Last Updated on October 2, 2026 by Jade Artry
At a glance
Data Brokers Explained: Who Has Your Information
What a data broker is. A company that collects, combines, analyses, licenses, shares or sells information about people, usually with no direct relationship to you.
People search sites are a subset. The FTC describes them as a type of data broker. They are simply the visible end of a much larger market.
Accuracy matters as much as volume. Records can be stale or wrongly matched, and AI can turn shaky inputs into confident-sounding conclusions.
Two high-leverage actions. UK readers can opt out of the open electoral register. California residents can use DROP to reach every registered broker at once.
Deletion is not suppression. Suppression keeps a rule attached to your record. Deletion can remove the rule along with the data, so future imports rebuild the profile.
Data brokers are easy to ignore until a company you've never dealt with seems to know your age, address, household or interests. That's usually the moment people realise their information hasn't stayed neatly inside the services they gave it to.
I don't think the main concern is that every data broker is doing something sinister. It's the loss of visibility and control. One company has your address, another has a phone number, another has marketing data, and a fourth may combine several of those records. By the time the information appears in a people-search report or a targeted message, it can be difficult to work out where the chain started.
AI adds another layer because systems can process and infer from large amounts of information much faster. The ICO has specifically warned that agentic AI may infer new personal information from what it already processes. For me, that makes accuracy and linkability just as important as the raw number of fields a broker holds. A wrong inference based on stale data can still look convincing.
What Is a Data Broker?
A data broker is broadly a company that collects, combines, analyses, licenses, shares or sells information about people, often without having a direct relationship with each person whose information appears in its databases. Not every broker does the same job.
Some specialise in marketing. Some help businesses verify identities or reduce fraud. Some provide audience and advertising data. Some build risk or demographic profiles. Some power people search websites that let ordinary consumers look up names, phone numbers, emails or addresses.
The term therefore covers a much bigger market than the sites most people encounter when they search their own name.
What AI Adds to the Data Broker Problem
Traditional data broking already relied on matching, profiling and enrichment. AI doesn't create that business model; it gives organisations and bad actors better tools for processing what they already have.
The ICO has highlighted a specific concern with agentic AI: systems may infer new personal information from existing data. That's important when broker records are stale or incorrectly matched, because an inference built on bad information can still be presented with confidence.
The part I worry about most is what happens when inference is built on stale data. People-search and broker records can already contain old addresses, recycled phone numbers or relatives matched to the wrong person. An AI system can turn those shaky inputs into a confident-sounding conclusion, and the person reading it may never see how uncertain the source data was.
When I look at exposure, I therefore don't only count data points. I look at provenance, accuracy and how easily one record can be connected to another. AI makes that distinction more important because a bad inference can travel just as quickly as a good one.
Where Do Data Brokers Get Their Information?
The answer depends on the broker, but common source categories include public records, commercial data, publicly accessible online information and information acquired from other data companies. The ICO gives examples including contact lists, open electoral register information, profiling, enrichment and data matching.
The result is that one organisation may know your address while another has a phone number, and a third provides demographic or behavioural information. Data matching can make those pieces more valuable when they're connected.
What Information Can a Data Broker Have About You?
Potential categories include:
- name
- current and previous addresses
- phone numbers
- email addresses
- age or date-of-birth information
- household members
- relatives
- property information
- professional information
- demographic characteristics
- interests and likely preferences
- purchasing or marketing attributes
- public-record information
Not every broker has every category, and not every record is accurate.
That last point matters. Data broker profiles can contain stale, inferred or incorrectly matched information. A wrong record can still create a privacy problem if somebody treats it as fact.
Are People Search Sites Data Brokers?
Yes, in the broad sense. The FTC explicitly describes people search sites as a type of data broker.
The difference is that people search sites are unusually visible to ordinary consumers. Services such as BeenVerified, Spokeo, PeopleFinders, Intelius and TruthFinder let users search for people or identifiers and receive reports built from public and commercially available information.
Many other brokers don't give the public a search box. Their customers may be businesses, advertisers, identity services or other organisations.
If you're trying to work out which removal route applies, people search sites vs data brokers focuses on that difference.
Where the Safety Risk Comes In
Because ease of access changes risk. An address might technically be available in an old public filing, but that doesn't mean everybody knows where to look for it.
A people search or broker-generated profile can connect that address to a phone number, relatives and previous locations in seconds. That can matter for stalking and harassment, unwanted contact, impersonation scams, social engineering, identity fraud, targeted phishing and doxxing.
I wouldn't treat every database as equally dangerous. I'd focus on the records that make you easier to locate, impersonate or target and deal with those first.
How Do You Find Out Which Data Brokers Have Your Information?
There's no perfect universal directory for consumers. I'd combine several methods:
- Search your own name and contact details.
- Check major people search sites.
- Use Google's ‘Results about you' for eligible contact information.
- Use a data removal service's exposure scan where it offers one without forcing you immediately into a subscription.
- For US-focused research, check official state data-broker registries where available.
- Review privacy notices when unfamiliar marketing or profiling companies appear in your data trail.
To check your own footprint without feeding your details into dozens of sites, use how to find out what information is public about you online.
Two Source-Level Actions Worth Knowing About
If you're in the UK, check whether you're on the open electoral register. Unlike the full electoral register, the open version can be bought by any person, company or organisation. You can opt out through GOV.UK or your local electoral registration office without affecting your right to vote. That doesn't erase old copies already sold, but it can stop your name and address being included in future open-register releases.
If you're in California, DROP offers a single-request route. One verified request can be sent through California's Delete Request and Opt-Out Platform to active registered data brokers. Since August 1, 2026, brokers must access DROP at least every 45 days to process applicable requests. Status updates can take up to 90 days; this is not instant deletion. I'd do that before spending an afternoon hunting down brokers one by one.
Can You Ask Data Brokers to Delete Your Information?
Sometimes, depending on the organisation, your location and the legal basis on which it's processing your data. In the UK, the right to erasure can apply in certain circumstances, although it's not absolute.
You also have a particularly strong right to object to your data being used for direct marketing. The ICO explains your right to object to direct marketing and why a limited suppression record may be retained.
In the US, privacy rights vary by state, and many people search sites provide opt-out routes regardless of whether a particular statutory right applies to every user. The FTC recommends using those opt-out processes or paying a removal service to handle them.
What Is the Difference Between Deletion and Suppression?
This is an important distinction.
Deletion usually means the company removes personal data from a particular system or processing activity, subject to legal exceptions.
Suppression can mean the organisation retains enough information to make sure it doesn't display, market to or re-add you in the same way.
For direct marketing, the ICO specifically notes that a suppression list can be useful because an organisation may need to remember that you opted out in order to avoid marketing to you again. PeopleConnect also uses the language of suppression for its people-search reports.
Don't assume that ‘suppressed' always means ‘every underlying copy has been erased'.
Are Data Brokers Legal?
Data broking isn't automatically illegal. The legal question depends on what data is collected, how it was obtained, what the company does with it, which jurisdiction applies and what privacy rights the individual has.
In the UK, organisations using data brokers remain responsible for complying with data protection law, including transparency, lawful basis and people's rights. The fact that data is publicly available doesn't automatically remove every data protection obligation around how it's collected and reused.
Do Data Removal Services Stop Data Brokers?
They can reduce your exposure to the brokers they cover. Services such as Incogni, DeleteMe, Optery, Privacy Bee, Kanary and Cloaked submit opt-out or deletion requests and continue monitoring according to the product.
They don't dismantle the data broker ecosystem, remove every statutory public record or guarantee that information can't return from a new source. The best reason to use one is practical: there are many brokers, each can use a different process, and keeping up with reappearances is time-consuming.
What Can You Do Without Paying?
Quite a lot. You can opt out of major people search sites manually, remove old profiles, ask websites to delete information, use Google's removal tools, exercise applicable privacy rights, object to direct marketing and reduce the personal information you publish in future.
Paid services mainly automate the repetitive part. For practical steps, use the wider personal-information removal guide or the free people-search opt-out guide. To compare ongoing coverage, see Best Data Removal Services.
Data Brokers and Identity Theft Are Related, but Not the Same
Having a data broker profile doesn't mean your identity has been stolen. The concern is that widely available personal information can make impersonation, phishing and social engineering easier.
If your information is simply too visible, start with removal. If you have evidence of fraud or misuse, add identity monitoring and recovery support. For US readers, DSS currently recommends Aura, Identity Guard and Norton LifeLock among its leading identity-protection options. Check regional availability in our identity theft protection comparison before choosing a service.
What This Looks Like in Real Life
Data brokers are often discussed as though the problem is a mysterious database somewhere in the background. I find it more helpful to see it as a system built from ordinary fragments.
A phone number given to one company. An address on a public filing. A profile left open. A purchase category. An old email. A household link.
Each fragment can feel harmless. The privacy issue begins when enough of them are connected to make a person easier to profile, contact, manipulate or locate than they ever consciously agreed to be.
Understanding the system is still worthwhile even if you never pay for a data removal service, because it tells you which exposure you can control yourself.
Frequently Asked Questions
What is a data broker?
A data broker is a company that collects, combines or supplies information about individuals, often using data from multiple sources.
Are people search sites data brokers?
Yes. The FTC describes people search sites as a type of data broker.
How do data brokers get my information?
Sources can include public records, commercial datasets, public online information, marketing sources and data acquired from other organisations.
Can I opt out of data brokers?
Many brokers and people search sites provide opt-out or deletion routes. Your legal rights also depend on where you live and how the organisation uses your data.
Is a data removal service necessary?
No. Manual opt-outs are often free. A service mainly saves time and adds repeated monitoring across a larger number of sites.
