Data Brokers Explained: How Your Information Is Sold

TLDR

Data brokers collect or obtain personal information, connect it to identities and sell access to the resulting records, audiences or insights. An opt-out can reduce how easily strangers, marketers or other buyers find you, but it usually affects one company at a time. It does not erase public records or guarantee permanent removal. The practical strategy is to combine broker opt-outs with prospective tracking controls, careful data sharing and periodic checks for profiles that return.

The phrase “data broker” covers more than the people-search site that lists your age, address and possible relatives. It can also describe companies dealing in marketing audiences, location histories and other specialized datasets. The common business model is simple: personal information becomes more valuable when it can be collected, connected, sorted and delivered to someone else.

How personal information becomes a product

A broker does not need to obtain every detail directly from you. The Federal Trade Commission’s guide to people-search sites explains that these services can compile information from public records, public social-media sources and other data brokers, then sell access to searchable reports about individuals.

Individual facts may look harmless in isolation. An old address, an approximate age, a property record and the name of a relative reveal much more when they appear together. The resulting profile can help a legitimate user reconnect with someone, but it can also make unwanted contact, impersonation or targeted manipulation easier.

Other data products focus less on a readable biography and more on classification. A buyer may care that a device appears in a particular area, that a household fits a marketing category or that a person seems interested in a subject. The product can be a report, a list, access to a search tool or a segment used by another system.

Location information shows why the consequences matter. In a 2024 action involving X-Mode Social and Outlogic, the FTC alleged that precise location data could reveal visits to medical facilities, places of worship and domestic-abuse shelters. The resulting order prohibited the company from selling or sharing sensitive location data. A location point becomes far more revealing when it is connected to a device, routine or identity.

What a data broker opt-out actually does

A broker opt-out is a request directed at a particular company. Depending on the applicable law and request type, it may ask that company to delete matched information or stop selling or sharing it. Those outcomes are related, but they are not identical.

Deletion generally concerns information the broker can match to you and is legally required to remove. A request not to sell or share can instead restrict what happens to covered information. A broker may retain limited information on a suppression list so it can recognize the request and avoid selling newly acquired matching data later.

The distinction matters because an opt-out is not an internet-wide eraser. A people-search site can remove its profile while the underlying property, court or other public record remains available. The same information may still exist at another broker, appear in a relative’s profile or return when the site receives fresh data.

Why profiles can remain or return

The request covers one broker or service rather than every company holding similar information.
The broker may be unable to match the submitted identity details to a record.
Publicly available and legally exempt information may remain outside a deletion right.
Information supplied directly to a company through an account or subscription may be governed by a different relationship and process.
A broker may acquire a new or updated record after the original removal.

A “record not found” result is also ambiguous. It can mean the broker has no record, or that it could not locate one using the information supplied. California’s DROP system explicitly recognizes that distinction. A clean result is encouraging, but it is not proof that no related data exists elsewhere.

Manual opt-outs, paid services and centralized requests

Manual removal is the most direct approach: find a profile, locate the site’s privacy or opt-out process, verify the request and save the confirmation. It costs time rather than a subscription fee. The FTC identifies both free site-by-site requests and paid removal services as common options.

Paid services can reduce repetitive work, especially when they monitor many sites and resubmit requests. Their coverage and accuracy still vary. In a small, non-nationally representative 2024 test, Consumer Reports evaluated seven removal services and observed that 117 of 332 profiles among service users were removed within four months. Its manual group removed 36 of 47 observed profiles. Neither method eliminated every profile.

A 2025 Northwestern University study of four commercial removal services found that only 41.1% of the records those services identified actually belonged to the participant. The measured services removed 48.2% of the records they had classified as removable. Those findings do not describe every provider, but they show why a polished dashboard should not be mistaken for complete removal.

Centralized government systems can reduce the burden where they exist. California residents can use California’s DROP system to send one request to active registered data brokers. DROP launched on January 1, 2026, and brokers were required to begin processing requests on August 1, 2026. It remains limited to California residents and registered brokers, and legal exemptions still apply.

A practical privacy-reduction workflow

Search for your full name with a city, prior city, age range or phone number to identify exposed profiles.
Start with sites displaying the most sensitive or actionable details, such as addresses, phone numbers and relatives.
Use each site’s official privacy or opt-out page. Record the date, profile URL and confirmation number.
Use a centralized state tool if you qualify, while remembering that it may cover registered brokers rather than every website.
Enable a browser-based opt-out preference signal such as Global Privacy Control where supported. This communicates a prospective request not to sell or share data to sites you visit; it is not retroactive deletion of existing broker profiles.
Check again after several weeks and then periodically. Resubmit requests when removed profiles return.
Reduce new collection at the source by limiting unnecessary form fields, app permissions, public social details and account data. Organizations collecting information through tools such as event forms can also follow privacy-conscious QR code practices.

Do not provide more verification data than a broker’s official process reasonably requires. A removal request sometimes needs enough information to distinguish you from someone with a similar name, but the goal is to reduce exposure rather than create another unnecessarily detailed record.

Treat opt-outs as maintenance, not a one-time cure

Data broker opt-outs are worth doing when exposed profiles create privacy, harassment or security concerns. Their value is reduced discoverability: fewer easy lookups, fewer visible contact details and fewer accessible profiles. The available evidence does not support treating them as permanent removal from the internet.

Choose manual requests if your exposure is concentrated on a manageable number of sites. Consider a paid service when recurring monitoring saves enough time to justify the cost, but verify its work independently. In either case, combine removal with controls that limit future collection. Privacy improves through layers, and broker opt-outs are one useful layer rather than the whole defense.

Data Brokers Explained: How Personal Information Becomes a Product