A data broker is a company that collects personal information about people it has no direct relationship with and sells or licenses that information to others. California's privacy regulator puts it plainly: a data broker is "a business that gathers and sells consumer information that the consumer didn't give them directly." If you have never been a customer of a company but it holds your address, phone number or purchase history and sells it, it is probably a data broker.
This article covers how the law defines one, where brokers get their information, the main kinds of broker, and how to find the ones that are required to register.
The legal definition
There is no single federal definition. The working definitions come from the states that make brokers register.
California. The California Privacy Protection Agency (CalPrivacy) describes a data broker as "a business that collects personal information about consumers from various sources and sells that information to other companies, even when the consumer did not interact with the business for its products or services."
Vermont was the first state to require registration. Its statute defines a data broker as a business "that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship." Vermont lists what counts as a direct relationship: you are, or were, the business's customer, client, subscriber, user, employee, contractor, investor or donor.
The common thread is the missing relationship. A store you shop at is not a data broker for the purchase data it collects from you. If that store sells your purchase history to a company you have never heard of, and that company resells it, the second company is the broker.
That distinction matters for what you can ask for. CalPrivacy notes that information you give a business directly, for example when you open an account, is outside the reach of California's broker deletion platform. If a data broker later buys that same information, the copy the broker holds is within reach.
Where brokers get their information
The Federal Trade Commission studied nine data brokers in depth for a 2014 report. It found that "data brokers collect data from commercial, government, and other publicly available sources," and gave examples including "bankruptcy information, voting registration, consumer purchase data, web browsing activities, warranty registrations, and other details of consumers' everyday interactions."
Two findings from that report explain why brokers are hard to deal with:
- You usually don't know they exist. "Data brokers do not obtain this data directly from consumers, and consumers are thus largely unaware that data brokers are collecting and using this information."
- Brokers sell to each other. The FTC found that the nine brokers it studied "obtain most of their data from other data brokers rather than directly from an original source," and that seven of the nine provided data to each other. Its conclusion: "it would be virtually impossible for a consumer to determine how a data broker obtained his or her data."
For people-search sites specifically, the FTC's consumer guidance says they "may buy information from other data brokers, collect information from social media profiles that are public or viewable by everyone, and compile data from federal, state, and local government public records."
The kinds of data broker
The FTC's 2014 report sorted the brokers it studied by the products they sell: marketing, risk mitigation, and people search. Those categories still describe most of the industry, and they behave differently when you try to opt out.
People-search sites
These are the brokers most people meet first, because their pages show up when you search your own name. You type in a name, phone number or address and get a profile: addresses, relatives, phone numbers, sometimes court records. Spokeo and Whitepages are examples. Most offer an opt-out form, and because the profile is public, you can search again later to see whether it is still listed. See the list of people-search sites for more.
Marketing data brokers
Marketing brokers build profiles used to target advertising and mail. You will not find a public page about yourself on their sites, which means you cannot check for yourself whether a deletion request worked. Acxiom is one example in our registry.
Risk, identity and investigator databases
These brokers sell data for identity verification, fraud prevention, debt collection and investigations. Their customers are businesses and agencies, not the public, and their opt-outs are usually narrow. Some of their products are also covered by the Fair Credit Reporting Act, which affects what they have to delete. Our skip-tracing topic page covers TransUnion TLOxp and similar products.
Which brokers have to register
Four states run data broker registries. Each is a public list you can use to find companies you might want to contact.
- California. Any business that meets the definition must register with CalPrivacy every year between January 1 and 31. The registry is searchable, and CalPrivacy offers a download of every registration.
- Vermont. A data broker must register with the Secretary of State on or before January 31 each year, and the registration must describe the broker's opt-out method, if it has one, and whether it lets a consumer authorize someone else to opt out for them.
- Texas. A data broker must register with the Secretary of State to do business in Texas, and the state keeps a searchable registry.
- Oregon. House Bill 2052 (2023) requires a data broker to register before collecting, selling or licensing brokered personal data in Oregon; registration started on January 1, 2024.
A registry tells you a company exists and, in Vermont and California, how it says you can opt out. It does not tell you whether that company holds a record about you.
What you can do about it
Your options depend on where you live and what kind of broker it is.
- Start with people-search sites. They are the brokers whose listings you can see and re-check. The article How to remove yourself from people-search sites walks through the process.
- Use your state's law if you have one. In California, you can send a data broker a deletion request under the CCPA, and the state's DROP platform sends one deletion request to every registered broker.
- Send requests to the brokers you cannot see. For marketing and risk brokers, a written request is the only route. How to opt out of data brokers covers how to write one, and our free kit generates the letters in your browser.
Removal is not guaranteed. Some brokers don't comply, some data is legally exempt, and information can be listed again after it is removed: see why your information reappears.