Thread by @WolfieChristl

Ok, this is devastating. It seems that almost the whole database of People Data Labs, a MASSIVE data broker who claims to have detailed profiles on 1.5 billion people, was left open on the Internet.

https://twitter.com/haveibeenpwned/status/1197974831003619328

This is from the company's website:
peopledatalabs.com

All this data being exposed is only the final stage of the drama. The real scandal is that this company has been selling extensive data on hundreds of millions to anyone already before, largely without their knowledge.

People Data Labs has a page with detailed stats on 'their' database. It includes 91m birth dates, 413m educational records, 783m email addresses, 678m phone numbers, 809m records on work experience, 2,362m names, plus inferred salary, skills, interests etc
docs.peopledatalabs.com/docs/stats

...linked to 884 million FB accounts, 640m LinkedIn accounts, 180m Twitter accounts, 18m GitHub accounts, 5m Klout accounts, and many other social networks and databases:
docs.peopledatalabs.com/docs/social-ne…

Apparently, much of People Data Labs' data has been scraped from LinkedIn (troyhunt.com/data-enrichmen…).

But they state to have 'thousands' of other 'contributing data sources', including companies in 'HR Tech, Real Estate Tech, Identity/Anti-Fraud, Martech':
docs.peopledatalabs.com/docs/data-sour…

And I'd say even though LinkedIn data is publicly available, most users wouldn't expect that a widely unknown third-party data broker scrapes their profile data, puts it into a population-scale database, and sells it to anyone, most likely including HR tech firms and employers.

Btw. This is also why I think it was a bad decision that the EFF fighted for hiQ labs' right to build profiles on employees (eff.org/deeplinks/2019…) based on data scraped from LinkedIn.

https://twitter.com/WolfieChristl/status/986372131163459584

Coincidentally, @podehaye+@PersonalDataIO have been investigating People Data Labs in recent weeks:

https://twitter.com/PersonalDataIO/status/1197977336974630913

It's super easy for anyone to access the company's database via API. People Data Labs provides 1,000 profiles per month for 'free': dashboard.peopledatalabs.com/signup

@podehaye @PersonalDataIO How can others use their API? Just send them a name, email, phone number, school, employer name or profile url from FB, LinkedIn, Twitter, GitHub, Meetup, YouTube etc, and receive all the other data they have on this person. Easy!
docs.peopledatalabs.com/docs/quickstart
docs.peopledatalabs.com/docs/requests

@podehaye @PersonalDataIO People Data Labs also has a breakdown of the countries of their profiles. Although they claim to 'de-duplicate' data (docs.peopledatalabs.com/docs/data-build), they seem to have quite some data that is not linked to the right person. Anyway, this is a global issue.
docs.peopledatalabs.com/docs/countries

@podehaye @PersonalDataIO I'd say, everything this company does is completely illegal in the EU. I guess, there might also be legal issues in other regions, including in the US. If not, the law needs an update.
docs.peopledatalabs.com/docs/data-build

@podehaye @PersonalDataIO But make no mistake, People Data Labs is not alone. There are several similar companies, who probably have even more comprehensive data and/or have learned to sell it in less obvious ways.

For example, take a look at FullContact:

https://twitter.com/WolfieChristl/status/1174785190041772034

@podehaye @PersonalDataIO People Data Labs reminds me of RapLeaf, screenshots from 2012.

Later, RapLeaf became LiveRamp and was acquired by Acxiom. Today, LiveRamp is basically what remained from Acxiom. LiveRamp sells now identity data+matching, but mentions 'privacy' nearly 2000 times on its website.