Editing LiveRamp (section)

==Incidents==

===2003 Data breach (as Acxiom)===
In 2003, LiveRamp's predecessor company Acxiom experienced a massive data breach involving 1.6 billion personal records.<ref name="wiki-liveramp" /> The breach occurred during data transmission between Acxiom and its clients via an FTP server located outside the company's firewall.<ref name="privacy-int-hack">{{cite web |url=https://privacyinternational.org/examples/2348/acxiom-data-intercepted-hacker |title=Acxiom data intercepted by hacker |website=Privacy International |access-date=2025-05-07}}</ref> Described by prosecutors as the "largest ever invasion and theft of personal data" at that time, the incident exposed names, addresses, and email addresses of millions of consumers.<ref name="harvard" /> This breach highlighted the significant risks inherent in large-scale data collection and the vulnerability of centralized personal data repositories.<ref name="troy-hunt">{{cite web |url=https://www.troyhunt.com/data-breach-misattribution-acxiom-live-ramp/ |title=Data Breach Misattribution, Acxiom & Live Ramp |author=Troy Hunt |date=2022-11-22 |website=Troy Hunt's Blog |access-date=2025-05-07}}</ref>

===FTC complaint over military data sharing (2003)===
The Electronic Privacy Information Center filed a complaint with the Federal Trade Commission against Acxiom (LiveRamp's predecessor) and JetBlue Airways in 2003.<ref name="wiki-liveramp" /> The complaint alleged that the companies provided consumer information to Torch Concepts, a company hired by the U.S. Army to analyze how public and private records might be used to defend military bases.<ref name="privacy-int-timeline">{{cite web |url=https://privacyinternational.org/databrokerstimeline/acxiom |title=Privacy International |website=Privacy International |access-date=2025-05-07}}</ref> This occurred without consumer consent, notice, or the ability to opt out, despite Acxiom's public statements about individual choice regarding data dissemination.<ref name="wiki-liveramp" /> This incident demonstrated how data collected for commercial purposes can be repurposed for surveillance with minimal consumer knowledge or consent.

===Rejection of bulk opt-out requests (2003)===
In 2003, the for-profit privacy company Private Citizen, which helped consumers unsubscribe from telemarketing lists and direct mailings, discovered that Acxiom had begun rejecting batches of opt-out notices sent on behalf of subscribers.<ref name="privacy-int-timeline" /> Acxiom insisted that each person had to individually submit opt-out requests directly to the company, creating a significant barrier to consumers exercising their privacy rights. This practice effectively prevented many consumers from removing their information from Acxiom's databases and demonstrated how data brokers can create intentional barriers to service cancellation.

===Complaints of unlawful data processing (2024, ongoing)===
In February 2024, the Open Rights Group (ORG) submitted formal complaints to the UK Information Commissioner's Office and the French data protection authority CNIL against LiveRamp.<ref name="computerweekly" /> The complaints allege that LiveRamp's "privacy-invasive profiling" breaches European data protection laws due to the lack of a clear legal basis and meaningful transparency for data subjects. ORG claims LiveRamp's processing activities include "indiscriminate collection and processing of personal data" out of proportion to its objectives, reuse of personal data collected for other contexts, and inadequate security measures for sensitive data.<ref name="computerweekly" /> The complaint also notes that LiveRamp offers inconsistent information about its lawful basis for processing across different jurisdictions.

===Identity surveillance system allegations (2024, ongoing)===
In 2024, research institute Cracked Labs released a 61-page report detailing LiveRamp's extensive "identity surveillance system".<ref name="computing-stalker" /> The report revealed that LiveRamp maintains identity databases on 700 million consumers globally using identifiers like cookies and mobile IDs to create unique "RampIDs" for each individual, tied to their real-world identity. These RampIDs allow LiveRamp's clients to combine and link personal data across databases, track website and mobile app usage, create personal profiles, and transmit consumer records to adtech firms.<ref name="computing-stalker" /> The technology enables tracking of individuals even when they believe they are protecting their privacy, such as by not logging into sites or providing only partial information.<ref name="computerweekly" /> This sophisticated system operates largely without consumer awareness or meaningful consent.