As the founder of privacy-focused non-profit humanID, I will take the opportunity to take a critical look at the business model of collecting, ‘enriching’, and selling our personal data online, at the example of Liveramp, formerly known as Acxiom.
Acxiom was founded in 1969 in Arkansas using lists of physical mailing addresses from phone books. Until 2018, Acxiom was the proud owner of the world’s largest commercial database.
Avoiding public attention until then, Acxiom and the data brokerage industry came under intense scrutiny following the Cambridge Analytica scandal. New privacy laws in Europe and California changed the industry dramatically.
Acxiom reacted by selling of its databases and brandname for $2.3 billion, rebranding to Liveramp, and positioning itself as a data exchange standard between large data marketplaces.
Today, LiveRamp’s main product is called IdentityLink. It enables companies that own data (including the company that is now named Acxiom) to use their algorithms to match hundreds of identifiers for any individual, and enrich it with third-party data. Companies can upload the contents of their CRM or POS systems, and it will be matched using Artificial Intelligence with data sources including public databases and ‘contextual cues’ such as the weather in your current location. The process now being called “Data Onboarding” is still to a large extend relying on browser cookies to bring together other information.
The result is a highly specific profile for each of us, that can be used to judge our credit-worthyness, or target us with marketing – up to 10,000 data points on each of 2.5 billion human beings!
The risks of this model are best illustrated by the 2003 breach of 1.6 billion (!) personal records by the company. While LiveRamps claims to anonymize all data, the industry is famous for the lax oversight, and anonymity doesn’t mean much if a dataset includes such variables as geo-location.
Value Creation through data standards
While the below model show’s Acxiom’s data profile before it sold of it’s databases, it would be a mistake to believe it knows less about you today.
With privacy laws and potential competitors endangering it’s position dominating the data brokerage industry, the 2018 move to spin of Acxiom was a masterpiece in market positioning, public relations and value creation.
First, LiveRamp let go the association with a brandname that is largely associated with data leaks, and the heavily critized secret data sharing agreement with Facebook that was ended in early 2018.
Secondly and ironically, LiveRamp is positioning itself to benefit from privacy legislation such as GDPR, which to a large extend were passed following recent data excesses and increased privacy concerns among citizens. GDPR introduces massive new complexity to any sort of data handling, in particular digital marketing. For smaller companies, that introduces a massive legal and financial risk. In this situations, companies will naturally tend to trust the established player holding up to 70% of the niche market more than new players in the market. The AdTech industry is likely to see consolidation, and the beneficiaries are frequently those that caused the privacy nightmares of recent years – including LiveRamp.
Lastly, by offboarding the ownership of data themselves, while retaining the close integration with many sources of valuable data – an asset incredibly hard to match by a potential competitor – LiveRamp is in a position to define data standards and protocol for the whole industry. Instead of being one player, LiveRamp is becoming the infrastructure the industry is working on.
Beyond the societal risk of providing a company (and indirectly the intelligence agencies) a way to blackmail every single citizen, profiling is used to discriminate against already marginalized communities. Pinpointed ads individualized by Artificial Intelligence are creating separate realities in different “bubbles”, as used by Cambridge Analytica during the 2016 elections. Increased use of AI makes it harder to understand the biases and decisions the system makes. When Facebook offered racial and income targeting in their advertising frontend, public pressure was able to make it back off eventually. This will not work for algorithms run far away from any public oversight.
Being positioned at the center of the data enrichment industry, LiveRamp is in a unique position and responsibility to set up the industry for a long-term future that returns to users ownership and control of their data, and thereby avoids legislation that goes much further than current privacy laws. Enabling an individual consumer to force all databases integrated wtih LiveRamp to delete their personally identifiable information (PII) will bring the industry out of the shadow. It will not just be the morally right way, but also an insurance against a much broader privacy backlash that we can already see as privacy-safe browsers and phones are gaining traction.