Data about your body is up for sale. Who's buying it?

Your personal biometric data—from your face, to your gait, to your weight—is constantly being collected and sold. Who’s buying it, and why?

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Ira Flatow?

  Science Friday is supported by MathWorks, creator of MATLAB and Simulink software for technical computing and model-based design. MathWorks, accelerating the pace of discovery in engineering and science. Learn more at mathworks.com.

• 0:19Flora Lichtman?

  Hey, it's Flora, and you are listening to Science Friday. If you're one of the millions of Americans who leave the house, prepare for your close up because cameras are everywhere. Your neighbor's Ring camera catching you as you walk by. The grocery store security camera looking at you as you shop. The plate reader capturing you in the car. These images are a type of biometric data, and more and more biometric data is being collected. So what happens to it? And if you have nothing to hide, should you care? Here to talk about that is Anne Toomey McKenna. She's an attorney specializing in privacy and biometric surveillance, and she's on the AI Advisory Council for the IEEE,

• 1:01Flora Lichtman?

  the Institute for Electrical and Electronics Engineers. Hey, Anne, welcome to Science Friday.

• 1:06Speaker 02

  Hey, thanks for having me. Happy to be here.

• 1:09Flora Lichtman?

  Thank you for being here. Yeah. You know, we hear this word biometrics a lot. How should we define it?

• 1:15Speaker 02

  Biometrics is something that should be really broadly defined. So a way to think about biometrics are really measurable characteristics about you. And those measurable characteristics could include things like health data, right? Your particular heart rate. What is your heart rate variability? Your biometrics could be not just your eyes and particular features of your retina to identify you from a retinal scan, or to be able to identify you from the shape of your face, but your particular pattern of walking, right? Your gait, or the way you hold your phone. So your phone is collecting biometric data of all kinds, right?

• 2:01Speaker 02

  Not just your, not just your image. And I think that's an important thing to remember because so much of the attempts by states to protect biometric privacy Really go to facial recognition privacy. But I think it would be helpful to think of biometrics more broadly. Right? Not just your face, not just your fingerprint, but really all of these idiosyncratic or very specific measurements that reflect things about you and make it identifiable to be you.

• 2:31Flora Lichtman?

  And it's not just your phone taking this data either, right? Typically.

• 2:35Speaker 02

  Yeah, we live in an ecosystem of surveillance with all of our smart devices. But it's also everything around us to participate in modern society is to consent to pervasive and persistent surveillance. Your car is loaded with sensors. It's collecting your weight. You sit on the seat. You put your hands on the steering wheel. Modern cars are, you know, can collect your heart rate from the steering wheel. You then are looking ahead. Your, your face, there's a camera that's like looking at your face. And people say, what? How's that possible? But if you've ever gotten the attention alert from a modern car, right? That's because it's scanning your face to see are your eyes on the road? And are you focused and paying attention?

• 3:21Speaker 02

  So you pull into the gas station. The gas station owner likes to make sure that they know what goes on on their property. So they have surveillance camera. That surveillance camera picks you up, but they have a contract with the camera vendor. So they're getting the footage, but a camera vendor is also getting that footage. It's in the cloud. And as AI systems advance, more and more insights can be gleaned. And those insights can be like, who is the person? What is their emotional state as they're looking at something? What are they wearing? What's the significance of that?

• 3:57Flora Lichtman?

  And then I guess I could be marketed to very effectively.

• 4:00Speaker 02

  That's exactly it. At the end of the day, this surveillance is something that has been termed by a brilliant professor, Shoshana Zuboff, Surveillance Capitalism. And Surveillance Capitalism is just that. Like you make money when you know information about people because you can target them so specifically. The problem is that it's not the the massive quantities of data that are collected about you aren't just from walking into stores. I think it's important that we recognize what's being collected about you is often occurring through apps on your smartphones and your other devices.

• 4:41Speaker 02

  The software embedded in there is collecting of just all kinds of data. And that data is valuable, yes, to market things to you, but it's also valuable for insurance companies. Insurance companies want to know what's your health like, right? Are you a more expensive risk to insure? Financial entities want to know all kinds of information about you because they're going to factor that into the rates that you're charged for, say, a credit card or even for, you know, a mortgage. So you have all of these private entities that collect all of this data, much of it biometric data.

• 5:22Speaker 02

  And all of that data gets aggregated and it gets put into what it becomes what we call commercially available information. And it ends up in a massive data market where data brokers are constantly buying and selling it. Your data is money and it's worth a lot of money because it tells us so much. The the, I guess, the underside that's a little more concerning and dangerous is that law enforcement can access that data by buying it. And we have example after example of data brokers and private companies having contractual relationships with federal, state, and local law enforcement agencies to sell that data.

• 6:08Speaker 02

  So it's both your data is being collected to to make money off of you so you can be targeted for advertising. It's being collected so it can be sold to many players, but those players can include law enforcement. So it's a market that's incredibly unregulated as well. You know, the US, we're just behind on data privacy regulation.

• 6:33Flora Lichtman?

  Right, right. I mean, we've talked about this with other types of data on the show, but you know, I think people have this sense, myself included, or had this sense, that the sort of amount of data in the data set automatically gives people some anonymity. You know, like, how would it be possible to compile all of these separate data streams for everybody? Is that true anymore?

• 6:58Speaker 02

  Yeah. No, that's, it's not true anymore because of the power of AI. The ability to, you know, analyze just mind-bogglingly astonishing amounts of information to glean insights about a particular person and target that specific person. Micro-targeting, right? Micro-advertising is something that occurs almost instantaneously. And it's, you know, it's AI systems that enable that. And I think that's really hard for the average person to wrap their brain around. They think, oh, I'm safe because it's just really data about everyone. But that's just not the case.

• 7:38Speaker 02

  You know, as a retailer could collect information, or really, anyone who wants to buy it could collect information about, I want information on all the people who, like this particular band, are gender fluid and shop in this store. That's how specific you can get. And that ability to identify very specific, you know, traits about persons and to target specific persons is no longer a complicated process. It is an instantaneous process in data analytics.

• 8:17Flora Lichtman?

  How do these systems identify me personally? You know, after a picture of me is taken, is it compared to some big database somewhere of photos? How does that work?

• 8:28Speaker 02

  Yeah, it depends. Um, uh, different companies have what we we term face banks. And it's not just different companies that have face banks. Law enforcement has face banks. And those face banks help them to identify. So let's say a flock camera picks up a group of people at a protest. Law enforcement can take that footage and compare it to massive existing face banks that they have. So think about your everybody's driver photo, everybody's social media activity.

• 9:04Flora Lichtman?

  Your social media activity could land you in a face bank.

• 9:07Speaker 02

  Oh, yes, because it's publicly available information that can be scrubbed.

• 9:12Flora Lichtman?

  It can just be read and slurped up.

• 9:15Speaker 02

  Correct. And that's the thing about agentic AI, right? These generative AI systems, they just go around and scoop up the data.

• 9:24Flora Lichtman?

  You know, I think a lot of people might have this temptation to think like, well, I have nothing to hide. So therefore I'm not going to worry about this. You're a lawyer. I'm sure you have a thought on this.

• 9:37Speaker 02

  First of all, I have nothing to hide. Well, if laws change, like if from a criminal perspective, you know, think about what happened with Dobbs. Overnight in some states, activity that was lawful the day before became unlawful. So the criminal piece of it isn't, you know, is is a real significant issue. But what it's not appreciating is, well, um, did you have two donuts? And you're having two donuts every morning? Does that mean your insurance premiums should be higher? You should pay more for healthcare? And an employment search, right? Like employers now want to know.

• 10:18Speaker 02

  And there's companies that make so much money selling to employers searches, background, instantaneous background searches on potential employees.

• 10:29Speaker 02

  And that includes your social media activity. That can include posts and things you said. Data brokers know what your, you know, what your sexual preferences are. Data brokers know what your faith is or your spiritual state is. They know what kind of books you like to buy. They know what kind of music you listen to. It's, it's not about, are you going to go to jail for this now?

• 10:54Flora Lichtman?

  What do we do, Anne, in 30 seconds?

• 10:57Speaker 02

  We need to have effective data privacy regulation. You know, it, that the United States is the United States and doesn't have that at a federal level leaves us alone among the world's nations. And finally, you know, as citizens, you know, we do have rights. We have a fourth amendment that protects us from unreasonable searches and seizures. And we should not allow these loopholes simply to profit tech.

• 11:30Flora Lichtman?

  Anne, thank you so much for coming on the show today.

• 11:33Speaker 02

  Thanks. It was a pleasure talking with you.

• 11:36Flora Lichtman?

  Anne Toomey McKenna is an attorney specializing in privacy and biometric surveillance. She's also affiliate faculty at the Penn State Institute for Computational and Data Sciences. This episode was produced by Annette Heist. Just look for me on your Ring Cam. I'll be wearing that hat that said Rate and Review Science Friday. No, seriously, please help us out so I don't actually have to do that. Thank you for listening. I'm Flora Lichtman.