Uncovering the Hidden Data Ecosystem

Achieved Results

October 2020 update:  the UK regulator issued an enforcement notice against Experian, one of the companies we targeted. The regulator also forced changes in practice against TransUnion and Equifax. The regulator's action must send a clear message to the sector.

It is time that these companies - which operate within the hidden data ecosystem - receive the attention and scrutiny they deserve. Our campaign to uncover this hidden data ecosystem began on 25 May 2018  the day the new EU data privacy law - GDPR - came into force. We will be using the law as a tool to investigate and hold to account a range of data companies that facilitate mass data exploitation.

data exploitation hidden ecosystem

There has been a lot of attention given to companies with which we engage on a daily basis - and for very good reason. But what about companies that work in the background, away from the media's spotlight and outside of people's day-to-day online routine? It is time that these companies - which operate within the hidden data ecosystem - receive the attention and scrutiny they deserve.

We use the word hidden, because it’s incredibly difficult - even for experts - to fully understand what exactly is happening to your data. This is a general problem that affects the software we use and the devices we rely on. Yet nowhere is such data exploitation more persistent and systemic than in the online advertising ecosystem. Marketers and credit bureaus have always collected, analysed, and compiled lots of data about people: from loyalty programs, to consumer credit reporting. Now in addition, the drive to create ever more targeted ads has created an entire ecosystem made up of thousands of companies that are all in the business of tracking and profiling people in virtually all aspects of their lives. The problem is: today’s pervasive digital tracking is mostly invisible.

Our campaign to uncover this hidden data ecosystem began on 25 May 2018  the day the new EU data privacy law - GDPR - came into force. We will be using the law as a tool to investigate and hold to account a range of data companies that facilitate mass data exploitation.