Personal Data Economy Map
Personal information can move through several organizations before a person sees a profile, advertisement, decision, or deletion request. This map explains the possible roles and links each description to evidence; it is a conceptual model, not a claim about every company or individual.
Step 1
You
Person / data subject
You provide information directly when using an app, website, service, purchase, or privacy request. Other information may be observed or obtained from public and commercial sources.
Evidence: FTC: Protecting consumer privacy and security ↗Step 2
Collection point
App, website, purchase, or public record
A business, public agency, or other organization may collect or maintain personal information for a stated purpose. The exact data and legal basis depend on the context.
Evidence: FTC: Privacy and security guidance ↗Step 3
Data holder
First-party organization or service provider
The organization may use service providers, disclose information, or retain records subject to its notices, contracts, applicable law, and exceptions.
Evidence: FTC: Privacy and Security Enforcement ↗Step 4
Broker / aggregator
Data broker or enrichment intermediary
Some companies collect, combine, license, or sell personal information and profiles. Registry disclosures and enforcement records show examples, not a universal map of every data flow.
Evidence: CPPA: California Data Broker Registry ↗Step 5
Downstream use
Advertising, analytics, people search, or other buyer
Possible downstream uses include advertising, analytics, identity resolution, people-search products, risk decisions, or other commercial purposes. The use must be checked against the source disclosure or official record.
Evidence: FTC: Data broker and privacy enforcement materials ↗Step 6
Oversight and rights
Regulator, law, complaint, or deletion request
Privacy laws and regulators create rights, obligations, remedies, or complaint channels that vary by jurisdiction and data category. A deletion request does not automatically remove information from every independent source.
Evidence: CPPA: Information for data brokers / DROP ↗What to verify
- Who collected the information?
- What categories and purposes are disclosed?
- Who receives, licenses, or processes it?
What removal can do
A request can address the recipient covered by the request and applicable law. It does not automatically recall copies held by independent recipients or erase public records.
Explore the evidence
Sources and limits
This is a conceptual model based on the linked FTC and CPPA materials. It does not map a particular person's data, identify a specific company's complete data flow, or establish that a deletion request reaches every recipient.