Edition 015: The Choice Was Made For You

The thing the corporation is taking is not just your human data, as the record of you. It is your ability to choose what happens next. It is your agency and autonomy. This is not an exaggeration.

The corporation that holds your data, which is the record of who you are, can build a picture of who you are likely to become. The picture lets the corporation shape what reaches you before you reach it, like the price you are quoted, the credit terms or insurance premium you are offered, or the article that loads at the top of your feed. Each of these is the corporation acting on the profile, narrowing the options that arrive in front of you, deciding in advance what you will get to choose between. By the time you are choosing, the choice has already been made smaller by a system you cannot see.

The data broker industry is the industry that does much of this work. It compiles human data from sources you cannot trace, makes individual profiles, and sells those profiles to anyone who will pay.[1] The buyers include governments, insurers, lenders, employers, landlords, retailers, and the platforms that price your day.[2] It is an industry with an estimated value at over $290 billion in 2025.[3] It has been the subject of FTC enforcement, congressional hearings, and state registration laws in Texas, among other places.[4] In 2024, the Consumer Financial Protection Bureau proposed a rule that would have brought many data brokers under the Fair Credit Reporting Act and required them to comply with the same accuracy, dispute, and disclosure obligations that govern traditional consumer reporting agencies. But in May 2025, under new leadership and as part of a broader rollback of the agency’s regulatory activity, the CFPB withdrew the rule before it could be finalized.[5]

To date, there is no federal law requiring data brokers to tell you they have your file. You have no right to see it, correct it, delete it, or opt out of its sale. There is also no law restricting what can be done with your data or your profile has been sold. And nothing is stopping the federal government from buying the data or your profile itself. Normally, the Fourth Amendment requires a warrant when the government compels disclosure of information. But the Fourth Amendment does not apply when the government pays for information. So, agencies that would need a warrant to get the same information directly, like the FBI or the Department of Homeland Security, can purchase it from data brokers instead.[6]

The buyer, of course, is not always the government. More often, it is the retailer who wants to know what you will pay. The industry calls it “personalized pricing.” The Federal Trade Commission calls it “surveillance pricing.” It is the practice of setting an individual price for an individual person based on what the data says about that person, meaning that people who buy the same product at the same time may be offered different prices.[7] The FTC’s preliminary findings, published in January 2025, examined six data brokers that worked with at least 250 client companies and concluded that retailers can and do use granular personal data to set individualized prices and discounts for the same goods and services. The hypothetical the agency offered was a consumer profiled as a new parent being shown higher-priced baby thermometers on the first page of search results, because babies wait for no one, and desperate parents will pay a premium.

On April 28, 2026, Maryland became the first state in the country to ban the use of surveillance data to raise prices on staple foods.[8] The mango you buy in Maryland will cost the same as the one I buy in Maryland. But nothing is stopping predicative mango pricing in Texas. And federal law still does not prohibit the practice. It also does not require disclosure of it. So, heck if we will know.

The system makes the price you see different from the price the person next to you sees. This is how your human data is being used against you. And this extraction is legal, profitable, and largely invisible.

***

The same system decides which apartments appear in your search, which articles reach the top of your feed, and which insurance rates you are offered. None of it is presented to you as a decision. By the time you are choosing, the choice has already been made.

This is what the loss of autonomy looks like. It’s not a dramatic moment in which something is taken from you. It is a quiet narrowing of the world that reaches you, like the rate you would have refused if you had known what the person next to you was being offered, or the article that would have changed your mind if it had loaded at the top of your feed instead of the bottom. Nothing feels like a loss because you never saw the alternative. The system decided in advance what you would get to choose between, and then it offered you the choice, and you made it, and it felt like yours.

It was not yours. That is what has been taken.

***

Some of my friends still shrug when asked for their data. They say they have nothing to hide. But “nothing to hide” assumes the threat is exposure of information. The threat is extraction.[9] Don’t imagine a searchlight, imagine a pipeline. You can have lived the most transparent life imaginable and still be the reservoir. The question was never what you are hiding. The question is what is being taken, and why you cannot feel it leaving or being leveraged against you.

***

You may have heard the phrase: data is the new oil. It is still said admiringly by people who are very pleased about it. The comparison is meant to suggest that data is a raw material, extracted from the world, refined, and converted into enormous economic value. And in that narrow sense about its value, it is accurate. But the comparison reveals more than it intends to. Oil is extracted from the earth. The people living above it may or may not benefit from its extraction. Most often, they do not. The oil companies extract the value. The communities live with the consequences, the pipelines, and the spills. Data is extracted from your life on the same terms. The corporations extract the value. You are living with the consequences.

The Earth took millions of years to make oil from the bodies of living things. You are making data in real time, from the body of your living life. And the law that was built to protect you was not built for this.

***

But no metaphor can capture why the extraction is happening. The corporations are not pumping your data to store it. They are extracting it to build a model of you, precise, predictive, and constantly updated, that gives the corporation an information advantage over you in every transaction you will ever conduct with it. It knows what you fear, what you need, and what you cannot afford to walk away from. And it uses this information against you.

***

For most of the last century, the law assumed the buyer knew less than the seller. That assumption no longer holds. The seller now knows more about the buyer than the buyer knows about herself. The law hasn’t caught up. We will consider that next.

***

[1] See Federal Trade Commission. Data Brokers: A Call for Transparency and Accountability. May 2014, www.ftc.gov/system/files/documents/reports/data-brokers-call-transparency-accountability-report-federal-trade-commission-may-2014/140527databrokerreport.pdf. Accessed 18 May 2026. (The foundational federal study of the industry. Defines data brokers, documents that they collect from sources consumers cannot trace, and establishes the scale of individual profiling — one broker alone held 700 billion data elements.)

[2] Electronic Privacy Information Center, "Data Brokers." EPIC,epic.org/issues/consumer-privacy/data-brokers/. Accessed 18 May 2026. (Documents who the buyers are. Brokers sell to advertisers, to fraudsters targeting retirees and veterans, to government agencies, and to abusers tracking domestic violence survivors.)

[3] See Maximize Market Research. Data Broker Market: Global Industry Analysis and Forecast (2026-2032) by Data Category, Data Type, End-User and Region. Mar. 2026, www.maximizemarketresearch.com/market-report/global-data-broker-market/55670/. Accessed 18 May 2026. (The market research firm whose industry revenue estimates — $290 billion in 2025, projected to reach $473.35 billion by 2032).

[4] Texas’s is the Texas Data Broker Law (Tex. Bus. & Com. Code §§ 509.001, et seq. (2023)); California's data broker registration law is the Delete Act (Cal. Civ. Code §§ 1798.99.80, et seq. (2023)); Vermont’s is 9 V.S.A. §§ 2446–2447 (2018), the first such law in the country.

[5] Consumer Financial Protection Bureau, CFPB Launches Inquiry Into the Business Practices of Data Brokers (Mar. 15, 2023), https://www.consumerfinance.gov/about-us/newsroom/cfpb-launches-inquiry-into-the-business-practices-of-data-brokers/. Accessed 14 May 2026; Protecting Americans from Harmful Data Broker Practices (Regulation V), 89 Fed. Reg. 101402 (Dec. 13, 2024) (proposed rule), withdrawn May 2025.

[6] Emile Ayoub and Elizabeth Goitein. "Closing the Data Broker Loophole." Brennan Center for Justice, 13 Feb. 2024, www.brennancenter.org/our-work/research-reports/closing-data-broker-loophole. Accessed 18 May 2026. (documenting the sale of consumer profiles to government agencies in ways that bypass Fourth Amendment process.)

[7] Federal Trade Commission. “FTC Surveillance Pricing Study Indicates Wide Range of Personal Data Used to Set Individualized Consumer Prices.” 17 Jan. 2025, www.ftc.gov/news-events/news/press-releases/2025/01/ftc-surveillance-pricing-study-indicates-wide-range-personal-data-used-set-individualized-consumer. Accessed 18 May 2026. Accessed 18 May 2026 (establishing that retailers use granular personal data — down to mouse movements on a webpage — to set individualized prices.)

[8] Maryland General Assembly. House Bill 895: Protection From Predatory Pricing Act. Reg. Sess., 2026, mgaleg.maryland.gov/mgawebsite/Legislation/Details/HB0895?ys=2026RS . Accessed 18 May 2026. (prohibiting food retailers and third-party delivery service providers from using dynamic pricing or personal data to set higher prices on food, enforced by the Maryland Attorney General with civil penalties up to $10,000 per violation and $25,000 for repeat violations. Takes effect October 1, 2026.); see also Office of Governor Wes Moore. “Governor Moore Signs Legislation to Protect Marylanders' Pocketbooks in Grocery Stores, Safeguard Voting Rights, and Strengthen Foster Care Oversight.” Office of Governor Wes Moore, 28 Apr. 2026, governor.maryland.gov/news/press/pages/Governor-Moore-Signs-Legislation-to-Protect-Marylanders'-Pocketbooks-in-Grocery-Stores,-Safeguard-Voting-Rights,-and-Streng.aspx. Accessed 18 May 2026.

[9] For readers who want to further consider this question, the New York Times Privacy Project is where I would send you. The series ran in 2019, in the wake of the Cambridge Analytica revelations, when the public was beginning to understand that the platforms had been doing the things the platforms had been doing for years. The Times opinion department gathered more than a hundred articles, interviews, and interactive features, organized around four questions: Does privacy matter? What do they know and how do they know it? What should be done? What can I do? The writers were technologists, lawyers, journalists, and scholars. The answers they gave to those four questions are still the answers, because the underlying conditions have not changed. The platforms have grown, the collection has accelerated, and the frameworks still have not caught up. The series is worth your time. https://www.nytimes.com/interactive/2019/opinion/internet-privacy-project.html. Accessed 14 May 2026.