Originally published by The 19th. Subscribe to its daily newsletter.
Companies called data brokers are lightly regulated, making the danger of doxxing — where contact information is made public to facilitate harassment — overwhelming.
In November, a study revealed how easily foreign governments could use companies known as data brokers to purchase personal information about U.S. military personnel. In some cases researchers paid less than a quarter per record for information that included home addresses, cell phone numbers and sensitive health data.
Congress reacted quickly; the House passed legislation this year that seeks to restrict the sale of “personally identifiable sensitive data” of American residents to North Korea, China, Russia or Iran or any businesses or individuals in any of those countries. The Protecting Americans’ Data from Foreign Adversaries Act of 2024 is now with the Senate’s committee on Commerce, Science, and Transportation.
Data brokers are analytics companies that compile dossiers about all of us, combing thousands of sources, including DMVs, licensing agencies and social media. They then sell it to law enforcement, immigration authorities and insurance companies. (If you’ve ever been contacted about a class-action lawsuit, your information could have been provided by a data broker.)
In November, a study revealed how easily foreign governments could use companies known as data brokers to purchase personal information about U.S. military personnel. In some cases researchers paid less than a quarter per record for information that included home addresses, cell phone numbers and sensitive health data.
Congress reacted quickly; the House passed legislation this year that seeks to restrict the sale of “personally identifiable sensitive data” of American residents to North Korea, China, Russia or Iran or any businesses or individuals in any of those countries. The Protecting Americans’ Data from Foreign Adversaries Act of 2024 is now with the Senate’s committee on Commerce, Science, and Transportation.
Data brokers are analytics companies that compile dossiers about all of us, combing thousands of sources, including DMVs, licensing agencies and social media. They then sell it to law enforcement, immigration authorities and insurance companies. (If you’ve ever been contacted about a class-action lawsuit, your information could have been provided by a data broker.)
One of the most insidious forms of violence to emerge over the past decade is doxxing, or the public release of personal contact information to facilitate harassment. Part of the reason doxxing is so common is because of the ease of access to this information granted by data brokers, which often charge only a small fee.
Jessica Ensley first became aware of data brokers in 2017, when she joined Reproaction, an organization focused on increasing access to abortion and advancing reproductive justice. During her training she was advised to search herself online and remove as much information as possible.
“The first time that I did it, I was absolutely horrified at how easy it was to find all of the addresses where I had lived. You could create a very clear trail of where I was, who my family is, where I’ve been, where I went to school, where I live now,” Ensley said. “I found it very disturbing.”
Now Ensley is the senior vice president of outreach at Reproaction, and part of her duties involve leading staff security. She keeps tabs on possible threats, leads frequent privacy trainings and is always seeking outside expertise on the best ways to keep workers safe.
“I think everybody should be worried generally about their digital information, digital security and their digital footprint. But it is very much so repro workers that are targets of a lot of harassment and doxxing threats,” Ensley said.
The 19th spoke with several workers in reproductive health and justice, but some declined to speak on the record due to concerns about becoming a target of doxxing or worsening ongoing abuse.
When Sarah Philips started organizing around abortion access in college in Texas eight years ago, an older mentor at an abortion fund told her to start paying attention to her personal information online. The mentor paid for Philips to have access to DeleteMe, a subscription service that monitors data brokers for personal information and automatically requests takedowns.
“If she hadn’t said that, I would have had no idea that this is even a thing,” Philips said. That experience helped lead her to work at Fight for The Future, a nonprofit focused on protecting digital privacy and freedom of expression.
Especially in the wake of the Supreme Court decision that ended a federal right to abortion, reproductive health and justice advocates are more visible online, Philips said. “You’re fundraising online, you’re doing fund-a-thons online, you’re educating people about Supreme Court cases, you’re talking to the media. We have to do all those things because of the state of reproductive and abortion access right now.”
That digital presence is necessary to raise awareness about services and current legislation, but it can come at a cost. After Eugenia Schauerman, admin and accounting manager at Northwest Abortion Access Fund (NWAAF), was interviewed for a state newspaper, a clinic received mailed threats meant for her.
When Schauerman first started working with abortion funds, she used her home address for business filings. Now she’s much more careful. She maintains a separate phone number to catch people who call to harass her.
Sometimes people silence themselves, avoiding media appearances, out of fear of harassment or violence.
“What’s so hard is that sometimes for our clients, their story could make a difference in the world, right? Their story could be really persuasive, but it’s so unsafe for them to have that story shared publicly, and that is really hard to see,” said Sara Ainsworth, senior legal and policy director at If/When/How: Lawyering for Reproductive Justice, which offers legal services through the Repro Legal Helpline.
Some of the clients represented by the organization have been doxxed or swatted, which is when someone calls in a false threat to someone’s home that results in a raid by a SWAT team. Ainsworth noted that this kind of harassment is extremely dangerous for people of color and people who have already been targeted by the criminal legal system.
Ainsworth said she has observed “an uptick in boldness” from people seeking to harass their clients, and “more certainty from those who would target them that they have state power behind them.”
The anti-abortion movement has gotten much more aggressive, said Melissa Ryan, CEO of CARD Strategies, a consulting firm that helps nonprofit organizations deal with targeted harassment, extremism and disinformation. “When you have someone’s personal information released online, they’re immediately under threat from a movement that is known to be violent and dangerous,” she said. Perpetrators also know there will not be strong consequences.
The most common way to prevent doxxing is to periodically remove your information from individual data broker sites. Organizations like the Digital Defense Fund, which provides cybersecurity training and grants for the abortion rights movement and was cited by many people interviewed for this article, compile guides on how to submit removal requests.
One resource shared by DDF recommends 24 data brokers to audit for your personal information. Another lists 220. More than double that number were registered in California in 2023. In Vermont, triple.
One of the most daunting aspects is that data brokers constantly are scanning for public information. Ensley said her coworkers find it shocking that they need to repeat the information removal process over and over. She recommends reviewing data brokers for personal information each quarter. But the process isn’t easy and is often intentionally difficult to complete.
“There is no set standard among data brokers’ sites as to how to get your information removed,” Ensley said. “It’s often very tricky to find.”
Ensley said she has even seen some data brokers require someone to watch ads as part of the process of trying to request information removal.
The convoluted, time-intensive process has an alternative: paying for a service to do it. One of the most popular is DeleteMe, which costs $129 per person for a year-long subscription. Since new data brokers are always popping up and more established ones recompile personal information, someone concerned about doxxing needs to subscribe indefinitely.
The expense can be difficult for both individuals and their employers. Some organizations do pay for personal information deletion services, but even then, if an employee leaves, the protection doesn’t follow them.
Lower-level workers can be more vulnerable to harassment. “Folks who are higher up in an organization are going to naturally have more protection most of the time, because organizations are built to protect people with power, versus someone who was an associate level staffer or an intern,” Ryan said.
The threats against Schauerman marked a turning point for the employees at NWAAF, who increased pressure on the board of directors to provide stronger safety protections for workers, said Jade Pfaefflin Bounds, the former volunteer and training coordinator. The staff sent a list of demands about pay equity and safety concerns to the board in 2022, less than a month after the Dobbs decision.
When the abortion fund decided to pay for a personal information removal service for employees, it felt like a blanket solution to a complex problem. Pfaefflin Bounds had a lot of questions about how the service worked and what sorts of information needed to be scrubbed. He was unsure how it would cover him as a trans person who changed his name. Did he also need to purchase a subscription for his husband, in case the two of them could be linked?
This confusion about data brokers is common. The general public has never heard of most data brokers, and neither have many lawmakers, said Sarah Lamdan, a professor at CUNY Law School and author of “Data Cartels: The Companies That Control and Monopolize Our Information,” even as there’s more data about us than ever before.
Signing away the right to data privacy is a common condition of many apps such as Grindr and DoorDash, and companies like Meta track people who don’t even have registered accounts.
The 19th is an independent, nonprofit newsroom reporting on gender, politics and policy.
