It's scary how much each candidate in the upcomingknows about you. And it's all information you've willingly given up over time.
The trove of data goes beyond voter registration information like your name, home address and date of birth. Thanks to an army of data crunchers who marry that information with data you drop at a clothing or automobile site, many candidates often have intimate knowledge of who you are and whether you're likely to support them.
The increasingly effective use of big data to create targeted political ads is one of the main causes for the climbing costs of running a campaign. Spending on this year's midterms is about to pass $5 billion, making it a billion dollars more expensive than the 2016 presidential election, according to the Center for Responsive Politics.
The political-data industry has raked in millions of dollars selling voter information to campaigns and political organizations, and this year's races signal continued big business. And it's a largely unregulated industry.
Facebook's data scandal involving consultancy Cambridge Analytica shed light on how companies can take personal information we give away and transform it into highly effective targeted ads. Data was used to help sway the 2016 US presidential elections, one of the most dramatic examples of a practice that's been around for much longer.
While you may be aware your data is being used, you might not know the full extent of the process. So we dug in to find out how data goes from your voter registration form to data brokers and back to you in the form of a political ad.
Voter data in America
You start giving away personal information when you register to vote.
That information is added to a database each state keeps, thanks to the Help America Vote Act. The legislation required states to maintain centralized, computerized voter registration databases to help election administrations keep track of eligible voters.
In some states, the information can be obtained free. Other states charge, with fees ranging from $2.50 in Arkansas to $30,250 in Alabama. The data includes, at a minimum, your full name, address, voting history and jurisdiction. Some states, such as Florida and Texas, include more information, like date of birth, phone number or race.
This map details the level of access to your information by each state.
All states allow access to voter data for election purposes, which usually lets political campaigns request voter files from state authorities. Companies can also request the information, if it's being used for political purposes.
Campaign software companies, like NationBuilder, turn to state offices to keep their voter files updated.
"NationBuilder works with state offices [secretaries of state] across the country to acquire each file, standardize the data for easy use for all those running for office and regularly update the information to include current voter registration and recent elections," Sorcha Rochford, an enterprise account manager at NationBuilder, said in an emailed statement.
The rules differ when it comes to uses of voter data for purposes other than elections. California, New York, Nebraska and others have specific laws limiting who can access the data and what it can be used for. Many states don't allow commercial use of voter information. Vermont specifically prohibits sharing voter data with foreign governments and agencies.
However, Alabama, Alaska, Florida and some others have no restrictions. Anyone can request the data for any purpose.
In the hands of data brokers
Voter information alone, however, isn't that helpful. That's where data brokers come in.
You've probably heard of the term Big Data, the ability to make sense of huge amounts of data. Data brokers do that when they link your voter information to information you've submitted on retail sites. That isn't hard, because the personal information you provide for voter registration is likely the same as what you give to online merchants. This enables data brokers to match your purchases, your house and your car to you.
Consumer data comprises all sorts of odds and ends of varied importance, including property ownership, marital status, wealth and income, all of which provide a high-level picture of you. It can also include magazine subscriptions, club memberships and other granular information that gives a sense of your interests.
"When we interact with any entities online, they keep logs of our trails," said Augustin Chaintreau, a computer science professor at Columbia University. "If you visit a site that sells shoes, and then you see similar shoes on another site -- that information is shared between firms."
Companies can also identify you by tracking the browser you use, according to Chaintreau.
Data companies also need to make sure their voter data is as current as possible.
Aristotle, a data mining firm founded by John and Dean Aristotle Phillips in 1983, uses phone and utility records to verify when someone moves from one jurisdiction to another. That helps campaigns engage with new residents, Aristotle representatives said during a public webinar hosted on Oct. 3. Aristotle also flags swing voters, tracks specific registered voters to see if they actually voted, and tells campaigns which voter is more likely to pick up the phone.
Aristotle didn't respond to a request for further comment.
The next step is to take all that voter and consumer information and combine it with data gleaned from surveys that are often sent to your smartphone.
PredictWise, a political data analytics startup, is building a database that collects more than 25,000 responses to smartphone surveys every month. On top of buying up credit card and spending data, it partners with device engagement companies, such as Pollfish, that administer in-app surveys to randomly selected groups of app users, often based on age ranges. That's what those survey pop-ups you get on your phone are.
"We're literally tracking 250 million Americans," said Tobias Konitzer, co-founder of PredictWise. "We use voter data to give us details on an individual level."
Pollfish partners with more than 150,000 app makers, and the company can target people with specific apps like Amazon and Facebook, according to Michael Harbolt, vice president of marketing at Pollfish.
"With pollsters, we accurately predicted Brexit, the 2016 election and the winners of the last three special elections," Harbolt said.
Device engagement companies can reach millions of Americans every day, says PredictWise's Konitzer, who uses the results to build a profile of you.
For example, those companies can estimate your level of education by looking at what kind of phone apps you use. If you have newspaper apps like The Wall Street Journal and The New York Times, you're probably educated. At the other end of the spectrum are users who only have apps like Candy Crush Saga.
The companies didn't detail how they know which apps are on your phone.
They also scrape data from social networks, like Facebook.
Campaigns use this information to figure out where you likely stand on any given issue.
For example, i360, a firm owned by the Koch brothers, has a tool called Issue Cluster Model. Based on voter records and on consumer and social data, it generates a score that rates an individual's likelihood to support or oppose an issue, such as taxes or gun control.
i360 didn't respond to a request for comment.
Once your personal information is crunched, hundreds of political entities, including local, state and federal campaigns, buy it from the data brokers and campaign software firms.
"It takes a lot of money to run data-driven campaigns, so that favors rich candidates," said Colin Bennett, a politics and privacy expert and professor at the University of Victoria in Canada. That can be problematic, he says, if politicians use the data to simply parrot what voters want to hear.
During the 2017-18 election cycle, i360 raked in $3.4 million from campaigns, according to Federal Election Commission records obtained by Open Secrets, a nonprofit and nonpartisan group that tracks the effect of money and lobbying on elections and public policy.
Some of i360's bigger clients include the Republican Party of Massachusetts, the campaign of Mississippi Sen. Roger Wicker and Arizona Grassroots Action, a Republican PAC, according to Open Secrets.
Aristotle received over $3 million, with top clients like the campaigns of California Rep. Devin Nunes and New York Rep. Eliot Engel, as well as Argentum Silver PAC, a nonpartisan organization promoting issues for seniors.
NationBuilder received more than $1 million, from political entities including Donald J. Trump for President, Prosperity Action and the Republican Party of Tennessee.
That personal touch
The ultimate purpose of collecting and analyzing big data is to advertise the right political message to the right voters. So all of that information comes back to you in the form of social media and TV ads, phone calls or a knock on the door.
For example, i360 partners with social media and technology companies to deliver tailored ads to individuals, according to its website. It also partners with D2 Media Sales, a joint venture between DirectTV and Dish, to push TV ads to specific households that meet a candidate's criteria "no matter which stations or programs they're watching." This means some audiences see a specifically tailored political message.
D2 Media Sales, DirectTV and Dish didn't respond to requests for comment.
Besides targeted advertising, i360 offers Walk, an app that directs door-to-door campaign volunteers in real time, letting them see who lives in a specific house and what household information is available about the residents.
The data firm also offers tools to help political campaigns make robocalls and send text messages. In addition, it can target specific users on Facebook.
Alan Mislove, a professor at Northeastern University, found that you can target a specific individual for an ad.
Advertisers can upload a list of 15 different fields on Facebook's advertising platform -- phone number, name, date of birth, address and more -- and the social network then matches that information against its user base of more than 2 billion people. If your information matches, you become part of that audience, Mislove said. Facebook will tell advertisers how many users they've matched, but it doesn't provide those users' names, he said.
A Facebook spokesperson confirmed that campaigns can upload their lists of targeted voters and show the ad specifically to them. He also said you can delete the contact information you've uploaded, and that Facebook is reviewing how it uses contact information for ads.
On Monday,by President Donald Trump's re-election campaign that targets voters in Arizona and Florida. The video ad reportedly featured a cop-killer who was deported several times, and a message that says "America cannot be allow this invasion. The migrant caravan must be stopped. President Trump and his allies will protect our border and keep our families safe."
The ad was taken down because it violated the social network's rules against "sensational content."
Facebook and Twitter are trying to be more transparent. In May, they began labeling political ads so that you can see who paid for them and how much they paid. You can also search an ad in Facebook's Ad Archive.
Is all of this legal?
Have you clicked on "Accept" or "Continue" when you see a cookie notification on a website?
Then yes, this is all legal.
When it comes to voter data, however, some states specify that it can't be used for commercial purposes. Still, a lot of data firms can get their hands on voter information and profit.
The Federal Trade Commission, the US government's consumer watchdog, produced a report on data brokers in 2014 and recommended that Congress require greater transparency from the data industry. Congress hasn't passed any legislation in response to this report.
"Under US [federal] law, regulations are on credit agencies, but [there's] no regulations on data brokers," said Steven Bellovin, a privacy expert and computer science professor at Columbia University.
There's also little regulation on political campaigns.
"The US has a lot of policy laws that may not touch political campaigns," said Joseph Jerome, policy counsel at the Center for Democracy and Technology. Jerome said that there's no infrastructure in place on regulating political campaigns, such as who watches over the use, sharing or protection of voter data by candidates and committees.
Generally, states don't have the resources to keep track of where the data goes after purchase.
Vermont, for example, prohibits the sharing of voter files to foreign governments and agencies, but the state doesn't keep track of data after it's been requested, according to Will Senning, the director of elections and campaign finance for the Vermont secretary of state. He said the state relies on illegal activity being reported before they investigate.
Sometimes voter information gets leaked online.
Earlier this month, researchers found hackers selling 35 million voter records from 19 states on the dark web, according to a report from Anomali Labs. The hackers charged between $150 and $12,500 for statewide voter lists.
In July, Virginia-based political campaign and robocalling company RoboCent left hundreds of thousands of voter records online without protection, according to ZDNet. A RoboCent spokesperson told CNET in July that the company partners with data firms NationBuilder, Aristotle and i360 for voter data.
"The very politicians who fight for consumer data are also using it and not responsible for [where] that data goes to after campaigns," said Kim Alexander, founder and president of California Voter Foundation. "If the government collects all this info on people, they need to protect it."
First published on Nov. 1, 5:00 a.m. PT.
Updates on Nov. 2, 7:42 a.m. PT: Adds more information from Facebook.
Updates on Nov. 5, 7:49 a.m. PT: Adds new report that Trump's campaign is targeting voters in Arizona and Florida with an anti-immigration video ad on Facebook.
Election security: Everything you need to know about election security in the 2018 US midterm elections.
Security: Stay up-to-date on the latest in breaches, hacks, fixes and all those cybersecurity issues that keep you up at night.