What Is a Data Broker and How Do They Make Money From You?
Unlike a retailer or an app you signed up for, a data broker typically has never interacted with you directly. It builds your profile from dozens or hundreds of secondary sources instead.
Where the raw data comes from
Public records (voter rolls, property deeds, court filings, marriage licenses) get scraped and structured. Commercial partnerships add loyalty program activity, warranty registrations, and retail purchase histories. Online tracking contributes browsing and app behavior licensed from ad-tech partners. A single profile can end up containing 1,500 or more individual data attributes.
Who buys broker data
Buyers include advertisers building targeting audiences, insurers assessing risk, employers running background checks, political campaigns, and, increasingly, AI companies looking for structured behavioral datasets. Some buyers are less benign — 2026 has seen growing scrutiny of brokers selling data to entities with no legitimate consumer-facing purpose.
Why regulation is catching up in 2026
A wave of new state laws in 2026 — including an expanded California registration and disclosure regime and a sweeping new New Jersey law covering both brokers and the "data collectors" who sell to them — is forcing brokers to register, disclose more about who buys their data, and process deletion requests faster.
Frequently Asked Questions
Is it illegal for a data broker to sell my information?
In most U.S. states, no — data brokerage is legal, though a growing number of states now require brokers to register, disclose their practices, and honor opt-out or deletion requests.
How many data brokers have information on me?
Estimates commonly cite well over a hundred active brokers in the U.S., which is why manual opt-out is slow — most people use an automated removal service to cover more of them at once.
Can I find out what a specific broker has on me?
Most major brokers are required to provide an access or disclosure request process; response times vary, and some now route requests through centralized state deletion platforms.