disclose who they're collecting data on, exactly what data they are collecting – and most importantly – what it is they're doing with that data once they have it. Holding data brokers accountable will certainly not be easy, but securing your own private, personal information is more than worth the time and effort in the end.