Data brokers gather personal information from public records, apps, stores and websites, merge it into a profile of you, and sell or license that profile to other businesses. You never deal with them directly, which is why most people have no idea it is happening. Don’t panic. You can’t erase the fact that this data exists, but you can shrink your exposure a lot, and the steps below take minutes, not days.
TL;DR
- Data brokers collect data from government records, retailers, apps, social media and other brokers, then combine it into one profile per person.
- They sell those profiles for marketing, identity checks, risk scoring and people-search reports. Anyone willing to pay can buy some of them.
- Opting out of one broker does not clear you from the rest, because brokers buy from each other. Removal is a recurring job.
- ⏱️ Do two things first: freeze your credit at all three bureaus (free, about 15 minutes) and start opt-out requests with the biggest people-search sites.
- A removal service can automate the repeat work. Doing it yourself is free but slow.
Table of Contents
- What a data broker actually is
- Where the data comes from
- How the profile gets built and sold
- Who buys it and why it matters to you
- What the law lets you do
- Why opting out is never one-and-done
- What to do now: a 5-step plan
- DIY or a removal service?
- Our view: what we see after testing privacy tools
- Compare removal tools in one place
- FAQ
- Sources
What a data broker actually is
A data broker, also called an information broker or reseller, is a business that collects large amounts of personal information about consumers, analyzes and aggregates it, then sells or licenses it. California’s privacy agency describes it more plainly: a business that gathers and sells consumer information the consumer didn’t give it directly.
That last part matters. When you hand your email to a store, you know who has it. A broker’s customer is not you, and its supply chain runs through other companies. The Federal Trade Commission told Congress that a core problem for consumers is that brokers operate without direct interaction, so people rarely know their data is being gathered and traded.
Brokers come in a few types:
- Marketing data brokers build audience segments for advertisers.
- Risk and verification brokers support identity checks, fraud screening and underwriting.
- People-search sites turn the data into searchable reports about named individuals.
The last group is the one most readers meet first, because your name, city and relatives show up in a Google search.
Where the data comes from
Brokers pull from many places at once. Think of your data trail in layers.
Public records
Government records are the base layer. For people-search sites the FTC says information can come from federal, state and local public records, which can include your age, date of birth, past names and addresses. Property records, court filings and voter files are typical examples.
Commercial and online activity
The research behind this guide lists government records, social media and commercial retailers as inputs. In practice that means purchase history, loyalty programs, website tracking, mobile apps and location data. A free app that asks for location access may be one link in the chain.
Other brokers
This is the part people miss. Brokers buy from and sell to each other. People-search sites, for example, may buy information from other data brokers as well as scrape public social profiles. That is why one record can sit in dozens of databases.
Breaches
Data exposed in breaches can also end up circulating. If you want to know how that raises your risk, read how a breach affects your identity risk.
How the profile gets built and sold
Here is the pipeline in four steps.
- Collect. Raw records arrive from the sources above, in different formats and with different spellings of your name.
- Match. The broker links records using identifiers such as name, address, phone, email and device IDs, so “Jon A. Smith” and “Jonathan Smith” at the same address become one person.
- Enrich and infer. Analytics fill gaps. Experts note that brokers use advanced AI to infer sensitive details, such as political beliefs, health conditions or likely future purchases. Those guesses can be wrong.
- Sell or license. Buyers get the data as lists, audience segments, API access or one-off reports.
The scale is large. Brokers hold thousands of data points per person, from basic contact details to sensitive health, political and GPS location data, according to TechTarget’s definition.
Who buys it and why it matters to you
Buyers include advertisers, retailers, lenders, insurers, employers, landlords and, on people-search sites, ordinary members of the public. The legitimate uses are real: fraud checks and identity verification are part of the business.
The risks are also real:
- ⚠️ Scams and fraud. The same profile that helps a marketer can help a scammer find your address, phone number and relatives.
- ⚠️ Wrong inferences. Inaccurate assessments can affect access to credit, insurance or jobs.
- ⚠️ Errors in criminal and court data. The FTC’s identity theft recovery guide notes that information brokers buy criminal records and sell information to employers, and tells victims to write to brokers to ask them to remove errors from their file.
- ⚠️ Harassment and safety. A home address in a public report is a problem for anyone with a stalker or a difficult ex.
Can data brokers sell your SSN?
People ask this often. Privacy.ca.gov lists Social Security numbers among the sensitive information some brokers collect and sell. Whether a specific broker offers it depends on the company, the buyer and the laws that apply. Treat your SSN as exposed if it has appeared in a breach, and lock down your credit (more below).
What the law lets you do
There is no single federal opt-out button for the whole industry. Your rights depend on where you live. Some states give residents a right to request deletion or opt out of the sale of their data. Our guide to state privacy laws and broker removal explains how those rules play out in practice.
California is the furthest along. Under the Delete Act, California residents could start registering for a one-stop deletion platform called DROP on January 1, 2026, and registered data brokers must process those requests starting August 1, 2026, with fines of $200 per request per day for noncompliance. If you live in California, this is the first place to go. If you live elsewhere, you still have opt-out forms on individual broker sites.
Why opting out is never one-and-done
Many people believe that one opt-out wipes the slate. It doesn’t. Because brokers buy and aggregate from one another, your information likely sits in dozens of other databases that each need their own request, and often repeat requests.
Privacy advocates put it this way: you can’t delete the fact that your data exists, but systematic opt-outs can significantly reduce its visibility and make your profile harder to aggregate and sell. That is a realistic goal. Aim for less exposure, not zero.
Also know what a freeze does not do. A credit freeze stops new-account fraud, but it does not stop brokers from collecting and selling your purchase habits, browsing history or location data. You need both layers.
What to do now: a 5-step plan
1. Freeze your credit (⏱️ 15 minutes)
A credit freeze is the best way to protect against an identity thief opening new accounts in your name, according to the FTC. Place one at Equifax, Experian and TransUnion. It’s free, it lasts until you lift it, and you can lift it temporarily when you apply for credit. Our credit freeze guide walks through each bureau. Parents can also freeze a child’s credit at all three bureaus in one session.
2. Check your credit reports (⏱️ 10 minutes)
You’re entitled to a free report from each bureau every 12 months, and the FTC says you can currently check them weekly for free at AnnualCreditReport.com. Look for accounts you don’t recognize.
3. Find yourself first (⏱️ 20 minutes)
Search your name plus your city, then your phone number and email. Note which people-search sites list you. Those are your first opt-out targets, since they are open to anyone.
4. Submit opt-outs (⏱️ 1 to 3 hours the first time)
Use each site’s opt-out or “do not sell” page. Save confirmation emails and a spreadsheet with dates. If you’re in California, register with DROP. For a worked example, see our Spokeo removal action plan, and for the wider picture, how to remove yourself from the internet. After removal you’ll notice changes in what appears when someone searches you, which we cover in what broker removal does to your search results.
5. Repeat and tighten (⏱️ 30 minutes a quarter)
Re-check every three months. Records reappear when brokers re-buy data. Also cut the supply: limit app location permissions, use a separate email for shopping, and use a password manager so one breach doesn’t open every account. Our identity protection checklist for adults bundles these habits.
✅ If your data was already exposed in a breach or you suspect fraud, go to IdentityTheft.gov. It provides a free, personalized recovery plan. Then follow our identity theft recovery steps.
DIY or a removal service?
Doing it yourself costs nothing but time, and the repeat cycle is what wears people down. A paid service submits and re-submits requests for you. It makes the most sense if you’re in many databases, you have a safety reason to stay off people-search sites, or you simply won’t keep up a quarterly routine. A service can’t promise a clean record, since brokers keep re-collecting data, so look for one that reports what it removed and re-checks on a schedule.
We break down the trade-offs in is a data removal service worth it.
Our view: what we see after testing privacy tools
We review privacy services hands-on, with real accounts, and we don’t take paid rankings. Rankings come from performance, not payouts, and we update reviews monthly. That testing has shaped how we think about data brokers.
First, the biggest mistake is treating removal as an event. The readers who stay protected treat it as maintenance, like changing a furnace filter. Second, free steps come first. A credit freeze costs nothing and blocks the most damaging outcome, new-account fraud, so do it before you pay anyone for anything. Third, vendor claims about “removing everything” deserve skepticism. Brokers refill from each other, so the useful questions are how many sites a tool covers, how often it re-checks and whether it shows proof.
We also earn affiliate commissions when readers sign up for services we recommend. That’s why we state our testing method openly and keep rankings tied to measured results.
— TechStackTeam
Compare removal tools in one place
If you’d rather hand off the repeat work, start with our data removal service reviews and comparisons, then see the privacy tools comparison checklist to match features to your needs. You can browse everything else from the TechStackToday homepage.
FAQ
What do data brokers use your data for?
Mostly marketing, identity verification, fraud screening and risk assessment, plus people-search reports sold to the public. Advertisers use the profiles to target ads, and lenders or insurers may use them in risk models. The same data can also be misused by scammers.
Is it legal for data brokers to sell my information?
In most of the US, yes, with limits that vary by state and by type of data. Some states let you opt out or request deletion, and California has a registration and deletion platform for its residents. Check our state privacy law guide for how your state’s rules work.
How do you become a data broker?
There’s no federal license. A business becomes a broker by collecting and selling personal data it didn’t get directly from consumers. In California, those businesses must register and process deletion requests through the state’s platform.
Does a credit freeze stop data brokers?
No. A freeze blocks new credit accounts in your name, but brokers can still collect and sell non-financial data like purchase habits and location. Use a freeze for fraud protection and opt-outs for exposure.
How long does it take to get removed?
It varies by broker. Many process requests within days to weeks, and some require email confirmation. Keep records of every request and re-check quarterly, because listings can return.
Sources
- What is a data broker (information broker)? | TechTarget
- Personal information and data brokers | privacy.ca.gov
- FTC prepared statement on what information data brokers have on consumers
- What To Know About People Search Sites That Sell Your Information | FTC
- Is a credit freeze or fraud alert right for you? | FTC
- How to recover from identity theft | FTC
- IdentityTheft.gov A Recovery Guide | FTC
- Analyzing the California Delete Act Regulations | Troutman Privacy