Who data brokers are
A data broker is a company whose business is gathering personal information, combining it and selling or licensing it to others. Most people have never dealt with one directly. They are not usually the sites you visit; they sit in the background, buying from one party and supplying another.
The industry is varied. Some firms focus on marketing lists, some on verifying identities or detecting fraud, and some on “people search” sites that let anyone look up a name. The same firm may do several of these. Because these companies rarely have a customer relationship with the people they describe, awareness of them is low.
Where the data comes from
Brokers typically assemble records from several kinds of source, and the mix differs between companies.
- Public records. Depending on the country, these may include property records, court filings, voter registration details and business registrations. Rules about what is public and how it can be used vary widely.
- Commercial sources. Retailers, loyalty schemes, magazine subscriptions and surveys may share or sell customer information, subject to their own policies and applicable law.
- Online activity. Advertising and analytics partners can supply browsing and app data tied to identifiers, part of the wider practice of online tracking. Location signals from apps may also reach brokers through intermediaries.
- Other brokers. Data is often resold, so information can pass through several hands before reaching the final buyer.
- Inference. Brokers or their customers use statistical models to guess traits such as income band, household type or interests.
A user normally “agreed” to something in a long policy at some point, but whether they understood that the data could travel this far is another question.
How profiles are assembled
Raw records are messy. One person might appear as “Jon Smith” at one address and “Jonathan R. Smith” at another, and two different people can share a name. Brokers therefore use matching, sometimes called identity resolution, to decide which records belong together.
Matching usually relies on shared anchors such as an email address, phone number, postal address or device identifier. A link between two anchors, for example an email used to sign up on a shop’s site that also appears alongside a postal address in a delivery record, can join two datasets. The more links, the larger the profile grows.
The process is imperfect. Wrong matches can attach one person’s details to another, and old information may linger after someone moves or changes their name. Inferred traits are guesses. For this reason, a profile should be read as a rough statistical sketch, not an accurate biography.
Who buys the profiles
Buyers are diverse, and the legitimate uses are real as well as the worrying ones.
- Advertisers and marketers use lists and audience segments to choose who sees an offer, which feeds into targeted advertising.
- Financial and insurance firms sometimes use data for marketing, or, where specific laws allow, for decisions. Regulated credit reporting is typically treated differently from general marketing data.
- Fraud-prevention and identity verification services use data to check whether details are consistent. Identity verification is one case where broker-style data is used to protect people.
- Employers and landlords may use screening services, which in many places are subject to specific rules.
- People-search sites let members of the public look up others, which can raise safety concerns for people trying to avoid being found.
- Researchers, political campaigns and charities also buy or license data in some regions.
Why it matters
The concern is less about any single fact than about aggregation. Many pieces of information that seem harmless alone can, when combined, reveal habits, finances, health-related interests or home addresses. Aggregated data can also be exposed after a data breach at the broker or one of its customers, and leaked files can then be used for scams such as phishing scams that appear convincingly personal.
What individuals can do
Control is limited, but not zero, and results vary by location.
- Some places give you rights to ask a company what it holds, to delete it, or to opt out of its sale, under data protection laws in some regions. Some jurisdictions also require brokers to register publicly, which can help find them.
- Many brokers and people-search sites offer opt-out forms. Opt-outs often need to be repeated for each company, may require you to provide further details to confirm who you are, and data can reappear when it is re-collected from other sources.
- Paid services exist that submit opt-out requests on your behalf. Their value differs, and it is sensible to read what they do with the information you give them.
- Reducing what is collected in the first place, such as by limiting app permissions and sharing your email address and phone number selectively, shrinks future profiles.
None of these steps is guaranteed to remove you entirely, and it is wise to be wary of any service that promises that it will.