Personal Data Economy Map
Personal information can move through several organizations before a person sees a profile, advertisement, decision, or deletion request. This map explains the possible roles and links each description to evidence; it is a conceptual model, not a claim about every company or individual.
Step 1
You
Person / data subject
You provide information directly when using an app, website, service, purchase, or privacy request. Other information may be observed or obtained from public and commercial sources.
Evidence: FTC: Protecting consumer privacy and security ↗Step 2
Collection point
App, website, purchase, or public record
A business, public agency, or other organization may collect or maintain personal information for a stated purpose. The exact data and legal basis depend on the context.
Evidence: FTC: Privacy and security guidance ↗Step 3
Data holder
First-party organization or service provider
The organization may use service providers, disclose information, or retain records subject to its notices, contracts, applicable law, and exceptions.
Evidence: FTC: Privacy and Security Enforcement ↗Step 4
Broker / aggregator
Data broker or enrichment intermediary
Some companies collect, combine, license, or sell personal information and profiles. Registry disclosures and enforcement records show examples, not a universal map of every data flow.
Evidence: CPPA: California Data Broker Registry ↗Step 5
Downstream use
Advertising, analytics, people search, or other buyer
Possible downstream uses include advertising, analytics, identity resolution, people-search products, risk decisions, or other commercial purposes. The use must be checked against the source disclosure or official record.
Evidence: FTC: Data broker and privacy enforcement materials ↗Step 6
Oversight and rights
Regulator, law, complaint, or deletion request
Privacy laws and regulators create rights, obligations, remedies, or complaint channels that vary by jurisdiction and data category. A deletion request does not automatically remove information from every independent source.
Evidence: CPPA: Information for data brokers / DROP ↗What to verify
- Who collected the information?
- What categories and purposes are disclosed?
- Who receives, licenses, or processes it?
What removal can do
A request can address the recipient covered by the request and applicable law. It does not automatically recall copies held by independent recipients or erase public records.