What Is a Data Broker? How They Buy and Sell Your Information

TL;DR: A data broker is a company that collects personal information about people -- from public records, purchase history, online activity, and other sources -- then sells or licenses that data to third parties. There are over 4,000 data brokers operating globally. Most people have no idea these companies exist, yet data brokers hold detailed profiles on virtually every adult in the United States.

What Is a Data Broker?

A data broker is a business that collects personal data about individuals and sells it to other companies, organizations, or individuals. Data brokers do not have a direct relationship with the people whose data they trade. You have likely never heard of most data brokers, but they have heard of you.

Data brokers are also called information brokers, data vendors, or data aggregators. Under the California Consumer Privacy Act (CCPA), a data broker is legally defined as "a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship."

The data broker industry generates an estimated $200 billion in revenue annually. Major data brokers include companies like Acxiom, Experian (consumer data division), Oracle Data Cloud, LexisNexis Risk Solutions, and CoreLogic.

How Do Data Brokers Get Your Information?

Data brokers collect information from dozens of sources, both online and offline. These fall into several categories:

Public Records

• Property records and home ownership data
• Court records, including bankruptcy and liens
• Voter registration records
• Business registrations and professional licenses
• Marriage and divorce records

Online Activity

• Website browsing history (via third-party cookies and tracking pixels)
• Social media profiles and public posts
• App usage data sold by app developers
• Online purchase history
• Search history shared by advertising networks

Commercial Sources

• Loyalty program and rewards card data
• Credit card transaction records (aggregated)
• Warranty registrations
• Survey and sweepstakes entries
• Subscription and membership lists

Other Sources

• Census and demographic data
• Health and insurance records (where legally available)
• Location data from mobile apps
• IoT and connected device data

A single data broker can hold thousands of data points on one person. Acxiom, one of the largest brokers, has publicly stated it holds data on approximately 2.5 billion consumers worldwide.

What Data Do Brokers Collect?

The breadth of data broker profiles is extensive. A typical profile includes:

This data is packaged into consumer segments with labels like "Expectant Parent," "Financially Stressed," "Health Enthusiast," or "Frequent Gambler." These segments are sold to marketers, insurance companies, employers, landlords, and political campaigns.

Who Buys Data from Brokers?

Data broker customers span nearly every industry:

• Advertisers and marketers -- for targeted ad campaigns and audience building
• Insurance companies -- for risk assessment and pricing decisions
• Financial institutions -- for credit decisions and fraud detection
• Employers and recruiters -- for background checks
• Landlords -- for tenant screening
• Political campaigns -- for voter targeting and persuasion
• Law enforcement -- for investigative purposes (often without a warrant)
• Other data brokers -- brokers buy from and sell to each other

The result is a vast, interconnected market where your personal information circulates with minimal oversight and virtually no input from you.

How to Check If a Company Is a Data Broker

Not every company that collects data is a data broker. The distinction matters: a data broker's core business is trading in personal information, while other companies collect data as part of delivering a service.

PrivacyFetch analyzes every company in its directory for data broker indicators. Here is how to check:

1. Go to privacyfetch.com/explore and search for the company
2. Open the company profile
3. Look for the data broker flag -- PrivacyFetch assigns a broker confidence score from 0 to 5 based on policy language, disclosed practices, and known indicators
4. Check the Data Sharing tab for details on who the company shares data with

Key signals that indicate a data broker:

• The company's privacy policy describes selling or licensing personal data to third parties
• The company collects data on individuals it has no direct service relationship with
• The company is registered as a data broker under California's data broker registry (required by law)
• The privacy policy references "data monetization," "audience segments," or "information products"
• The company shares data with a high number of advertising partners

A company flagged as a data broker on PrivacyFetch will typically have a low data sharing score (below 40) and will carry a "Sells personal data" or "Shares with data brokers" red flag.

What Does a Data Broker Flag Mean on PrivacyFetch?

When PrivacyFetch identifies broker indicators, the company profile displays:

• Broker confidence level -- Rated 0 to 5, where 5 is highest confidence
• Specific indicators -- The evidence found in the company's policies
• Data sharing score impact -- Sharing with data brokers results in a -25 point deduction; selling personal data results in a -40 point deduction on the data sharing dimension

These are the two heaviest penalties in the PrivacyFetch scoring system. A company that both sells data and shares with brokers can lose up to 65 points on the data sharing dimension alone, virtually guaranteeing an F grade on that dimension.

Your Rights: How to Opt Out of Data Brokers

Laws are catching up to the data broker industry. Several regulations now give you the right to opt out:

Under CCPA (California)

• Right to know what personal information a data broker has collected
• Right to delete your personal information
• Right to opt out of the sale of your personal information
• Data brokers must register with the California Attorney General

Under GDPR (European Union)

• Right to access all data held about you
• Right to erasure ("right to be forgotten")
• Right to object to processing for direct marketing
• Data brokers must have a lawful basis for processing

Under state privacy laws (Virginia, Colorado, Connecticut, etc.)

• Right to opt out of data sales
• Right to opt out of targeted advertising
• Right to delete personal information

How to Opt Out: Step by Step

1. Identify which brokers have your data -- Use resources like PrivacyFetch company profiles to identify data brokers in your industry or category
2. Submit opt-out requests -- Most major brokers have opt-out forms, though they vary significantly in accessibility
3. Use your legal rights -- Reference CCPA, GDPR, or your state law when making requests
4. Monitor and repeat -- Brokers continuously collect data, so opt-out is not a one-time action
5. Check privacy scores -- Use PrivacyFetch to verify whether companies you use share data with brokers

The difficulty of opting out varies dramatically. Some brokers process requests within days. Others require identity verification, mailed forms, or phone calls -- a practice known as "deletion friction" that PrivacyFetch tracks as a risk signal.

How Is the Data Broker Industry Regulated?

Regulation is evolving but remains inconsistent:

At the federal level in the United States, there is no comprehensive data broker regulation. Several bills have been introduced but none have passed as of 2026.

How to Reduce Your Exposure to Data Brokers

Beyond opting out, you can take steps to reduce the data available to brokers:

• Limit loyalty program participation -- Rewards cards are a major data source for brokers
• Use privacy-focused browsers and search engines -- Reduce online tracking data
• Review app permissions -- Revoke location and contact access for apps that do not need them
• Use disposable email addresses -- For signups and subscriptions
• Check companies before signing up -- Look up the privacy score of any company before creating an account
• Opt out of data sharing in account settings of services you already use

Key Takeaways

• Data brokers are companies that collect and sell your personal information without a direct relationship with you
• They gather data from public records, online tracking, purchase history, and hundreds of other sources
• A single broker can hold thousands of data points on one individual
• Laws like CCPA and GDPR give you the right to opt out of data sales and request deletion
• PrivacyFetch identifies data broker indicators automatically -- check any company's profile to see if they buy or sell personal data
• Opting out is an ongoing process, not a one-time fix

This analysis is based on PrivacyFetch's automated privacy policy analysis. Check any company's privacy score