A digital vein of gold — Trading your data is a lucrative business.

The global market for trading personal data is valued at $156 billion a year and growing. To data brokers, we are just a product to be packaged and sold.

Mike Seay, a resident of Lindenhurst, Illinois, picked up mail from his mailbox as he did every morning. Among the piles of letters, flyers, and advertising ads, one envelope caught his particular eye. The package, mailed by an OfficeMax store, had a disturbing notation on its address sticker:

“Mike Seay, daughter killed in car accident.”

The envelope was indeed in the right hands, as barely a year earlier Seay’s 17-year-old daughter had been killed in an accident along with her boyfriend. But how on earth did the store where the man occasionally bought a ream of printer paper know about it? When he called to complain, the manager didn’t believe him and sent him away.

Only after Seay’s story was reported by an NBC reporter did OfficeMax admit that the error “was the result of using a mailing list provided by a third party”.

An executive eventually called the man to apologize, but despite his insistence, he refused to name the company allegedly responsible for the incident. Nor did he say whether it had similar information on other potential customers.

Seay’s case is just the tip of the iceberg of a practice that has been flourishing for years. Companies that trade in personal information, known as data brokers. The procedure is spread on an unheard of scale. Brokers seize information from our Internet service providers. Basically, all possible data is collected. For example, information about credit card issuers, cell phone carriers, banks, credit agencies, pharmacies, car service centers and grocery stores to sell it later for profit. While ethically questionable, this activity is generally legal and practiced around the world.

Good because it’s free

Unfortunately, in most cases, what companies know about us is “due” to us. Every day we leave behind dozens of cyber footprints that brokers consistently collect and sell for fat billions of dollars. Tracking a user in the network is trivial nowadays, because every electronic device leaves its own “fingerprints”, thanks to which everyone can be watched and catalogued. Unique identifiers, such as the IP address of the computer network that connects to the Internet, the MAC address of the network card and the IMEI or IMSI numbers of the cell phone, allow Internet companies to determine exactly which devices and users access their services.

We also more or less consciously provide companies with information about our preferences. We create free accounts in social networks, do not read terms and conditions and unreflectively accept cookies, allowing them to track our movements. This kind of data is associated and sold to as many entities as possible for the highest possible price. Apps like Pokemon Go are the best example of how to force users to be permanently geolocated. The problem is that someone collects this information and can interpret it without our knowledge in ways that are harmful to us.

Let’s imagine that our cell phone is lying on the bedside table in the same house next to our spouse’s phone six days a week. From this, we can conclude that the owners of these two phones live together and even sleep in the same bed. What if our phone is lying one day a week next to another man or woman’s phone? What conclusions can people who have access to this kind of data draw?

Few people wonder why services like Google, Facebook, Twitter, YouTube and LinkedIn are free. Most will probably answer that it’s all about advertising. Yes, but the services’ profits from advertising are only a part of their revenue. The real vein of gold is ourselves, or rather the data we generate about ourselves. A scandal broke out over a Russian app called Prisma, which turns photos into beautiful images. The success was overshadowed by the “affair” that broke out when someone got to know the privacy policy of its producer more closely. The policy clearly states that Prisma Labs takes over the rights to the transformed pictures. What is more, it can use them in any way it wants and the user will only receive emails with information about the changes. Shock? Only for laymen. It is no secret that similar rules have long been introduced by most of the “free” services.

By using LinkedIn, we give the owner of the application irrevocable and lifetime access to all the information we post on the site. The company can legally sell it to whomever they want and in whatever form they want. Instagram, three months after being acquired by Facebook, announced that it would sell the names, photos and images of its users to advertising companies. Using updated terms of service, the service has granted itself the right to 16 billion photos posted on its servers. In practice, this means that every photo posted on Instagram belongs to a company that can sell it. So our face can adorn some billboard, and we will not only have no idea about it, but in addition we will not get a penny for it. Are we glad that thanks to Google Doc service we can use Word and Excel sheets for free? And who has read the terms and conditions and knows that Google has the rights to all the materials that we produce through them? Theoretically, if J.K. Rowling had written “Harry Potter” in Google Docs rather than in Microsoft Word, she would have granted Google a worldwide license to use her work, including any use of images of the characters. In doing so, the author would cede to Google a novel series worth £15 billion. The old adage that nothing in life is free comes true.

To show how bizarre conditions can be placed in the privacy policy agreement, the British company Gamestation conducted an experiment to prove that almost no one reads terms of service. The terms of service included the paragraph, “By placing an order through Gamestation’s website, you grant the company the inalienable right to claim your immortal soul now or in the future. If the company exercises this right, the user agrees to surrender his or her immortal soul, along with all rights pertaining thereto, within five business days of receiving written notice.” 7,500 people have agreed to “surrender their souls.”

Digital Pandora’s Box

While the above example can be taken as a joke, the problem is not funny at all. When the PatientsLikeMe website was launched in 2004, thousands of people suffering from Parkinson’s, multiple sclerosis, necrotizing fasciitis, acute lymphoblastic leukemia, type 1 diabetes, HIV, amyotrophic lateral sclerosis and many other serious diseases finally found a place where they could share their stories and connect with people struggling with similar health issues. Within a few years, the site had evolved into a global community of more than 200,000 people with 1,500 rare diseases. Through the forum, patients detailed their symptoms, test results, and listed any medications they were prescribed. In 2010, BuzzMetrics employees copied the content of all the forums and moved them to their own server. It soon became apparent that the company belonged to Nielsen, an advertising giant, who sold the information to pharmaceutical companies. Naturally, a scandal broke out, although the procedure was not illegal. Because of the controversy, however, the founders of the portal decided to remind that every user of the service, by clicking on the window suggesting to read the terms of use, automatically agrees to the transfer of data about themselves, which the administrators of PatientsLikeMe scrupulously exploited. This is because the service regularly sold sensitive data to companies in the medical industry that produce drugs, medical devices, services and insurance.

Every social network means new public records. Everything we share with people online, whether knowingly or not, can be copied, sorted and warehoused by newly-formed global data-mining moguls and then sold to advertising agencies, state governments and independent data brokers with an unbridled appetite for the most intimate details of our lives, warns Marc Goodman, a UN and International Telecommunications Union (ITU) expert on global cybersecurity.

Acxiom, Epsilon, Datalogix, RapLeaf, Reed Elsevier, BlueKai, Spokeo and Flurry are company names that most people don’t know much about, but they all make up an electronic surveillance industry valued at $156 billion a year. Little Rock-based Acxiom Corporation alone has more than 23,000 servers collecting and analyzing data records (every online activity that makes up our personal profile — every like, comment, tweet, etc.), which number more than 50 trillion annually. In late 2013. Scott Howe, the company’s CEO, proudly admitted that Acxiom has profiles of 700 million consumers from around the world! Each one takes into account a range of individual human characteristics such as race, gender, phone number, car model, education level, number of children, square footage of home, investment portfolio value, recently acquired items, age, height, political views, health issues, occupation, and even left- or right-handedness. What such stored knowledge looks like in practice was revealed on the example of Acxiom Corporation by Natasha Singer, who described the whole procedure in the pages of the New York Times. It turns out that Acxiom assigns everyone a 13-digit code and, based on their demographic and lifestyle characteristics, assigns them to one of 70 categories of people. Examples? “Segment 38: Americans of African or Hispanic descent, working parents of teenage children in the lower-middle class, shopping at local discount stores.” Or another. “Segment 48: Caucasian, college educated, living in rural areas, valuing family life, interested in hunting, fishing or racing.”

Of course, all profiles are supplemented with accurate contact information. Because the more detailed the profile, the higher its price. From the point of view of advertising agencies, this is an extraordinary value, because it is not known today that the effectiveness of advertising depends on its relevance. Showing advertisements of disposable diapers to a 20-year-old student would be throwing money down the drain, but the same advertisement presented to a 32-year-old pregnant housewife may already translate into concrete sales revenues. The situation becomes much more serious when collecting data about us is done in violation of the law.

The era of data surveillance

All over the world lawsuits in cases of violation of privacy are multiplying. They are more or less justified, because we often think that every use of our image requires our consent. However, we forget that in case of social networking sites we have already given our consent by accepting the regulations. This doesn’t mean that big companies can’t be accused of anything. In 2012, the Attorneys General of 38 American states sued Google for stealing private data. The company, pressed against the wall, admitted that its cars equipped with advanced cameras with a 360° field of view installed on the roof not only took pictures for the Google Street View service, but while driving on the streets, they downloaded data from unsecured Wi-Fi networks from homes and offices: passwords, e-mails, photos, messages, etc. Google explained that a bug had crept into the software, but under pressure from prosecutors it finally admitted to the theft. This kind of information is even more valuable if we realize that at the beginning of 2012, Google announced that it was merging data from all of its 70 products and services into one profile, including Gmail, Google Maps, Google Calendar, Google Voice, Google Translate, Google Docs, Google Chrome, Google Android, Google Photos (Picasa) and Google Video (YouTube). The results? A unified, detailed and unprecedented view of each user and their world.

To the charge that Google scans our emails, the company responded:

“Just as the sender of a letter to a business partner can’t be surprised if the recipient’s assistant opens it, people who use web-based email today can’t be surprised if their messages are processed by the recipient’s electronic service provider in the delivery cycle.”

In 2014. Google filed a police report against one user after analyzing his email (though it should be noted that it involved a pedophile).

Of much greater concern is the trading of the data we leave behind when we pay for purchases with our cards. More and more often stores are sniffing out opportunities and quietly reselling transaction records, because they know they can make as much money on them as on the goods themselves.

“I’m pretty sure I’d be better at predicting someone’s heart attack risk based on where they shop and eat than on their genotype,” said Harry Greenspun, director of the Center for Health Solutions, disarmingly.

Al Gore, at the 2013 South by Southwest conference in Austin, called such phenomena a “stalking economy.” Other experts are even more blunt and talk about surveillance. But the heads of big companies see nothing wrong with the whole procedure. Eric Schmidt, CEO of Google, said that if you’re doing something that you don’t think anyone should know about, perhaps you should stop doing it in the first place.

A platitude like “I have nothing to hide” is not the best starting point for a discussion. After all, you don’t have to break the law to draw some social repercussions. Does someone who calls a suicide hotline for help, or browses the Internet for advice on impotence, or searches for the address of the local chapter of Alcoholics Anonymous really want the rest of the world to know about it? Let’s go further. Would we want insurance companies to keep tabs on our every purchase? What would our health insurance premium be if the insurer got information about our regular fast food purchases? What if a large company was preparing to lay off some of its employees, and made its decisions based on algorithms developed with data bought from brokers, such as the pregnancy algorithm mentioned above? Of course, these are just considerations for now, though you never quite know. Walmart, the company that runs the popular supermarket chain, already pays companies like Castlight Healthcare to collect and compile data on the health of its employees. As its management points out, this is to encourage those it employs to take care of their health. Because by doing so, Walmart will eliminate unnecessary costs, both those related to medical treatment and absenteeism.

Regulatory Vocabulary

The fact that privacy policy regulations are written so that no one reads them is no coincidence. They are usually long, fifty-page documents in four-point font with single spacing and narrow margins. They are designed to be impossible to read, so we don’t do it. But we may pay a high price for it. A Carnegie Mellon University study found that the average American has to deal with 1,462 such regulations each year, and on average they are 2,518 words long. If someone wanted to read them all, they would have to spend 76 days reading them for 8 hours a day. The record-breaking is PayPal’s Terms of Service, which is 36,275 words long. By comparison, Shakespeare’s Hamlet consists of 30,066.

State monopoly

Although in the context of data brokerage the most often mentioned are private entities, the state can also make money on the sale of personal data. The best example of this is Sweden, which openly trades the data of its citizens. For 2 kroner (about 20 cents) anyone can buy the data of one person, which are specified by individual offices in thematic groups, such as “a list of students in Stockholm who have recently taken a loan to furnish their apartment” or “women in Östergötland who have recently registered a car with a towbar”. The sale of the data is conducted by the Tax Administration (Skatteverket), the Business Registration Office (Bolagsverket), the National Student Aid Board (Centrala studiestödsnämnden) and the Swedish Transport Administration (Transportstyrelsen). The latter alone collects about 30 million kronor per year (5 million dollars) from this. Sweden was the first country in the world to enact a Freedom of Information Act as early as 1766. However, information transparency, which was supposed to serve the society, in modern conditions results in complete commercialization of personal data. Of course, every citizen has the right to stipulate that he does not wish his data to be sold. To do so, however, he or she must contact the relevant authority and make a request. The absence of any intervention means approval.

Cool that you made it to the end of this article. I will be very pleased if you appreciate the effort of creating it and leave some claps here, or maybe even start following me. Thank you!