MICHEL MARTIN, HOST:
OK. So have you ever gotten one of these letters, you know, the one that comes when a big company that you have some business with gets hacked, and your data is compromised? Millions of these go out, and they say something like, we're sorry, but you can sign up for some service to help protect you. Amanda Aronczyk from our Planet Money podcast takes a closer look at those offers.
AMANDA ARONCZYK, BYLINE: I recently got a letter from Ticketmaster that said that my data might have been stolen. I took the letter to someone who has seen a lot of these - a man named Jim Francis.
OK. So I got a letter from Ticketmaster.
JIM FRANCIS: OK.
ARONCZYK: Did you get one of these?
FRANCIS: I did not get one, but my clients got that letter.
ARONCZYK: Jim has clients because he is a lawyer at Francis Mailman Soumilas. He focuses on consumer protection, and he's working on a class action against Ticketmaster. He says that Ticketmaster did not send this letter to me just out of the kindness of their heart.
FRANCIS: The reality is some, if not all, states have a data breach notification law requiring the company to notify consumers the minute they find out that there's a breach.
ARONCZYK: I could become a victim of identity fraud, a target for phone scams. Someone could try to get a new credit card in my name.
So back to the letter. At the bottom, there is an activation code, so I can log in and get free credit monitoring from TransUnion, one of the big three credit bureaus. They'll monitor my online info, let me know if there's anything suspicious. Jim and I look at this offer together.
ARONCZYK: OK, and I have a code.
FRANCIS: Be careful.
ARONCZYK: So - yeah, should I not do this, or should I put in my activate now?
FRANCIS: Well, let's see. Hang on a second.
ARONCZYK: Yeah.
FRANCIS: Let me just look here.
ARONCZYK: Oh, this is so great to look at terms and conditions with a lawyer.
FRANCIS: Yeah.
ARONCZYK: It says right here, if you click on it, the terms and conditions below contain an arbitration agreement and a class action waiver.
FRANCIS: Yep. There you go. So you're out of the class.
ARONCZYK: So it said that if I took this free credit monitoring service, I'd waive my right to sue TransUnion. Now, we reached out to TransUnion. A spokesperson said that that arbitration waiver was posted in error. We checked later, and it was removed. And this is life on an internet powered by the buying and selling of personal data. If you don't carefully check every line of the endless fine print, you might give up a valuable right to sue. Then, Jim says, let's take a closer look at some of the other terms and conditions.
FRANCIS: Oh, by the way, by accessing CreditView dashboard, you agree that TransUnion may use and share your information.
ARONCZYK: No.
FRANCIS: Yes.
ARONCZYK: We asked TransUnion about this, too. And they said their credit monitoring service, TrueIdentity, does not sell consumers' personal information to any third party for any reason. But to log in and activate this service, I have to agree to their terms of service and privacy policy. Click the link, and it says that they may also start collecting and selling my ethnicity, my marital status, where I work, where I am, even how long it took me to fill in these online forms.
FRANCIS: You clicked into something as a result of a data breach to use their credit monitoring service, and you've just agreed for them to share all of your data and use it basically however they want.
ARONCZYK: So this time, instead of signing up for the free data monitoring service, I went online and froze my credit instead. Hopefully, for now, that will protect my personal info until the next data breach.
Amanda Aronczyk, NPR News.
(SOUNDBITE OF MARTIN REV'S "WHISPER") Transcript provided by NPR, Copyright NPR.
NPR transcripts are created on a rush deadline by an NPR contractor. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.
