Alternative data: what investors buy, and where the legal risk sits

Alternative data is any information investors use beyond the traditional set of prices, financial statements, company filings, analyst estimates and press releases. In practice, alternative data means things like card transaction panels, satellite photos of parking lots, app usage estimates, web traffic, scraped job postings and prices, and conversations with people who work in an industry. Treat each dataset as one piece of evidence that needs a second source, and check how the vendor collected it before anyone trades on it, because the legal trouble in this field has come from how data was gathered.

This page is general information. It is not legal advice and not investment advice. If you work at a fund, your compliance team's policy comes first.

1. Much alternative data is the exhaust of other businesses, so learn the main types

A CFA Society Toronto summary of a 2021 webinar series defines alternative data as roughly anything that is not traditional investor data, and notes that much of it is "exhaust data": a by-product of a company's normal operations, such as card transactions and phone geolocation. Some vendors also collect it themselves by web scraping or polling. The SEC's examiners use a similar definition in a 2022 risk alert, listing satellite and drone imagery of crop fields and retailer parking lots, aggregate credit card transactions, social media and internet search data, phone geolocation, and email data from consumer apps. The same footnote says alternative data does not necessarily contain material non-public information.

Here is how the main types line up. The "what it can answer" column is our summary of typical uses, not a promise about any vendor's product.

Data owners are also getting more protective. The CFA Society Toronto piece gives the example of Amazon removing purchase details from order confirmation emails, which is bad news for anyone whose model depended on reading them.

2. Start with one question, then buy the cheapest dataset that answers it

Pick the decision first. A dataset bought because it looked interesting tends to produce charts that also look interesting and change nothing.

Here is a made-up example. Priya covers a fictional chain called Kibble & Co., which runs 400 pet-supply stores. Her question is narrow: are same-store sales holding up this quarter, or is the new loyalty program only moving existing customers' purchases forward? A card panel can show spending trends. Parking lot imagery can show visits. Scraped prices from the chain's site can show whether it is discounting harder to hit the number. Only the card panel speaks to her actual question, so she buys that one and treats the other two as optional checks.

Alternative data does not fit every investor. The CFA Society Toronto summary describes datasets that are large and messy, a niche of firms that exist to clean them and map them to securities, and a shortage of people who can do the work. If you hold positions for years, or you have no one to clean a raw feed, start with filings and calls; the investment research guide covers that order.

3. Read the panel before you read the chart

Every alternative dataset is a sample of somebody. A card panel only sees the cardholders in it. A foot traffic feed only sees phones running the apps that report location. Before you trust a trend, ask who is missing and whether that group behaves differently.

Back to the made-up example. Priya's card panel shows Kibble & Co. sales up 6% on a year ago. She then learns that most panel members live in the Southeast, where the chain opened 30 of its 400 stores in the past year. New stores are excluded from a same-store figure, so a regional panel heavy with new-store shoppers can overstate what she wants to measure. She asks the vendor for a cut that drops spending at stores open less than a year.

Short version: a trend you cannot explain by panel makeup is worth a phone call; a trend you can explain by panel makeup is worth nothing.

4. The legal risk sits in how the data was collected

The clearest lesson comes from the SEC's case against App Annie, a mobile app data provider. On September 14, 2021, the SEC announced what it called its first enforcement action charging an alternative data provider with securities fraud. App Annie sold estimates of app downloads, usage and revenue to trading firms. Companies had shared their app performance data on the condition that it would be aggregated and anonymized. According to the SEC, from late 2014 through mid-2018 App Annie used that confidential company data, without aggregating or anonymizing it, to adjust the estimates it sold, which made them more valuable to traders.

The SEC also found that App Annie told its trading firm customers that its estimates matched the consents it had obtained and that it had controls against misuse of confidential data. App Annie agreed to pay a $10 million penalty, and its former chief executive, Bertrand Schmitt, agreed to $300,000 plus a three-year bar from serving as an officer or director of a public company. Both settled without admitting or denying the findings.

The point for buyers is uncomfortable. The customers in this story were relying on the vendor's description of its own methods. Ask how every number is derived, get the answer in writing, and treat a vague answer as a reason to walk away.

5. Write your vendor diligence down, and redo it when the vendor changes

The SEC has flagged this for years. Its 2020 examination priorities said examiners would look at firms' use of alternative data and at whether the related compliance and control functions worked. The 2022 risk alert on adviser handling of material non-public information then listed what examiners found. Advisers ran ad hoc and inconsistent diligence on data vendors, had no policy for assessing the terms and legal obligations attached to collecting the data (including after red flags about a source), skipped diligence on some sources, had no trigger for repeating diligence when time passed or collection practices changed, and could not produce documents showing they followed their own policies.

That list doubles as a checklist. Before a dataset reaches an analyst, get written answers to these questions:

1. Where does each field come from, and who supplied it to the vendor?
2. What did the original source (consumer, company or website) agree to, and does your use fit that agreement?
3. Could any part of the data come from someone who owed a duty of confidentiality, such as an employee or a company that shared data under contract?
4. Is any of it tied to identifiable people?
5. Has the vendor received legal complaints or cease-and-desist letters about collection?
6. What change at the vendor would make you redo this review, and on what date will you redo it anyway?

Keep the answers in a file your compliance team can hand to an examiner. To an examiner, a review nobody wrote down looks a lot like no review.

6. Public web data is not automatically fair game

Scraping is a common way vendors build datasets of job postings, prices and profiles, and the law is less settled than many people assume. In hiQ Labs v. LinkedIn, decided on April 18, 2022, the Ninth Circuit upheld a preliminary order stopping LinkedIn from blocking hiQ, a data analytics company, from public member profiles. The court found hiQ had raised serious questions about whether the federal anti-hacking law, the Computer Fraud and Abuse Act, covers scraping pages that do not require a login, even after the site sends a cease-and-desist letter.

Read that narrowly. It was a ruling at the preliminary injunction stage, and the same opinion says sites that object to scraping may still have other claims, including trespass to chattels, copyright infringement, misappropriation, breach of contract and breach of privacy. Ask the vendor which sites it crawls, whether it logs in to any of them, and what those sites' terms of service say.

7. Data about people carries privacy risk beyond securities law

Location and receipt data come from individuals, so consumer protection rules apply even when no one is trading on inside information. In January 2024 the Federal Trade Commission published a proposed consent order against X-Mode Social and its successor Outlogic, a location data broker. The FTC's complaint alleged that the company sold location data tied to mobile advertising IDs that could track people to medical facilities, places of worship and domestic abuse shelters, and that it failed to verify that apps using its software kit got users' informed consent. The proposed order bars it from selling sensitive location data and requires a program to check that its suppliers obtained consent.

An investor buying a foot traffic feed is not the broker in that story. You still want to know whether the feed was built on that kind of collection, because a regulator's order can make a dataset disappear halfway through a model. Buy aggregated counts instead of device-level records.

Ask the vendor to show you the consent language its sources used.

8. Expert calls are alternative data with a person attached, so give them the same controls

A dataset tells you that Kibble & Co.'s card spending rose. A former regional manager can tell you whether the loyalty program pulled purchases forward, which is the question Priya started with. That is the reason to pair a dataset with calls through an expert network and distributor channel checks.

The SEC treats calls as a source of the same risk. The 2022 risk alert describes advisers that did not track and log calls with expert network consultants, did not review detailed call notes, and did not review staff trading in companies from industries discussed on calls. Run every call with the rules in our guide to MNPI: ask about the industry and the person's own past work, and end the call if they start describing unannounced results at a current employer or client.

Pick people who sit next to the number you are testing. For a retail question, a former retail CFO can explain how a promotion shows up in margins. A chief data officer can tell you how a vendor's panel is likely built. A chief compliance officer can pressure-test your vendor checklist. If you know exactly who you want, Instant Expert can send that specific person a paid request for a short call or a written or voice answer, and you pay only if they book or answer.

Start with one question and one dataset this week, and write down where that dataset came from before you open the first chart.