Data Brokers Assign Predictive Labels on Health, Finances, and Beliefs

Data brokers go beyond collecting basic personal information; they analyze this data to infer and predict sensitive characteristics such as health status, financial circumstances, religious beliefs, and even potential vulnerabilities. These predictions, often derived from algorithms and cross-referenced databases, are then used to sort individuals into various categories.

These classifications can include health-related labels like inferred diabetes or pregnancy, financial categories such as affluent or price-sensitive consumers, and even indications of religious or political leanings. For example, a company called Acxiom developed a segmentation system named PersonicX, which historically categorized households into lifestyle groups like "Rural Everlasting" and "Urban Scramble." Another company, InMarket, offered advertising segments such as "Christian church goers" and "parents of preschoolers," though its use of sensitive location data was later restricted by the Federal Trade Commission (FTC).

This practice has drawn scrutiny from regulators. The FTC has documented how data brokers combine information from multiple sources to infer sensitive characteristics. While some of these inferred labels may be inaccurate, they can still influence how companies perceive and target individuals. The FTC has intervened in cases where data brokers were found to be misusing or misrepresenting sensitive data, including enforcing restrictions on companies like InMarket.

How Data Brokers Make Predictions

Data brokers compile information from a variety of sources, including online activity, purchase histories, public records, and commercial databases. Predictive models then analyze this data to identify patterns and make inferences. For instance, searching for information about a specific health condition, even if for a family member, could lead to a profile suggesting the individual has that condition. Similarly, visiting a church or researching a political candidate might result in labels related to religious or political affiliation.

These classifications are often referred to as modeled attributes or inferences, representing predictions rather than verified facts. The concern is that companies purchasing access to these segments may use the predictions without verifying their accuracy for each individual.

Use of Data by Scammers

While data brokers aim to help advertisers identify target audiences, the detailed profiles they create can also be exploited by scammers. Basic personal information like names and addresses can lend credibility to fraudulent schemes. If a scammer also possesses information suggesting an individual is nearing retirement or researching medical expenses, they can tailor pitches for fake investment opportunities or medical services.

The Justice Department's case against Epsilon Data Management highlighted how consumer data can be sold to operators of fraudulent schemes. Epsilon agreed to a $150 million settlement after selling information on millions of Americans to entities running fraudulent sweepstakes promotions. The FBI reported a significant increase in financial losses due to internet crime among older Americans, with such targeted data potentially aiding criminals in identifying and convincing potential victims.

Exercising Privacy Rights

Accessing all the profiles created about oneself can be challenging, as there is no single, centralized system for reviewing marketing predictions. However, some state privacy laws, like the California Consumer Privacy Act (CCPA), grant eligible residents rights to access, correct, or delete personal information, including certain inferences. California also launched the Delete Request and Opt-out Platform (DROP) in January 2026, allowing eligible residents to submit a single deletion request to registered data brokers.

Individuals can take steps to reduce the amount of personal information available to data brokers. This includes searching for one's own information on people-search websites, submitting removal requests to data brokers, reviewing state-specific privacy rights, and limiting unnecessary data sharing with online services. While complete removal of all inferred data may not be possible, these actions can make it more difficult for unfamiliar entities and potential scammers to build detailed profiles.