Facebook scandal: Who is selling your personal data?

Offering handy parenting tips and £200 worth of vouchers, Emma's Diary may have seemed like the perfect website for new parents to sign up to.

But in exchange for free nappies, they also gave consent for their data to be used for a mix of advertising purposes.

It has now emerged that the data was sold to the Labour Party in 2017, even though the consent did not extend to political parties.

The site now faces a fine for misuse of personal data.

The case is part of the Information Commissioner's inquiry into political digital marketing, following the Cambridge Analytica data scandal.

What began with a look at the misuse of Facebook data has now opened a window on the complex ecosystem of online advertising, and thrown light onto the opaque world of data brokerage.

Data has been described as the "new oil" and data brokers play a huge role in extracting value from our personal information in all its forms.

They collect it from hundreds of sources, including census information, surveys, public records and loyalty card programs.

They then sell that information to other organisations.

One researcher, writing about the role of data brokers back in 2014, described the entire industry as "largely invisible".

It is an industry that has to date been unregulated, although the introduction of the General Data Protection Regulation (GDPR) in the EU did put more onus on "data controllers" to ensure users understood how their information was being used.

Acxiom and Experian are probably the best-known data brokers - and they make a lot of money.

In the 2018 financial year, Acxiom is expected to make around $95m (£71m) and was recently bought by media advertising giant IPG.

But there are thousands of smaller players in the industry, alongside apps and websites that sign up users for one purpose, asking for consent to use their data, which is then sold on to advertisers.

As part of its inquiry, the Information Commissioner's Office (ICO) investigated Experian, Lifecyle Marketing (the owners of Emma's Diary), CACI and Data8.

Digital campaigning is now hugely important for political parties. It involves diving into often complex relationships with data brokers and data analytics firms.

In Facebook's case it had three data broker partnerships - with Acxiom, Experian and Oracle Data Cloud. It also allowed political parties to target an audience by gender, location, interests and behaviours and it offered what it called its Partner Categories service, allowing advertisers to draw on information compiled by the data brokers.

This data allowed the political parties to further refine their targeting, based on information such as whether a person owned their own home, whether they were looking to buy a new car or whether they were a loyal customer of a particular brand.

For example, an advertiser wanting to target new mothers could use information gleaned from data brokers about those who had recently bought baby products using a store rewards card.

Facebook has now said it will end this practice, which had been one of the key methods marketers used to link users' Facebook data about their friends and lifestyle with their offline data about their families, finances and health.

Privacy International has described the scope and scale of the ICO's investigation as "mindboggling".

"It shows that data exploitation is rampant and systemic. This goes way beyond Facebook, or a single ruthless company."

The whole industry is now feeling decidedly nervous, said Paul Wright, chief executive of the digital advertising platform Iotec.

"I think it was fair to say that the digital marketing industry got a wake-up call with the introduction of GDPR, and this ICO inquiry will remind people that we have a regulator that has teeth, which will worry some of the bad players in the industry."

Gareth Oldale, a partner at law firm Sharpe Pritchard, thinks the ICO investigation will force websites such as Emma's Diary to rewrite their privacy policies.

"The ICO's view is that simply signing up for a website and giving consent to your data being used is not enough, if it is never made clear that it may be shared with political parties.

"It will no longer be acceptable if individuals sign up to a website for a particular purpose, and they then re-use data for a completely different purpose," he told the BBC.