Credit Card Metadata: Not As Anonymous As You Think

Consumers are well aware of the sensitivity of their financial information, but it’s still surprising to learn how much one can glean from seemingly useless details. MIT researchers demonstrated that data containing no personal information can still be linked back to a person’s identity.

Identifying Customers From a Few Simple Facts

An MIT study published in the journal Science revealed that it takes very little information for one to identify an individual. With the date, location, and price of four credit card purchases, researchers could identify 90 percent of the individuals in a pool of 1.1 million shoppers.

Making the data less precise helped only marginally. Given a time range of a week and a pool of 150 stores in a general area rather than the specific location, the data still made it possible to identify over 70 percent of users. When price was eliminated from the equation, researchers could still identify over 40 percent of the individuals.

Why the Information is Valuable

Credit card metadata containing information on your purchase history may seem insignificant at first glance, but this data is extremely useful to the right people. Marketers can use this information to better understand their customer base. It tells them which products are most popular, how placement impacts sales, and how purchase trends change over time. Metadata is also valuable to law enforcement agencies, as it has the potential to help them identify criminals. Metadata carries great potential, but customers aren’t always comfortable with sharing it.

Australia’s Data Retention Plan

Australia has passed data retention laws that will collect and retain data on customers for law-enforcement purposes. The legislation passed 43 to 16, but not everyone is confident about the new laws. Senator Ludlam said he will be “building the case, from today, for the repeal of this legislation.” Though the purpose of the legislation is to increase public safety, many see it as a breach of privacy for all citizens.

Risks to Revealing Customer Data

Privacy is a hot button issue, particularly in America where 90 percent of people feel they have lost control of their personal information. A fact sheet released by the Office of the Press Secretary warns that consumers who fear for their anonymity and privacy may contribute to a less productive economy. Their concerns over data protection can lead to less interaction with technology and slower innovation.

The vulnerability of consumer data is nothing new. A 2013 study revealed that our cell phone use makes us easily identifiable as well. Four spatiotemporal points collected from cell phones by carrier antennas can identify 95 percent of individuals. One Tweet carries 150 points of metadata. Information is readily available to most anyone who knows how to find and use it.

Where the U.S. Government Steps In

The United States government does take steps to protect consumer data. The Personal Data Notification & Protection Act is a legislative proposal that would criminalize overseas trade in identities. It would also require a 30-day notification for the discovery of a data breach. Another legislative proposal, The Student Digital Privacy Act, strives to protect data collected from students in the course of using tech-based educational programs.

There are a growing number of services that make credit scores available to consumers for free. These make it easier for customers to keep a close eye on how their most personal information is used, giving them the ability to spot identity theft and fraud early.

How You Can Protect Your Anonymity

If you’re uncomfortable with the idea of the government or marketers gathering your data and tying your purchasing trends back to you, there are steps you can take to increase your anonymity and shop safely. Tokenization is a new payment technology that creates a proprietary token for each purchase, making it more difficult for researchers to link your purchases to one another. Apple’s Apple Pay uses this technology. The individual tokens are useless since they’re designed for one-time use, unlike a credit card number that’s used again and again.

Keeping data private is increasingly difficult in our digital age, where everything from your online activity to app purchases paints a virtual picture of who you are for marketers and others interested in the data. Staying ahead of the trends will help you make smart choices to keep your information safer.