The Fatwa on Data Brokers

Once a shadowy marketplace for trading personal information, data brokers now face an existential crisis caused by a shifting data commerce market, risking their future. Their challenges include:

• Apple Privacy and Restricted Data Supply For Data Brokers to Monetize

• First-Party Data Reduces Relevance of 3^rd-Party Data and Data Brokers.

• Regulation Increased Costs On Data Brokers.

• FISA Section 702 Imperils a Key Market for Data Brokers.

Apple’s Privacy Revolution

Under CEO Tim Cook, Apple has made privacy a core aspect of its brand identity, marking a significant shift in how companies handle data. Apple launched marketing campaigns, such as “Privacy. That’s iPhone,” showcasing features like Face ID, secure messaging, and Safari's anti-tracking capabilities. These initiatives positioned Apple as the top choice for privacy-conscious consumers seeking shelter from the growing surveillance economy. By emphasizing privacy as a key feature of its products, Apple prioritizes consumers over advertisers through:

1. Differential Privacy / On-Device Data Processing: This approach anonymizes data for analysis, ensuring that individual data points cannot be traced back to specific sources or users.

2. App Tracking Transparency (ATT): In iOS 14.5 (2021), ATT requires apps to obtain explicit user consent before tracking activity across various applications and websites. This critical change significantly impacted the advertising industry.

Everything is an Ad Platform - 1^st Party Data Supremacy.

The rise of first-party data—information collected directly by companies through their interactions with users—has redefined the advertising ecosystem. This trend is driven by the growing dominance of platforms like Amazon, Uber, and Apple, which now serve as comprehensive ad platforms that leverage their direct consumer relationships and proprietary data. As more companies evolve into ad platforms, the “everything is an ad platform” (credit to Eric Seufert) paradigm continues to reshape the advertising industry.

1. Companies that engage directly with consumers can gather detailed, consent-based data on user behavior, preferences, and habits, eliminating the need for third-party intermediaries.

2. These platforms utilize distinctive, highly accurate datasets to provide advertisers with targeting capabilities unmatched by generic third-party data.

The result is an ecosystem where first-party data is the cornerstone of advertising strategies, leaving traditional third-party providers with questionable value.

Regulation

The DELETE Act (SB 362), enacted in California in 2023, empowers residents to manage their personal information by streamlining the process of deleting data held by data brokers. The law requires establishing a centralized online tool managed by the California Privacy Protection Agency (CPPA), enabling individuals to request data deletion from all registered data brokers with a single submission. The provisions of the DELETE Act expand the regulatory environment in ways that do not favor data brokers:

1. A data broker is any company that collects and sells personal information about consumers without having a direct relationship. Just because a company doesn’t identify as a data broker doesn’t mean regulators won’t classify it as one. Engaging in the buying and selling of personal data in any form could subject

2. The California Privacy Protection Agency (CPPA) states that a "direct relationship" refers only to first-party data. As a result, companies that utilize third-party data for targeted advertising may be categorized as data brokers under California law, even if they do not consider themselves as such.

FISA 702: A Game Changer for Data Access

Traditionally, governments relied on data brokers to gather commercial information, including geolocation data, purchase histories, and online activities collected from apps, websites, and credit agencies. Section 702 permits the U.S. government to bypass intermediaries like data brokers and directly obtain datasets from commercial entities by using legal authorities, avoiding the often fragmented and incomplete information data brokers provide.

1. Direct Access to Data: 702 requires electronic communication service providers, including prominent tech platforms, to provide user data. This direct access to sensitive information makes data broker services obsolete for intelligence purposes.

2. Real-Time Monitoring: Unlike data broker acquisitions that typically involve static datasets, 702-authorized programs offer access to real-time communications and updates.

3. Cost Efficiency: The government’s authority to require tech companies' cooperation reduces the financial burden of obtaining data from brokers.

The Data Broker Dilemma

Once essential intermediaries, data brokers now confront an existential crisis triggered by privacy measures, first-party data, regulation, and direct access authorities for the government. The message for data brokers is clear: survival depends on a radically new value proposition. But I’m unaware of a dataset they can hack, steal, intercept, or buy that will help them find it.