Data Brokers: Who Is Selling Your Personal Information in 2026

Every time you sign up for a loyalty card, download a free app, or browse a shopping site, invisible companies are watching. They collect your name, address, income, health interests, political leanings, and even your late-night search habits, then package that information and sell it to the highest bidder. These companies are called data brokers, and most people have never heard of them, even though the industry generates over $250 billion globally each year.

This guide explains exactly who data brokers are, how they get your personal information, who buys it, and what you can do to reduce your exposure.

What Are Data Brokers?

Data brokers are companies that collect personal information about consumers from public and private sources, aggregate that data into detailed profiles, and sell it to marketers, insurers, employers, law enforcement, political campaigns, and other businesses. Most operate without the direct knowledge or explicit consent of the people whose data they trade.

The industry is enormous. Firms like Acxiom, Experian, Equifax, LexisNexis, Oracle Data Cloud, and CoreLogic maintain files on billions of individuals. A single broker may hold thousands of data points per person, including your income bracket, medical conditions, family members, hobbies, religion, sexual orientation, purchase history, and geolocation patterns.

The Three Main Categories of Data Brokers

1. Marketing and advertising brokers — Sell profiles to advertisers so they can target ads with laser precision. Examples: Acxiom, Epsilon, Nielsen.
2. Risk mitigation brokers — Provide data to banks, insurers, and employers for background checks, fraud detection, and creditworthiness. Examples: LexisNexis Risk Solutions, TransUnion, Equifax.
3. People-search brokers — Publish personal information online, often making it searchable by anyone. Examples: Spokeo, Whitepages, BeenVerified, Radaris.

How Data Brokers Collect Your Personal Information

Data brokers do not usually hack you or breach systems. They buy, scrape, or license information from thousands of legal sources and combine it into a profile. Understanding these pipelines is the first step to closing them off.

Common Data Collection Sources

• Public records — Court filings, property deeds, voter registrations, marriage and divorce records, professional licenses, and bankruptcy filings.
• Mobile apps — Free weather, flashlight, fitness, and game apps often sell location, contacts, and device identifiers to broker networks.
• Website tracking — Cookies, pixels, and browser fingerprinting silently follow you across the web, feeding data to ad-tech partners who sell it onward.
• Loyalty and rewards programs — Grocery stores, pharmacies, and airlines routinely license purchase histories to third parties.
• Social media — Public posts, likes, friend lists, and inferred interests are scraped in bulk.
• Data partnerships — Brokers trade databases with each other to fill in gaps, so a leak at one company enriches dozens of others.
• Warranty cards, surveys, and sweepstakes — Those "win a car" entries at the mall almost always feed into broker databases.

Who Buys Data From Data Brokers?

The customer base is far broader than most consumers realize. It is not just retailers looking to sell you sneakers.

Buyer Type	Typical Use Case	Risk to You
Advertisers and marketers	Targeted ads, audience segmentation	Manipulation, price discrimination
Insurance companies	Setting premiums, denying coverage	Higher rates based on lifestyle inference
Employers and recruiters	Background checks, candidate screening	Rejection based on inaccurate data
Financial institutions	Credit scoring, loan decisions	Denied credit, unfavorable terms
Government agencies	Law enforcement, immigration, tax enforcement	Surveillance without a warrant
Political campaigns	Voter targeting, persuasion messaging	Micro-manipulation of political views
Scammers and fraudsters	Phishing, identity theft, romance scams	Financial loss, identity fraud
Stalkers and abusers	Locating individuals	Physical danger

What Kind of Personal Information Do Data Brokers Sell?

The depth of these profiles surprises most people the first time they see one. A single record typically includes:

• Full name, current and past addresses, phone numbers, and email addresses
• Date of birth, marital status, and household composition
• Income range, net worth estimates, and credit tier
• Occupation, employer, and professional history
• Ethnicity, religion, and inferred political affiliation
• Health conditions inferred from purchases and searches (diabetes, depression, pregnancy)
• Precise location history from mobile devices
• Vehicle ownership, property value, and mortgage details
• Shopping preferences, brand loyalty, and predicted lifetime value
• Relatives, roommates, and known associates

Some brokers segment people into categories with alarmingly specific labels: "financially struggling seniors," "rural and barely making it," "expectant parents," or "diabetes interest." These labels are then sold to companies who target those groups.

The Real-World Risks of Data Broker Activity

The data broker economy is not a victimless spreadsheet. It creates concrete harm in several ways.

1. Identity Theft and Fraud

Scammers routinely buy broker records to craft convincing phishing emails or answer security questions. When a fraudster already knows your mother's maiden name, previous street, and employer, resetting your bank password becomes trivial.

2. Price and Service Discrimination

Retailers use broker data to show different prices to different shoppers. Insurers charge more to people flagged as "high risk" based on grocery purchases. Lenders offer worse terms to consumers profiled as financially distressed, deepening cycles of debt.

3. Physical Safety Threats

People-search sites have been repeatedly used by stalkers, abusive ex-partners, and doxxing campaigns to locate victims. In several documented cases, this exposure has led to violence.

4. Government Surveillance Without a Warrant

Agencies that would normally need a court order to obtain location data or communications metadata simply buy it from brokers instead. This loophole has been used by federal law enforcement, immigration authorities, and military intelligence around the world.

5. Discrimination in Employment and Housing

Automated screening tools ingest broker data to score applicants. Errors in these files, and there are many, can silently disqualify you from a job or apartment without any ability to appeal or even know why.

The Legal Landscape: What Laws Actually Protect You?

Regulation lags far behind the industry, but the situation is improving in some regions.

United States

There is no comprehensive federal privacy law. Protections are patchwork:

• California (CCPA/CPRA) — Residents can request deletion and opt out of the sale of their data.
• Virginia, Colorado, Connecticut, Utah, Texas, and others — Have passed similar state laws.
• Vermont and California — Require data brokers to register publicly, creating a useful list of who to target for opt-outs.

European Union and United Kingdom

The GDPR and UK GDPR grant strong rights: access, correction, deletion ("right to be forgotten"), and objection to processing. Brokers operating in these jurisdictions must have a lawful basis and respond to requests within one month.

Other Regions

Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act reforms), Japan (APPI), and South Korea (PIPA) all have privacy frameworks that grant varying levels of control, though enforcement quality varies widely.

How to Remove Yourself From Data Broker Databases

Reducing your data broker footprint is time-consuming but achievable. Here is a practical, ordered process.

1. Search yourself first. Google your name, phone number, and email. Note which people-search sites appear in the top results — Spokeo, Whitepages, BeenVerified, Radaris, MyLife, PeopleFinder, and Intelius are the usual suspects.
2. Use each site's official opt-out page. Every major broker has one, though it is often buried. You will typically need to verify your identity and provide the URL of your listing.
3. Send GDPR or CCPA requests if you live in a covered jurisdiction. Templates are freely available online.
4. Register on the California Data Broker Registry to find a comprehensive list of registered brokers to contact.
5. Consider a paid removal service such as DeleteMe, Kanary, Optery, or Incogni if the manual process is overwhelming. These typically cost $80–$200 per year.
6. Repeat every 3 to 6 months. Brokers frequently re-list you after you disappear, because new data keeps flowing in from the sources you have not yet closed off.

How to Reduce the Data You Leak in the First Place

Removal is only half the battle. If you keep feeding the pipeline, you will keep reappearing. These habits meaningfully shrink your data footprint.

Practical Everyday Habits

• Use a private, tracker-blocking browser such as Brave, Firefox with strict tracking protection, or DuckDuckGo's browser.
• Switch to encrypted DNS (DNS over HTTPS or DNS over TLS) to prevent your internet provider from logging and monetizing your browsing.
• Use email aliases from services like SimpleLogin, AnonAddy, or Apple Hide My Email so each website receives a different address.
• Give a secondary phone number from Google Voice, MySudo, or a similar service when signing up for accounts.
• Deny app permissions aggressively. Most apps do not need your contacts, location, or microphone. Revoke access unless you actively use the feature.
• Skip loyalty programs or use a dedicated alias identity when the discount is worth it.
• Freeze your credit with all major bureaus. It is free and stops many downstream data uses.
• Use link tools that respect privacy. When sharing URLs, choose a shortener like Lunyb that focuses on secure redirects without aggressive third-party ad tracking. You can read our transparent honest review of Lunyb to understand how it compares.

Tools and Services Worth Considering

Category	Recommended Options	Approximate Cost
Broker removal	DeleteMe, Optery, Incogni, Kanary	$80–$200/year
Email aliases	SimpleLogin, AnonAddy, Fastmail Masked	Free–$30/year
Password manager	Bitwarden, 1Password, Proton Pass	Free–$60/year
Private browser	Brave, Firefox, Mullvad Browser	Free
Encrypted DNS	NextDNS, Quad9, Cloudflare 1.1.1.1	Free–$20/year
Credit freeze	Equifax, Experian, TransUnion	Free

The Future of the Data Broker Industry

The industry is at an inflection point. Regulators in the US, EU, and Asia are actively drafting stricter rules, especially around sensitive categories like health, location, and children's data. In 2024, the US Federal Trade Commission began aggressively pursuing brokers that sold precise location data without consent, and several states now prohibit the sale of health-related profiles.

At the same time, artificial intelligence has made the raw data more valuable than ever. Modern AI systems can combine anonymized fragments and re-identify individuals with unsettling accuracy, meaning yesterday's "safe" datasets are today's privacy landmines.

Expect three trends over the next few years:

1. Universal opt-out signals like Global Privacy Control will become legally binding in more jurisdictions.
2. Broker registries will expand beyond Vermont and California, creating clearer accountability.
3. Class-action lawsuits against brokers who sell sensitive data will multiply, pushing companies toward stricter internal policies.

Individual action still matters. Every opt-out you file, every alias you use, and every tracker you block chips away at the profile that brokers can build and sell.

Frequently Asked Questions

Is it legal for data brokers to sell my personal information?

In most countries, yes — with limits. In the US, most broker activity is legal at the federal level, though state laws in California, Virginia, Colorado, and others give residents the right to opt out. In the EU, UK, Brazil, and several other regions, brokers must have a clear lawful basis and honor deletion requests. Selling certain sensitive categories, such as precise location or children's data, is increasingly restricted or outright banned.

How do I find out what data brokers know about me?

Start by searching your name, phone number, and email address on Google. Then visit the top people-search sites (Spokeo, Whitepages, BeenVerified) to see your listing. If you are in a jurisdiction with data-access rights, send formal "subject access requests" or CCPA "right to know" requests to major brokers like Acxiom, LexisNexis, and Experian. They are legally required to disclose what they hold.

Are paid data broker removal services worth it?

For most people, yes — if you value your time. Services like DeleteMe, Optery, and Incogni scan hundreds of brokers and file removals on your behalf, then re-check every few months because listings return. Manual removal is free but requires several hours upfront and ongoing maintenance. If you have a public-facing job, are a domestic-violence survivor, or simply want peace of mind, the annual fee is a reasonable investment.

Can I stop data brokers from collecting information about me entirely?

Realistically, no — not while participating in modern digital life. Public records alone guarantee some baseline listing. However, you can dramatically shrink your profile by combining removal requests, private browsing habits, email and phone aliases, aggressive app-permission hygiene, and encrypted DNS. Most people who follow the steps in this guide reduce their exposure by 80 to 95 percent within six months.

What is the difference between a data broker and an advertiser?

An advertiser is a company trying to sell you something — a shoe brand, a car dealership, a streaming service. A data broker is the middleman that supplies advertisers (and many others) with the personal information used to target you. Advertisers usually do not build the underlying profiles themselves; they license the data from brokers. That is why opting out of a single ad platform is not enough — the source data keeps flowing from dozens of broker relationships behind the scenes.