In a 2018 Forbes article, Jedidiah Yueh and Randy Bean argued that every company is now a data company. “Leveraging data — in an ethical manner — has to be at the heart of your company and product strategy,” they wrote. “Collect, sift, then monetize.” Just shy of a decade later, virtually every company (in the tech space and beyond) prioritizes making data-driven decisions.

Fanatics CEO Michael Rubin has confirmed that, despite its humble beginnings as a brick-and-mortar sporting goods store in Florida, the company now holds “up to 16 data attributes per customer.” Handling billions of data points annually, Daniel Fox, Principal Product Manager at Fanatics, says that “[our] mission is to enhance the fan experience in everything we do…and data is the underlying tissue that ties all that together.”

Fanatics is not unique in this — companies began aggressively collecting data back in the 1990s, culminating in the big data wave in the early 2000s. But its transition from a company in which data is a byproduct of commerce to one where data is a product in and of itself is a microcosm of what many organizations are facing right now. With that comes new responsibilities.

As companies collect more and more customer data (which begs the question of how much data is too much data), they need to take additional steps to protect it. And, as the concept of ethical data consumption shifts from esoteric internal discussions to strict regulation, a shift that’s only being accelerated by AI, its associated best practices are changing rapidly.

Responsible Stewardship of Customer Data

The more data a company holds about its customers, the greater responsibility is has to protect that data. Where data was once gathered without a second thought (collect first, ask questions later), we’re now seeing more organizations pause to question what they really need.

A company that holds names, addresses, Social Security numbers, credit card information, and so on becomes both an attractive target to bad actors and subjects the company in question to more intensive regulatory measures to ensure compliance. As such, organizations that collect customer data are increasingly faced with all sorts of ethical and operational considerations.

Some organizations are also reconsidering functions like single sign-on (SSO). SSO is a powerful tool for both users and companies, reducing friction and simplifying identity management across multiple related platforms. But there’s a case to be made that, in a world of AI systems and partner ecosystems, it no longer fits with newer definitions of identity.

Organizations with vast ecosystems of connected services are increasingly, or should be, interrogating the idea that a user can log in once and access those entire ecosystems indefinitely. Even though both actions might exist under one parent company, purchasing a throwback jersey is a very different action to depositing $500 to use on the blackjack table.

Many of the questions and principles of zero trust architecture are especially relevant to AI agents, which are beginning to interface with sensitive data:

• How much data does this agent/user need to access?
• For how long can they access it?
• What is the intent of the agent/user?
• Should the agent/user have any standing privilege?

As appealing as it may be for companies with vast ecosystems to hold a single super-profile of their users for convenience, marketing purposes, and streamlining operations, there are architectural approaches that are better suited to protecting users and reducing attack surfaces.

Going Beyond OAuth

As organizations move away from broad access granted by a single authentication request, we’re seeing wider implementation of user-friendly access control measures like:

• Separation between data domains
• Token minimization
• Fine-grained access controls
• Continuous risk evaluation
• Decentralized identities, with selective disclosure

Although that may not sound appealing for organizations, who can use the data they hold to create targeted campaigns and embed users deeper into their ecosystem, perhaps the massive reduction of liability and compliance friction with incoming data protection laws will sway them.

The recent shift toward agentic access places greater emphasis on adapting OAuth 2.0 — which debuted back in 2012, before most API developers were thinking about autonomous non-human consumption — to strengthen components like the principle of least privilege.

In a recent post, we covered the idea of just-in-time authorization and using Rich Authorization Requests to model access for non-humans and exert greater control over fine-grained permissions associated with authorization requests. Where SSO made authentication easier, JIT seeks to ensure it’s being handled more responsibly.

A concern here is that some organizations continue to place the onus of opting out of tracking measures on users, rather than handling it internally. That could be a mistake since end users, just like some organizations, are questioning authentication and authorization in their own ways.

The rise of VPNs and features like Apple’s Hide My Email, for example, are direct outcomes of users looking to anonymize or pseudonymize their browsing habits, demonstrating an appetite to bolster privacy and reduce the commoditization of their data.

The Ethics of Data Minimization

A New York Times Magazine article recounts the troubling story of marketers at Target figuring out that a teenage girl was pregnant based on her shopping habits. They sent her coupons for baby clothes and cribs, which ended up on the desk of her father, who had no idea of his daughter’s situation.

More than a decade after that story broke, marketers are now capable of building a much more comprehensive picture of their customers. Coca-Cola recently admitted that data from its Freestyle vending machines are, at least in part, used to direct future drink offerings. Megan Tallman, VP of Foodservice Innovation and Equipment, said that “with live data from roughly 11 million servings per day, Coca‑Cola Freestyle is the largest, live consumer taste test in the world.”

The use of common soda variations to dictate future product development is fairly innocuous. But for brands operating in sensitive or highly-regulated spaces like finance, healthcare, or gambling, the stakes are higher, and the considerations are much more serious.

In many jurisdictions, it remains legal for companies to build highly detailed pictures of consumers (and potential consumers) provided the collection and processing of that data complies with applicable privacy regulations. But there’s nothing to say that won’t change in the future, and organizations that aggressively centralize behavioral data collection may need to change their habits or find themselves on the wrong side of regulation and/or public opinion.

The ethical question isn’t whether organizations can collect this information to create customer profiles that follow users across products and devices, but whether they should — not every system needs access to every user attribute, and not every API request requires a full identity profile. Short-lived tokens, selective disclosure of identity attributes, and even pseudonymization features can be used to strike a balance between convenience and strengthening user trust.

AI, Compartmentalization, and the Future of Identity

The introduction of AI into the mix complicates many of the issues outlined above even further. We’ve already seen the introduction of the AI Act in the EU, which regulates the use of so-called “high-risk AI systems” and states that “Unacceptable risk is prohibited (e.g. social scoring systems and manipulative AI).”

In the gambling space, the Ethical AI Standards Committee (AIC) has been “charged with the responsibility to curate AI algorithm fairness standards for global gaming markets.” In other words, this is a hot topic in the space at large — Microsoft, Google, SAP, and Meta all have their own committees, panels, or boards focused on AI ethics — and it’s clear that brands are looking to get ahead of imminent legislation and additional regulatory measures they’ll need to comply with.

New guidance around Automated Decision-Making Technology (ADMT) under California’s CPRA rulemaking is a clear indicator that such measures are very much on their way, and is unlikely to be the last example of existing data regulations like GDPR and CCPA being layered together with new AI-specific laws.

Although AI systems are capable of what some would describe as overreach, such as creating hyper-targeted gambling offers in real time, they’re also capable of functions like fraud prevention, automated document verification, and identifying patterns of problem spending. For those reasons alone, agentic consumption of data by AI deserves a seat at the table…as long as it can be done ethically and in a manner that complies with new regulations.

That means extensive control over API requests, whether they’re made by humans or agents, and fine-grained control over the flow of data. This is something that, in the age of AI, will likely move quickly from a “nice to have” to an essential ingredient of authorization and identity management, and is already emerging as a vital ingredient in several identity and access management (IAM) platforms.

Organizations operating interconnected systems and exposing data via APIs, both internal and external, increasingly have a duty of care to protect their users. Governance over how identity is managed across those systems is just one part of that conversation, but it’s one that can be adopted more effectively when companies see themselves as the data stewards they are.

When all companies are data companies, the underlying infrastructure of APIs becomes more important than ever. Data management and authorization become less about easy access, and more about continuous evaluation based on the principles of Zero-Trust Architecture and the level of access that AI agents and humans can safely, legally, and ethically be granted.