Why Do They Want My Phone Number?

Dec. 16, 2005 — -- On the checkout line this holiday season, make sure you have everything on your gift list, your cash or credit card ready -- and, oh yeah, get set for one more thing.

"Can I have your phone number, please?"

"I hate that," said Larry Ponemon, a former corporate auditor who founded the Ponemon Institute, a Michigan-based think tank that studies privacy, data protection and information-security policy.

Hate it or not, more stores are asking for phone numbers or other personal information, and that has some privacy experts concerned.

"The various data companies are trying to acclimate people to invasions of privacy. It started with the zip code and now it's moved on to phone numbers," said Chris Hoofnagle of the Electronic Privacy Information Center in San Francisco. "I'm willing to bet that retailers' market research is showing a willingness of customers to share the telephone number, and that's why it's happening."

Privacy advocates advise against revealing such information, because it can be the key to accessing more sensitive information about you.

"I think a lot of stores, to be fair, they're not abusing your privacy," said Ponemon, who once audited an unspecified chain store's use of customer data and found it ethical. "But some stores are thinking there's money in your data."

Because a phone number often can be used to look up a customer's address, stores say it helps them send special offers through the mail or tailor those offers to a customer's prior purchases. Many stores have signs explaining such a policy near checkout counters. Such signs commonly add that the stores don't share their customer information with third parties.

Susan McLaughlin, a spokeswoman for Toys R Us Inc., said its stores have asked for phone numbers for several years. She believes most customers have no problem voluntarily giving their numbers at the register -- though it's "no problem at all" if they decline.

"It's so we can send you offers, coupons, et cetera, and we don't sell it to third parties," she said. "I'd say the majority of people like getting coupons."

'Hub of Customer Identification'

But phone numbers can be used to organize much more than just who gets the best coupons, and that's what worries the privacy experts.

"The telephone number is really becoming the hub of customer identification," said Hoofnagle, in San Francisco. "Consumers do not understand that giving out the phone number allows the business to buy more information about the consumer through a system known as enhancement."

Companies that specialize in enhancement can generate things like marketing profiles, credit reports or background checks on individuals. Two database companies, Acxiom and Experian, did not return calls from ABCNews.com seeking comment. A spokesman for a third, ChoicePoint, said that the company's data collection did not extend to retail stores, and that it did not index data via phone number.

"Telephone numbers are an element of the information used by ChoicePoint to verify a person's identity," spokesman Chuck Jones said. "However, none of ChoicePoint's products begin the verification process with a telephone number."

But if a store sought to gather data starting with a phone number, Hoofnagle explained how it might occur.

"The retailer sends the database company the full list of phone numbers and receives back the same list, but enhanced with demographic information -- addresses, information about interests and hobbies, information about whether there's children in the home, et cetera," Hoofnagle said.

The additional personal information may have been culled from other sources, Hoofnagle said, possibly including product registration forms, corporate customer support lines, or surveys voluntarily filled out by individuals.

It's also conceivable that the information could have been gathered from purchases in stores or online. Ponemon, for one, is not reassured by stores' stated promises to keep such information private.

"Policies change," he said. "Even if they have a policy and they mean to the best of intentions that they don't share, it's hard to hold businesses to account."

He cited the case of Toysmart.com, which had a policy of not sharing customer information. The company moved to sell its customer database when it went bankrupt, but was taken to court over the matter and eventually agreed with the Federal Trade Commission not to sell the information.

Power of Data

Experts worry about what happens when a store manages to circulate its customer data.

"We don't have very good privacy protection in law in this country, so there aren't very many clues in the marketplace as to what's being done with the information, where does it end up ultimately, how does it flow," said Beth Givens of the Privacy Rights Clearinghouse in San Diego.

"It's very difficult for people to know how a certain decision about them was arrived at and whether their personal information played a part," she said. "So much of this information flow is invisible to people. How do you know how the insurance company came to the decision to increase your rates?"

Hoofnagle said there might be another drawback to providing a phone number at checkout: It could open a person up to telemarketing -- even if they are on the federal "do not call" registry. According to Hoofnagle, giving a phone number while making a purchase may establish a business relationship, and companies can call individuals on the "do not call" list with whom they have prior business relationships.

"Not only that, you can also get an e-mail address" through data enhancement, Hoofnagle added. "So getting the phone number opens you up not just to getting phone calls, but to spam."

Some experts don't consider giving up a zip code at the cash register quite as risky. Givens said it "doesn't really say much about you," and she understands that it's useful for stores to know where their customers come from.

Hoofnagle is less blasé.

"In a lot of America, a name is unique in a zip code," he said. "Not only that, a date of birth is almost always unique. Data that seems innocuous can get more information when aggregated."

It's unclear whether Americans really care about whether or not their personal data is being aggregated. But Givens points to the popularity of the federal "do not call" registry as evidence that they care about the possible end result of aggregation.

However, she worries reluctance to reveal personal information may be eroding among a key demographic.

"It's hard for me to speak about identity theft to young people and get them to understand it," Givens said.

"I think there's a life-experience issue there with young people. But more so, young people grow up with Internet access. They're more immersed in an information-rich environment. … It's just natural for them to spend most of their time dealing, in one way or another, with their personal information."