In the intervening years, groups like the ACLU pushed back on the practice of demanding passwords, and some states passed legislation banning it. Today, you probably won’t be asked to hand over your passwords when applying to college, a job, a loan, or a lease—but that doesn’t mean your private social data isn’t still fair game.

A wide range of companies have tried to come up with ways to assess a person’s reliability and creditworthiness using nontraditional data. For some, the goal is to extend the benefits of credit to those who don’t generally have access to it—perhaps because they don’t have an official credit score at all. Others aim to provide lenders, service providers, and hiring managers with a more complete picture of a person’s background before deciding whether to trust him or her.

Both are worthy goals, but the ways companies chase them have raised eyebrows.

Last year, Facebook was awarded a patent for a system that would scan the credit scores of a user’s friends in order to help a bank decide whether or not to award a loan to that person. The product never got off the ground, but it raised questions about trusting an algorithm that sniffs its way through a person’s social network to come up with a risk rating. People are likely to be friends with people from similar socioeconomic and ethnic backgrounds, so a network analysis that developed a credit score based on one’s peers could help reinforce class distinctions.

If Facebook had gone through with its plans, it could have landed in a potentially dangerous legal gray area. Consumer reporting agencies like credit bureaus are subject to regulation under a set of laws that the Federal Trade Commission enforces. In 2012, a data broker called Spokeo paid an 800,000 dollar fine and entered into a consent decree with the FTC in order to settle charges that it violated consumer-protection laws. The company assembled detailed personal information about individuals from credit agencies, social networks, and other sources, and sold the data to human-resources departments looking for a leg up in hiring.

Because of stringent credit-reporting laws in the U.S., alternative methods of developing credit have generally gotten more traction overseas. In parts of Africa and Latin America, companies are monitoring cell-phone use, social media, and even typing patterns to try and assess a person’s creditworthiness.

Most recently, a British startup has stirred the pot with a product called Tenant Assured. The service is aimed at landlords who want to check up on potential tenants before leasing out an apartment, and it works by connecting to applicants’ social networks: Facebook, Twitter, Instagram, and LinkedIn.

Once a candidate grants the app permission to access his or her accounts, an automated spider crawls through “millions of data points, both public and private,” according to the company. It can read both public posts and private messages, and uses a variety of “cutting-edge techniques” to deliver inside information about the individual’s personality traits, hobbies, and potential risks they might pose to the property (like smoking or owning pets).