Scope and purpose: This timeline examines the claim that commercial data brokers compile so‑called “shadow profiles” — detailed dossiers about people made without their direct knowledge or consent. It traces key dates, academic studies, regulatory reports, lawsuits, and enforcement actions so readers can see what is documented, what is disputed, and where gaps remain. The article treats the subject as a claim under review rather than an established fact.
Timeline: key dates and turning points for data brokers and ‘shadow profiles’
- 2012–2013 — Early public attention to “shadow profiles” on social platforms: Reporting and bug disclosures connected to Facebook suggested that the company held contact and behavioral data about people who had not voluntarily provided it to the service, a usage often called “shadow profiles.” Coverage and advocacy raised public awareness of the idea that platforms can reconstruct profiles from contacts, uploads, and cross‑site signals.
- May 2014 — FTC publishes “Data Brokers: A Call for Transparency and Accountability”: The Federal Trade Commission issued a formal study of nine data brokers and recommended transparency, consumer access, and legislative oversight. The report documented how brokers combine online and offline records, infer sensitive attributes, and share data across broker ecosystems — language that is often cited in discussions about shadow profiling.
- August 2017 — Academic study quantifies “shadow profile” risks: A peer‑reviewed research article (David Garcia et al., Science Advances) modeled how social networks and friend disclosures allow platforms to infer attributes of non‑users or of users who have not provided particular data — providing a formal basis for the term “shadow profile” as a measurable privacy leak in networked systems. The study documents inference methods and their limits.
- April 2018 — Congressional hearing where the Facebook CEO was asked about shadow profiles: Lawmakers publicly questioned Facebook about whether it maintained profiles of non‑users or stored data people had not provided directly; the exchange exemplified the political attention to alleged shadow profiling on large platforms. Companies denied or downplayed the label even as they described data practices.
- 2018–2021 — Litigation and consolidated complaints referencing “shadow profiles”: Multiple class actions and consolidated complaints against social platforms and advertising intermediaries cited the term while alleging that background data and tracking produced undeclared profiles and secondary uses. Court filings used the phrase to describe inferred or aggregated records compiled without consumers’ direct submission. These cases show how the term entered legal pleadings, though outcomes vary by jurisdiction and claim.
- August 2022 — FTC sues Kochava over sale of sensitive geolocation data: The FTC filed a civil enforcement action alleging Kochava sold geolocation data that could be used to trace visits to sensitive locations (reproductive health clinics, shelters, places of worship). Regulators framed harms in terms of sensitive inferences derived from raw location streams — a pattern critics connect to shadow‑style dossiers assembled by brokers. Kochava disputed the agency’s characterization.
- 2023–2024 — Increased FTC enforcement on location and sensitive inferences: The FTC brought or finalized several enforcement actions and proposed orders (examples include X‑Mode/Outlogic, InMarket, and actions announced against Gravy Analytics and Mobilewalla) that restrict the sale or sharing of precise location data and define “sensitive location” categories. Those orders document that brokers were buying, aggregating, and reselling granular device location data and that such data can enable sensitive inferences — evidence often cited when describing how shadow profiles are assembled from raw signals. Defendants and industry participants have contested some allegations and argued for different interpretations of consent and consent mechanisms.
- 2022–2026 — Ongoing debate, regulatory rulemaking attempts, and new state laws: States (for example Vermont and others) and federal agencies considered or enacted laws and rules addressing data brokers. Policy documents, legal filings, and activist reporting show converging concerns about opaque broker practices and automated inference, while the industry emphasizes legitimate uses like fraud prevention and marketing. Disagreements persist about statutory authority, how to define “brokered personal information,” and the technical feasibility of opt‑outs.
Where the timeline gets disputed
Three recurring disputes appear across documents and reporting:
- Terminology and scope: Scholars, regulators, journalists, and litigants use “shadow profile” to describe different phenomena — inferred attributes (academic usage), undeclared data collections about non‑users (journalistic usage), or brokered dossiers assembled from many commercial sources (regulatory usage). This inconsistent usage makes comparisons difficult. The Science Advances study focuses on inference risks; FTC reports and enforcement actions focus on commercial aggregation and sale of consumer data.
- Legal characterization and remedies: Regulators have brought unfair‑practice or deceptive‑practice actions and negotiated consent orders that restrict certain data sales (notably precise location data). Industry defendants often deny unlawful conduct or argue the FTC lacks authority for some remedies; litigation outcomes and regulatory settlements do not uniformly endorse the “shadow profile” label, even when they document risky practices. That conflict is visible in Kochava’s public statements and in litigation records.
- How comprehensive documented evidence is: Some academic and regulatory sources document methods and examples showing how disparate signals can be combined. But direct, verifiable public evidence that any particular broker compiled a named individual’s “complete” shadow dossier and sold it to third parties for specific harmful uses is rarer in the public record — many industry practices are described by internal documents in litigation, regulatory pleadings, or inferred from datasets that researchers could access under limited conditions. Where sources conflict, the record usually shows differing interpretations rather than identical factual accounts.
Evidence score (and what it means)
Evidence score: 68/100
- Multiple primary sources (FTC reports and enforcement actions) document large‑scale collection, aggregation, and sale of consumer data that enable sensitive inferences.
- Peer‑reviewed research demonstrates the technical feasibility of inferring attributes about non‑users or missing attributes via social ties and cross‑site signals.
- Court filings and class actions show industry practices and contested legal claims; however, outcomes and remedies vary, and few public records show a single canonical broker dossier producing a named harm.
- Recent regulatory settlements target location‑based datasets and require prohibitions or safeguards, strengthening the documentary basis for concerns about sensitive inferences.
- Disputes over definitions, consent mechanisms, and the evidentiary standard lower the score: some industry actors deny the characterization and litigation is ongoing.
Evidence score is not probability:
The score reflects how strong the documentation is, not how likely the claim is to be true.
FAQ
Q: What do people mean by “shadow profiles” when they talk about data brokers?
A: The phrase is used in at least three senses: (1) academic—automatic inferences about a person made from their social ties or behavior; (2) journalistic—platforms holding data about non‑users or undeclared data about users; and (3) regulatory/commercial—data brokers assembling dossiers from many commercial and public sources. Each sense overlaps but is distinct; careful reading of the source is required.
Q: Is there documented evidence that data brokers sell complete “shadow dossiers” about named individuals?
A: Regulatory reports and enforcement filings document large databases, frequent data sharing among brokers, and sales of datasets that enable sensitive inferences (for example, location histories). Those documents establish that detailed dossiers can be constructed, but public records rarely show a single broker selling a fully enumerated “complete” dossier tied to a documented downstream harm. Some court filings and settlements provide closer, case‑specific documentation while litigation is still evolving.
Q: How have regulators responded to the shadow profiles claim?
A: The FTC’s 2014 data broker report recommended transparency and consumer access; in 2022–2024 the agency brought enforcement actions focused on location data and sensitive inferences (X‑Mode, InMarket, Kochava, Gravy, Mobilewalla), producing consent orders or lawsuits that restrict certain sales and require safeguards. These actions document concerns about aggregation and resale practices that feed the shadow‑profile narrative.
Q: If I’m concerned, what verifiable steps show whether my data is in broker systems?
A: Several FTC and academic sources recommend (1) requesting data or opt‑outs where statutorily available; (2) checking people‑search services and data broker opt‑out pages; and (3) using privacy protections (tracker blockers, limiting app permissions). However, because brokers combine many sources, no single check guarantees comprehensiveness; regulatory and technical remedies remain a work in progress.
This article is for informational and analytical purposes and does not constitute legal, medical, investment, or purchasing advice.
Tech & privacy writer: surveillance facts, data brokers, and what’s documented vs assumed.