Data Brokers: Who Is Selling Your Personal Information in 2026

Every time you browse a website, download an app, sign up for a loyalty card, or even register to vote, someone is likely taking notes. That someone is often a data broker — a company you've probably never heard of, yet one that knows your home address, income bracket, health conditions, shopping habits, and political leanings. The global data broker industry is worth more than $300 billion in 2026, and it runs almost entirely in the shadows.

This guide explains exactly who is selling your personal information, how the trade works, which companies dominate the market, and what you can realistically do to limit your exposure.

What Are Data Brokers?

Data brokers are companies that collect personal information about consumers from public and private sources, then package and sell that information to third parties. They operate largely without direct interaction with the people whose data they trade, which is what makes the industry so controversial.

Unlike companies you knowingly share data with — such as your bank or email provider — data brokers acquire information about you from hundreds of indirect sources, combine it into detailed profiles, and license those profiles to marketers, insurers, employers, political campaigns, law enforcement agencies, and even stalkers willing to pay.

The Three Main Types of Data Brokers

Marketing data brokers — Build consumer profiles for advertising, segmentation, and lead generation (e.g., Acxiom, Epsilon).
People-search sites — Compile publicly accessible records into searchable profiles anyone can buy (e.g., Spokeo, BeenVerified, Whitepages).
Risk mitigation brokers — Sell data to banks, insurers, and employers for background checks, fraud detection, and underwriting (e.g., LexisNexis, CoreLogic).

How Data Brokers Collect Your Personal Information

Data brokers don't need to hack anyone. Most of what they know about you comes from sources that are either public, semi-public, or legally licensed. Here's where the raw material comes from:

1. Public Records

Court filings, property deeds, marriage and divorce records, voter registrations, professional licenses, and bankruptcy filings are all part of the public record in most jurisdictions. Brokers scrape these continuously.

2. Commercial Sources

Retailers, catalog companies, magazine subscriptions, loyalty programs, and warranty registration cards routinely sell or share customer lists. That "free" membership card at your grocery store is often funded by data resale.

3. Online Tracking

Cookies, tracking pixels, mobile ad IDs, browser fingerprints, and software development kits (SDKs) embedded in apps feed a constant stream of behavioral data into broker databases. A single news article you read can trigger notifications to dozens of brokers.

4. Social Media Scraping

Public posts, likes, follower lists, and profile details are harvested by bots and compiled into psychographic profiles — sometimes in violation of platform terms, often not.

5. Data Breaches and Leaked Databases

While reputable brokers claim not to use breached data, the line between legitimate acquisition and recycled leaked data is frequently blurred, especially in secondary markets.

6. Partnerships and Data Co-ops

Brokers trade data with each other, enriching their own profiles with fields they couldn't collect alone. A profile that starts with just your email can grow into a 1,500-attribute dossier through co-op enrichment.

The Biggest Data Brokers in 2026

The industry has consolidated significantly over the past decade, but several dominant players continue to shape the global market. Here's a comparison of the most influential companies:

Company	Primary Focus	Approx. Profiles	Headquarters	Annual Revenue
Acxiom (LiveRamp)	Marketing data, identity resolution	2.5 billion	USA	~$650M
Experian	Credit, marketing, risk	1 billion+	Ireland/UK	~$7B
Equifax	Credit, employment verification	820 million	USA	~$5.7B
LexisNexis Risk Solutions	Legal, insurance, law enforcement	500 million+	USA/UK	~$3B
Oracle Data Cloud	Advertising audiences	2 billion+	USA	Part of Oracle
Epsilon (Publicis)	Email, direct marketing	250 million	USA/France	~$2B
CoreLogic	Property, financial	Billions of records	USA	~$1.7B
Spokeo	People search	600 million	USA	Private

Beyond the giants, there are an estimated 4,000 to 5,000 data broker companies worldwide, most operating with minimal public visibility.

What Data Brokers Actually Know About You

A single consumer profile sold by a major broker can include hundreds or even thousands of individual attributes. These typically fall into the following categories:

Identity data: Full name, aliases, date of birth, Social Security or national ID number, driver's license, passport number.
Contact data: Current and previous addresses, phone numbers, email addresses (personal and work).
Financial data: Estimated income, credit score tier, mortgage status, investments, debts, bankruptcy history.
Household data: Marital status, number of children and their ages, pets, home value, vehicles owned.
Behavioral data: Purchase history, websites visited, apps installed, search queries, streaming habits.
Health inferences: Likelihood of conditions like diabetes, depression, pregnancy, erectile dysfunction — inferred from purchases, searches, and demographics.
Political and religious inferences: Likely party affiliation, donation history, faith, cause support.
Location history: Workplace, gym, places of worship, travel patterns (from mobile ad IDs).

Perhaps the most unsettling category is inferred data — attributes brokers calculate about you using machine learning, which may be entirely wrong but still influence decisions about credit, employment, and insurance.

Who Buys This Data — And Why

Understanding the buyer side of the market reveals why the industry is so hard to reform.

Advertisers and Marketers

By far the largest customer base. Brands use broker data to target ads, personalize offers, and measure campaign effectiveness across channels.

Financial Institutions

Banks, credit card companies, and lenders use broker data for underwriting, fraud detection, pre-approval mailings, and collections.

Insurance Companies

Health, auto, home, and life insurers increasingly use lifestyle and behavioral data to set premiums — a practice that raises serious discrimination concerns.

Employers and Background Check Firms

HR departments and screening services pull broker data to vet candidates, sometimes going well beyond what an applicant has disclosed.

Political Campaigns

Microtargeted political advertising, voter persuasion models, and get-out-the-vote operations rely heavily on commercial data brokers.

Governments and Law Enforcement

Agencies worldwide increasingly purchase commercial data to sidestep warrant requirements — a legal gray area known as the "data broker loophole."

Private Investigators, Debt Collectors, and Scammers

At the shadier end of the market, people-search sites make it trivially easy to locate individuals, which fuels harassment, stalking, and identity theft.

The Real Risks of Data Broker Surveillance

It's tempting to shrug off data collection as the cost of a connected life, but the consequences are concrete:

Price discrimination: You may pay more for the same product because an algorithm decides you're willing to.
Denied opportunities: Jobs, apartments, loans, and insurance can quietly slip away based on inferred attributes you never consented to share.
Identity theft and fraud: The more data points floating around about you, the easier it is for attackers to answer security questions or impersonate you.
Physical safety: Domestic abuse survivors, journalists, judges, and activists have been tracked and attacked using data purchased from people-search sites.
Chilling effects on speech: Knowing your political donations, religious attendance, or reading habits are for sale changes what you're willing to do in public.

The Legal Landscape in 2026

Regulation has slowly caught up, but enforcement remains patchy.

European Union — GDPR

The General Data Protection Regulation gives EU residents strong rights to access, correct, and delete personal data. Brokers operating in the EU must have a lawful basis for processing, and fines have reached hundreds of millions of euros.

United States — A Patchwork

There is still no federal privacy law, but California (CCPA/CPRA), Virginia, Colorado, Connecticut, Texas, and over a dozen other states have passed consumer privacy laws. California also maintains a public data broker registry, as do Vermont and Oregon.

United Kingdom — UK GDPR and the DPDI Act

The UK retained GDPR-equivalent protections and added the Data Protection and Digital Information Act, which rebalances some rules for businesses while preserving core individual rights.

Other Regions

Brazil's LGPD, Canada's PIPEDA (and the pending CPPA), Australia's Privacy Act reforms, India's DPDP Act, and Japan's APPI all provide varying degrees of protection — but enforcement against brokers specifically is rare.

How to Reduce Your Data Broker Footprint

You can't disappear from broker databases entirely, but you can significantly reduce your exposure with consistent effort.

1. Submit Opt-Out Requests

Most major brokers offer opt-out forms, though they are often buried. Start with Acxiom, Epsilon, LexisNexis, Oracle, Spokeo, BeenVerified, Whitepages, and Intelius. Expect to repeat this process every 6–12 months, because data flows back in from new sources.

2. Use a Data Removal Service

Services like DeleteMe, Kanary, Optery, and Incogni automate opt-outs across hundreds of brokers for an annual fee. They're not perfect, but they save enormous amounts of time.

3. Lock Down Your Browser

Use a privacy-focused browser (Brave, Firefox with strict tracking protection, or LibreWolf), block third-party cookies, install uBlock Origin, and enable encrypted DNS (DoH or DoT) to reduce ambient tracking.

4. Minimize App Permissions

Reset your mobile advertising ID regularly, deny location access to apps that don't need it, and uninstall apps you no longer use — many continue sending data in the background.

5. Be Careful What You Share Online

When you share links on social platforms, forums, or messaging apps, use a privacy-respecting link shortener such as Lunyb instead of trackers that log every click. You can read our honest review of Lunyb or compare it with alternatives in our 2026 URL shortener buyer's guide.

6. Use Email Aliases and Masked Phone Numbers

Services like SimpleLogin, Addy.io, Firefox Relay, and iCloud Hide My Email let you give out disposable addresses that can't be easily linked back to your real identity.

7. Exercise Your Legal Rights

If you live in a jurisdiction with privacy laws (EU, UK, California, etc.), submit formal data subject access and deletion requests. Non-response or inadequate response is itself a reportable violation.

8. Freeze Your Credit

A credit freeze at the major bureaus (Equifax, Experian, TransUnion) blocks most pre-approved offers that rely on broker data, and prevents new accounts being opened in your name.

The Future of the Data Broker Industry

Three trends are reshaping the industry in 2026 and beyond:

Regulatory tightening: More jurisdictions are passing comprehensive privacy laws, and enforcement is slowly becoming more aggressive. The U.S. FTC has started suing brokers over sensitive categories like location and health data.

The cookie-less web: As third-party cookies fade, brokers are shifting to identity graphs, server-side tracking, and clean rooms — which may actually make the industry more opaque, not less.

AI-driven inference: Machine learning allows brokers to predict attributes they couldn't previously observe, meaning even careful consumers end up profiled based on people who resemble them.

The result is an ongoing arms race. Individual action matters, but so does collective pressure for stronger laws, meaningful enforcement, and corporate accountability.

Frequently Asked Questions

Is it legal for data brokers to sell my personal information?

In most countries, yes — provided they comply with applicable privacy laws. In the EU and UK, brokers must have a lawful basis under GDPR. In the U.S., it's generally legal unless the data falls into a protected category (like health data covered by HIPAA or children's data under COPPA), though state laws are rapidly adding restrictions.

How do I find out what data brokers have on me?

Submit a Data Subject Access Request (DSAR) to major brokers. In the EU/UK this is a legal right under GDPR. In California and several other U.S. states, the "right to know" offers similar access. Expect responses within 30–45 days, though completeness varies.

Can I completely remove myself from data broker databases?

Realistically, no. You can dramatically reduce your presence through opt-outs and removal services, but new data flows in constantly from public records, purchases, and online activity. Think of it as ongoing maintenance rather than a one-time cleanup.

Are free people-search sites data brokers?

Yes. Sites like Spokeo, Whitepages, BeenVerified, Intelius, and TruePeopleSearch are all classified as data brokers. They aggregate public records and commercial data into searchable profiles, usually offering a free teaser and charging for the full report.

Does deleting my social media accounts stop data brokers?

It helps, but only partially. Historical data already scraped from your profiles is unlikely to disappear from broker databases. Brokers also pull from many other sources — public records, purchases, mobile apps — so social media deletion alone is far from sufficient.

What's the single most effective thing I can do today?

Submit opt-out requests to the top 10–20 major brokers (or subscribe to a removal service for a year), freeze your credit at the three bureaus, and switch to a privacy-focused browser with tracking protection enabled. Those three steps eliminate the majority of everyday exposure for most people.