Quantifying Use and Abuse of Personal Information

Once shared, our personal information on the Internet is no longer private. We routinely receive emails from companies that we have not had any known interaction with, and are receiving an increasingly large volume of spam phone calls. In this paper, we describe interim results from an experiment designed to quantify who is using and distributing our personally identifying information (PII). To do this, we set up 300 fake identities, each with an email address and around half with a live phone number, and performed one-time online interactions with 188 distinct companies. Over a 9-month span, we received around 20,000 artifacts and found that reputable companies, surprisingly, do not sell our information in ways that we could detect, that there was no observation of undue foreign interest during the election, and that the classic “extended vehicle warranty” scam is still in active use today.