Calling for greater transparency and an increase in consumer control, the Federal Trade Commission has released its report on the data broker industry.

Based on a study of nine data brokers, “Data Brokers: A Call for Transparency and Accountability” reported that the industry operates with a “fundamental” lack of transparency and recommended the enactment of federal legislation to regulate data brokers. Consumers should be given greater control over their personal information, the agency said, suggesting the creation of a centralized portal to provide access as well as the ability to opt out from the use of their data.

While the report did acknowledge some of the benefits provided by the collection and use of consumer data, the FTC said the industry’s control over “vast amounts of consumer information” raised privacy concerns.

“The extent of consumer profiling today means that data brokers often know as much – or even more – about us than our family and friends, including our online and in-store purchases, our political and religious affiliations, our income and socioeconomic status, and more,” Chairwoman Edith Ramirez said in a statement about the report. “It’s time to bring transparency and accountability to bear on this industry on behalf of consumers, many of whom are unaware that data brokers even exist.”

The report documented the size of brokers’ data collections, noting that a single broker held information on more than 1.4 billion consumer transactions, while another adds upwards of 3 billion new data points each month. Other findings in the report: data brokers collect consumer data from both online (social media activity) and offline (magazine subscriptions) sources and often share data with each other.

Much of the data collection is done without consumers’ knowledge, the FTC said. Information is combined and analyzed to make inferences about consumers, “including potentially sensitive inferences” related to ethnicity, income, religion, or health conditions, with the categorization of consumers into groups such as “Rural Everlasting” (single adults over age 66 with low educational attainment) and “Urban Scramble” (low-income Latinos and African-Americans).

The compiled data poses risks to consumers for unanticipated uses, the agency said. For example, “Bike Enthusiasts” could receive offers for discounts on motorcycles but could also be on the receiving end of higher insurance rates because of their identified risky behavior.

Concluding that federal legislation to regulate the industry would improve transparency and consumer control, the report recommended the creation of a “centralized mechanism” where data brokers could identify their company and explain their practices to consumers, who would be given access to their data and the ability to opt out of the use of their data.

A law should also require data brokers to inform consumers about the inferences derived from their data and provide consumers with information about their sources and whom they share their information with. Affirmative opt-in consent to collect and share sensitive information – like health data – should also be mandated, the FTC said.

The 110-page report concluded with three best practices for the data broker industry: implement privacy-by-design principles as set forth in the agency’s consumer privacy report, “implement better measures” to refrain from collecting information from children and teens, and take “reasonable precautions” to ensure that downstream users don’t use data for eligibility determinations or unlawful discriminatory purposes.

To read the FTC’s report, click here.

Why it matters: With the data broker industry already under scrutiny and the subject of multiple federal reports (from the Government Accountability Office as well as Sen. Jay Rockefeller (D-W.Va.), the FTC report produced few revelations or surprises. However, similar concerns in the 1970s led to the adoption of the Fair Credit Reporting Act (FCRA), which heavily regulates credit bureaus and users of consumer reports and credit scores. Although the information handled by data brokers is typically used for less significant purposes than consumer data covered by the FCRA (e.g., marketing purposes, in contrast to the credit, employment and insurance purposes that are the primary focus of the FCRA), this increased scrutiny, and general concerns today with privacy, could lead to regulation similar to the FCRA unless the industry aggressively self-regulates.