Data Brokers: Who Is Selling Your Personal Information in 2026

Every time you fill out an online form, sign up for a loyalty card, or browse a website, pieces of your personal information are quietly collected, packaged, and sold. The companies behind this invisible marketplace are called data brokers, and they operate a global industry worth more than $300 billion. Yet most people have never heard of the companies that know their home address, income bracket, medical conditions, political leanings, and shopping habits.

This guide pulls back the curtain on data brokers selling personal information: who they are, how they get your data, who buys it, and most importantly, what you can do to limit their reach.

What Are Data Brokers?

Data brokers are companies that collect personal information about consumers from a wide range of sources, aggregate it into detailed profiles, and sell those profiles to third parties. Unlike the platforms you knowingly interact with (like social networks or retailers), data brokers typically have no direct relationship with the people whose data they trade.

They operate largely in the shadows, buying raw data from public records, apps, websites, loyalty programs, and other brokers, then enriching it with inferred attributes like "likely diabetic," "recently divorced," or "gun owner." The U.S. Federal Trade Commission estimates that a single broker may hold information on over 700 million consumers worldwide, with as many as 3,000 data points per person.

The Three Main Categories of Data Brokers

Marketing data brokers — Build audience segments for advertisers (e.g., Acxiom, Epsilon, Oracle Data Cloud).
People-search sites — Publish personal profiles online for anyone to find (e.g., Spokeo, Whitepages, BeenVerified).
Risk and fraud brokers — Supply data to banks, insurers, landlords, and employers (e.g., LexisNexis Risk Solutions, CoreLogic, Verisk).

How Data Brokers Collect Your Personal Information

Data brokers rarely steal information; they buy, scrape, and infer it from legal (though ethically murky) sources. Understanding the pipeline is the first step to shutting it off.

1. Public Records

Court filings, property deeds, voter registrations, marriage and divorce records, business licenses, and bankruptcy filings are all public. Brokers scrape government databases en masse and link these records to individuals.

2. Commercial Sources

Retailers sell purchase histories. Magazine publishers sell subscriber lists. Warranty-card data, loyalty program activity, and charitable donation histories all flow into broker databases through resale agreements.

3. Mobile Apps and SDKs

Many free apps embed software development kits (SDKs) that silently transmit location data, device identifiers, and behavioral information to brokers. A weather app or flashlight utility can quietly feed your precise GPS coordinates into advertising ecosystems.

4. Web Tracking

Cookies, pixels, fingerprinting scripts, and real-time bidding (RTB) systems leak browsing data to dozens of ad-tech firms every time a page loads. That data is aggregated and sold as audience segments.

5. Data Breaches and Leaks

Though reputable brokers deny using breached data, leaked databases regularly surface on secondary markets and get laundered into "enrichment" datasets that enter the mainstream broker supply chain.

6. Inference and Modeling

Brokers don't just collect facts — they predict them. Using machine learning, they infer income, health conditions, sexual orientation, political views, and purchase intent from indirect signals like zip code, browsing history, and device type.

The Biggest Data Brokers You Should Know

Below is a snapshot of major players in the data broker industry. Together, they influence what ads you see, what loans you qualify for, and sometimes even what jobs you're offered.

Company	Primary Business	Estimated Profiles	Headquarters
Acxiom (LiveRamp)	Marketing data and identity resolution	2.5 billion+	USA
Epsilon	Marketing, loyalty program data	250 million+ US	USA
Oracle Data Cloud	Audience data for digital ads	5 billion+ device IDs	USA
LexisNexis Risk Solutions	Risk assessment, fraud, insurance	Billions of records	USA/UK
Experian	Credit data, marketing lists	1 billion+ consumers	Ireland/UK
Equifax	Credit reporting, workforce data	820 million+	USA
CoreLogic	Property and financial data	4.5 billion+ records	USA
Spokeo	People search	600 million+ profiles	USA
Nielsen	Consumer behavior, TV viewership	Hundreds of millions	USA

Who Buys Your Personal Data?

The buyers of broker data span nearly every industry. Here's who's likely holding a dossier on you right now:

Advertisers and ad networks — To target campaigns down to individuals.
Banks and lenders — To score creditworthiness and detect fraud.
Insurance companies — To set premiums based on inferred risk.
Employers and background check services — To screen job candidates.
Landlords — To vet prospective tenants.
Political campaigns — To microtarget voters with tailored messaging.
Law enforcement and government agencies — To circumvent warrant requirements by simply buying what they'd otherwise need a court order to obtain.
Debt collectors and private investigators — To locate people.
Scammers and stalkers — Unfortunately, cheap people-search sites make harassment easy.

The Real-World Risks of Data Brokers Selling Personal Information

The harms of unchecked data brokerage go far beyond annoying ads.

Price Discrimination

Retailers and travel sites adjust prices based on your perceived willingness to pay. Two shoppers can see completely different prices for the same product on the same day.

Identity Theft and Fraud

Broker profiles contain exactly the information criminals need to answer security questions, open accounts, and impersonate victims.

Stalking and Physical Safety

People-search sites have been linked to tragic cases of stalking and violence. In 2020, a federal judge's son was murdered by a man who bought her home address from a data broker.

Discrimination

Insurance premiums, loan approvals, housing decisions, and hiring choices can all be shaped by broker data — including inferences based on race, health, and sexuality that would be illegal to ask about directly.

Government Surveillance

Multiple investigations have revealed that U.S. agencies, including the IRS, DHS, and military, have purchased location and identity data from brokers to sidestep constitutional protections.

The Legal Landscape in 2026

Regulation is finally catching up — slowly and unevenly.

United States

There's still no comprehensive federal privacy law, but state laws are expanding. California (CCPA/CPRA), Texas, Colorado, Virginia, and more than a dozen other states now grant residents the right to access, delete, and opt out of the sale of their data. California and Vermont also require data brokers to register publicly, giving consumers at least a directory of who to contact.

European Union and United Kingdom

The GDPR and UK GDPR treat most broker activity as requiring a lawful basis and give individuals strong rights to access and erase their data. Enforcement has produced multi-million-euro fines against brokers who ignored requests.

Other Regions

Brazil (LGPD), Canada (PIPEDA, with reforms pending), Australia (Privacy Act reforms), Japan, South Korea, and India (DPDP Act) have all tightened rules. However, enforcement capacity varies widely, and cross-border data flows remain a loophole.

How to Remove Yourself from Data Broker Databases

You have more power than you might think. Here's a practical, prioritized plan.

Step 1: Identify the Brokers Holding Your Data

Start with the California and Vermont data broker registries — both are public and list hundreds of companies. Search for your name on major people-search sites like Spokeo, BeenVerified, Whitepages, MyLife, and Radaris to confirm you have a profile.

Step 2: Submit Opt-Out Requests

Each broker has its own opt-out process, usually buried in a privacy policy footer. Some require email, some require a web form, and a few still demand postal mail or ID verification. Keep records of every request.

Step 3: Use a Removal Service (Optional)

Services like DeleteMe, Kanary, Optery, and Incogni handle opt-outs on your behalf, typically for $100–$200 per year. They don't catch everything, but they dramatically reduce the manual workload.

Step 4: Exercise Your Legal Rights

If you live in the EU, UK, California, or another jurisdiction with strong privacy law, submit formal Data Subject Access Requests (DSARs) and deletion requests. Brokers that ignore them can be reported to regulators.

Step 5: Prevent Future Collection

Use a privacy-respecting browser like Brave, Firefox with strict tracking protection, or LibreWolf.
Install content blockers such as uBlock Origin.
Switch to encrypted DNS (DNS over HTTPS) providers like Quad9 or NextDNS to block tracker domains network-wide.
Use email aliases (SimpleLogin, Firefox Relay, DuckDuckGo Email Protection) to break the link between your identity and signups.
Use privacy-respecting link tools when sharing URLs. For example, Lunyb is a URL shortener built with minimal data collection in mind — a useful alternative to trackers-heavy alternatives. You can learn more in our honest review of Lunyb.
Audit app permissions, especially location, contacts, and background activity.
Opt out of loyalty programs you don't truly use.

Step 6: Repeat Regularly

Brokers frequently re-add profiles after removal, especially when new public records appear. Plan to repeat the opt-out cycle every 6 to 12 months.

How Businesses Can Reduce Their Role in the Data Broker Ecosystem

If you run a website or business, you may be feeding brokers without realizing it. A few steps make a real difference:

Audit third-party scripts and SDKs — remove anything that isn't essential.
Choose privacy-respecting analytics (Plausible, Fathom, Simple Analytics).
Use first-party, cookieless tools where possible.
Use link shorteners and marketing tools that don't resell click data. Our review of Rebrandly vs. Lunyb compares options.
Publish a clear privacy policy and honor deletion requests promptly.

The Future of Data Brokerage

Three trends will shape the next few years:

The death of third-party cookies is pushing brokers toward first-party data partnerships and server-side tracking — less visible, but no less invasive.
AI-generated inferences are replacing explicit data points. Brokers increasingly sell predictions ("likely to churn," "likely pregnant") rather than raw facts, making opt-outs less effective.
Stronger laws are coming. The U.S. is inching toward federal privacy legislation, and existing state laws keep expanding. Expect more brokers to be forced into transparency.

Frequently Asked Questions

Is it legal for data brokers to sell my personal information?

In most countries, yes — though with limits. In the U.S., selling personal data is generally legal but increasingly regulated at the state level. In the EU, UK, Brazil, and similar jurisdictions, brokers need a lawful basis (usually consent or legitimate interest) and must honor opt-out and deletion requests.

How do I find out what data brokers know about me?

Start with the California and Vermont data broker registries, then submit access requests to the major players like Acxiom, Experian, LexisNexis, and the top people-search sites. Under GDPR or CCPA, they're required to disclose what they hold.

Do data broker removal services actually work?

They work reasonably well for people-search sites and larger marketing brokers, but no service catches 100% of them. Expect removal of 60–80% of profiles initially, with ongoing re-removals needed as brokers re-scrape data.

Can I sue a data broker?

In some jurisdictions, yes. California's CCPA allows private lawsuits for certain data breaches. The EU's GDPR allows individuals to seek compensation for violations. Class actions against brokers have resulted in significant settlements, particularly in the U.S.

What's the single most effective thing I can do today?

Switch to a privacy-respecting browser with tracker blocking and enable encrypted DNS. This single change stops a huge fraction of ongoing data collection immediately, giving your opt-out efforts time to stick.

Final Thoughts

Data brokers selling personal information isn't going away, but the days of operating completely in the dark are ending. Regulation is tightening, consumer awareness is rising, and the tools for pushing back are getting better every year. You won't achieve perfect privacy, but with a couple of weekends of focused effort — plus smarter day-to-day habits — you can reclaim a meaningful amount of control over your digital shadow.

Start with the opt-outs, lock down your browser, and choose tools built with privacy in mind. Every data point you take off the market is one fewer that can be used against you.