Ok, I'll add to that a couple more details. Many ecommerce companies sell your purchase history to third parties as well, just like the credit card companies. This allows others to market to you more directly.

There is at least one company that has built technology that will monitor most all these purchases, monitor the IP's from them and the browser profile to identify a specific machine that you use. Then when you go to work, or are on your mobile they also will tag that traffic as you too. They have gotten so good they can serve ads that are relevant to your wife if she happens to be on your computer surfing the web for shoes say, but serve you different ads if you are on the same computer. They use data feeds from many sources, but ecommerce transactions, credit card transactions and companies like acxiom that let them match those with real people, incomes and household details make it very powerful.

In marketing we use Axiom and others a lot, their data used to be more vague and educated guesses about people. Now though, they have gotten it down pretty well, including how many animals, kids and your income/debt etc. They collect data from tax collectors offices, county records, city records, plus companies that will sell transaction data and other pieces so they can get a full picture. They of course work with Equifax, TransUnion etc too so they can build a whole economic profile on a person.

These companies are also what allow marketers to send you an email about their product/company after all you have done is visited their website. You don't have to enter anything or click on anything, but they will know who you are, who you work for and whether you fit their market profile in general. Poorly done it is extremely creepy, correctly done it can be an amazing conversion booster.

To me, well done, is still creepy.

I am from Brazil, and I am openly dissident of our government, and here assassinations (And other unpleasant things) DO happen to dissidents (example: in the last year a couple anti-government bloggers all in the same region where "murdered", the police claim it was just normal murder, but the coincidence is too great to be just normal murder, they were obviously assassinated).

What happen, if some day the government decide to assassinate me? They can just waltz in with a market company, offer a lot of money (or if they refuse, a lot of pain), get my data, and know all that stuff about me.

Then, they can do with me, what they did with Toninho and Celso Daniel: intercept them on the street, kill them, and pretend it was a robbery gone wrong.

Toninho case was very obvious: He was intercepted while fetching some suits he had bought before, using the tech you mentioned, assassins would know for certain that he was there, since they could know he would need to eventually fetch the suits, and that once inside the building, you could intercept him at the exit, indeed as he was exiting the shopping mall that had the clothing store, another car drove by, shot him (not "at his direction", but at him, directly, Toninho died instantly because of direct hits), and sped away. The police claimed it was a random incident where random criminals randomly passing by got pissed off at him cutting them off in the traffic and killed him, beside all that being unlikely, Toninho had some days earlier said to the press that should "something happen" to him, stuff were already set for his successor.

So what matters to me is: How I don't get tracked, unless I go "off grid survivalist style" ?

Your concern is totally valid, I luckily do not live in a country that I feel I need to be on guard at the level you do but it still doesn't mean I appreciate all the data collection either.

That said, there are things people can do with companies like Acxiom to help reduce the data collection. At least in the US (not sure overseas) if you as a consumer submit a request to be removed from their lists they must honor your request and remove you, many US states have strict laws about this and I believe the Federal laws also have strict restrictions. The catch 22 to this is that you can wind up back in the collection at a later date because of activity you take or because of a timeout period (from what I understand). You can read about Acxiom's policy and opt-out here: https://isapps.acxiom.com/optout/optout.aspx

As a point too, you may check out the data collection from Acxiom, as I believe they actively collect and use data in your home country, as they do in many counties. Equifax, Experian and TransUnion all also work in the US and overseas and collect/sell vast amounts of data on individuals. The very fact they collect so much data does make people (including me) nervous because I personally feel they do not take security of the data nearly serious enough, as recent security issues have shown at most of them. But that I guess is a different issue/post.

That is correct. Banks and credit card companies merchandise this information to their partners, which leads to this kind of thing. Check your cards' terms of services if you want to be somewhat horrified.

Banks are disgusting. They get a cut already from the purchase which ought to be more than enough to deliver this and make a profit. But no it's not enough.

I don't use facebook but do use a credit card. Hard to opt out of that in the modern world. God these people are filth.

Well, I don't know how hard is it in the USA, but I use cash most of the time and know several people who do the same. Sure, sometimes you need to make wire transfer, or pay with credit card, or paypal for that matter. But at least shopping in the supermarket is possible with cash.

Then I do hope that you do not own a cashback etc bonus card, or your can be quite sure that your personal consumption related high resolution data will end up in some buyers pocket.

And all that for a cheaper (and cheap) bread-knife.

This is why I frequently swap bonus cards with random people on the subway :)

A serious question, though I assume that you were joking: is it more creepy to have your own actions tracked and accurately tied to you, or other people's actions tracked and inaccurately tied to you? Both sound pretty awful to me, but I think I'd prefer the former if those were the only two options.

What stops these guys from selling to all the major health insurers.

Been buying too much sugar? Dental insurance up. Too much butter? Health insurance up. Bought three times the median amount of headache tablets? That's a paddlin'. Bought more alcohol than normal? Car insurance up.

Opt out to keep off their radar? They assume the worst and charge you double?

I've heard stories of this happening (shopper club data -> insurance companies), but it's never been substantiated.

Example sentence from mid-naughts: "I've heard several stories of USG bulk tapping Internet interconnection points, but it's never been substantiated."

Thinking from first principles lets us see incentives and probable outcomes before they are "substantiated" (adopted by the media).

I personally don't think shopper data is affecting insurance policies quite yet. But the groundwork is there (Acxiom etc), and the "great" thing about data is it stays around forever!

I'd guess a timeframe of 10 years, but does it really matter as to when?

> What stops these guys from selling to all the major health insurers.

Is this a response to my comment? I would guess that the answer is "nothing but the temporary protection of the law", but, assuming that protection is eventually revoked, it makes it all the more worrisome for me to have a random stranger's data taken as my own.

In the UK we have a company called Boots which used to be a pharmaceutical giant and is now a high street toothpaste and moisturiser giant. At the counter, they always ask if I have a 'Boots card' (purchase tracking card). I say no, because I don't, and they are often confused - because it's weird to not only have presented one immediately, but to claim not to own one. I'm then told I can be given my 'points' on a receipt so that I can add them to my (non-existent) card later.

I'm not a tin foil hat type, but I really don't like filling my wallet with tracking cards and can't be bothered to claim the miniscule compensatory benefits provided in return for proffering my purchase (and also location, hygiene, etc.) information.

Saying 'no' is almost more hassle than simply submitting, however, which is probably exactly what the company would like to hear. Suggestions welcome for brushing off this nuisance without a) Avoiding their shops entirely (not practical) or b) Being rude to cashiers.

Sometimes I do use several bonus cards, when there's some significant benefit (say, sale-out only for bonus-card owners). Guilty that. But I do not use them often and of course I don't use my real name when signing up for it. Or if I do — only when I use my CC anyway, which is rare.

Surely if you use your CC one time with this card they have your real details. After that every cash purchase where you use this card is tied back to you. Not hard to believe they do this and you should assume the worst.

> every cash purchase where you use this card

When I pay with cash, I usually don't present a card as well.

I avoid these for sure. As you say the reward is nothing - they can stick it.

Purchase and transaction histories provide very rich data profiles and are a big business. There are also several companies that match up this "offline" data with online profiles so you can be targeted online.

PII is not available, it is anonymized. There are laws around this. Purchase data itself is usually grouped into major purchase types, not amounts or actual goods purchased.

For that detail, it would be the CRM/ERP systems of the manufacturer that has that information tied to a serial number and this is why they ask you to register your product when you buy it. Some manufacturers might work with data providers to exchange this data (serial numbers in exchange for purchase histories) but it's rarely done at scale because of cost, complexity, legal/security risk and lack of options to benefit from it.

> PII is not available, it is anonymized. There are laws around this.

But we've seen how useless even apparently well meaning anonymisation is—think of the AOL search results. I can't imagine how utterly useless it becomes when it is done by people in whose interest it is to do it poorly, while remaining just within the law.

There is a difference. Yes search results can reveal a lot, even just a few hundred likes on Facebook can reveal your entire personality [1]. However this data is not regulated the same as actual personal information like names, address, gov id numbers, credit card data, etc. even though it should be.

The protection of the law does add to the security. Also anonymization of the PII (scrubbing into just a serial number) combined with the dilution of purchases into larger categories provides lots of protection. Your google search history is lot more detailed and granular than most of the purchase data you can buy through data markets. You might be able to figure out a basic "profile" and maybe use lookalike modeling but it would be incredibly difficult to actually distill that to a discrete person.

There's also been a push to buy "insights" rather than just data to get more ROI with less effort/cost so instead of buying purchase histories you would just buy a segment of people interested in buying washing machines for example.

1. https://soundcloud.com/rawdatapodcast/episode-1-uploaded

Agreed. I work on pharmacy data, which is additionally subject to HIPAA compliance. While the the pharmacy data does technically not contain anything identifiable, it is frightening how easily someone can match their own company's records up to a data set that is supposedly anonymous.

Now you know why some countries like Germany like cash. It's anonymous by design.

True. But there are already solutions in place to undermine this anonymity e.g. the bonus card system (see previous comment).

Yeah, it's a shame that people don't value their privacy to some miniscule percentage of their expenses.

People have absolutely no idea what trade off they're making I these cases. They just think they're getting a discount.

Tbh, $4-5k/year isn't a minuscule percentage of my expenses.

Guess why Google and Apple desperately wants to get in on payments? It fits their data driven business model perfectly.

Apple has a data-driven business model?

Well, they aspire to. Their ad network is large and growing.

I've not seen numbers and I'm skeptical that it's growing, but the revenue can't be more than a rounding error on their books.

Lumping Apple with Google in terms of data gathering is misleading at best.

You mean Apple, the company that until recently forced you to give them cc data in order to install any app on your device, regardless of the app being a paid or free one?

Apple wants your money, not your data (as further evidenced by the fact that they just killed iAds).

Literally every interaction with a 3rd party should be considered public knowledge as it is almost always shared with enough 3rd parties to guarantee that is the case.

This kind of thing is why the EU has data protection law.