N.J. data broker tried to sell personal info on a million kids but didn’t tell state officials

A New Jersey company that collects and sells personal information about consumers told regulators that it did not knowingly possess data on minors, even as it advertised a mailing list of more than a million high school students for sale on its website.

ALC Inc., a Princeton-based company, failed to acknowledge the possession of data on minors as required to comply with a Vermont law, the first of its kind in the country.

The Vermont law seeks to shed light on a multibillion dollar market populated by such companies as ALC that collect and sell personal information about millions of consumers. The information they sell could include names, addresses, hobbies, and income data. These companies don’t have a direct relationship with consumers, who are often unaware that their information is being sold and have no say in how it is used.

ALC registered as a data broker in Vermont in January to comply with the law enacted after the massive Equifax data breach that exposed the personal information on 145 million Americans. Among other provisions, the new law required data brokers to disclose whether they knowingly possess data on people under age 18.

On its registration form with Vermont, ALC declared it “has no knowledge nor do we allow the collection or use of data on any persons under the age of 18.” The form was dated Jan. 31.

But the company explicitly offered to sell data on 1.2 million students aged 14 to 17, including their names, addresses, high schools, and hobbies, according to an advertisement on its website. The firm also offered parents’ names, household incomes, and ethnicity, among other information. The starting price for the data was $100 per thousand records.

If ALC is found to have flouted Vermont’s law, the New Jersey company could have the unique distinction of being the first firm to violate the nation’s first data broker law.

The advertisement, which was taken off ALC’s website after The Inquirer asked about it, said the student list was last updated Dec. 20, 2018 — six weeks before the company told Vermont officials that it did not knowingly possess data on children.

“Ether they’ve filed a false declaration with the state or their advertising to the industry is fraudulent. One or the other is not true,” said Joel Reidenberg, a Fordham University law professor who co-authored a report on the opaque student data broker industry.

In an email, ALC chief marketing officer Sherry Booles said the company is “reviewing this information and will update our Vermont registration as needed.”

“Thank you for calling this to our attention,” wrote Booles, who signed ALC’s registration form with Vermont. “We have removed the products you have inquired about from our website while we review this matter.”

Although the Vermont law is new and has not been tested in court, the Vermont Secretary of State’s Office said it believes that falsifying a registration document would fall under the state’s perjury statute, which carries penalties of up to $10,000 or 15 years in prison. However, Deputy Secretary of State Chris Winters said he could not recall a prosecution over a business registration form in his two decades at the agency.

“Our duties are largely ministerial, and as such we do not have the authority or resources to investigate or enforce this law,” Eric Covey, chief of staff at Vermont’s Secretary of State’s Office, wrote in an email. He said the agency may refer complaints to the attorney general’s office.

ALC, formerly known as American List Counsel, is headquartered in Princeton and has offices in New York, Minnesota, Texas and California, according to the company’s website. Founded in 1978, the firm bills itself as the “leading privately held direct and digital data marketing services provider.” Clients include American Express, Gannett, MetLife, and Neiman Marcus, according to ALC.

Donn Rappaport is the company’s chairman and Susan Rappaport is president, according to ALC’s website, which says the firm first opened its doors in the Rappaports’ basement.

The firm offers much more than data on high school students. It sells data on pregnant women, grandparents with disposable incomes, and consumers who seek cheap prescription drugs, according to its website. The company’s slogan is “Make it personal.”

ALC also advertised mailing lists for subscribers of Seventeen magazine, a publication geared toward teenage girls. The advertisement for Seventeen magazine consumer data was removed from the ALC website after The Inquirer asked about that list, too.

The company said its high school student list was compiled using “sophisticated web-crawling and linkage technology” and “best-of-breed national consumer information,” according to the now-removed advertisement.

“This core student data is obtained via a multitude of different sources, including public profiles from social media sites, local news publications and websites, high school sports websites, and membership sites,” the ad said. “It is then linked to postal addresses utilizing top national consumer data and linkage powered in part by LexisNexis.”

ALC said the list of 1.2 million student records is “frequently being refreshed, verified, and validated,” with 30,000 records added each month. The company promised more records as “students matriculate out of high school and are replaced by junior high students just entering.” An update was scheduled for May, the ad said.

The firm pitched the list of 14- to 17-year-olds to marketers as a “uniquely sourced data set [that] has never been available before” that “covers a traditionally hard-to-find marketplace.”

ALC would not say which industries typically buy high school student data.

Reidenberg, the Fordham law professor, said student data buyers generally include colleges soliciting applications. That makes up a large part of the market that tends to be more transparent than other segments, such as summer camps and scholarship scammers, he said.

“It ranges from those that are looking to reach kids for legitimate educational purposes and those looking to reach kids for more crass commercial interests,” Reidenberg said.

Reidenberg co-authored a report published in June that examined the student data broker industry. Researchers from Fordham’s Center on Law and Information Policy found it was difficult to identify student data brokers, as companies often change names or merge with other firms. The center could identify only 14 data brokers who conclusively sell or advertise the sale of student information or have done so in the past. ALC was not one of them.

The Fordham researchers called for more transparency and regulation in the student data market, suggesting a model like the federal Fair Credit Reporting Act, which specifically applies to “consumer reporting agencies” that assemble reports used to evaluate eligibility for credit, insurance, or employment.

“A parent or student should be able to know who is selling student information, how student information is being used and sold, and the sources of the data,” the report said. “If data brokers are selling information on students based on stereotypes, this should be transparent and subject to parental and public scrutiny.”

The Vermont law requires data brokers that knowingly possess data on minors to detail its data collection practices, databases, sales activities, and opt-out policies.

“If they’re making the declaration in Vermont that is untruthful or that contradicts what they’re publicly stating they’re doing, that can open up the organization to enforcement actions from the Federal Trade Commission and other states,” Reidenberg said of ALC.