How Companies are Collecting, Tracking, and Selling Your Personal Information

Ron Zayas talks about data privacy and security.

The modern world comes with many technological and digital conveniences. But unfortunately, many of them come with a hidden cost: Your personal information. It can feel harmless in the moment to give out simple pieces of information, but companies can use that to build a detailed profile that they can then exploit – or sell. The secret to data privacy and security isn’t to completely disappear. It’s to make yourself a more difficult target.

See Data for Sale with Ron Zayas for a complete transcript of the Easy Prey podcast episode.

Ron Zayas is the founder and CEO of Ironwall by Incogni. While Incogni focuses on protecting the average consumer, Ironwall specifically protects at-risk professionals, including judges, law enforcement, and public agencies – people with a real risk of someone showing up at their house intent on harm. Ron founded Ironwall in 2011, and when it started, these high-risk protections and data removal were a small part of the business. But as data got more and more profuse and AI came around, Ron realized these stronger protections were where the future was going. Eventually Ironwall became part of the Incogni family, so they’re now part of the largest company in the data protection space. And it couldn’t come at a more important time.

What Companies are Collecting

We are in a weird time where people want privacy but also want attention on social media. It’s a little like a kid who wants to eat chocolate all day but also doesn’t want cavities. If the result is immediate, it’s easy for us as humans to see the cause-and-effect. But if the effect is long-term, it’s much harder for human psychology to make the connection between our actions now and the results later. It’s especially challenging when companies are doing everything they can to conceal how much they’re collecting.

Companies are going out of their way to not let you know how much information you’re giving out.
Ron Zayas

There are two categories of information that companies collect. The first is permanent identifiers. That used to be social security numbers. But these days, we’re all cautious about giving that out. Now, it’s your phone number. Once they have that, companies can collect and track everything you do.

Say you’re ordering a pizza. Your number is probably associated with your rewards account or you gave it for delivery. Then there’s your order – how many things did you order? Were any of them kid-oriented? When did you place it, and do you order a lot? Just your info from the pizza restaurant could identify that you’re a divorced dad who has your kids every other weekend and works late on Fridays. The restaurant will probably make more money from selling your data than from selling you pizza.

It’s not just companies using this data, either. Data privacy and security is essential because scammers, exes, and domestic violence perpetrators can get it, too. It’s scary to know just about anyone could buy that info, tie it to something like GPS, and then know exactly where you are and what you do.

Why Companies are Selling Your Data

Companies have always wanted your data. But initially, it was primarily internal. If the marketing department knew who you are, what you like, and what you buy, they can sell you more things. The data was valuable because they could keep you as a customer and convince you to buy more. But two things changed that.

One was that companies realized that they could make more money selling data than selling actual products. Say you’re a company that sells jeans. If you sell one pair of jeans, you might make $100, but that’s not all profit. Materials, labor, taxes, and other expenses come out of that. But if someone is willing to pay $50 or even $10 for information about your customer, that’s all profit. Big companies started getting into the data-selling business because it was more profitable than selling products.

When data itself became monetized, I can make more money … selling information on you than I could selling you a product.
Ron Zayas

The second big change was covid. That’s where smaller companies and mom-and-pop operations started to get into the data selling game. If you’re a small independent restaurant and everything is shut down because of covid, you’re not making any money. But you have all these phone numbers and order info from past customers that you could sell. Selling data kept a lot of smaller businesses from dying. And even after the covid restrictions lifted, these smaller companies saw the opportunity. Your local repair shop might make $15 profit on an oil change, but they could make $20 or $30 by selling your name, phone number, and license plate info.

It’s More Dangerous than You Think

Having your data out there can seem like a nebulous risk, like it’s preventing some vague danger or just reducing the risk of certain scams. But not paying enough attention to data privacy and security can have very real, very terrible consequences.

Anyone could buy all the GPS data for a major US city. It’s just the trips with no names. But most people’s workplaces are public. If someone knows where you work and one other piece of location info – like your neighborhood or your kids’ school – they can figure out which trip is yours. Then they can see how you get to work, what coffee shop you like to go to, when you drop off your kids and pick them up, and more. That’s scary info for anyone to have, especially for someone who wants to hurt you.

Most people say that they’re not someone people want to hurt. But that can change on a dime. What if someone sees you say something they don’t like and knows how to find you? Ron recently had a small TV appearance – less than a minute. Just from that, he got death threats. Even if he didn’t take them seriously, it’s still scary.

When Ron was a kid, nobody thought much about accepting rides from strangers. Then people started to realize that’s dangerous and told kids not to talk to strangers. These days, it’s more dangerous to give people your phone number than to get in a stranger’s van. But we can change that behavior, too.

It’s really more dangerous to give a lot of people your mobile number than it is to get in a van with somebody who has a nice puppy.
Ron Zayas

Legal and Criminal Dangers from Exposed Data

In some states, certain medical procedures for women are now illegal, when a few years ago they weren’t. Think about a marketer tracking someone’s purchases. One month she buys menstrual products. The next month she buys more. Then she buys a pregnancy test, then doesn’t buy menstrual products for two months, then the month after starts buying them again. First of all, that’s very personal info. But there’s also a case before the Supreme Court now arguing that that’s commercially available information. It’s not just about scams anymore. You could face criminal charges because the government bought your data.

Data privacy and security has a lot more impact than many people think.

It’s not just that you’re being a victim anymore, it’s that you could face criminal liability because of the data that the government can buy on you.
Ron Zayas

That’s scary. And a lot of people don’t realize that’s a risk. If that case stands, warrantless searches become completely legal because anybody can buy the data. Look at the Fourth Amendment. If a police officer wanted to track Ron and put a GPS device on his car without a warrant, that would get thrown out in court. But if the police could just go to a data broker and buy all Ron’s GPS data, that would be completely legal. And they could use that to get around needing to get a warrant.

Even if we’re concerned about data privacy and security, we still have to go to supermarkets and get our oil changed. But there are steps we can take. And we must, because if we stop preventing and just give it away, we become willing victims. Criminals and AI are both lazy. They’re always going to go for the easy victims. Don’t be the easy victim.

The thing about crooks, the thing even about AI, is it’s lazy. It’s always going to go to the low-lying fruit. Just don’t be the low-lying fruit.
Ron Zayas

For info that’s already out there, you can pay a company like Incogni to remove it or you can do it yourself. There are sixteen US states with privacy laws now. California’s is the most well-known. Even if your info is out there, you have the right to say you want it deleted. Companies don’t advertise it, but there’s a tiny link for California privacy compliance. Even if you don’t live in California, you can click the link. Most commercial entities will remove your info regardless of where you are.

If you’re dealing with a local business, remember that they’re humans and they want your business. When Ron takes his car in for service, for example, he asks up front if they’re going to share his info. Just their response to that will tell him a lot. If a company needs his name, he’s Ron Smith. If they ask for his address, he asks why they need it. We have to get into the habit of asking if companies really need that info. Only give out the info that’s actually needed. Or you can lie. They’re not entitled to any of your data, especially if they can’t give a good reason for why they need it.

Email is Better

If you have to choose between giving out your email address or phone number, always give your email. It’s safer from a data privacy and security perspective. First of all, you’ve probably changed your email address more often than your phone number, and companies want more permanent identifiers. And second, your email address is less dangerous if it falls into scammers’ hands.

If you get an email, how long does it take you to respond? What about if you have no idea who the person is? If you don’t know the person emailing you, you might never respond. Either way, you’ll take some time to think about it. It’s less urgent. A text or phone call, on the other hand, is much better at driving urgency. And scammers love urgency. If you get a serious text that looks like it’s coming from your mom, you’re not going to spend as much time thinking about it.

Ron’s team once did a test with someone where they said, “We’re going to show you how a scam works. You’re going to get a call, and it’s going to be fake.” The person answered the phone, and the voice sounded like his daughter. They had gotten the voice from a video she posted on social media. She called him an unusual term instead of “dad,” and they also got that from social media. The call sounded like her saying that, then the sound of a slap, and then crying. The person immediately panicked that someone was hurting his daughter. Even knowing it was coming, the urgency of a phone call and a cloned voice meant it took a lot of convincing for him to understand. A scammer with your phone number has a lot of power.

Protect Your Info

You wouldn’t give a stranger your social security number or credit card info. If you want to protect your data privacy and security, you have to think about your phone number and address the same way. If a stranger asks for your credit card number, you’re going to ask why, and who are you, and why do you want it. But we don’t think twice about giving out other info.

When Ron and his wife go to supermarkets, his wife ends up walking away from him in the checkout. Because the cashier will ask for someone’s phone number, and the person will say it. Ron will say, “Sorry, I didn’t get the last digit of that, was it a 2?” The person will look horrified that a stranger is asking, and Ron will point out that they just told everyone within hearing distance. We have to understand that these days, our phone number is just as important as our credit card number or social security number.

We also need to get into the habit of asking why. Businesses tend to back off when you say, “I’m already giving you my money, why do you need more?” Even on social media, figure out what you want out of it, and give only enough to get what you want. Screw what the company wants – it’s your data, and it’s not your job to give them data to sell.

There are also services like SurfShark Alt ID that will give you phone aliases. That’s great because it shows SurfShark’s info instead of yours if someone looks it up, it’s easy to change, and you know your mom or daughter wouldn’t be calling your alias because they have your real number. All of this makes you more difficult to target.

Become a More Difficult Target

Nobody was really talking about data privacy and security twenty years ago. The older you are, the more time you’ve had to share your information. But even if you’re just now thinking about it, you probably aren’t quite as exposed as you think. Newer info is more valuable than older info. And data collection has increased over time, so companies weren’t collecting quite as much twenty years ago. But the average profile has over 2,000 pieces of information – which is still a lot.

There are a couple things you could do. One option is to go completely off-grid and move to a shack in Montana. If you’re not going to do that, there are some things you can do. One is that, as previously mentioned, you’re entitled to remove your information from data brokers in most states. Even if your state doesn’t have that protection most companies will anyway.

New info supersedes old info. If that new info happens to be inaccurate, all the better. Don’t feel like you have to tell the truth. It’s okay to lie to people trying to collect and sell your information. They have no right to it, and adding false info to the process confuses everything and makes you a more difficult victim.

Start thinking about how often you give out your info. The more you think about it, the more data privacy and security will become second nature. If Ron has 200 pieces of information on Jim and 2,000 pieces of information Dave, he’s going to go after Dave because that’s the easier target. Be the one who removes information, changes it, and doesn’t give it out.

Making the Effort for Data Privacy and Security

Taking all of these steps is a lot of work. Ron isn’t trying to scare people into buying a service, but it’s a lot. This is what he’s done for fifteen years – he doesn’t have apps on his phone, and even his LinkedIn was created by the company and has no personal info. But he uses Incogni to catch things he may have missed. Services won’t remove everything, but if one person has 100 data points and another has 2,000, the one with 2,000 is going to be a much easier target.

You have to combine removal with prevention. How little info can you give out to do what you want? If you’re at the grocery store, the product is right there, they shouldn’t need anything else. Shopping online is different, but do they need your real phone number? If you just use social media to talk to family and friends, do you need to put anything on your profile? Ron doesn’t join loyalty programs because they’re designed to track you. Just give out as little as you can.

Many institutions send physical letters, hoping it will be too inconvenient and you’ll ignore it. But take the time to fill those out and send them in every time you get one. It’ll be less overwhelming to do one by one. And then you won’t risk forgetting them, too. Most people will be lazy or forgetful. Don’t be that easy prey, be the person who sends in the opt out and tells companies to not sell their data.

Visit incogni.com for general protection to lower junk mail, scams, robocalls, and general info exposure and become more difficult prey. If you’re high net worth, in the public eye, or worried about someone attacking you at home, visit ironwall.com.

All

All
Easy Prey Podcast
General Tech Topics, News & Emerging Trends
Home Computing to Boost Online Performance & Security
IP Addresses
Networking Basics: Learn How Networks Work
Online Privacy Topics to Stay Safe in a Risky World
Online Safety
Uncategorized

How Companies are Collecting, Tracking, and Selling Your Personal Information