Data Brokers Explained

Data brokers are one of the least visible but most pervasive parts of the digital economy. They do not make headlines the way data breaches do, but they hold detailed profiles on billions of people and sell them to anyone willing to pay. In 2026, the industry is larger, more automated and harder to escape than ever.

This article explains what data brokers are, how they get your information, what they sell, and what you can realistically do about it. For the broader privacy context, see online privacy in 2026.

What data brokers actually do

A data broker is a company that collects personal information about individuals and sells it to third parties. The buyers include:

• Advertisers and ad tech firms looking for targeting segments.
• Insurance companies assessing risk profiles.
• Employers conducting background checks.
• Financial services verifying identity and creditworthiness.
• Political campaigns building voter profiles.
• Law enforcement and government agencies in some jurisdictions.
• Scammers and fraudsters who buy leaked or poorly secured databases.

Brokers do not typically interact directly with consumers. You are not their customer. You are their product.

Where the data comes from

Brokers assemble profiles from many sources:

Public records

Property records, voter registrations, court filings, marriage licences, birth and death certificates, bankruptcy filings, professional licences. These are legally public and easy to scrape at scale.

Commercial sources

Loyalty programmes, warranty registrations, magazine subscriptions, sweepstakes entries, customer surveys, retail purchase histories. Every time you fill out a form for a "chance to win," your data likely enters the broker ecosystem.

Online behaviour

Through partnerships with ad tech companies, data management platforms and website publishers, brokers acquire interest categories, purchase intent signals and demographic inferences. This is where the behavioural layer comes in.

Social media and people-search sites

Some brokers scrape social media profiles, public posts and people-search directories. Others simply buy databases from smaller brokers who did the scraping.

Mobile apps and location data

Location data brokers buy or aggregate precise location signals from apps with location permissions. They then sell movement patterns, foot traffic analytics and audience segments based on where people go.

What a typical broker profile contains

A comprehensive broker profile might include:

• Full name, aliases, maiden name.
• Current and past addresses.
• Date of birth and age.
• Phone numbers and email addresses.
• Family members and known associates.
• Property ownership and estimated home value.
• Vehicle ownership.
• Political affiliation and voting history (where public).
• Estimated income and net worth.
• Occupation and employer.
• Education level.
• Hobbies and interests (inferred from behaviour).
• Purchase history categories.
• Health interests (inferred from searches and purchases).
• Online activity patterns.

Not every broker has all of this, but the largest firms come close.

The major players in 2026

The data broker industry includes thousands of small firms and a handful of dominant ones. The largest by volume include:

• Acxiom / LiveRamp — one of the oldest and largest, with consumer data on hundreds of millions of people.
• Experian, Equifax, TransUnion — known primarily as credit bureaus, but also major data brokers for marketing and identity verification.
• Oracle Data Cloud / BlueKai — massive behavioural data aggregator.
• Epsilon — owned by Publicis, focuses on marketing data.
• CoreLogic — specialises in property and real estate data.

On the people-search side, there are dozens of sites: BeenVerified, Spokeo, Whitepages, Intelius, TruthFinder, Instant Checkmate and many others. These are consumer-facing fronts for the same underlying data.

How the law handles data brokers

Regulation is fragmented:

• GDPR (EU) treats broker profiling as a high-risk processing activity. Brokers must have a legal basis, honour deletion requests, and comply with subject access requests. Enforcement is uneven but improving.
• CCPA / CPRA (California) grants residents the right to know what data is held, to delete it, and to opt out of sale. Brokers must honour these requests.
• Other US states — Virginia, Colorado, Connecticut1 Connecticut, Utah and others have similar laws, but there is no federal standard.
• No law — in many jurisdictions, data brokering is entirely unregulated.

The practical reality is that even where laws exist, enforcement is slow and brokers often make the opt-out process deliberately difficult.

How to opt out: the manual approach

If you want to remove yourself from broker databases, the process is tedious but effective:

1. Identify the brokers. Search your name on people-search sites. Make a list of which ones show your profile.
2. Visit each opt-out page. Most brokers have an opt-out link, usually buried in the footer or privacy policy. Search "[broker name] opt out" to find it.
3. Submit the request. This usually requires providing the information you want removed — ironically, you must give them data to delete data. Some require email verification.
4. Follow up. Opt-out requests can take days to weeks. Check back to confirm removal.
5. Repeat quarterly. Data brokers re-scrape and repurchase data continuously. A clean profile today may reappear in a few months.

Opt-out services: useful or not?

Several services offer to automate opt-outs for a fee:

• DeleteMe — well-established, removes you from major people-search sites.
• Optery — similar model, covers a large number of brokers.
• Incogni — owned by Surfshark, focuses on data brokers rather than people-search sites.

These services save time but are not perfect. They cover the major brokers but miss smaller ones. They also require ongoing subscriptions because the problem is recurring.

Whether they are worth the cost depends on your threat model and patience. For most people, manually handling the top 10-20 people-search sites and using a blocker for ongoing protection is sufficient.

Preventing future collection

Removing existing data is only half the battle. The other half is limiting what enters the system:

• Use a tracker blocker. NovaBlock blocks the ad and tracking scripts that feed behavioural data to ad tech platforms, which in turn supply brokers. Less tracking data means less broker fodder.
• Minise forms and surveys. Do not fill out warranty cards, sweepstakes entries or customer surveys with real information unless required.
• Use unique emails. Services like SimpleLogin or Firefox Relay let you use forwarding addresses for registrations. If one leaks, it is isolated.
• Avoid loyalty programmes unless the benefit is genuinely worth the data cost.
• Be careful with public records where you have a choice. Some jurisdictions allow you to request certain records be kept private.

The employer and tenant screening angle

Data brokers are not just for advertisers. Employment and tenant screening services use broker data to build background reports. These reports can include criminal records, credit history, eviction records and employment verification. Inaccuracies are common and can be costly.

If you are job-hunting or renting, it is worth checking what screening services might see. You have the right to dispute inaccuracies under the Fair Credit Reporting Act in the US and similar laws elsewhere.

Comparison: data broker types

Conclusion

Data brokers are a structural feature of the modern economy, not a bug you can patch. You cannot opt out of the entire industry, but you can meaningfully reduce your exposure. Remove yourself from the major people-search sites, limit the behavioural data you generate with a tracker blocker like NovaBlock, minimise unnecessary data sharing, and check back periodically. The goal is not invisibility. It is making the profile less complete, less accurate and less valuable. For the rest of your privacy stack, see online privacy in 2026.