💻 computer science

Understanding Data Collection, Brokerage, and Spam in the Lead Marketing Ecosystem

This paper presents the first empirical study of the lead marketing ecosystem, revealing through a large-scale measurement framework that sensitive health data is aggressively monetized through deceptive brokerage, rapid unsolicited contact, and widespread non-compliance with consumer privacy preferences.

Original authors: Yash Vekaria, Nurullah Demir, Konrad Kollnig, Zubair Shafiq

Published 2026-04-09

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Yash Vekaria, Nurullah Demir, Konrad Kollnig, Zubair Shafiq

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you walk into a bustling, chaotic marketplace called "The Lead Market." You go there because you need a specific service, like health insurance. You find a booth that looks official, fill out a form with your name, phone number, and even your medical history, hoping to get a fair price quote.

But here's the twist: You didn't just walk into a shop; you walked into a data factory.

This research paper, written by a team of security experts from UC Davis, Stanford, and Maastricht University, acts like a pair of X-ray glasses. They peeked behind the curtain of this marketplace to see what actually happens to your data after you hit "Submit."

Here is the story of what they found, broken down into simple analogies.

1. The "Bait and Switch" (Data Collection)

You think you are filling out a form to get a quote. In reality, you are handing over a golden ticket.

The Trap: The websites you visit aren't just collecting your info for themselves. They are secretly sharing it with dozens of other companies while you are still typing.
The Leak: Some of these sites are so poorly designed that your private info (like your phone number) gets stuck in the web address (URL) itself. It's like writing your home address on a postcard and mailing it to a stranger just to ask for the time.
The Result: Your data is instantly copied and sent to over 70 different third parties, including ad trackers and data brokers, before you even get a confirmation email.

2. The "Data Resellers" (Brokerage)

Once your data leaves the website, it enters a wholesale market.

The Auction: Your information is sold in real-time auctions. Imagine a group of insurance agents sitting in a room, bidding on your name the second you type it in. The highest bidder wins the right to call you.
The "Fake" Data: Here is where it gets creepy. The researchers bought leads (your data) from these brokers and found that some of them were lying.
- The Metaphor: Imagine you tell a broker you are 30 years old and 5'10". The broker sells your profile to an insurance company, but the profile they send says you are 50 years old and 6'2".
- Why it matters: These brokers sometimes make up facts (like your weight or health conditions) to make the lead look more valuable. This fake data can lead to you being charged higher insurance premiums or denied coverage based on lies.
No Gatekeepers: You can buy this sensitive data with almost no questions asked. You don't need to prove you are a real business; you just need a credit card.

3. The "Relentless Storm" (Spam & Harassment)

Once your data is sold, the marketing machine goes into overdrive.

The Tsunami: The researchers found that within seconds of submitting a form, their phones started ringing. They received over 8,000 calls, 600 texts, and 200 emails.
The "Neighbor Spoofing" Trick: The callers didn't just use random numbers. They used a trick called "neighbor spoofing."
- The Metaphor: If your number is (555) 123-4567, the caller makes their number look like (555) 123-XXXX. It looks like it's coming from your local neighborhood, tricking you into answering.
The Overwhelm: Some profiles received hundreds of calls in a single day. The calls were so frequent that the phones were effectively unusable. It wasn't just annoying; it was a digital siege.

4. The "Broken Exit Door" (Opt-Outs)

You might think, "I'll just tell them to stop." The researchers tested this, and the results were discouraging.

The "Whac-A-Mole" Game: When you try to opt-out (say "STOP" to a text or register on the Do Not Call list), it's like playing Whac-A-Mole. You stop one caller, but because your data was sold to hundreds of different people, a new caller pops up immediately from a different company.
The Broken Promise: Even when you successfully opt-out with one company, that company often doesn't tell the other 50 companies who also bought your data. The "stop" signal gets lost in the shuffle.
The Reality: Opting out helps a little bit, but it rarely stops the flood. The system is designed to keep selling your data even after you say "no."

5. What the "Real People" Say (BBB Complaints)

The researchers didn't just use fake profiles; they also looked at thousands of real complaints from the Better Business Bureau (BBB).

The Consensus: Real people described the exact same nightmare: "Hundreds of calls," "calls every 5 minutes," and "I can't stop them." One person reported getting 40 calls in the first 60 seconds after submitting a form.

The Big Picture Takeaway

The lead marketing ecosystem is a high-speed, unregulated data highway where your sensitive health information is treated like a commodity to be bought, sold, and resold.

The Problem: The laws meant to protect you (like the Do Not Call list) are being bypassed because the system is too fragmented and fast.
The Risk: Your private health data is being used to make decisions about your life (like insurance prices) based on data that might be fake or sold to unvetted strangers.

The Advice for You:

Be Careful: If you need insurance, try to go directly to the insurance company's official website or a government site (like Healthcare.gov) rather than clicking on "cheap quotes" ads.
Don't Check the Box: Be very careful about checking the "I agree to be contacted" boxes. That tiny checkmark is often the key that unlocks the floodgates.
Opt-Out Early: If you do submit a form, try to opt-out immediately, but know that it might not stop everything.

In short: In the lead marketing world, you aren't the customer; you are the product. And right now, the factory is running at full speed with very few safety regulations.

1. Problem Statement

The lead marketing ecosystem is a rapidly expanding sector (projected to reach $30 billion) where consumers submit personal and sensitive data via web forms to receive quotes (e.g., for health insurance). This data is collected, aggregated, and resold to multiple third-party buyers who contact consumers via phone, SMS, and email.

Despite the scale and sensitivity of the data (often including pre-existing medical conditions), this ecosystem remains largely unexplored by researchers. Existing studies have examined data collection, data brokers, and spam in isolation, but few have analyzed the end-to-end flow connecting these components. The authors identify three critical gaps:

Privacy Risks: Sensitive health data is shared with numerous third parties, often without clear user consent or understanding.
Deceptive Brokerage: Data brokers may fabricate or augment consumer attributes (e.g., weight, health status) to increase lead value, potentially leading to adverse decisions by insurers.
Aggressive Spam: Consumers face high-volume, non-consensual marketing outreach that often violates federal and state regulations (TCPA, DNC), with opt-out mechanisms proving largely ineffective.

2. Methodology

The authors developed an end-to-end measurement framework involving 105 health-related lead generation websites and 200 controlled synthetic profiles (105 for data collection, 105 for opt-out testing).

A. Data Collection & Instrumentation

Website Identification: Identified 105 active health insurance lead generation sites via Google search queries.
Synthetic Profiles: Created 105 unique personas with realistic demographics (age, income, ZIP codes) and fresh phone numbers (via Telnyx) and email addresses.
Browser Crawling: Used a custom Puppeteer-based crawler to:
- Fill out multi-step lead forms.
- Capture network traffic (HTTP/HTTPS), DNS, cookies, and local storage.
- Monitor client-side event listeners to detect data exfiltration (e.g., session replay scripts like TrustedForm, analytics trackers).
- Analyze URL structures to detect PII embedded in query parameters.

B. Downstream Data Brokerage Analysis

Lead Purchasing: The researchers signed up as buyers on three major platforms representing different ecosystem roles:
- QuoteWizard: Lead Generator (sells own leads).
- NextGen Leads: Aggregator/Exchange (auctions leads).
- Aged Lead Store: Broker (resells "aged" leads).
Purchase Strategy: Bought 392 leads (both "exclusive" and "shared") to analyze the data attributes sold, including health conditions, income, and fabricated data points.

C. Marketing Communication Monitoring

Inbound Monitoring: Monitored the 105 synthetic phone numbers and email addresses for 60 days post-submission.
Metrics Tracked: Volume of calls, SMS, and emails; timing of first contact; caller ID spoofing; VoIP infrastructure usage; and retry patterns.
Opt-Out Experiments: Divided profiles into three groups:
1. Phone Opt-out: Called provider numbers and registered on the Federal Do Not Call (DNC) registry.
2. Email Opt-out: Clicked unsubscribe links and sent opt-out emails.
3. Control: No opt-out action.
- Note: SMS opt-outs were not tested due to provider restrictions.

D. Consumer Perspective Validation

Analyzed 7,432 Better Business Bureau (BBB) complaints and reviews associated with the studied websites using thematic analysis and LLM-assisted coding to validate experimental findings against real-world consumer experiences.

3. Key Contributions

First End-to-End Empirical Study: The first research to trace the complete lifecycle of lead marketing from form submission to consumer harassment, linking data collection, brokerage, and spam.
Discovery of Data Fabrication: Uncovered that lead platforms sell fabricated or placeholder data (e.g., constant height/weight values) to buyers, which can negatively impact insurance underwriting.
Opt-Out Ineffectiveness: Provided quantitative evidence that current opt-out mechanisms (DNC, unsubscribe links) fail to stop marketing communications due to data redistribution and lack of real-time propagation.
Infrastructure Mapping: Mapped the technical infrastructure (VoIP providers, caller ID spoofing techniques) used to facilitate high-volume spam.

4. Key Results

A. Data Collection & Exfiltration

Widespread Sharing: Personal Identifiable Information (PII) was shared with 73 distinct third parties across the 105 sites.
Exfiltration Vectors:
- Intentional: Session replay scripts (e.g., TrustedForm, LeadID) captured keystrokes and form data before submission.
- Unintentional: Poor form design embedded PII directly into URLs, which were then sent to analytics/advertising vendors (e.g., Google Analytics, DoubleClick) via the Referer header.
Third-Party Reach: Data was shared with 99 distinct third parties, including verification vendors and ad networks.

B. Data Brokerage & Quality

Ease of Access: No substantive vetting was required to buy sensitive health data; platforms did not verify business legitimacy or intended use.
Fabricated Attributes:
- QuoteWizard: Sold height and weight data despite not collecting them on the form. ~80% of leads had identical placeholder values (65 inches, 175 lbs).
- Aged Lead Store: Assigned uniform marital status ("MARRIED") and constant height/weight (69 inches, 170 lbs) to all 200 leads.
Targeting: Platforms allowed buyers to filter by sensitive medical conditions (e.g., HIV/AIDS), despite the lack of transparency in how this data was sourced.

C. Marketing Spam Patterns

Volume: Received 8,214 calls, 674 SMS, and 166 emails.
Speed: 50% of first calls occurred within 2 minutes of form submission; 80% within 24 hours.
Aggressiveness:
- Individual profiles received up to 1,676 calls.
- Neighbor Spoofing: 59% of calls used the same area code as the recipient; 4% matched the first six digits.
- VoIP Dominance: >80% of calls originated from VoIP providers (Sinch, Onvoy, Flowroute).
Compliance Violations:
- Florida/Oregon: Significant violations of state limits (3 calls/24hrs).
- Hours: Calls made outside federal (8am-9pm) and state (8am-8pm) permissible windows.
- SMS: Only 14% of SMS messages included valid opt-out keywords ("STOP").

D. Opt-Out Effectiveness

Phone Opt-outs: Statistically significant reduction in call volume ( $p < 0.001$ ), but not total cessation. Callers often switched numbers or ignored DNC registration.
Email Opt-outs: Reduced volume slightly, but many emails continued past the 10-day legal requirement (CAN-SPAM Act).
BBB Corroboration: Consumer complaints confirmed that blocking numbers and registering on DNC lists rarely stop harassment, with users reporting "non-stop" calls immediately after opt-out attempts.

5. Significance & Recommendations

Significance:
The study reveals a "policy vacuum" where U.S. consumer protection laws (TCPA, CCPA) are systematically bypassed due to the opaque, multi-stakeholder nature of the lead ecosystem. The ecosystem operates as a "consent farm," tricking users into granting broad consent that is then sold to unvetted buyers, leading to harassment and potential financial harm via fabricated data.

Recommendations:

For Consumers: Avoid lead generation sites; use official government sources (e.g., healthcare.gov) and direct insurer sites. Do not check TCPA consent boxes.
For Policymakers:
- Enforce strict federal limits on call frequency (e.g., total calls per consumer, not just per caller).
- Mandate real-time, centralized opt-out propagation (API-based) so that a single opt-out request stops all downstream marketers immediately.
- Extend TCPA consent requirements to require explicit, pop-up disclosures about data sharing and marketing intensity.
For Industry:
- Lead platforms must vet buyers and stop selling fabricated data.
- Websites must stop embedding PII in URLs and ensure valid, functional opt-out channels.

This research provides the empirical foundation needed to reform regulations and protect consumers from the aggressive monetization of their sensitive personal data.