What Data Brokers Actually Do
Most people encounter the phrase "data broker" only after something goes wrong — an unexplained targeted ad, a stranger finding their home address online, or a data breach notification from a company they'd never heard of. Yet the industry operates continuously, assembling profiles on hundreds of millions of Americans.
Data brokers are not a monolithic industry. People-search sites let anyone look up a name and address for a small fee. Marketing data companies sell audience segments to advertisers. Risk and fraud firms supply background screening tools to landlords and employers. Each segment operates with different data inputs and different downstream uses, but they share a core practice: collecting personal information without a direct relationship with the person being profiled.
Understanding how this works is a practical first step in managing your digital footprint. For a broader view of how personal data flows across the apps you use daily, see what your apps actually know about you.
4,000+
Estimated data brokers operating in the US
Industry analysts and privacy advocacy organizations have estimated the US data broker ecosystem includes several thousand companies, though a precise count is difficult because the industry lacks comprehensive registration requirements at the federal level.
$200B+
Estimated annual US data broker market value
Privacy and data industry research organizations have placed the total US data brokerage market in the hundreds of billions of dollars annually, reflecting demand from marketers, financial services, and risk management sectors.
~70%
Americans unaware their data is being sold
Surveys conducted by privacy advocacy and consumer research organizations have consistently found that a large majority of US adults are not aware that data brokers compile and sell detailed profiles about them.
Where the Data Comes From
The raw material of the data broker industry comes from an often-surprising mix of sources, most of which individuals interact with voluntarily without realizing the downstream implications.
- Public records: Court filings, property records, voter registrations, marriage and divorce records, and business licenses are legally public in most US states. Data brokers systematically aggregate them at scale.
- Loyalty and rewards programs: Supermarket loyalty cards, retail rewards apps, and hotel points programs generate detailed purchase histories that are often licensed to third parties.
- App and website data: Tracking pixels, cookies, and SDK integrations inside mobile apps transmit behavioral data that can be packaged and sold. This is a significant channel for location data specifically.
- Social media activity: Publicly visible profile information, group memberships, and even inferred interests based on engagement patterns contribute to profile-building.
- Data purchased from other brokers: Brokers routinely buy from and sell to each other, creating a compounding effect where a profile enriches as it passes through multiple hands.
The result is a profile that may contain a home address, estimated income, health-related interests inferred from purchases, political affiliation, and consumer behavior — far more than any single source would reveal alone. Skimming privacy policies is one of the most common ways consumers miss the data-sharing disclosures that authorize this kind of information transfer.
The Regulatory Landscape and Your Options
Federal law in the United States does not comprehensively regulate data brokers the way some other countries regulate data processing. The Fair Credit Reporting Act (FCRA) places meaningful restrictions on brokers whose data is used for credit, employment, or housing decisions, but it does not cover marketing-focused brokers.
State-level protections have advanced more quickly. California's Consumer Privacy Act (CCPA) and its successor CPRA grant California residents the right to know what data is held about them and to request deletion. Several additional states have passed comparable legislation. Vermont requires data brokers to register with the state annually.
State Laws Vary Significantly
Whether you have a legal right to opt out of data broker data collection depends heavily on where you live. California, Colorado, Texas, and Virginia have enacted consumer data privacy laws with opt-out provisions, while many other states have not. Checking the current status of data privacy law in your state is advisable before assuming any particular right applies to you.
For practical steps, most major data brokers maintain opt-out pages accessible directly on their websites. Submitting requests requires time and, in some cases, identity verification — a friction point that many consumers abandon mid-process. A more systematic approach to limiting exposure is covered in the complete guide to reducing your online data trail.
It's also worth considering that newer data types — such as biometric identifiers — introduce additional dimensions of exposure. Biometric data trade-offs deserve their own scrutiny as face and voice recognition become more common authentication methods. And if you use AI-powered applications, verifying data handling practices before signing up is an increasingly important habit.
“The data broker ecosystem has created a shadow industry where your personal information is bought and sold dozens of times without your knowledge or consent. The challenge is that the data collected is often legal to collect — the problem is the aggregation.”
— Pam Dixon, Executive Director, World Privacy Forum
Frequently Asked Questions
Data brokers pull from a wide range of sources: public records such as voter registrations and property filings, loyalty card programs, website tracking pixels, social media activity, and data purchased from app developers. Many of these sources are individually mundane, but combined they form surprisingly detailed profiles.
Yes, data brokerage is broadly legal under current federal law. A patchwork of sector-specific regulations — such as the Fair Credit Reporting Act for credit-related data — applies in specific contexts. Several US states, including California, Vermont, and Texas, have enacted laws requiring brokers to register or allow consumers to opt out.
You can submit opt-out requests to individual data brokers, and many are legally required to honor them under applicable state law. However, with hundreds of brokers operating, the process is manual and time-consuming. Some services exist to help automate opt-out submissions, though results vary.
Data brokers sell to a broad client base including marketers, financial services companies, landlords, employers, and law enforcement agencies. Most legitimate brokers have contractual use restrictions, but enforcement of those terms varies significantly.
Risks range from targeted manipulation via advertising to more serious concerns such as identity theft, discriminatory pricing, and stalking facilitated by people-search sites. Sensitive inferences — like health conditions or financial distress — can affect insurance or credit evaluations.
The content on this site is for informational purposes only and is not a substitute for professional advice. Always consult a qualified professional for guidance specific to your situation.