How Businesses Are Collecting Data (And What They’re Doing With It)

Types of consumer data businesses collect

The consumer data that businesses collect break down into four categories:

1. Personal data. This category includes personally identifiable information such as Social Security numbers, date of birth and gender, as well as nonpersonally identifiable information like browser fingerprints, IP addresses, web browser cookies and device IDs (which both your laptop and mobile device have).
2. Engagement data. This type of data details how consumers interact with a business’s website, mobile apps, text messages, social media pages, emails, paid ads and customer service routes.
3. Behavioral data. This category encompasses transactional details such as purchase histories, browsing patterns, product usage information (e.g., repeated actions), session recordings and qualitative data (e.g., mouse movement information and heat mapping).
4. Attitudinal data. This data type includes metrics on customer satisfaction, purchase criteria, product desirability, brand perception and customer feedback scores.

How do businesses collect your data?

Companies capture data in many ways from many sources. Some collection methods are highly technical, while others are more deductive (although these processes often employ sophisticated software).

The bottom line, though, is that companies are using a cornucopia of collection methods and sources to capture and process customer data on metrics, with interest in types of data ranging from demographic data to behavioral data, said Liam Hanham, data science manager at Workday.

“Customer data can be collected in three ways: by directly asking customers, by indirectly tracking customers, and by appending other sources of customer data to your own,” said Hanham. “A robust business strategy needs all three.”

A good starting point from which to source data is user activity on your website and social media pages. You can also gather data through customer phone calls and live chats. Many businesses also leverage zero-party data — information that customers voluntarily share through surveys, preference centers and loyalty programs. [Make sure your company has the best business phone system to improve communications with your customers.]

More sophisticated methods have gained popularity, too. One example is geofencing and location-based advertising, which uses tracking technologies such as an internet-connected device’s IP address (and the other devices it interacts with — your laptop may interact with your mobile device, and vice versa) to build a personalized data profile. This information is then used to target users’ devices with hyperpersonalized, relevant advertising.

Companies also dig deep into their customer service records to see how customers have interacted with sales and support departments in the past. Here, they are incorporating direct feedback about what worked and what didn’t, what a customer liked and disliked, on a grand scale.

Besides collecting information for business purposes, companies that sell personal information and other data to third-party sources have become commonplace. Once captured, this information regularly changes hands in a data marketplace of its own. 

Turning data into knowledge

Capturing large amounts of data creates the problem of how to sort through and analyze all that information. No human can reasonably sit down and read through line after line of customer data all day long — and even if they could, they probably wouldn’t make much of a dent. Computers, however, sift through this data more quickly and efficiently than humans, and they can operate around the clock without taking a break.

As machine learning algorithms and other forms of AI proliferate and improve, data analytics becomes an even more powerful field for breaking down the sea of data into actionable insights. Advanced AI programs now use natural language processing and predictive analytics to flag anomalies or offer recommendations to decision-makers within an organization based on the contextualized data. According to McKinsey & Company, companies that leverage customer analytics extensively are 23 times more likely to outperform competitors in customer acquisition.

How do businesses use your data?

There are several ways companies use the consumer data they collect and the insights they draw from that data.

1. Improve the customer experience

For many companies, consumer data offers a way to better understand customer needs and boost customer engagement. When companies analyze customer behavior, as well as vast troves of reviews and feedback, they can nimbly modify their digital presence, goods or services to better suit the current marketplace.

Not only do companies use consumer data to improve consumer experiences as a whole, but they also use data to make decisions on an individualized level, said Brandon Chopp, digital manager for iHeartRaves.

“Our most important source of marketing intelligence comes from understanding customer data and using it to improve our website functionality,” Chopp said. “Our team has improved the customer experience by creating customized promotions and special offers based on customer data. Since each customer is going to have their own individual preferences, personalization is key.”

2. Refine a company’s marketing strategy

Contextualized data can help companies understand how consumers are engaging with and responding to their marketing campaigns, and adjust accordingly. This highly predictive use case gives businesses an idea of what consumers want based on what they have already done. Like other aspects of consumer data analysis, marketing is becoming more about personalization, said Brett Downes, director at Haro Helpers.

“Mapping users’ journeys and personalizing their journey, not just through your website but further onto platforms like YouTube, LinkedIn, Facebook or on to any other website, is now essential,” Downes said. “Segmenting data effectively allows you to market to only the people you know are most likely to engage. These have opened up new opportunities in industries previously very hard to market to.”

3. Transform the data into cash flow

Companies that capture data stand to profit from it. The global data broker market is expected to reach $512.45 billion by 2033, according to Grandview Research. Data brokers, or data service providers that buy and sell information on customers, have risen as a new industry alongside big data. For businesses that capture large amounts of data, collecting information and then selling it represent opportunities for new revenue streams.

This information is immensely valuable for advertisers, and they’ll pay for it, so the demand for more and more data is increasing. That means the more disparate data sources data brokers can pull from to package more thorough data profiles, the more money they can make by selling this information to one another and to advertisers.

4. Secure more data

Some businesses even use consumer data as a means of securing more sensitive information. For example, banking institutions increasingly use biometric authentication including voice recognition and facial scanning to authorize users to access their financial information or protect them from fraudulent attempts to steal their information. The Federal Trade Commission reported that consumers lost $10 billion to fraud in 2023, making security measures more critical than ever. 

These systems work by pairing data from a customer’s interaction with a call center, machine learning algorithms, and tracking technologies that can identify and flag potentially fraudulent attempts to access a customer’s account. This takes some of the guesswork and human error out of catching a con.

As data capture and analytics technologies become more sophisticated, companies will find new and more effective ways to collect and contextualize data on everything, including consumers. For businesses, doing so is essential if they want to remain competitive well into the future; failing to do so is like running a race with your legs tied together. Insight is king, and insight in the modern business environment is gleaned from contextualized data.

Data privacy regulations

So much consumer data has been captured and analyzed that governments are crafting strict data and consumer privacy regulations designed to give individuals a modicum of control over how their data is used. Below are several prominent consumer privacy regulations.

European Union General Data Protection Requirements

The European Union’s General Data Protection Requirements (GDPR) lays out the rules of data capture, storage, usage and sharing for companies. GDPR regulation and compliance doesn’t just matter for European countries — it’s a law applicable to any business that targets or collects the personal data of EU citizens.

California Consumer Privacy Act

Data privacy has expanded across the U.S. in the form of the California Consumer Privacy Act (CCPA). The CCPA is similar to GDPR regulation but differs in that it requires consumers to opt out of data collection rather than putting the onus on service providers. As of 2023, the CCPA has been amended by the California Privacy Rights Act (CPRA), which adds new consumer rights including the right to correct inaccurate personal information and limits the use of sensitive personal information. It also names the state as the entity to develop applicable data law rather than a company’s internal decision-makers.

Virginia Consumer Data Protection Act

The Virginia Consumer Data Protection Act (VCDPA) went into effect on January 1, 2023. As with the CCPA, the VCDPA puts the onus on consumers to opt out of companies processing or selling their data. The VCDPA also requires companies to store only data relevant to their goals and then delete that data once the goal has been achieved. Any companies to which the VCDPA applies must inform consumers of their rights under the law and how to exercise them.

Colorado Privacy Act

The Colorado Privacy Act (CPA) went into effect on July 1, 2023. As with the CCPA and the VCDPA, the CPA requires consumer opt-out. The CPA covers targeted advertising and certain types of data-based profiling as well. Data-holding entities are required to address consumer requests within 45 days and display privacy notices on their websites.

Additional state privacy laws

As of 2024, multiple additional states have enacted comprehensive consumer privacy laws. These laws generally grant consumers rights to access, delete and opt out of the sale of their personal data. 

Connecticut’s data privacy law took effect July 1, 2023, followed by Utah’s on December 31, 2023. 

Texas and Oregon’s data privacy laws went into effect in July 2024, followed by Montana’s Consumer Data Privacy Act on October 1, 2024.

In 2025, more states saw data privacy laws take effect, including Delaware, Iowa, New Jersey, New Hampshire and Tennessee. 

What do consumers think of business data collection?

According to a 2023 Pew Research Center study, 73 percent of Americans believe they have little to no control over what companies do with their data, and 67 percent have no idea what businesses do with it. The study also found that 81 percent of Americans are very or somewhat concerned about how that data would be used.

The Pew study also found that while 78 percent of respondents trust themselves to make the right decisions about their personal information, 61 percent felt skeptical that anything they do will make much difference. Additionally, 37 percent reported feeling overwhelmed by figuring out what they need to do. Only 21 percent of respondents felt that those who have access to their data would “do what is right” with it.

The report also examined respondents’ approaches to their data security habits. Nearly 6 in 10 respondents reported frequently ignoring privacy policies, and only 18 percent of respondents said they regularly read privacy policies before agreeing to them. Password hygiene is also a challenge, with 69 percent of respondents reporting they feel overwhelmed by the number of passwords they have to keep and 46 percent say they generally create passwords that are easier to remember, even if it means they are less secure. 

Taken as a whole, the results suggest that the average consumer is both worried about their online data privacy and feels powerless to control how their information is used by businesses.

How can you protect your data?

Experts recommend taking the following steps to keep your data as private as possible.

• Block ads and trackers. The ads you encounter while browsing the internet can collect your data through cookies and pixel tracking. Many websites also include third-party trackers that can obtain your data. Browser extensions that block ads and trackers, such as privacy-focused browsers with built-in protection, can create a privacy barrier around this information.
• Use a VPN. When you browse the internet with a Virtual Private Network (VPN), you tunnel information from your device to a server. This tunneling masks your IP address and browsing activity, putting up a wall between businesses and your data. The VPN will encrypt all your data as well, making it unreadable to potential interceptors.
• Reconsider free apps and platforms. Social media platforms are free because they sell your data to make a profit. The same may be true for any free app. That’s a reason to avoid free apps or limit your free app usage to solely those from reputable companies. For example, the free Slack mobile app is probably fine since you can pay for Slack. But a free gaming app with no paid option might be selling your data.
• Sign up for unimportant memberships with minimal information. Nobody would tell you to use false information for essential services like your health insurance plan. But that’s a trusted and necessary service with a revenue stream independent of your personal data. On the other hand, non-essential services — say, a streaming subscription or retail loyalty program — might sell your data. Consider using a separate email address and providing only required information to protect your privacy.
• Avoid linking your apps. Connecting your personal apps through single sign-on (SSO) features can make them more convenient to use, but these apps will also share your data with one another. Consider whether the convenience is worth the expanded data sharing, and use separate logins when possible to limit cross-platform data collection.

The future of business data use

Data privacy regulations are rapidly evolving the way businesses capture, store, share and analyze consumer data. With the rise of artificial intelligence and machine learning, companies are finding increasingly sophisticated ways to process and utilize consumer information. 

Businesses that are so far untouched by data privacy regulations can expect a greater legal obligation to protect consumers’ data as more states enact privacy laws and consumers demand stronger privacy rights. Data collection by private companies, though, is unlikely to disappear; it will merely transform as businesses adapt to new laws, implement privacy-by-design principles and develop more transparent data practices that balance business needs with consumer privacy expectations.

Adam Uzialko contributed to this article. Source interviews were conducted for a previous version of this article.