Data Brokers: Who Is Selling Your Personal Information in 2026

Every click you make, every store you visit, every form you fill out leaves a digital footprint. And somewhere, in a quiet office park or cloud server, a company you've never heard of is collecting that data, packaging it, and selling it to the highest bidder. These companies are called data brokers, and they power a shadow economy worth more than $250 billion globally.

If you've ever wondered why targeted ads feel eerily accurate, why spam calls know your name, or how a stranger can find your home address with a few keystrokes, the answer almost always leads back to data brokers selling personal information. This guide explains who they are, what they know about you, and how you can start taking your data back.

What Are Data Brokers?

Data brokers are companies that collect, aggregate, analyze, and sell personal information about consumers, usually without those consumers' direct knowledge or consent. They operate in the background of the digital economy, buying data from one source and selling it to another at a markup.

Unlike platforms you interact with directly, such as social networks or retailers, data brokers rarely have a consumer-facing product. Their customers are advertisers, insurance companies, employers, political campaigns, debt collectors, law enforcement agencies, and sometimes other brokers. The result is a sprawling, interconnected marketplace where your personal profile is traded thousands of times a day.

The Three Main Types of Data Brokers

1. Marketing data brokers: Compile consumer profiles for targeted advertising and lead generation. Examples include Acxiom, Epsilon, and Oracle Data Cloud.
2. People search sites: Publish personal information in searchable public databases. Examples include Spokeo, Whitepages, BeenVerified, and Intelius.
3. Risk mitigation and identity brokers: Sell data used for fraud prevention, credit decisioning, and background checks. Examples include LexisNexis Risk Solutions and CoreLogic.

How Data Brokers Collect Your Personal Information

Data brokers don't need to hack anyone. The majority of the information they hold is collected legally through a mix of public records, commercial partnerships, and online tracking. The scale is what makes it extraordinary.

Primary Collection Channels

• Public records: Property deeds, court filings, voter registrations, marriage and divorce records, professional licenses, and bankruptcy filings.
• Commercial sources: Retailers sell purchase histories, loyalty program data, warranty registrations, and subscription information.
• Web tracking: Cookies, pixels, fingerprinting scripts, and software development kits embedded in websites and mobile apps.
• Social media scraping: Publicly visible profiles, posts, friend lists, and interests are harvested at scale.
• Mobile device data: Location pings, Wi-Fi access points, Bluetooth beacons, and advertising identifiers.
• Data breaches and resales: Leaked data sometimes ends up legally repackaged by downstream brokers.

What Data Brokers Actually Know About You

The depth of a modern consumer profile can be unsettling. A typical broker file contains hundreds, sometimes thousands, of attributes tied to a single person. These attributes are organized into categories that advertisers and other buyers can query like a database.

Common Data Categories

Category	Examples of Data Points
Identity	Full name, aliases, date of birth, Social Security number fragments, government IDs
Contact	Home address, previous addresses, phone numbers, email addresses
Financial	Estimated income, credit score tier, mortgage status, investment behavior
Household	Marital status, children, pets, home value, vehicles owned
Behavioral	Shopping categories, brand preferences, media consumption, political leanings
Health inferences	Likely conditions, pregnancy status, prescription patterns, fitness activity
Location	Workplace, commute patterns, frequented businesses, travel history
Digital	Device IDs, IP addresses, browser fingerprints, social handles

Some brokers go further, assigning you to lifestyle segments with names like "Rural Everlasting," "Diabetes Interest," or "Financially Distressed." These categories can influence what prices you see online, which job ads you receive, and even whether certain services are offered to you at all.

Who Buys Personal Information from Data Brokers?

The buyer side of the data economy is almost as large as the broker side. Understanding who purchases your profile explains why so many organizations seem to know things you never told them.

Major Categories of Buyers

1. Advertisers and ad tech platforms: Use broker data to target campaigns and measure attribution.
2. Financial services: Insurance companies, lenders, and banks use broker data for underwriting and pricing.
3. Employers and recruiters: Background check providers rely on broker data to vet candidates.
4. Political campaigns: Micro-target voters based on inferred ideology, turnout likelihood, and issue priorities.
5. Government agencies: Law enforcement and intelligence agencies increasingly buy data they would otherwise need a warrant to obtain.
6. Scammers and fraudsters: People search sites make it trivial for bad actors to build dossiers on specific targets.

The Real-World Risks of Data Broker Exposure

It's easy to dismiss broker activity as harmless marketing, but the downstream consequences can be serious. The same data that powers a shoe advertisement can also fuel identity theft, stalking, discrimination, and emotional harm.

Documented Harms

• Identity theft: Fraudsters piece together broker data to pass knowledge-based authentication questions and open accounts in your name.
• Stalking and harassment: Abusive ex-partners and online harassers routinely use people search sites to locate victims.
• Price discrimination: Websites quietly adjust prices based on your inferred wealth, device, or location.
• Insurance and employment denials: Health inferences and credit-adjacent data can disqualify people without explanation.
• Scam targeting: Elderly and vulnerable consumers appear on "sucker lists" sold specifically to fraud operations.
• Doxing: Journalists, activists, and public figures face coordinated attacks fueled by broker data.

The Legal Landscape in 2026

Regulation is finally catching up with the data broker industry, but enforcement varies wildly by region. Knowing your rights is the first step to exercising them.

Key Regulations by Region

Region	Law	Key Rights
European Union	GDPR	Access, deletion, portability, objection to processing
United Kingdom	UK GDPR & Data Protection Act	Access, erasure, restriction, objection
California	CCPA / CPRA / Delete Act	Access, delete, opt-out of sale, universal deletion request
Other US States	Virginia, Colorado, Texas, Oregon, etc.	Varies: access, delete, opt-out of targeted advertising
Canada	PIPEDA	Access, correction, withdrawal of consent
Brazil	LGPD	Access, deletion, portability, revocation of consent
Australia	Privacy Act	Access, correction, complaint rights

California's Delete Act, which took effect for enforcement in 2026, is particularly notable. It requires registered data brokers to honor a single, universal deletion request submitted through a state-run portal, eliminating the need to contact each broker individually. Several other states are considering similar frameworks.

How to Remove Your Information from Data Brokers

Opting out is tedious but possible. Most brokers are legally required to provide a removal mechanism, even if they bury it behind confusing forms and verification hoops. A disciplined approach can meaningfully reduce your exposure within a few months.

Step-by-Step Opt-Out Process

1. Inventory your exposure. Search your name, phone number, and email on Google and major people search sites to see where you appear.
2. Prioritize high-risk brokers. Start with people search sites that publish addresses and phone numbers publicly.
3. Submit opt-out requests. Each broker has its own process. Expect to provide an email, verify identity, and sometimes mail a form.
4. Document everything. Keep a spreadsheet with dates, confirmation numbers, and follow-up deadlines.
5. Re-check every three to six months. Brokers frequently repopulate removed records from fresh data pulls.
6. Consider a removal service. Services like DeleteMe, Kanary, and Optery automate requests for a yearly fee if the manual process is overwhelming.

Major Brokers to Opt Out of First

• Spokeo
• Whitepages and Whitepages Premium
• BeenVerified
• Intelius
• PeopleFinder
• MyLife
• Radaris
• Acxiom (LiveRamp)
• Epsilon
• LexisNexis

How to Minimize Future Data Collection

Removing yourself from brokers is only half the battle. If you don't change your habits, your profile will be rebuilt within months. The goal is to reduce the raw material brokers depend on.

Practical Privacy Habits

1. Use email aliases. Services like Apple Hide My Email, SimpleLogin, and Firefox Relay let you create unique addresses for each signup, making it harder to link profiles.
2. Lock down mobile advertising IDs. On iOS, disable App Tracking Transparency. On Android, reset your advertising ID and opt out of personalized ads.
3. Choose a privacy-focused browser. Firefox, Brave, and Safari block significantly more trackers than default Chrome.
4. Use encrypted DNS. DNS-over-HTTPS providers like Cloudflare 1.1.1.1 or NextDNS reduce how much your network provider and third parties can log.
5. Limit social media visibility. Make profiles private, remove birth dates, and purge old location-tagged posts.
6. Freeze your credit. Credit freezes with the major bureaus prevent risk-mitigation brokers from pulling your file for most queries.
7. Pay with privacy-friendly methods. Virtual card numbers, prepaid cards, and cash reduce the purchase trails sold to marketing brokers.
8. Avoid loyalty programs that trade data. If the discount is paid for with your profile, consider whether it's worth it.
9. Shorten and track links carefully. When sharing links publicly, use a privacy-respecting shortener. Lunyb is one option that avoids the aggressive tracking common in older shorteners. For a broader comparison, see our 2026 URL shortener buyer's guide.

The Future of the Data Broker Industry

The next few years will reshape how brokers operate. Three trends are converging to force change: tighter regulation, consumer backlash, and the collapse of third-party cookies in major browsers. Expect more consolidation among brokers, more opaque server-side tracking, and more reliance on inferred data generated by machine learning rather than directly collected information.

On the positive side, universal opt-out signals like Global Privacy Control are gaining legal recognition, and services that make deletion easier are growing rapidly. The industry is unlikely to disappear, but the balance of power is slowly shifting toward consumers who are willing to assert their rights.

Frequently Asked Questions

Is it legal for data brokers to sell my personal information?

In most jurisdictions, yes, provided the broker complies with applicable privacy laws. In the EU, UK, Brazil, and a growing number of US states, you have the legal right to request access, correction, and deletion of your data. Brokers must honor these requests within specified timeframes, usually 30 to 45 days.

How much is my personal data worth to a broker?

Individually, surprisingly little. A single marketing profile might sell for a fraction of a cent per query, while a complete background report can go for $20 to $50. The industry's profitability comes from scale, selling billions of records to thousands of buyers rather than extracting high value from any one person.

Will opting out of data brokers really make a difference?

Yes, especially for people search sites that publish home addresses and phone numbers. Within three to six months of a thorough opt-out campaign, your public visibility drops substantially, reducing spam calls, stalking risk, and identity theft exposure. Marketing-side brokers are harder to escape fully, but every removal reduces your profile's completeness.

Can I sue a data broker for selling my information?

In limited cases, yes. Some laws, such as Illinois' Biometric Information Privacy Act and California's CCPA, provide private rights of action for specific violations. More commonly, you can file a complaint with a regulator like the FTC, state attorney general, or EU data protection authority, which may lead to enforcement action.

What's the single most effective step I can take today?

Freeze your credit with all three major credit bureaus and submit opt-out requests to the top five people search sites. These two actions take less than two hours combined and dramatically reduce the two most harmful downstream uses of broker data: identity theft and physical location exposure.

The data broker economy thrives on consumer inattention. By understanding who is selling your personal information, exercising your legal rights, and adopting a few sustainable privacy habits, you can meaningfully reclaim control over your digital shadow, one request at a time.