What Is a Data Broker? How They Get Your Info and How to Stop Them

Search your full name on Google. If your home address, phone number, or the names of your relatives appear in the results, a data broker put them there.

A data broker is a company that collects, packages, and sells personal information about private individuals, typically without their knowledge, consent, or any direct relationship with the people whose data they trade. The data brokerage industry in the US generates an estimated $250 billion in annual revenue. Most consumers have never heard of it.

This guide explains exactly what data brokers are, where they get your information, what they do with it, and what legal rights you have to make them stop.

What Data Brokers Are, and Are Not

What they are:

Data brokers are information intermediaries. They collect raw data from many sources, aggregate and enrich it into structured consumer profiles, and sell access to those profiles to buyers ranging from marketers to insurers to anyone willing to pay for a subscription.

The industry divides into several distinct segments:

• People-search sites: Whitepages, Spokeo, TruePeopleSearch, Radaris, BeenVerified, and hundreds of similar sites that publish your address, phone number, relatives, and background data in searchable format
• Background check providers: Instant Checkmate, Intelius, TruthFinder, sell consumer reports to landlords, employers, and individuals
• Marketing data aggregators: Acxiom, Epsilon, Oracle Data Cloud, sell segmented consumer lists to advertisers, direct mailers, and insurers
• B2B lead generators: ZoomInfo, Apollo.io, Lusha, sell professional contact data to sales teams and recruiters
• Risk intelligence firms: LexisNexis, TransUnion TrueAccord, sell identity verification and risk scoring to lenders and financial institutions

What they are not:

Data brokers are not hackers. They do not breach databases to get your information. They compile it from legal sources, which is both the reason they operate openly and the reason the harm is so widespread.

How Data Brokers Get Your Information

The information in your data broker profile came from sources you touched, most of them legitimate, many of them invisible to you in the moment.

Public Records

In the United States, a wide range of government records are legally public and accessible to anyone. Data brokers systematically scrape and purchase these datasets:

• Voter registration records: Name, address, date of birth, party affiliation, and voting history. Most states sell or make available voter roll data; some states (California, for example) have restricted access, but many do not.
• Property records: Every real estate transaction, purchase price, deed, property tax records, is recorded with the county. These records are searchable by name and address.
• Court records: Civil lawsuits, criminal charges, divorce filings, bankruptcy petitions, eviction records, and restraining orders are typically public.
• Business registrations: When you file for an LLC or corporation, the state requires contact information that becomes a public record. Many founders unknowingly put their home address on state filings.
• Professional licenses: Doctor, lawyer, contractor, and real estate agent licenses include identifying information and are public by regulation.
• Marriage and divorce records: Depending on the state, marriage licenses and divorce decrees include names, addresses, and ages.

Commercial and Transactional Data

Every commercial transaction you complete potentially feeds the data broker ecosystem:

• Loyalty and rewards programs: When you sign up for a grocery store card, airline miles, or retail membership, your purchase history becomes a commercial asset that retailers sell to data aggregators.
• Warranty and product registration: Registering a new appliance or electronics product is largely a data collection mechanism. Most manufacturers sell this data.
• Sweepstakes and contests: Entering promotional sweepstakes is one of the most efficient ways your data enters marketing databases.
• Real estate and mortgage inquiries: Requesting a mortgage quote generates a credit inquiry that credit bureaus sell as a "trigger lead" to competing lenders.

Digital Behavioral Data

The digital layer adds behavioral and interest data to the public records foundation:

• Mobile app location data: Location permissions granted to weather apps, navigation apps, and retail apps are frequently monetized. A single app's location data, aggregated across millions of users, creates a commercial location tracking dataset.
• Website tracking pixels: Third-party tracking scripts embedded in websites (often Facebook Pixel, Google Analytics, or advertising networks) track your browsing behavior and feed it to advertising data brokers.
• Social media scraping: Public LinkedIn profiles, Facebook posts, Twitter/X bios, and Instagram posts are scraped by B2B brokers and enrichment services to correlate professional and personal identities.

Data Purchased from Other Brokers

The data broker ecosystem is deeply interconnected. Brokers routinely purchase enrichment data from each other, creating compounding profiles. Your entry in Whitepages may include data originally sourced from three or four separate commercial databases.

What Your Data Broker Profile Contains

A typical consumer profile maintained by a major people-search site includes:

A premium background check report may also include vehicle registrations, business associations, social media profile links, and historical litigation records.

Who Buys Your Data and Why

Understanding who purchases your data helps explain why data brokers exist and why they resist removal requests.

Direct marketers: Companies purchase consumer lists filtered by demographics, income, location, and purchase interests to send targeted mail, email, and phone solicitations.

Lenders and insurers: Some lenders and insurance companies use "alternative credit data" from brokers to make decisions about consumers without traditional credit histories. Insurance companies use lifestyle and behavioral data (legally, in most states) to set premiums.

Landlords and property managers: Tenant screening companies pull from background check data brokers to assess rental applicants, often including data beyond what standard credit reports contain.

Employers: Pre-employment screening services pull from multiple data broker sources. Beyond criminal history, some services include social media monitoring and public records searches.

Recruiters and salespeople: B2B data brokers sell professional contact data that enables cold outreach. If you receive unsolicited recruiter messages on LinkedIn or cold emails at a personal address, your data was purchased.

Scammers and identity thieves: While brokers do not intentionally market to criminals, the same data they sell legally is accessible through people-search sites that anyone can query. A home address, mother's name, and recent employer, all findable on Spokeo or BeenVerified, provides the raw material for social engineering attacks.

Your Legal Rights to Demand Deletion

The United States has no comprehensive federal data broker law. What exists is a patchwork of state laws that collectively cover a majority of the population.

California (CCPA/CPRA): The California Consumer Privacy Act gives eligible California consumers rights to request deletion and opt out of certain sales or sharing from covered businesses, subject to exceptions and verification. The standard response period is generally 45 calendar days, with permitted extensions and other conditions. The California Delete Act created the CPPA's DROP process for eligible residents and covered or registered brokers; check current CPPA guidance for scope and timing.

Virginia (VCDPA), Colorado (CPA), Texas (TDPSA), Connecticut (CTDPA): These states have enacted privacy laws giving residents deletion and opt-out rights substantially similar to California's.

Vermont and Oregon: These states require data brokers to register annually and disclose their opt-out mechanisms, giving residents a clearer roadmap for finding and using their rights.

GDPR (EU/EEA contexts): Article 17 may provide a right to erasure where its territorial scope, controller role, legal basis and exceptions apply. A provider's location alone does not answer whether GDPR applies; use the current official text or regulator guidance for the request.

Practical reality: Some providers offer voluntary routes outside a statutory scope, but a form or provider practice is not a nationwide legal conclusion. State the right that actually applies to you, or ask the provider which voluntary process it offers.

How to Remove Your Data from Data Brokers

Option 1: DIY (free)

Manually submit requests to each provider where you can verify a relevant listing. Time depends on the number of providers, route and verification steps; a catalog count does not establish a universal workload. See the complete free removal guide.

Option 2: First-party tool (low one-time cost)

OfflistMe prepares reviewable request drafts for 1000+ recorded catalog workflows. The draft is composed locally and sent from your own email address; no ID is uploaded to OfflistMe and no subscription is required. Provider verification, acceptance and timing still control the outcome, and a first-party route does not bypass a provider's requirements.

Option 3: Subscription service

Incogni ($95.88/year), Optery ($39–$249/year), and DeleteMe ($129/year) offer automated ongoing monitoring and re-submission. Useful for high-risk individuals or those who want fully hands-off management. See the service comparison for independent effectiveness data.

Frequently Asked Questions

Is the data broker industry legal?

The answer depends on the provider, source, use, jurisdiction and applicable exceptions. Public availability does not make every collection, sale or use lawful, and a privacy right does not necessarily prohibit the industry from operating. Use current regulator guidance for a specific complaint or request.

Can data brokers sell my health information?

HIPAA protects certain health information held by covered entities and business associates, but it does not cover every wellness, app, retail or inferred-data context. Whether a dataset is protected, disclosed or subject to an opt-out depends on the source, entity and facts; do not treat this page as a determination that a particular record is lawful to sell.

Why does my data keep coming back after I opt out?

Data brokers and other sources may receive new or republished information, and a matching change can create a later listing. There is no verified universal re-submission interval; choose follow-up based on the provider response, exposure and risk plan. See the data reappearance guide for the evidence workflow.

Are credit bureaus the same as data brokers?

Credit bureaus (Equifax, Experian, TransUnion) are a specific regulated category of data company governed by the FCRA. They also operate separate marketing data divisions (Acxiom/LiveRamp for Equifax, Experian Marketing Services) that function as traditional data brokers. The credit reporting functions are regulated; the marketing data functions are largely not.

The 2025–2026 Regulatory and Enforcement Shift

The data broker industry is experiencing its most significant regulatory pressure in its history, with several major developments in 2025–2026 that materially affect what consumers can do:

California's DROP Platform (January 2026):

The CPPA's Delete Request and Opt-Out Platform is the first government-operated mechanism allowing Californians to submit a single deletion request to active data brokers covered by California law. Starting August 1, 2026, brokers must access DROP at least once every 45 days and process requests within required timelines. CalPrivacy says DROP reaches 600+ active brokers. This is a landmark shift: instead of the consumer chasing each broker individually, a single government submission reaches the California-covered broker ecosystem.

FTC Enforcement Escalation (2025–2026):

The FTC launched what legal observers called an "unprecedented crackdown" on data brokers in 2025–2026. Key actions included enforcement against brokers selling sensitive location data, specifically calling out brokers that tracked individuals to sensitive locations (abortion clinics, religious centers, support group meetings, domestic violence shelters). The FTC's actions signaled that selling location and other sensitive data without meaningful consent is a Section 5 unfair practices violation.

Gravy Analytics breach (2025):

The major location data broker Gravy Analytics suffered a significant breach exposing consumer location data. The breach confirmed the theoretical risk that data broker databases present: aggregated location data is not just commercially valuable, it is a target for hostile actors. The FTC cited the breach in its 2026 enforcement priorities.

The global regulatory direction:

The EU's GDPR continues to be enforced with escalating fines (Meta received a €1.2 billion GDPR fine in 2023 for cross-border data transfers). The UK's ICO has issued several fines against people-search sites for unlawful data processing. Australia passed its Privacy and Other Legislation Amendment Act in 2024 expanding individual data rights. The global regulatory trend is unambiguously toward stronger consumer data rights and stronger enforcement.

A Map of the Data Broker Ecosystem

The data broker industry is not monolithic: it is a layered ecosystem where different types of companies serve different buyers:

Raw public records (voter rolls, property deeds, court filings)
        ↓
Tier 1 Aggregators (Acxiom, LexisNexis, Experian Marketing)
- Collect from raw sources at scale
- Sell to Tier 2 and directly to commercial enterprises
        ↓
Tier 2 Consumer Services (Whitepages, Spokeo, BeenVerified, Intelius)
- Buy from Tier 1 and build searchable consumer products
- Generate revenue from ad-supported free searches and paid background reports
        ↓
Tier 3 Re-Publishers (hundreds of smaller sites)
- Scrape Tier 2 and re-publish data with slight reformatting
- Often have no direct data collection, just scraped republication
        ↓
End Users (individuals, landlords, recruiters, marketers, scammers)

Industry Consolidation (2025–2026 M&A Activity)

The industry is consolidating fast at the top: Omnicom's acquisition of Interpublic Group brought Acxiom under its umbrella, and Publicis Groupe agreed in May 2026 to acquire LiveRamp for $2.2 billion, concentrating consumer identity data inside a handful of global advertising conglomerates.

Understanding this structure matters for your removal strategy: opting out of Tier 2 (people-search sites) without addressing Tier 1 (aggregators) means new data will continue flowing from Tier 1 to Tier 2 over time.

Data brokers operate legally but often harmfully, monetizing your personal information without meaningful consent. The opt-out rights that exist under CCPA and state equivalents are your primary lever. Exercise them, and maintain them annually, since the system continuously rebuilds what you remove.

Review request workflows for 1000+ catalog entries →

For a complete breakdown of data broker mechanics and commercial pricing models, see our commercial What Is a Data Broker Overview.

Related Guides

• Data Broker List 2026: Complete Guide
• Why Is Your Personal Data Everywhere?
• Complete Data Broker Opt-Out Guide
• Are Data Removal Services Worth It?
• FTC data-broker reports and enforcement: what consumers can verify