One broker in the FTC's study added more than 3 billion new data points every month. Another held more than 1.4 billion consumer transactions and over 700 billion data elements, which means your life can be packaged, enriched, and sold without you ever meeting the company doing it.
That's the unsettling reality behind data brokers. They sit between the places that generate ordinary data, like apps, stores, registries, and ad systems, and the businesses that want to use it.
Table of Contents
- What Data Brokers Actually Are
- The Three Categories of Data Brokers
- What Brokers Collect and How They Infer the Rest
- Risks From Privacy Loss, Profiling, and Security
- How SourceX Can Help
- How to Find Out Whether Your Data Is Held
- A Practical Opt-Out and Audit Workflow
- How IP Masking Fits Into the Broker Picture
- Major Data Brokers and Where to Start Opt-Outs
What Data Brokers Actually Are
A data broker is a resale layer between the places that collect information and the businesses that want to use it. They pull together records from sources they do not directly serve, add inferred details, and license the resulting profiles onward. Some inputs are easy to recognize, such as retail programs, warranty registrations, magazine subscriptions, or app activity. Others come through public records, social activity, and commercial intermediaries.
Practical rule: if a company's main business is collecting data about people it does not serve directly, enriching that data, and reselling it, you are probably dealing with a data broker.
That role is different from a bank, retailer, or social platform that interacts with you directly. Those companies may still share, sell, or monetize data, but they sit closer to the original transaction. Data brokers sit one layer farther out, which makes them harder to spot and harder to challenge.
The resale layer between you and the buyer
The clearest way to understand a broker is to separate what is observed from what is inferred. An address is a direct record. A likely income band, interest category, or household profile is an inference built from many smaller signals. Brokers package both kinds of information together, then sell the bundle to marketers, data vendors, and other buyers.
That is why broker files often feel strangely specific. A person may never have submitted a profile form, yet still appear in a database because ordinary actions, like browsing, subscribing, registering, or using an app, created usable signals. The broker's job is to turn those signals into a product.
Why the scale matters
The FTC's 2014 study described an industry that collected and stored billions of data elements covering nearly every U.S. consumer, with one broker holding more than 1.4 billion consumer transactions and another adding more than 3 billion new data points each month. The same study found that 7 of the 9 companies shared information with at least one other broker. FTC study on data broker transparency
That sharing matters because a single record rarely stays single. A purchase, a device ID, or a location ping can be folded into a larger profile, then passed to another company, then blended again into marketing, fraud, or scoring systems. Here is the useful signal-to-inference map: an IP address can suggest a rough network location, a device ID can help link activity across sessions, and a location ping can show where a device appeared at a given moment. None of those signals proves a full identity on its own, but in broker systems, several weak signals can be combined into a much stronger profile.
The clean way to think about the industry is simple. Data brokers are the resale layer between ordinary data sources and the companies that want to act on the profile, and the first step in dealing with them is treating opt-out as an audit, not a one-time form submission.
The Three Categories of Data Brokers
Not every broker behaves the same way, which is why generic advice often fails. Some companies are built for consumer profiling, some for business contacts and sales intelligence, and some for highly sensitive uses that affect pricing, eligibility, or surveillance.
Consumer, B2B, and niche brokers
Consumer brokers build profiles for marketing, fraud prevention, and risk scoring. This is the category that most users recognize first, because it includes people-search sites and identity-verification vendors that can tie names, addresses, and habits together. These firms are the ones most likely to show up when someone searches their own name online.
B2B brokers sell firmographic and contact data. Their files often track business emails, job titles, company size, and technology stacks, then layer on inferred details about the person behind the role. Sales teams, recruiting tools, and account-based marketing systems buy this kind of data because it helps them decide who to contact and how to route leads.
Niche brokers specialize in more sensitive material, such as financial status, health-related interests, criminal records, or location history. Their data can feed underwriting, lending decisions, surveillance-pricing systems, or other decisions where the downstream use is more consequential.
Why the boundary matters
The same person can appear in all three categories at once. A work email may sit in a B2B database, a home address may sit in a consumer profile, and a coarse location pattern may end up in a niche audience segment. That overlap is why one opt-out rarely solves the whole problem.
Ad networks are often confused with brokers, but they play a different role. They usually broker ad placements in real time rather than maintaining persistent consumer files. Credit bureaus are different again, because they operate under a separate federal framework and don't map neatly onto ordinary privacy opt-outs.
Useful shortcut: ask what the company sells. If it sells persistent profiles, contact lists, or inferred traits, you're in data broker territory. If it sells ad inventory or regulated credit files, you're probably not.
The practical takeaway is that your rights and your opt-out path depend on which category holds your data. A people-search site, a sales-intelligence vendor, and a sensitive-location broker may all look similar from the outside, but they do not respond to the same request in the same way.
What Brokers Collect and How They Infer the Rest
A broker rarely knows everything about you from one source. It assembles a profile the way a puzzle is built, one piece at a time, from what you gave directly, what another company passed along, and what the broker guesses from patterns.
Direct signals, inferred traits, and bought data
Directly supplied data is the clearest layer. It includes warranty cards, loyalty programs, magazine subscriptions, app signups, and public records. A person may have entered that information once and never thought about it again.
Inferred attributes work differently. A broker can combine fragments of direct data with statistical patterns to guess income brackets, parental status, political leaning, health interests, or membership in a segment such as parents of preschoolers. Those guesses may help with marketing, but they remain guesses, not confirmed facts.
Third-party data is the layer many people miss. Brokers often buy or receive information from ad-tech systems, location SDKs, real-time-bidding flows, and partner brokers. A profile can grow even when no one ever filled out a form with the broker's name on it.
The cleanest way to read a file is to separate signal from inference.
| Signal | What it can genuinely reveal | What brokers may claim from it |
|---|---|---|
| IP address | An approximate region, a network provider, sometimes a rough business or home network context | A more exact location, or that one device belongs to one person |
| Device ID | That the same app or browser instance showed up again | A stable personal identity across devices and services |
| Location ping | A point in time and place, often imperfect and context-dependent | Routine visits, habits, or sensitive interests |
An IP address is a signal, not a person. On its own, it can point to a city or region, an internet service provider, and sometimes a network organization. That supports rough location checks and fraud screening, but it does not identify a home address by itself.
The picture changes when brokers combine signals. A device identifier, an advertising ID, a browser fingerprint, or an account login can turn a weak hint into a stronger profile. What starts as “this device may be in this area” can become “this device probably belongs to this household and is being used for this app on this network.”
Location pings need the same caution. A ping shows that a device was near a place at a moment in time. It does not, by itself, prove who was there, why they were there, or whether the visit was repeated in a meaningful way. That gap between observation and inference is where broker claims often become more confident than the underlying signal warrants.
The FTC's surveillance-pricing work is useful because it keeps these layers separate instead of treating them as one blob of “tracking.” Once you sort direct data, third-party data, and inferred data into different buckets, it becomes much easier to judge what a broker knows and what it is only estimating.
Risks From Privacy Loss, Profiling, and Security
A data broker profile can change what a person sees, what they are offered, and who gets access to their details. The risk is not one thing. Some harm is immediate, some appears later through profiling, and some becomes visible only after a breach or a reuse of the same record set.
Privacy and autonomy risks
Sensitive segments can be built without a person knowing it. FTC cases describe brokers using mobile-app and real-time-bidding data to identify visits to health clinics and places of worship, then building audience categories such as “parents of preschoolers” and religious groups. That does not mean every location ping is intimate by itself. It does show how a small signal can be turned into a stronger inference when it is combined with other records. The FTC's surveillance-pricing work has the same value because it keeps direct data, third-party data, and inferred data in separate buckets instead of treating all tracking as one lump of information.
An IP address is a signal, not a person. It can point to a city or region, an internet service provider, and sometimes a network organization. That is enough for rough location checks and fraud screening, but not for a home address on its own. An overview of Google's IP Protection changes shows why network-level signals are starting to get more restricted, which matters because brokers often try to stitch weak signals together.
The same caution applies to location pings. A ping shows that a device was near a place at a moment in time. It does not prove who was there, why they were there, or whether the visit meant anything beyond a brief stop. The gap between observation and inference is where broker claims can grow more confident than the underlying signal supports.
The practical risk is not only embarrassment. A profile can shape what a person is shown, what they are charged, or whether they are approached at all. If a system decides someone is likely to respond to a certain offer, that person may never see the standard offer.
Security and fraud risks
Broker data also creates security risk. Names, home addresses, phone numbers, emails, and similar records can be used for doxxing, phishing, account takeover, or synthetic-identity fraud. No single record has to be devastating for the whole profile to be useful. When ordinary details are stitched together across markets, they become much easier to misuse.
Some harms are easier to reduce on your own. Re-exposure, spam, and social engineering often fall into that category. Other harms, such as discrimination in housing, employment, or lending, need collective action because the decision happens downstream, after the data has already moved through the broker chain.
The legal map
The legal response is fragmented, but there are clear anchors. The GDPR in the EU and UK treats brokers as data controllers and processors and gives people rights to access, deletion, restriction, and objection to profiling. In California, the CCPA and CPRA give residents rights to know, delete, correct, and limit the use of sensitive personal information. The state's Data Broker Registry requires brokers to register with the California Privacy Protection Agency starting January 1, 2024. California Data Broker Registry
California's model matters because it creates a public record of who is operating in the market. It also pairs registration with consumer-facing deletion and opt-out mechanisms, including the state's Delete Request and Opt-Out Platform.
| Law | Region | Key Consumer Right | Broker-Specific Rule |
|---|---|---|---|
| GDPR | EU and UK | Access, deletion, restriction, objection to profiling | Brokers are treated as controllers or processors |
| CCPA/CPRA | California | Know, delete, correct, limit sensitive use | Data brokers must register and support consumer requests |
| State broker rules | U.S. states | Varies by state | Some states require registration or opt-out mechanisms |
Where the law is still catching up
Texas, Vermont, Oregon, and other states have added their own broker rules, but the patchwork remains uneven. Canada's PIPEDA, plus emerging rules in Brazil, India, and Australia, also shape the global environment for brokers even when the rules are not identical. Privacy rights still depend heavily on where a person lives and which kind of broker has the data.
How SourceX Can Help
When companies need to move data through a controlled licensing process, a platform like SourceX is useful because it turns a messy, manual exchange into a governed workflow. It's designed for enterprise data licensing, not consumer privacy cleanup, which means it helps when the problem is proving rights, preparing datasets, and packaging them for approved buyers.
Why it matters in this context
For privacy-minded teams, the core value is control. SourceX standardizes sourcing, rights validation, deidentification, contracting, delivery, and payment in one workflow, with supplier approval at each step. That's the opposite of the opaque, uncontrolled resale model that makes data brokers so hard to audit.
Its fit assessment and private inventory tools are especially helpful when an organization wants to understand what it possesses before it shares anything. The rights review and provenance confirmation steps also matter, because a lot of privacy risk starts with unclear permission chains and undocumented reuse.
When it's the right choice
SourceX makes sense when the data question is commercial and operational, not consumer deletion. If an enterprise wants to license real-world operational data to AI labs or other buyers, it needs documentation, deidentification, and clear terms. If it's trying to delete consumer records from broker databases, this is the wrong tool.
The practical decision rule is straightforward. Use a controlled licensing workflow when you need proof of rights and supervised distribution. Use opt-out and deletion requests when you're trying to reduce your exposure as an individual.
How to Find Out Whether Your Data Is Held
The first question isn't “How do I delete it?” It's “Who has it?” A good discovery process starts with your own identifiers and works outward.
Start with self-search and registry checks
Search your name, email aliases, and phone number in quotes across major search engines and people-search sites. Then check California's Data Broker Registry, because registry listings tell you which companies are operating as brokers and what categories of data they handle. A registry entry doesn't prove your exact record exists, but it tells you where to look next.
Practical rule: registry presence tells you who to contact, not whether your file is definitely there.
You can also use breach-notification search portals and your annual credit-report lookups to spot exposure patterns. Those tools help you find where data may have leaked or been commercialized, but they don't replace broker-specific searches. Reverse-email lookup services can help too, but many draw from the same broker ecosystem you're trying to audit.
Use masking tools with caution
A VPN, proxy, or Tor can change what a site sees at the network layer, but it doesn't erase account-based identifiers or advertising IDs already tied to your apps. That means an IP-layer change may reduce one signal while leaving others untouched. The point is to understand the layer you're changing, not assume every signal changed with it.
The best discovery routine is short and repeatable. Search your identifiers, check the registry, look for breach exposure, and record where your data appears. Then return to the same sources later, because broker records can reappear when a partner republishes them.
A Practical Opt-Out and Audit Workflow
Opting out is not a single form submission. It's a verification problem, because the same data can come back under a different legal entity or through a downstream partner.
Use a six-step audit loop
- Identify the data category. Decide whether the record is identity, contact, location, financial, or health-related. Different categories can trigger different request paths.
- Locate the responsible entity. Match the broker name to the exact legal company, not just the brand you found in search results.
- Submit the right request. Deletion, suppression, and sale opt-out are not the same thing. A sale opt-out may stop future sharing while leaving the record in place.
- Capture confirmation. Save the email, the reference number, and any status page you're given.
- Recheck after an interval. A later search tells you whether the record disappeared, stayed suppressed, or reappeared.
- Escalate when needed. If the broker ignores you, file with the relevant regulator or attorney general.
The Senate Joint Economic Committee has described broker opt-out systems as “largely invisible and incomplete,” which is why this loop matters. A request may apply only to one legal entity, it may not erase data held by partners, and it may need to be resubmitted if the same data is collected again. Senate Joint Economic Committee report
Keep a record, not a memory
A simple log is enough. Note the broker, the date, the request type, the confirmation text, and the date you plan to check again. If the data reappears, you already have the paper trail needed to show repeat exposure.
| Broker type | Typical request to start with | What to verify later |
|---|---|---|
| People-search site | Deletion or suppression | Whether the profile reappears |
| Marketing or identity broker | Sale opt-out or deletion | Whether partner listings still show it |
| Sensitive-location or niche broker | Removal and recheck | Whether the same segment returns |
Use the audit mindset, not the one-time cleanup mindset. That's the only way to tell whether a request changed the data ecosystem around your name.
How IP Masking Fits Into the Broker Picture
IP masking helps, but it's only one layer of defense. A public-IP lookup shows the network signal a site or ad-tech partner can see in its server logs, and that signal is usually low resolution, more useful for rough geography and network attribution than for identity on its own.
What changes and what doesn't
A VPN or proxy replaces the public IP seen by the destination server. Tor changes the route again by chaining multiple hops and rotating the apparent IP across circuits. Residential proxies swap in another consumer-style address, which can be useful for testing but may still land in broker lists.
None of that changes account logins, cookies, or advertising IDs already tied to apps and browsers. If a broker already knows your email, device ID, or profile history, masking the IP alone won't make that relationship disappear.
The safer approach is layered. Use IP masking where it fits, separate accounts where that's practical, block trackers, and keep sending deletion or opt-out requests where needed. That combination works better than any single tool because brokers usually stitch together multiple weak signals.
For a plain explanation of proxy trade-offs, a good starting point is the guide to proxy servers and how they work. If you want to understand browser-level trade-offs too, the broader privacy-browser overview is also useful, especially when you're deciding how much of your activity should stay tied to one identity. privacy browsers and how they compare
Working rule: mask the IP, separate the identity, and recheck the record. If any one of those steps is missing, the broker still has a path back to you.
Major Data Brokers and Where to Start Opt-Outs
The field of data brokers changes constantly, so no list stays complete for long. The practical goal is to start with the names people encounter most often, then use the registry to fill in the gaps.
Consumer and people-search brokers
| Broker | Category | Data Types | Opt-Out / Deletion Link |
|---|---|---|---|
| Spokeo | Consumer people-search | Identity, contact, location signals | Spokeo opt-out page |
| BeenVerified | Consumer people-search | Identity, contact, public records | BeenVerified opt-out page |
| Whitepages | Consumer people-search | Identity, address, phone lookups | Whitepages opt-out page |
| PeopleFinder | Consumer people-search | Identity and contact records | PeopleFinder removal page |
| LexisNexis Risk Solutions | Consumer and risk data | Identity verification and risk-related data | LexisNexis consumer disclosure and opt-out |
Marketing, identity, and B2B brokers
| Broker | Category | Data Types | Opt-Out / Deletion Link |
|---|---|---|---|
| Acxiom, now part of LiveRamp | Marketing and identity | Audience, identity, and enrichment data | LiveRamp privacy choices |
| Epsilon | Marketing data | Audience and campaign data | Epsilon privacy choices |
| Oracle Data Cloud | Marketing data | Audience and ad-tech data | Oracle advertising privacy choices |
| Experian Marketing Services | Marketing and identity | Consumer and audience data | Experian privacy choices |
| ZoomInfo | B2B data | Contacts, titles, company data | ZoomInfo privacy center |
| Apollo | B2B data | Business contacts and company data | Apollo privacy page |
| Clearbit | B2B enrichment | Firmographic and contact enrichment | Clearbit privacy page |
| Dun & Bradstreet | B2B and risk data | Company and business identity | Dun & Bradstreet privacy notice |
Sensitive and location-heavy sources
Some sensitive-location or niche brokers don't market themselves clearly to the public, which is why the registry matters so much. For those firms, start with the state registry entry, identify the legal entity, and use the broker's designated request path rather than a general contact form.
A 90-day maintenance routine
Days 1 to 7, run the discovery workflow and submit deletion or opt-out requests to every broker you found. Save every confirmation email and reference number. Days 8 to 30, separate accounts where you can, reduce tracker exposure, and check the apps and browser extensions that share advertising IDs.
Days 31 to 60, recheck the brokers that confirmed deletion and look for reappearance through downstream partners. Days 61 to 90, file unresolved complaints with the relevant regulator and verify that your public-IP and network signals behave the way you expect. Privacy gets durable when you treat it as a recurring audit, not a one-time cleanup.
If you want to confirm what a website or broker can see from your current network setup, use WhatIsMyIP.org as a quick check, then repeat your broker audit on a schedule instead of assuming the first opt-out solved everything.