What Are Data Brokers? Everything You Need to Know
There are thousands of companies building detailed profiles on every American adult — your home address, relatives, income range, health interests, and political affiliation. Most people have never heard of them. Here's what data brokers actually are, why they matter, and what you can do about it.
What Is a Data Broker?
A data broker (also called an information broker or data dealer) is a company that collects personal information about private individuals, packages it into detailed profiles, and sells or licenses that information to third parties — usually without the individuals' knowledge or consent.
Data brokers are not a new phenomenon. The industry grew out of direct-mail list companies in the 1970s and 1980s that compiled consumer addresses from public records. But the internet dramatically accelerated their capabilities. Today's data brokers combine public records with social media activity, online purchase history, app location data, loyalty program records, and hundreds of other sources to build profiles of remarkable depth.
What makes them distinct from ordinary businesses that hold customer data is their core business model: they collect data on people who are not their customers and who have no direct relationship with the company at all. You never signed up for Acxiom or LexisNexis. You never agreed to let Spokeo publish your home address. But they likely have your data anyway.
How Data Brokers Collect Your Information
Data brokers pull information from a wide variety of sources — most of them perfectly legal, which is part of why the industry has been so difficult to regulate.
Public Records
Federal, state, and local governments publish enormous amounts of personal data as part of normal operations. Property records show who owns what home and the assessed value. Court records document lawsuits, divorces, bankruptcies, and criminal cases. Voter registration files in many states include name, address, party affiliation, and voting history. Business filings list officers and registered agents. Birth, marriage, and death records are often accessible. Data brokers systematically scrape and ingest all of this.
Online Activity
Third-party tracking pixels, ad networks, and data management platforms follow users across websites and aggregate behavioral profiles. When you browse products on a retailer's site, search for health information, or read political news, that behavior is recorded, categorized, and sold into data broker pipelines. Data brokers also harvest social media profiles — public posts, friend networks, group memberships, location check-ins — to enrich their records.
Purchase and Financial History
Retailers sell their customer purchase data. Loyalty card programs are particularly rich sources: your grocery club card documents every item you buy, week after week, creating a detailed picture of your household composition, diet, health interests, and spending habits. Credit card transaction data — sometimes anonymized, sometimes not — flows from financial institutions to data brokers through intermediaries.
Mobile Location Data
Apps on your smartphone — weather apps, games, navigation tools, free utilities — frequently collect and sell precise GPS location data. This data is sold to data brokers and aggregated into location history profiles showing where you live, work, worship, receive medical care, and spend your time. A single week of location pings can reveal your home address, employer, medical providers, and religious affiliation.
Data-Sharing Agreements
Insurance companies, banks, healthcare providers, and other large institutions sometimes enter commercial data-sharing arrangements. Magazine subscriptions, mail-in warranties, sweepstakes entries, and survey completions have historically been another pipeline. When you fill out a form online — even one that appears to be collecting information "for your benefit" — there is often language buried in the terms of service authorizing the company to share your information with "partners."
What Information Do Data Brokers Have?
The scope of information in a typical data broker profile is broader than most people expect. An established data broker may maintain records that include:
- Identity information — full name, date of birth, Social Security Number derivatives, driver's license information, aliases and maiden names
- Contact and location data — current and historical addresses going back decades, phone numbers, email addresses
- Family connections — names and contact information for relatives, roommates, and household members
- Financial indicators — estimated income range, net worth estimates, bankruptcy filings, property values owned, creditworthiness tiers
- Health and lifestyle — inferred health conditions based on purchase and browsing history, fitness and diet patterns, pharmacy data where available
- Political and religious activity — party registration, donation history, inferred political leanings, religious affiliations inferred from location data
- Consumer behavior — purchase history across categories, brand preferences, shopping frequency, online browsing interests
- Employment — current and historical employers, job title, professional licenses
- Legal records — court filings, criminal records, traffic violations, lawsuits
Not every data broker maintains every category of data. Specialized brokers focus on particular verticals — people-search sites emphasize contact and family data, marketing data companies emphasize purchase behavior, background check services emphasize legal and employment records. But the largest players, like Acxiom and LexisNexis, maintain extraordinarily comprehensive files on hundreds of millions of individuals.
Who Buys Your Data — and Why
Data brokers sell to a broad range of buyers, which is why the issue touches so many different privacy concerns.
| Buyer Type | What They Use It For |
|---|---|
| Advertisers & marketers | Targeted advertising, direct mail campaigns, behavioral segmentation |
| Insurance companies | Underwriting decisions, premium pricing, risk assessment |
| Employers & HR platforms | Background screening, candidate vetting |
| Financial institutions | Credit decisioning, fraud detection, identity verification |
| Real estate platforms | Property ownership history, homeowner profiles |
| Political campaigns | Voter targeting, microtargeting, donation solicitation |
| Law enforcement (with caveats) | Investigations, skip tracing, locating individuals |
| Private investigators | Skip tracing, asset searches, surveillance support |
| General public | People-search sites allow anyone to look up home addresses, phone numbers, relatives |
That last row is worth emphasizing. Consumer-facing people-search sites — Spokeo, Whitepages, BeenVerified, Intelius, and dozens of others — are essentially retail data broker storefronts. Anyone can pay a small fee (or sometimes nothing at all) to look up another person's home address, phone number, email address, and the names of their family members. This is the mechanism through which data broker exposure becomes a physical safety risk.
The Real-World Risks
The harms from data broker exposure are not abstract or hypothetical.
Stalking and Physical Safety
Survivors of domestic abuse, people with stalkers, public-facing professionals, and witnesses to crimes can have their current addresses published on people-search sites despite their efforts to keep that information private. Stalkers routinely use these services. In documented cases, perpetrators of violent crimes have used publicly available data broker records to locate victims who had relocated to escape them.
Identity Theft Enablement
Identity thieves don't need to hack a bank's systems when they can buy a comprehensive profile — name, address, date of birth, relatives, employment history — for a few dollars from a data broker or scraped free from a people-search site. This information is frequently sufficient to pass security questions, intercept mail, or initiate fraudulent account openings.
Discriminatory Profiling
When data about health conditions, financial stress, political views, or religious affiliation flows into underwriting, hiring, or lending decisions, it enables discrimination that would be illegal if applied directly — but which becomes difficult to trace or challenge when embedded in algorithmic scores derived from data broker profiles.
Surveillance and Harassment
Journalists, activists, domestic violence survivors, and members of marginalized communities face elevated risk when their detailed personal data is freely available. People-search sites have been used to facilitate targeted harassment campaigns and doxxing.
Your Legal Rights
Until recently, data brokers operated almost entirely outside any regulatory framework. That is beginning to change, though the protections remain uneven and incomplete.
California Consumer Privacy Act (CCPA)
Passed in 2018 and strengthened by Proposition 24 in 2020 (which created the CPRA), the CCPA gives California residents the right to know what personal information businesses hold about them, the right to request deletion of that information, and the right to opt out of the sale of their information. Critically, the law applies to data brokers — any business that buys and sells consumer personal information must honor deletion requests from California residents within 45 days. Data brokers must also register annually with the California Attorney General.
Other State Privacy Laws
Virginia, Colorado, Connecticut, Texas, Washington, and a growing number of other states have passed consumer privacy laws with opt-out and deletion rights similar to the CCPA. The state law landscape is rapidly expanding. However, these rights only apply in states where they have been enacted — there is no federal equivalent for consumers.
Fair Credit Reporting Act (FCRA)
The FCRA governs consumer reporting agencies — a category that includes data brokers whose products are used for employment screening, credit decisioning, or tenant screening. FCRA-regulated brokers must provide access and correction rights, limit use of their data to permissible purposes, and follow dispute resolution procedures. However, the FCRA does not cover the vast majority of data broker activity, which falls outside these specific use cases.
What the Law Does Not Cover
The honest answer is that most data broker activity in most US states remains largely unregulated. Without a federal privacy law, consumers outside California and a handful of other states have limited formal rights to access or delete their broker records. Even in states with strong laws, enforcement is limited and the industry's response to individual deletion requests is inconsistent.
How to Protect Yourself
Despite the regulatory gaps, there are concrete steps you can take to reduce your data broker exposure.
Submit Opt-Out Requests
The most direct approach is to contact data brokers individually and submit deletion or opt-out requests. Each major broker has its own process — some require email requests, some have online forms, some require copies of government ID, and some honor CCPA deletion requests through a standardized process. The challenge is the scale: there are hundreds of data brokers, and the opt-out process for each one takes time.
Use a Privacy Removal Service
Given the scale of the problem, many people use automated services that submit opt-out requests on their behalf across hundreds of brokers simultaneously, monitor for re-registration, and provide proof of each submission. This approach trades cost for time — instead of spending dozens of hours on manual opt-outs, you let software handle the submissions at scale. VanishMode does this with screenshot proof and a downloadable audit report for every submission.
Minimize Future Data Collection
Reducing your exposure going forward means being thoughtful about which apps get location access, using a separate email address for loyalty programs and online shopping, reviewing the privacy settings on social media profiles, and being cautious about what you share in online forms. None of these measures eliminate data broker collection, but they reduce the volume of fresh data flowing into broker pipelines.
Check People-Search Sites Regularly
People-search sites pull from data broker feeds and update regularly. Even after you submit opt-out requests, some sites re-populate records within months from new public records pulls. Periodic monitoring — either manually or through an automated service — helps ensure removals remain effective.
The Bigger Picture
The data broker industry exists in the gap between what consumers understand about their digital lives and what is actually happening with their information. Most people would be surprised to learn the depth of the profiles assembled about them, who has access to that data, and the variety of ways it influences decisions made about them.
The good news is that awareness of the issue is growing, the regulatory environment is shifting (however slowly), and the tools available to individuals for asserting control over their own data have never been more accessible. Understanding what data brokers are is the essential first step toward doing something about them.
If you're ready to take action, our complete opt-out guide walks through the removal process in detail.