[EDRM Editor’s Note: The opinions and positions are those of Michael Berman.]
In Roberson v. Acxiom LLC, 2026 WL 824055 (E.D. Va. Mar. 2026), Mr. Roberson and others unsuccessfully sued an alleged data broker, Acxiom, under two Virginia statutes. The court granted Acxiom’s motion to dismiss. As such the court assumed, and this blog assumes, all of the allegations in the Complaint to be true. Id. at n. 1 (“For purposes of considering the Motion to Dismiss, the Court accepts all facts contained within the Complaint as true, as it must at the motion-to-dismiss stage.”). They are, of course, unproven at this stage.
The Roberson court wrote that: “Acxiom is one of the largest data brokers in the United States.” Id. at *1. Its “core business involves building detailed profiles of people, integrating consumer data from multiple sources, and ensuring the accuracy and quality of that data—i.e., using software tools and algorithms to confirm the data actually pertains to each individual.” Id.
In short, Acxiom sells people’s identities as its business.
Roberson v. Acxiom LLC, 2026 WL 824055, at *1 (E.D. Va. Mar. 2026).
“In short, Acxiom sells people’s identities as its business.” Id. at *1. It is alleged to collect data from “a multitude of sources” thereby creating profiles of people and then “licensing or selling these profiles to businesses and governments.” Id. Data is allegedly licensed or sold to marketers. Id. Further: “Under a contract between Acxiom Corporation and the U.S. General Services Administration, Acxiom has [allegedly] been selling personally identifiable data and related services.” Id. at *4. The data is allegedly “directly associated with people’s names and other identifying information.” Id. at *1.
The Roberson court wrote that:
Acxiom claims it has personal data relating to approximately 2.6 billion people worldwide and that it has collected and culled the personal data of approximately 260 million U.S. citizens, covering 98% of the country’s adult population…. Acxiom states that its collection of individuals’ personal data includes over 12,000 data attributes (including name, address, social security number, date of birth), many of which are by themselves personal identifiers and which, in the aggregate, are designed to identify and describe each specific individual in detail.
Id. at *1.
The plaintiffs alleged: “Acxiom collects geolocation data, data related to individuals’ consumption or purchase of alcohol, tobacco, and pharmaceutical products, where one works, shops, eats, and lives, and individuals’ religious practices, ethnicity, and other categories of protected and highly sensitive personal data.” Id.
One plaintiff described the extent of the data collected on him:
Prior to filing this lawsuit, Plaintiff Johnson made a data access request to Acxiom seeking to review the data Acxiom had collected about him…. Acxiom responded with a 70-page report that disclosed that it had obtained Johnson’s social security number, date of birth, extensive categories of personal data (including, for example, “ethnicity/religion” and “assimilation level”), and its conclusions about Johnson and his lifestyle (including, for example, “diet lifestyle,” “exercise frequency,” “sleep quality,” “stress level,” “net worth household,” and “monthly likelihood to spend” on various merchants)—all connected to his name.
Id. at *2.
Mr. Johnson alleged that some of the data was incorrect.
It is alleged that: “Acxiom has compiled an electronic warehouse of names, identifying information, and other personal data collected from multiple sources and has aggregated this data into personal profiles, including Plaintiffs’ and [putative] class members’ names and other identifying information….” Id. at *2.
Spending on identity solutions and services in the U.S. has grown from $3 billion in 2018 to an estimated $10.4 billion in 2023, as the result of major browser providers stopping the use of “third party cookies.” Id. at *2. The Roberson court stated:
Acxiom admits that it has sold or licensed Johnson’s personal information to companies and entities in the following industries: automotive, business services, business services/agency, communications, entertainment, financial services, healthcare, insurance, media and publishing, retail, services non-professional, services professional, and travel and tourism…. Acxiom admits to selling at least the following categories of Plaintiffs’ and class members’ personal data: name, personal identifiers, personal characteristics, real and personal property, buying activity/interest, internet activity, geolocation, employment information, education information, and other inferences.
Id. at * 2.
The Roberson court wrote that Acxiom has an “identity resolution solution” called Real ID. Id. at *3. Based on the allegations, the court wrote:
A sample use case for Real ID is a company that has a customer “Jane Doe” who makes multiple purchases but using different email addresses and identities…. Jane may use a VPN, reject cookies, and/or browse the site on her phone, but complete purchases on her desktop, creating fragmented behavior data across devices…. As a result, the company’s marketing team is unable to engage in targeted marketing with Jane because they don’t understand her tendencies, preferences, or purchase interests…. With Real ID, the company is able to associate these different data sets and merge them into a single identifiable person and profile, thus discovering who Jane Doe is and understanding more about her – more than she intended to share.
Id. at *3.
The court wrote that:
Acxiom uses its extensive identities and personal data attributes to develop targeted audience segments for its customers (e.g., new parents, new movers, pre-movers, college students, etc.), enabling Acxiom’s customers to identify, reach, and engage customers and prospects across multiple channels…. The most essential element of the provided data segment is the name and other identity information, which allows Acxiom’s customers to connect more effectively with their own prospective customers…. A key component of Acxiom’s audience solutions offering is a tool called Personicx, which according to Acxiom allows “[c]onsumer segmentation at household, individual and geo levels…. Personicx categorizes individuals and households into distinct clusters based on demographics, behaviors, and life stages.
Id. at *4.
The Roberson court continued:
Acxiom states: “You may think you’re addressing sedate empty nesters, but in reality of [sic] you have three distinct personalities within one household: Successful head of household Jack who hopes to retire in 6 years and spend more time tinkering with his vintage car collection[;] Active lawyer Mary spends her extra hours volunteering for community causes and is fond of any new tech gadget[;] Adult child James has just moved back home to save a little money while he pursues an Executive MBA and works full time.” …. Acxiom’s example shows that the essential value of its Personcix solutions is their ability to isolate data by name and identity (e.g., James Jones, Jack Jones, and Mary Jones – three unique individuals).... Without selling names and identities, Acxiom would be unable to sell its Personcix and related “solutions.”
Id. at *4.
Plaintiffs sued under Va. Code, §18.2-216.1 (“Unauthorized use of name or picture of any person”) and §8.01.40 (“Unauthorized use of name or picture of any person”). The Roberson court wrote that it was “troubled by the extensive allegations in the Complaint,” but held that they did not state a claim on which relief could be granted. Id. at *7.
The Complaint was dismissed with prejudice. I again emphasize that the decision and this blog are based on unproven allegations in a Complaint.
Assisted by GAI and LLM Technologies per EDRM’s GAI and LLM Policy.
