Data Brokers: Who Is Selling Your Personal Information in 2026

Every time you sign up for a loyalty card, apply for a mortgage, download a free app, or even just browse the web, someone is probably taking notes. Those notes get packaged, bundled, and sold on a vast and largely invisible market. The companies behind this trade are called data brokers, and in 2026 they represent one of the biggest—yet least understood—threats to personal privacy.

This guide breaks down who data brokers are, what they know about you, who buys the information, and what you can realistically do to limit the damage.

What Are Data Brokers?

Data brokers are companies that collect personal information about individuals from public and private sources, then package and sell it to third parties. They operate largely without the direct knowledge or consent of the people whose data they trade.

Unlike the apps and websites you interact with daily, data brokers rarely have a consumer-facing product. You never sign up for them. You never agree to their terms. Yet they likely hold hundreds or even thousands of data points about you—from your home address and income bracket to your health conditions, political leanings, and shopping habits.

The global data broker industry is estimated to be worth over $300 billion in 2026, with major players holding dossiers on billions of people worldwide.

Types of Data Brokers

People-search sites: Public-facing services like Spokeo, BeenVerified, and Whitepages that let anyone look up names, addresses, and phone numbers.
Marketing data brokers: Firms like Acxiom, Experian Marketing Services, and Epsilon that build consumer profiles for advertisers.
Risk-mitigation brokers: Companies like LexisNexis Risk Solutions that sell data to insurers, lenders, and employers for fraud and background checks.
Health data brokers: Firms like IQVIA that aggregate prescription and medical information.
Location data brokers: Companies such as Veraset and SafeGraph that specialize in GPS-tracked movement data.

How Data Brokers Collect Your Information

Data brokers rarely collect information directly from you. Instead, they aggregate it from dozens or hundreds of sources, then combine the pieces into a single detailed profile.

Common Data Sources

Public records: Court filings, property records, voter registrations, marriage and divorce records, business licenses.
Commercial transactions: Loyalty programs, warranty cards, magazine subscriptions, retail purchases.
Online tracking: Cookies, pixels, device fingerprinting, and tracking scripts embedded in millions of websites.
Mobile apps: SDKs built into free apps that quietly report location, contacts, and usage patterns back to third parties.
Social media: Publicly visible posts, profiles, friend lists, and engagement patterns.
Data partnerships: Deals between retailers, telcos, credit bureaus, and other brokers to swap or sell datasets.
Data breaches: Some brokers (and plenty of less reputable actors) incorporate leaked information from past breaches.

What Data Brokers Know About You

The scope of information held by major data brokers is staggering. A single profile may contain 1,500 or more individual data points, giving buyers an intimate portrait of who you are.

Categories of Collected Data

Category	Examples	Primary Source
Identity	Full name, aliases, date of birth, Social Security or national ID number	Public records, credit files
Contact	Home address, email addresses, phone numbers (current and historical)	Public records, commercial data
Financial	Estimated income, net worth, credit score range, debt levels, mortgage details	Credit bureaus, property records
Household	Marital status, number of children, ages of family members, pet ownership	Surveys, warranty cards, public records
Behavioral	Shopping habits, brand preferences, media consumption, hobbies	Loyalty programs, online tracking
Health	Inferred conditions, prescription patterns, wellness interests	Pharmacy data, app tracking, surveys
Location	Home, work, places visited, travel patterns	Mobile app SDKs, carrier data
Political & Religious	Party affiliation, donation history, inferred beliefs	Voter rolls, donation records, online activity

Who Buys Your Information?

The buyers of data broker information are far more varied than most people realize. It isn't just advertisers trying to sell you shoes.

Common Buyers

Advertisers and marketers: To target ads with precision, build lookalike audiences, and measure campaign performance.
Insurance companies: To assess risk and set premiums for auto, home, health, and life insurance.
Banks and lenders: For creditworthiness, fraud detection, and loan underwriting.
Employers and background check firms: To screen job candidates.
Landlords: To vet tenant applications.
Political campaigns: To micro-target voters with tailored messaging.
Government agencies: Including law enforcement, intelligence, and immigration services, which routinely purchase data they would otherwise need a warrant to obtain.
Scammers and stalkers: Low-cost people-search sites make it trivially easy for bad actors to locate someone.

Why This Matters: Real-World Harms

The sale of personal information is not a victimless administrative annoyance. It produces concrete harms every day.

Financial Discrimination

Insurers and lenders use broker data to score consumers based on factors that go far beyond traditional credit history. A profile that suggests you are a frequent takeaway buyer, drive at night, or live in a particular ZIP code can bump your premiums without you ever knowing why.

Identity Theft and Fraud

When data broker files leak—and they do, repeatedly—the information fuels identity theft, SIM-swapping attacks, and highly convincing phishing attempts. In 2024, a single breach at a background-check broker exposed personal details on nearly three billion individuals.

Stalking and Harassment

People-search sites make it alarmingly easy for abusers, stalkers, and harassers to find current addresses, phone numbers, and relatives of their targets. Journalists, activists, and domestic-violence survivors are especially at risk.

Government Surveillance

Agencies in multiple countries buy commercially available data to sidestep legal protections. If a warrant would be required to obtain your location history from a carrier, buying the same data from a broker often requires no court order at all.

Manipulation

Detailed psychographic profiles enable political campaigns and scammers alike to deliver highly tailored messages designed to exploit specific vulnerabilities—financial stress, health anxiety, loneliness, or ideological fears.

The Legal Landscape in 2026

Regulation of data brokers is uneven and lags far behind the industry's growth.

Regional Differences

Region	Key Regulation	Consumer Rights
European Union / UK	GDPR, UK GDPR	Right to access, delete, and object to processing; explicit consent required for sensitive data
California, USA	CCPA/CPRA, Delete Act (2026 rollout)	One-click deletion request to all registered brokers; right to opt out of sale
Other US states	Patchwork laws (Virginia, Colorado, Texas, Oregon, etc.)	Varies; most include opt-out of sale and limited deletion rights
Canada	PIPEDA, provincial laws	Right to access and challenge accuracy
Australia	Privacy Act (currently being reformed)	Access and correction rights, limited deletion
Brazil	LGPD	Comprehensive rights similar to GDPR

California's Delete Act is particularly notable: it requires data brokers to honor a single deletion request submitted through a state-run portal, forcing all registered brokers to purge your data at once. Several other jurisdictions are expected to follow this model.

How to Protect Yourself From Data Brokers

You cannot disappear from every database overnight, but you can meaningfully shrink your digital footprint with consistent effort.

1. Opt Out Directly

Every major broker is legally required (in most jurisdictions) to offer an opt-out. The process is deliberately tedious, but it works. Start with the largest players: Acxiom, LexisNexis, Epsilon, Oracle, Spokeo, BeenVerified, Whitepages, Intelius, and MyLife. Expect to repeat the process every 6–12 months, because brokers often re-add records from fresh public data pulls.

2. Use a Data Removal Service

Services like Incogni, DeleteMe, Kanary, and Optery automate opt-out requests across hundreds of brokers for an annual fee. They cannot catch everything, but they save enormous amounts of time.

3. Reduce New Data Collection

Use a privacy-focused browser such as Brave, Firefox with strict tracking protection, or LibreWolf.
Install a reputable ad and tracker blocker like uBlock Origin.
Enable encrypted DNS (DNS over HTTPS) to prevent your network provider from logging and selling your browsing history.
Use email aliases (SimpleLogin, Firefox Relay, Apple's Hide My Email) so sign-ups cannot be cross-referenced.
Avoid logging into accounts with Google or Facebook on third-party sites.
Review and revoke mobile app permissions, especially location, contacts, and advertising ID access.

4. Be Careful With Links You Share

Many shortened links sold by free services double as tracking tools, feeding behavioral data into the same ecosystem that supplies brokers. When sharing links—especially in public posts, newsletters, or professional contexts—use a privacy-respecting shortener that does not resell click data. Platforms like Lunyb focus on clean, trackable-for-you-only analytics without piping visitor profiles into third-party marketing stacks. If you want a wider comparison, our 2026 URL shortener buyer's guide breaks down which providers respect user privacy and which do not.

5. Lock Down Public Records Where Possible

Depending on your jurisdiction, you may be able to request address suppression on voter rolls (especially as a victim of harassment), use a registered agent for business filings, or set up a PO box for public-facing addresses.

6. Exercise Your Legal Rights

If you live in the EU, UK, California, Brazil, or another region with strong privacy laws, submit formal data subject access and deletion requests. Brokers often respond faster to legally framed requests than to casual opt-out forms.

What the Future Holds

The data broker industry is at an inflection point. On one side, regulators are catching up: more deletion registries, stricter rules around sensitive data (health, location, biometrics), and growing enforcement actions. On the other side, brokers are getting more sophisticated, using AI to infer sensitive attributes from innocuous signals, making "anonymous" data trivially re-identifiable.

In the next few years expect to see:

More US states adopting California-style universal deletion mechanisms.
Growing restrictions on government purchase of commercial data.
Lawsuits targeting brokers whose products enable stalking or discrimination.
Increased market demand for privacy-first alternatives to everyday online services.

The best defense remains a combination of regulatory pressure and personal vigilance. Every account you don't open, every tracker you block, and every opt-out you file chips away at the dossier someone is quietly building about you.

Frequently Asked Questions

How many data brokers are there?

Estimates vary, but there are roughly 4,000 to 5,000 companies worldwide that qualify as data brokers. California's registry alone lists over 500, and that only captures firms doing business in a single state. The true global number is likely much higher once niche and foreign brokers are included.

Is it legal for data brokers to sell my information?

In most countries, yes—provided they comply with applicable privacy laws. The GDPR and similar regimes require a lawful basis and give you strong rights to object and request deletion. In the United States, legality varies by state, but the baseline federal rules are weak, which is why brokers thrive there.

Can I remove myself from every data broker?

Realistically, no. New brokers appear constantly, and public records keep refilling the pipeline. However, you can remove yourself from the vast majority of consumer-facing people-search sites and significantly reduce your presence in marketing databases through consistent opt-outs and reduced data sharing going forward.

Are data removal services worth paying for?

For most people with limited time, yes. Services like DeleteMe, Incogni, and Optery handle the repetitive paperwork across hundreds of brokers. They typically cost $100–$180 per year. If you're comfortable spending a few hours per quarter, you can replicate most of their work manually at no cost.

How can I tell if my data has been sold or leaked?

Use tools like Have I Been Pwned to check for breaches tied to your email addresses. Search your name, phone number, and address on major people-search sites to see what is publicly visible. Monitor your credit reports, and pay attention to unusual spikes in targeted ads, spam calls, or phishing attempts—they often follow fresh data sales.