The Price of Free: Why You Are The Product (And How to Opt Out)

"If you are not paying for the product, you are the product." The cliché has become background noise. That's a problem, because the specifics, which platforms sell what, to whom, for how much, are what actually tell you whether to care.

Key Takeaways

• Google's advertising revenue per US user is estimated at $260+ per year. Gmail users are generating that value without compensation.
• California's CCPA created a framework for calculating the monetary value of personal data; courts have used it in class-action contexts.
• Free platforms sell behavioral data, purchase intent, demographic profiles, and direct contact info to advertisers, insurers, employers, and data brokers.
• Once your data enters the data broker network from these platforms, it replicates across hundreds of downstream sites automatically.
• The only reliable way to stop the cycle is source opt-out + downstream broker removal.

What Free Platforms Sell About You

These are estimates based on disclosed ARPU (average revenue per user) figures and data licensing agreements where reported. The actual value of your data depends on your income level, purchase history, and the enrichment overlays applied by downstream buyers.

The CCPA Valuation: Your Data Has a Legal Dollar Amount

California's CCPA created a framework that implicitly acknowledges personal data has economic value. Under CCPA § 1798.150, a consumer whose data is involved in a qualifying breach can recover $100–$750 per incident without proving actual damages. That statutory floor reflects a legislative judgment that personal data is worth something concrete.

CCPA also requires that if a business offers financial incentives in exchange for personal data, discounts, free services, loyalty points, it must disclose the estimated value of that data in its privacy policy. This "financial incentive value disclosure" requirement is the closest thing US law has to a formal data valuation framework.

When Google offers free Gmail in exchange for access to your email content signals, that is a financial incentive exchange. The company is required to value the data. Most disclosed valuations are vague, but the structure acknowledges the transaction.

What does this mean for you? It means the law recognizes you have a property interest in your personal data, and that interest has a dollar value that companies are profiting from without explicit compensation.

How to Audit Which Platforms Are Selling Your Data

Step 1: Request your data from each platform.

Under CCPA (for California residents) and GDPR (for EU residents), you have the right to download a copy of all data the platform holds about you. Every major platform has a data export function:

• Google: myaccount.google.com/data-and-privacy → "Download your data"
• Facebook: Settings → Your Facebook Information → Download Your Information
• LinkedIn: Settings → Data Privacy → Get a copy of your data
• TikTok: Settings → Privacy → Personalization and Data → Download Your Data

The export shows you exactly what they have collected. Cross-referencing against what you have consciously shared shows you what they inferred or scraped.

Step 2: Review the platform's privacy policy for "third party sharing" disclosures.

Most privacy policies contain a section listing the categories of third parties data is shared with. "Advertising partners," "analytics providers," and "service providers" are typical euphemisms. Under CCPA, California-resident users can request the specific companies their data was shared with in the prior 12 months.

Step 3: Check if your email or phone is in broker databases.

If a platform shared your contact info with data brokers, you'll find it on people-search sites. Google your email address and phone number in quotes. Presence on broker sites suggests the platform shared or leaked that data.

Step 4: Opt out of data sharing at each platform.

• Google: myaccount.google.com/data-and-privacy → Ad personalization → turn off
• Facebook: Settings → Privacy Shortcuts → See more privacy settings → Off-Facebook Activity → Clear History and disconnect
• LinkedIn: Settings → Data Privacy → Manage your data and privacy
• TikTok: Settings → Privacy → Ads → turn off personalized ads

Step 5: Run a data broker removal pass.

Data that has already entered the data broker network through these platforms won't be recalled by the platforms' opt-out settings. You need to address the downstream brokers directly. OfflistMe generates the removal emails for 500+ brokers in a single pass.

Frequently Asked Questions

Q: Does opting out of ad personalization stop the platform from selling my data?

A: It stops some uses. Ad personalization opt-out typically disables targeted advertising. It usually does not stop the platform from sharing aggregated or anonymized data with third parties, or from data sharing for "measurement" purposes. Downloading your data and reviewing the "third party sharing" section of the privacy policy gives you a more accurate picture.

Q: If I delete my Facebook account, does my data disappear?

A: Facebook's data deletion process takes approximately 90 days for most data. Some data (messages sent to others, certain account activity logs) may be retained for longer. Under CCPA, California residents can submit a formal deletion request to accelerate and confirm deletion. Data Facebook already sold to third parties before deletion is not recalled.

Q: Is LinkedIn safer than other platforms because it's professional?

A: LinkedIn's basic tier is among the most aggressively scraped platforms because professional data (title, employer, direct contact info) commands high per-record prices in B2B markets. ZoomInfo, Apollo.io, and Lusha all derive significant data from LinkedIn scraping. Your LinkedIn profile, even set to "public," feeds B2B data brokers continuously.

Q: How do I know if a "free" tool is selling my data?

A: The telltale signs: no clear business model, requests access to contacts or email content, unusually broad data permissions in the terms of service, or a free tier with no feature limitations (free services that are genuinely monetized on premium tiers, not data, usually have meaningful feature gates). If you can't identify the revenue model, you are the revenue.

You select the brokers. You send the emails. You stay in control.

Start removing your data from 500+ brokers now →

The Data Collection Timeline: From Signup to Profile

Most people think of data collection as something that happens after they have used a platform for a long time. The reality is that data collection begins at the moment of account creation and accelerates rapidly. Here is a realistic timeline showing how quickly a new free platform account becomes a populated data profile.

Day 1, Account creation:

• Email address collected and stored
• IP address logged (maps to approximate city-level location)
• Device fingerprint recorded (browser type, screen resolution, operating system, timezone)
• If you signed up with Google or Facebook (OAuth), your name, profile photo, and email are immediately transferred
• If you provided a phone number for 2FA, that number is now in the database

Day 1–7, Behavioral calibration:

• Every page you visit, every click you make, every item you scroll past is logged
• The platform begins building an interest and behavioral profile from your in-app activity
• If the platform has a mobile app, location data (GPS or cell tower-based) begins accumulating if location permissions were granted
• If you connected contacts, the platform now has your full contact list, including people who have never signed up for the service

Day 7–30, Identity enrichment:

• Your email address is run against known data broker databases to cross-reference existing profiles
• Third-party data enrichment services (like Clearbit or ZoomInfo for B2B platforms) append job title, employer, and company size to your record
• Your behavioral data is matched against lookalike audiences in advertising platforms
• If you made any in-app purchase or connected a payment method, purchase behavior data is added

Month 1–3, Commercial data sharing begins:

• Your pseudonymized (but re-identifiable) profile is shared with advertising partners through the platform's data management platform (DMP)
• Retargeting pixels allow advertisers to follow you across the web, your behavior on this platform influences ads you see on unrelated sites
• If the platform participates in a data co-op (common in e-commerce and media), your data is pooled with data from other platforms you may not have heard of

Month 3–12, Data broker ecosystem entry:

• Your contact information (email, phone, city) begins appearing in data broker databases as the platform's data is sold or leaked to downstream buyers
• If your name appeared in social posts or public content on the platform, web scrapers have indexed and filed it with professional data aggregators
• Your platform profile is linked to your other online identities through email address matching and device fingerprinting

Year 1+, Permanent record:

• Even after account deletion, data shared with third parties before deletion is not recalled
• Historical behavioral data may be retained in aggregate (anonymized) form indefinitely
• Your email and contact data, now in hundreds of downstream databases, continues to generate new associations and reappear in new contexts

Understanding this timeline makes clear why platform-level opt-outs (ad personalization settings, data download requests, account deletion) are necessary but not sufficient. By month three, your data has already left the platform.

How Free Platform Data Ends Up at Data Brokers

The path from a free platform signup to a data broker profile is not a single transaction, it is a multi-step journey through a commercial data ecosystem that most users never see.

Step 1: The platform collects and enriches

Free platforms collect behavioral, contact, and demographic data and enrich it using third-party data appending services. By the time a user has been active for 30 days, the platform's internal record is significantly richer than what the user knowingly provided.

Step 2: Advertising partners receive audience data

The platform shares data with advertising partners through three main mechanisms: custom audience uploads (hashed email lists matched against ad platform databases), behavioral targeting pixels (real-time event data on what users do on the platform), and third-party measurement partners (analytics firms that aggregate cross-platform behavior). These ad partners are often large data companies, Google, Meta, The Trade Desk, LiveRamp, that maintain their own massive databases of consumer profiles.

Step 3: Data enrichment companies buy and resell

Companies like Acxiom, Experian Marketing Services, TransUnion's marketing division, and LiveRamp operate as intermediaries between platforms and downstream buyers. They purchase behavioral and demographic data from platforms (often indirectly through data management platforms), enrich it, and sell enriched profiles to other businesses. These enriched profiles include data from dozens of sources, including the original free platform.

Step 4: Data brokers ingest from multiple upstream sources

People-search sites like BeenVerified, Spokeo, and WhitePages source their data from these commercial data aggregators. When BeenVerified updates your profile, it is pulling from an Acxiom or LexisNexis data feed, which in turn got some of its data from the free platforms you used. The chain from platform to data broker can involve three or four intermediaries.

Step 5: Cross-platform identity linking

The most sophisticated step is identity resolution, linking your email from one platform, your device ID from another, and your phone number from a third into a single unified profile. Companies like LiveRamp and ID5 specialize in this probabilistic identity matching. Once your identity is resolved across platforms, your combined behavioral and demographic profile becomes the product sold to advertisers and data brokers.

Why this matters for opt-out strategy:

By the time your data reaches a people-search site, it has been through at least two or three commercial intermediaries. Opting out at the original platform stops future data collection from that platform but does not recall data already in the pipeline. Opting out at the data broker level addresses the visible, consumer-facing exposure. Neither action addresses the intermediate data enrichment companies that hold your profile, those require separate data access and deletion requests.

A complete strategy addresses all three layers: minimize ongoing collection at the platform level (adjust privacy settings, restrict permissions), delete downstream broker profiles, and for the highest-risk users, submit deletion requests to major data aggregators like Acxiom (acxiom.com/about-us/privacy/acxiom-customer-data-ethics-hotline/) and LexisNexis (lexisnexis.com/en-us/terms/privacy-policy.page).

For downstream broker removal across 500+ sites, OfflistMe handles the opt-out submissions in a single pass.

The Monetization of "Free" Privacy Services

The adage "if you're not paying for the product, you are the product" applies directly to the privacy software industry. Many free background checks, opt-out forms, and contact shields are monetized through secondary data pipelines.

How Free Privacy Tools Make Money:

• Lead Generation: Some free opt-out directories list removal steps only to direct users to paid partner services, receiving a commission for every signup.
• Telemetry and Ingestion: Free apps often collect user email logs, app usage statistics, and contact lists to monetize via advertising networks.
• Aggregator Partnership: In some cases, free lookup tools are operated by subsidiaries of the data brokers themselves, using the opt-out forms to collect and verify your most current, active email and phone number.

Related Guides

• What Are Data Brokers?
• Opt Out of AI Training Data
• How AI Companies Scrape and Sell Your Data
• Complete Data Broker Opt-Out Guide
• The Subscription Tax of Privacy: 5-Year Cost Analysis