“Bad Credit: Card Declines.” “Paycheck to Paycheck Consumers.” “Cash Cows: Underbanked File.” “Suffering Seniors.” “Ethnic Second-City Strugglers.” “Rural and Barely Making It.” These are the titles of marketing lists that data brokers have sold to predatory lenders so they can target financially vulnerable individuals. Lenders use the information in these lists to pitch exploitative and unlawful financial products to people already struggling to make ends meet. 

Alongside these lists, data brokers also sell loan companies “Assimilation Codes” indicating a person’s familiarity with the English language. The widespread sale of personal identifiers, including names, addresses, and social security numbers, enables even more precise targeting. People have lost their homes due to the sales of such lists. Taken together, these practices have generated a shadow digital economy of sensitive personal information that puts privacy and financial security at risk. 

Data brokers collect and aggregate “unprecedented amounts of personal data” from users’ cell phones, cars, household appliances, and other personal devices. By combining the collected data with publicly available information from sources like voter registration records and social media platforms, data brokers can produce acutely detailed profiles for sale.

Reports from the Federal Trade Commission (“FTC”) and the Senate Commerce Committee detail how data brokers help predatory lenders market high-risk products directly to financially vulnerable individuals. The Senate report warned that the data sold by some brokers appeals to companies that sell high-cost loans and other financially risky products. The FTC likewise observed that many people would find it “disconcerting” to know how easily such products can be targeted at disadvantaged individuals. Put simply, these data broker lists enable marketers to identify vulnerable consumers with ease. 

Taken together, these practices have generated a shadow digital economy of sensitive personal information that puts privacy and financial security at risk. 

In 2024, the Consumer Financial Protection Bureau (“CFPB”) proposed a rule to protect consumers from data-driven predatory lending practices. The rule would have required data brokers to comply with the Fair Credit Reporting Act (“FCRA”) and receive explicit authorization from consumers to obtain or share data. But six months later, new leadership withdrew the rule. Later that year, the Trump administration effectively dismantled the agency, terminating more than 80% of its workforce in a single day. 

 The Problem

The harvesting of private information creates harms that go far beyond predatory lending. With little resistance from law or society, data brokers sell personal information to stalkers, scammers, government agencies, and political consultants. In 2018, for example, The New York Times reported that Cambridge Analytica, a political data firm hired by President Trump’s election campaign, accessed the private information of over 50 million Facebook users. The firm offered tools to “map personality traits” based on users’ likes and social networks, identifying susceptible individuals to target with digital ads. 

Government agencies are also regular customers of data brokers. Although the Fourth Amendment requires agencies to obtain a warrant to acquire information in which individuals have a “reasonable expectation of privacy,” they can avoid the warrant requirement by simply buying the information instead. Because people lose any expectation of privacy in information that they voluntarily disclose to others, several agencies argue that traditional Fourth Amendment protections do not apply to data broker transactions.

While commercial data brokers frequently claim that the data they sell is anonymized, it can often be reidentified when cross-referenced with publicly available information or quasi-identifiers, like zip codes and birthdates. A recent study found that 99.98% of Americans would be correctly reidentified by combining just 15 demographic attributes. 

In 2019, The New York Times was able to track President Trump’s movements by deanonymizing the data from his Secret Service agent’s cell phone. Likewise in 2025, Vance Boelter amassed deanonymized dossiers containing the names, addresses, and daily routines of 45 Minnesota legislators “for less than the cost of a tank of gas.” Police believe he used that information to murder Minnesota House Speaker Melissa Hortman and her husband. The integration of new artificial intelligence (“AI”) tools will make it ever easier to “extract, re-identify, link, infer, and act on sensitive information about people’s identities, locations, habits, and desires,” amplifying the privacy, security, and civil liberty risks. 

Even though most Americans strongly favor more government regulation of personal data, the U.S. does not have a national data privacy law. Instead, it has a patchwork of FTC rules against deceptive and unfair practices and sector-specific legislation. The U.S. stands increasingly isolated in its lack of a federal data privacy law. As of last year, 144 countries had enacted national data privacy laws, bringing 82% of the world’s population under some form of national protection. While the U.S. came close to passing a comprehensive data privacy law in 2024, the effort stalled out amid struggles to reconcile privacy interests with industry desires for limited liability.

Without a federal regulatory framework that can meaningfully restrict the harms flowing from data broker transactions, the U.S. relies heavily on “notice and consent” privacy regimes. Notice and consent requires private entities to notify individuals and ask for their permission before collecting their personal data. In practice, this looks like a pop-up asking you to “click here” to accept a site’s terms and conditions. Few ever read the lengthy and legalistic policies. And even if they do, the lack of individual bargaining power means that these policies offer a false choice. People can either consent and gain access or decline and have no access at all. 

The lack of comprehensive data privacy laws and the overreliance on notice and consent procedures have plunged us into an age of “surveillance capitalism” where corporations accumulate vast wealth and power by buying and selling predictions about our behavior. The current consensus seems to be that collecting, aggregating, and selling users’ personal data to third-party purchasers is perfectly legal. In fact, it is an inevitable consequence of technological innovation. 

The lack of comprehensive data privacy laws and the overreliance on notice and consent procedures have plunged us into an age of “surveillance capitalism” where corporations accumulate vast wealth and power by buying and selling predictions about our behavior.

Total digital surveillance has become so normalized that many people are no longer bothered by their data being collected and commodified. This new economic order did not emerge by accident. It is the product of specific historical conditions, deliberate policy choices, and powerful corporate influence.

Historical Undercurrents

The surveillance capitalist project was favored by two historical developments that contributed to a “uniquely sheltering habitat for the surveillance mutation.” The first was the late twentieth-century rise of neoliberalism, a political-economic theory premised on the superiority of self-regulating companies and markets. The emergence of neoliberalism involved not only hostility to regulation but also a broader restructuring of corporate purpose, privacy theory, and market governance. The second historical development was the post-9/11 preoccupation with “total information awareness” as a strategic asset for national defense. The 9/11 attacks initiated an abrupt shift away from stricter privacy protections toward more intrusive surveillance practices in the interest of national security.

In 1932, roughly forty years before the neoliberal turn, the Harvard Law Review published a debate between two leading corporate law scholars about the purpose of the public corporation. On one side stood Adolph A. Berle, Jr., coauthor of the influential work, The Modern Corporation and Private Property. Berle argued for “shareholder primacy,” the view that the corporation exists only to maximize profits for its shareholders. 

On the other side of the debate stood Professor Merrick Dodd of Harvard Law School. Dodd disagreed with Berle’s shareholder primacy thesis. He argued that corporations have “a social service as well as a profit-making function.” The purpose of the corporation is not confined to making money for shareholders. It also includes more job security for employees, better quality products for consumers, and greater contributions to community welfare. Put another way, Dodd argued that corporations should act on behalf of all stakeholders, not just shareholders.

For a time, Dodd appeared to be winning. His vision of the public corporation as a social institution enjoyed widespread acceptance during the New Deal and postwar eras. In 1954, twenty years after the original debate, Berle even conceded that his original theory was no longer accurate. The argument had been settled “squarely in favor” of Dodd’s position that corporate powers were “held in trust for the entire community.” At least for the time being.

But shareholder primacy resurfaced in the 1970s as a key tenet of neoliberalism. In his classic New York Times essay, economist Milton Friedman asserted that the only social responsibility of business is to increase shareholder profits. Quoting himself, Friedman argued that a corporation’s only purpose is “to use its resources and engage in activities designed to increase its profits so long as it stays within the rules of the game.” He reframed corporate social responsibility as a “taxing” function that required accepting the “socialist view” that political mechanisms, not market mechanisms, should dictate resource allocation.

By reinterpreting corporate social responsibility as a costly error, Friedman and other neoliberal economists were instrumental in fusing shareholder primacy with the notion that regulation is a drag on free enterprise. The emerging neoliberal consensus recast the corporation’s long-standing reciprocities with customers and employees as “destructive violations of market efficiency.” 

By the turn of the twenty-first century, the foundational mechanisms of surveillance capitalism had begun to take shape. Shareholder primacy was widely accepted as the objective function of the corporation, and self-regulation was heralded as a remedy for “coercive” governmental oversight. Corporations would set their own standards, monitor their own compliance, and the market would take care of the rest. 

This neoliberal legacy produced an economic model that treats privacy as a competitive good. A model premised on the assumption that consumers engage only with services that offer an acceptable level of privacy. According to this view, notice and consent structures are accurate signals of informed consent, while privacy regulations interfere with consumer choice and competitive diversity. 

By the turn of the twenty-first century, the foundational mechanisms of surveillance capitalism had begun to take shape.

While neoliberalism provided an essential deregulatory framework, it is unclear if surveillance capitalism would have emerged without the post-9/11 fixation on “total information awareness.” A year before 9/11, the FTC had concluded that corporate self-regulation was insufficient to protect consumer privacy and recommended that Congress enact legislation to “guarantee basic consumer protections.”

The proposal would have required commercial entities that collect personal information to comply with fair information practices. In other words, it would have established a federal “floor” of minimum privacy protections. Had these recommendations been codified, it is entirely possible that the foundational elements of surveillance capitalism would have been illegal or at least subject to intense public scrutiny. 

But after the attacks, this momentum dissipated. It was replaced by a groundswell of popular support for expanding domestic surveillance capabilities, as existing institutions had failed to protect the country despite months of intelligence warnings. People feared another attack. National security became a powerful justification for data collection, and the Bush administration poured money into sweeping programs designed to accelerate the integration of state and corporate surveillance.

One such program was Total Information Awareness (“TIA”), a national surveillance system constructed in partnership with the private sector. By compiling and mining massive datasets for patterns of suspicious behavior, TIA was intended to identify terrorist threats before they occurred. In 2003, TIA’s funding migrated to a defense “black budget,” and it became the precursor to Prism, the infamous surveillance program leaked by Edward Snowden in 2013. 

Alongside the rise of neoliberalism, this sharp tilt toward more intrusive surveillance practices in the interest of national security helped shelter the early development of surveillance capitalism. But the success of the surveillance capitalist project is not purely the result of historical circumstance.