Data Brokers: Who Is Selling Your Personal Information in 2026

Every time you sign up for a loyalty card, install a mobile app, browse a website, or register a product warranty, there's a strong chance that information doesn't stay with the company you shared it with. Instead, it travels through a vast, largely invisible industry: data brokers selling personal information to advertisers, insurers, political campaigns, employers, and even scammers.

This guide pulls back the curtain on how the data broker economy works, who the biggest players are, what they know about you, and what you can realistically do to limit the damage.

What Are Data Brokers?

Data brokers are companies that collect, aggregate, analyze, and resell personal information about individuals, usually without any direct relationship with the people whose data they trade. The U.S. Federal Trade Commission has estimated that the industry is worth more than $200 billion globally, and growing every year.

Unlike platforms you knowingly sign up for, like a social network or an email provider, data brokers operate quietly in the background. You rarely interact with them, yet they often hold hundreds, sometimes thousands, of individual data points on you.

Three Main Categories of Data Brokers

Marketing data brokers: Build consumer profiles for targeted advertising and audience segmentation (e.g., Acxiom, Epsilon, Oracle Data Cloud).
People-search sites: Publish searchable public profiles containing names, addresses, phone numbers, and relatives (e.g., Spokeo, Whitepages, BeenVerified, Radaris).
Risk and fraud brokers: Sell data to banks, insurers, landlords, and employers for background checks and risk scoring (e.g., LexisNexis Risk Solutions, CoreLogic, TransUnion's broker arm).

How Data Brokers Collect Your Personal Information

Data brokers don't typically hack anyone. They buy, scrape, and aggregate information from sources that are often perfectly legal, which is precisely what makes the industry so hard to regulate.

Common Collection Sources

Public records: Voter registration, court filings, property deeds, marriage and divorce records, business licenses.
Commercial transactions: Loyalty programs, warranty cards, magazine subscriptions, charity donations, retail purchase histories.
Online tracking: Cookies, pixels, fingerprinting scripts, and advertising SDKs embedded in websites and mobile apps.
Mobile app data: Location pings, device identifiers, contact lists, and app usage statistics sold by SDK providers.
Social media scraping: Public profiles, posts, friend networks, and job histories.
Data partnerships: Trades and purchases between brokers themselves, which multiply the reach of a single leak.

What a Typical Broker Profile Looks Like

A single broker file on an average adult may include:

Full name, aliases, and date of birth
Current and past addresses going back 20+ years
Phone numbers and email addresses (including "burner" ones linked back to you)
Relatives, roommates, and known associates
Estimated income, net worth, and credit tier
Religious and political leanings
Health conditions inferred from purchases and searches
Hobbies, pets, travel patterns, and shopping categories
Device identifiers and approximate real-time location history

Who Buys This Data (and Why)

Understanding the buyer side explains why the industry refuses to go away. There is simply enormous demand.

Buyer Type	Typical Use Case	Risk to You
Advertisers & brands	Targeted ads, lookalike audiences	Manipulative pricing, filter bubbles
Insurance companies	Risk scoring, premium adjustments	Higher premiums or denied coverage
Employers & recruiters	Background checks beyond credit reports	Hiring discrimination
Landlords	Tenant screening	Rental denials based on inaccurate data
Political campaigns	Microtargeted messaging	Voter manipulation
Government agencies	Surveillance workarounds	Bypassing warrant requirements
Scammers & stalkers	Phishing, identity theft, harassment	Financial and physical harm

The last row is the most alarming. Investigations have repeatedly shown that broker data purchased for a few hundred dollars has been used to locate domestic abuse survivors, out LGBTQ+ individuals, and run large-scale romance scams targeting the elderly.

The Biggest Data Brokers You've Never Heard Of

While names like Google and Meta dominate headlines, pure-play data brokers often fly under the radar despite handling just as much, or more, personal data.

Marketing & Consumer Data Giants

Acxiom (LiveRamp): Reportedly holds profiles on over 2.5 billion consumers worldwide.
Epsilon: Owned by Publicis, specializes in loyalty and transaction data.
Experian Marketing Services: The marketing arm of the credit bureau.
Oracle Advertising: Formerly BlueKai; aggregates audience data from thousands of sources.

People-Search Sites

Spokeo
Whitepages / Whitepages Premium
BeenVerified
Intelius
PeopleFinder
Radaris
MyLife

Risk & Identity Brokers

LexisNexis Risk Solutions: Used heavily by insurers and law enforcement.
CoreLogic: Property, mortgage, and household data.
Verisk Analytics: Insurance claim histories and risk modeling.

Why Data Brokers Are a Privacy and Security Problem

Even if you have "nothing to hide," the sheer concentration of personal data in broker databases creates systemic risks that affect everyone.

1. Aggregation Turns Harmless Data Into Dangerous Data

Your zip code is harmless. Your birth date is harmless. Your gender is harmless. But combined, those three fields alone can uniquely identify roughly 87% of Americans, according to landmark research by Latanya Sweeney. Brokers specialize in exactly this kind of aggregation.

2. Breaches Are Routine

Broker databases are high-value targets. The 2024 National Public Data breach exposed roughly 2.9 billion records containing Social Security numbers and historical addresses. Earlier incidents at Epsilon, Exactis (340 million records), and People Data Labs (1.2 billion records) show this is a pattern, not an exception.

3. Inaccurate Data Has Real Consequences

Broker records are notoriously inaccurate, yet they're used to make decisions about insurance rates, job offers, and loan approvals. Unlike formal credit reports, you often have no legal right to see or correct this data in most jurisdictions.

4. The Shortening of Shared Links Can Feed the Pipeline

Many free link shorteners embed trackers and sell click-level analytics to third parties, which eventually land in broker databases. Choosing a privacy-respecting shortener matters more than most people realize. Services like Lunyb are designed not to resell click data, which is one small but meaningful way to reduce your footprint, something we cover in detail in our honest Lunyb review.

How to Opt Out of Data Brokers (Step by Step)

Opting out is tedious but genuinely effective, especially for people-search sites that rank in Google results for your name.

Step 1: Start With the High-Visibility People-Search Sites

Search your own name in Google and note every people-search result on the first three pages.
Visit each site's opt-out page (usually buried in the footer under "Privacy" or "Do Not Sell My Info").
Submit the opt-out form. Most require you to verify by email; some require a photo ID.
Wait 7–30 days and recheck. Resubmit if your profile reappears, which is common.

Step 2: Submit CCPA / GDPR Deletion Requests

If you live in California, the EU, UK, Brazil, or several other jurisdictions, you have a legal right to demand deletion. Even if you don't, many brokers will honor requests from anyone.

Email their privacy address with the subject line "CCPA/GDPR Data Deletion Request."
Include your full name, known addresses, and a clear deletion demand.
Keep records; brokers must respond within 30–45 days depending on the law.

Step 3: Use the DMA and Industry Opt-Out Tools

DMAchoice.org: Reduces direct mail from member brokers.
YourAdChoices.com: Opts you out of behavioral advertising from participating companies.
Global Privacy Control (GPC): A browser signal that forces compliant sites to treat you as opted out.

Step 4: Consider a Paid Removal Service

If manual opt-outs feel overwhelming, services like DeleteMe, Kanary, Optery, and Incogni will handle hundreds of brokers for roughly $100–$180 per year. Independent tests show they typically remove 50–70% of listings within six months.

How to Reduce New Data Collection Going Forward

Opting out is only half the battle. You also need to stop feeding the machine.

Everyday Habits That Shrink Your Data Footprint

Use email aliases: Services like Apple Hide My Email, SimpleLogin, and Firefox Relay create disposable addresses per signup.
Give fake information for low-stakes signups: Loyalty cards and warranty forms rarely verify anything.
Switch to a privacy-respecting browser: Brave, Firefox with strict tracking protection, or Safari with iCloud Private Relay.
Enable encrypted DNS: Services like NextDNS or Cloudflare 1.1.1.1 block tracker domains network-wide.
Audit mobile app permissions quarterly: Revoke location, contacts, and background refresh for anything that doesn't absolutely need it.
Use privacy-first link tools: When sharing URLs, pick services that don't resell click data. Our 2026 URL shortener buyer's guide and Rebrandly review compare several options on exactly these criteria.
Freeze your credit: Free at all three U.S. bureaus; stops many risk-broker queries.

The Regulatory Landscape in 2026

Momentum against data brokers is finally picking up, though enforcement remains patchy.

Key Laws and Regulations

EU GDPR: Still the gold standard; requires lawful basis and grants deletion rights.
California CCPA/CPRA: Gives Californians the right to know, delete, and opt out of sale.
California Delete Act (2024): Creates a single statewide "delete all" mechanism for brokers by 2026.
Vermont, Texas, Oregon, and Colorado: Have introduced broker registration requirements.
U.S. Protecting Americans' Data from Foreign Adversaries Act (2024): Restricts broker sales to foreign entities of concern.
CFPB rulemaking: Proposed treating certain brokers as consumer reporting agencies under the Fair Credit Reporting Act.

Pros and Cons of the Data Broker Industry

To be fair, not all broker use cases are sinister. Here is a balanced view.

Pros

Enables fraud detection that protects consumers and businesses.
Supports legitimate journalism and public-interest investigations.
Helps charities and nonprofits reach relevant donors cost-effectively.
Reduces advertising waste, which keeps many free services free.

Cons

Operates without meaningful consent from most individuals.
Suffers frequent, massive breaches with little accountability.
Enables price discrimination, stalking, and voter manipulation.
Data accuracy is poor, but decisions based on it are often binding.
Opt-out burden is placed entirely on the consumer.

Frequently Asked Questions

Is it legal for data brokers to sell my personal information?

In most countries, yes, provided brokers follow applicable laws like GDPR in Europe or CCPA in California. The U.S. has no comprehensive federal privacy law, so broker activity is largely legal at the federal level, though a growing number of states regulate it. Sensitive categories like health, financial, and children's data have stricter rules.

How much is my personal data worth to a data broker?

Surprisingly little per individual. A basic consumer profile sells for a fraction of a cent to a few dollars, depending on the richness of the data and the buyer's use case. The industry profits through scale: billions of profiles sold millions of times. That's why brokers aggregate aggressively, more data points mean a higher price per profile.

Will opting out of data brokers actually work?

Yes, but it's a maintenance task, not a one-time fix. Most people-search sites honor opt-out requests within 30 days, but profiles often reappear because brokers continuously ingest new public records. Expect to repeat the process every 6–12 months, or use an automated removal service. Opt-outs are most effective for people-search sites and less effective for behind-the-scenes marketing brokers.

Can data brokers see what I do on specific websites?

Often, yes, indirectly. Many websites embed advertising pixels and SDKs that report browsing activity back to broker-affiliated networks. Even if a single site doesn't sell your data, the trackers it loads might. Using strict tracking protection, encrypted DNS, and privacy-respecting tools (including link shorteners) significantly reduces this flow.

What's the single most effective step I can take today?

Freeze your credit at all three major bureaus and remove yourself from the top 10 people-search sites that show up for your name in Google. These two actions eliminate the majority of practical risks, identity theft and public exposure, within a few hours of effort. Everything else is incremental improvement on top of that foundation.

Final Thoughts

The data broker industry has quietly become one of the most consequential forces shaping modern life, deciding what ads you see, what rates you pay, and sometimes even who hires you. You can't opt out of its existence, but you can meaningfully reduce how much it knows about you.

Start with the opt-outs that matter most, build better habits around what you share, and choose tools, from browsers to link shorteners to email providers, that treat your data as yours rather than inventory. The industry won't fix itself, but your personal footprint is still within your control.