What Is a Data Broker? What They Sell, Who Buys It, and Are Data Brokers Legal

The companies holding the most complete file on you are, almost by definition, ones you have never contacted. You did not sign up. You did not agree to anything. You cannot log in and delete the account, because there is no account. That gap is the entire point of the industry, and it is also why getting out of it works nothing like closing a Facebook profile.

This is a plain explanation of what these companies are, what they hold, who pays them, and what US law currently does and does not require of them as of August 2026.

What is a data broker?

A data broker is a company that collects personal information about people it has no direct relationship with, then sells, licenses, or otherwise shares that information with others. The Federal Trade Commission's own framing, from its data broker report, is that these are "companies that collect information, including personal information about consumers, from a wide variety of sources for the purpose of reselling such information to their customers for various purposes, including verifying an individual's identity, differentiating records, marketing products, and preventing financial fraud."

Read that phrase again: no direct relationship. Your bank holds a lot of information about you, but it is not a data broker, because you walked in and opened an account. A people-search site that publishes your address, your age, and the names of your relatives never met you. It bought the records, matched them to your name, and put the result online for anyone who searches it.

That distinction has a very practical consequence. Every privacy habit built around accounts, strong passwords, closing old profiles, tightening settings, does nothing here. None of your data reached these companies through an account.

Who are data brokers?

"Data broker" is a category, not a business model, and the five kinds inside it behave differently enough that treating them as one thing is how people waste a weekend on the wrong opt-outs.

The five kinds of data broker, what each publishes or sells, and who pays for it

Type	What it does with your data	Who pays	Visible to the public?
People-search sites	Publish a free profile with your address history, phone numbers, age, and relatives	Ad revenue and upsells to paid reports	Yes, fully indexed by Google
Background-check sites	Sell reports covering criminal records, court filings, and address history	Consumers, landlords, curious individuals	Partly, a teaser page is public
Marketing aggregators	License audience segments and mailing lists built from purchase and behavioral data	Advertisers, brands, agencies	No, you never see the file
Risk and identity brokers	Supply identity verification, fraud scoring, and investigative databases	Banks, insurers, employers, law enforcement	No
Property and address brokers	Republish deeds, valuations, and who lives at an address	Ad revenue, real estate and lending customers	Yes

The first and last rows are the ones that change what a stranger finds when they type your name into Google. The middle three are larger, hold more, and are close to invisible. Most people should fix the visible ones first, because that is where the practical risk of being located sits. Our data broker opt-out list sorts the major names by category with a link to each real removal form.

How do data brokers get my information?

Four supply lines, and only one of them involves anything you chose to do.

• Public records. Property deeds, county assessor files, voter registration, court dockets, marriage and business filings, professional licenses. These are public by statute and legally republishable by anyone. This is the backbone of every people-search profile.
• Commercial purchase records. Loyalty programs, warranty cards, magazine subscriptions, catalog orders, and the resale of customer lists between companies.
• App and web tracking. Mobile SDKs that relay location and device telemetry, tracking pixels, and advertising identifiers that follow a device across sites and apps.
• Buying from each other. Brokers routinely license one another's datasets, which is why the same wrong middle initial or the same address you left in 2014 shows up on eight different sites at once.

The USPS change-of-address file deserves a specific mention, because it surprises people. Filing mail forwarding when you move puts you in the National Change of Address database, which USPS licenses to authorized mailing-list processors, who in turn supply direct marketers. There is no consumer opt-out from it. Moving house is one of the most reliable ways to generate a fresh crop of listings about yourself.

What data do data brokers have on me?

Until recently this was guesswork. It is not anymore, because California now makes registered brokers declare it. The state's data broker registry requires each registrant to disclose the categories of personal information it collects, and the checklist is the most concrete public answer available: minors' data, account login credentials, Social Security numbers, citizenship status, union membership, sexual orientation, gender identity, biometric data, precise geolocation, and reproductive health information.

No single broker collects all of it. But every item on that list is collected by some company that had to tick the box, and the registry is filterable by category, so you can see which ones. If you want the short version: assume anything that has ever appeared in a public record, a purchase, or a phone's location history is held somewhere and is for sale.

Who buys data from data brokers?

The same California registry answers this one too, and it is the disclosure most worth knowing about. Registrants must declare their recipients, and the categories they choose from include foreign actors, the federal government, state governments, law enforcement, and, as of the current registry, developers of generative AI systems.

That last category is new and it matters. Personal records sold as AI training data cannot be recalled once a model is trained on them, which makes it the first genuinely irreversible link in a chain that was otherwise merely difficult to unwind. The realistic buyer list therefore runs: advertisers and brands, insurers and lenders, employers and tenant screeners, private investigators, government and law enforcement agencies buying data they would otherwise need a warrant to compel, and AI developers.

Are data brokers legal?

Yes, in the United States, with limits that are tightening. There is no federal privacy law that bans the trade, and republishing public records is constitutionally protected speech, so the default is that all of this is lawful. What has changed is the perimeter around it.

Four states require data brokers to register: Vermont, which went first in 2018, California, Texas, and Oregon. Registration means the state publishes a searchable list of who these companies are, which is the only reason any of the disclosure above exists.

California goes further than a list. The Delete Act created DROP, a single state-run request that reaches every broker registered with California, rather than making residents file several hundred separate forms. It is the only mechanism of its kind in the country. Our explainer on the California Delete Act and DROP covers who qualifies and the gap it leaves, which is that it only reaches brokers that actually registered.

Federally, the constraint is about who the buyer is, not what is sold. The Protecting Americans' Data from Foreign Adversaries Act bars data brokers from selling personally identifiable sensitive data about Americans to foreign adversaries, specifically China, Russia, North Korea, and Iran, or to entities those countries control. In February 2026 the FTC sent letters to 13 data brokers reminding them of those obligations. Note what it does not do: selling the same file to a domestic buyer remains entirely legal.

How many data brokers are there?

Nobody can give you an honest exact number, and treat any article that does with suspicion. The state registries are the only real census, and each one counts a different thing: a company is only on California's list if it meets California's definition and actually complied, and the same is true in Vermont, Texas, and Oregon. Companies that quietly never registered appear on no list at all, which was precisely the problem the registries were created to expose and have only partly solved.

The useful framing is not a headcount. It is that the number of brokers that meaningfully affect what a stranger can find out about you is small, a few dozen consumer-facing sites, and that this is a finite, completable job. The invisible marketing and risk layer behind them is far larger and far less tractable.

The risk brokers are also the ones with real legal hooks, because several of them operate as consumer reporting agencies under the Fair Credit Reporting Act rather than as pure marketing companies. That status is what gives you a right to read the file and correct it. LexisNexis is the clearest example: nothing it holds is published anywhere, yet its reports price insurance quotes and decide rental applications, and you can pull yours free once a year.

How to stop data brokers from selling your information

There is no master switch, and any product implying otherwise is overselling. What works is a sequence:

1. Start with the public-facing people-search sites. These are what someone actually finds when they search your name. Spokeo, Whitepages, BeenVerified, FastPeopleSearch, USPhoneBook, and their peers each take a few minutes. Our Spokeo opt-out guide is a good first one, because its form has the trap most of the others copy.
2. Then the background-check sites, which run on the same records but sell reports rather than publish them.
3. Then the aggregators upstream, the marketing and risk brokers that feed both. Slower, less satisfying, and the reason listings come back if you skip it.
4. Finally, clean up the search results themselves. A removed listing leaves a live Google result behind until the page is recrawled. The Google Results about you tool handles the remainder.
5. If you live in California, file through DROP first, then do the manual passes anyway for the brokers that never registered.

Budget roughly a full working day for a thorough first pass, and expect to repeat it. Removal is not permanent, because the underlying public records that generated your profile are still public and still being refreshed. Every guide that promises a one-time fix is describing a different industry than this one. The full sequence, in order, is in our walkthrough on removing your information from the internet.

The one thing worth taking away

Data brokers are not a privacy setting you forgot to turn off. They are a legal industry built on records that were public before you were born and on a supply chain you were never party to. That is genuinely bleak, and it is also oddly freeing, because it means the fix is not a security habit you failed at. It is administrative work: a finite list of forms, filed in the right order, repeated a few times a year.