What Data Brokers Know About You: A Plain Map

What data brokers know about you is usually far more than a name and an address. A typical file combines identity details, public records, purchase and household data, device and location signals, and a layer of predictions about your income, health, family and habits. The FTC's study of the industry found brokers holding "billions of data elements covering nearly every U.S. consumer," and the data mostly arrives from other companies, not from you.

A data broker is a business that collects personal information from many sources and sells or shares it with other businesses, often with no relationship to the person described. The California Privacy Protection Agency's registry page describes it in nearly those words: a business that collects personal information about consumers from various sources and sells it to other companies, even when the consumer did not deal with that business.

This guide is a map of what such a file contains, how each layer is built, who uses it and what it changes for you. It also explains the part most articles skip: which layers are facts, which are guesses, and which you have a legal right to see. It is not a guide to looking anyone up. Every rule is described as of the official page named beside it, and these pages change, so check the live version before you rely on it. This is information, not legal advice.

The short version

A broker file has layers: identity, public records, commercial and household data, device and location signals, and inferences. Only the first two are mostly factual.
Most of the data comes from other companies and from records, which is why you never agreed to it and why one deletion rarely ends the problem.
The inference layer is the least known and the least accurate. It can still shape the offers, prices and ads you see.
You can often request a copy of what a business holds about you. Use the right to know in California or an access request under GDPR, and expect the answer to be partial.
If a file exposes you to harassment or stalking, treat that as a safety matter before a privacy chore.

Four kinds of data broker, and why the label hides the differences

The phrase "data broker" covers businesses that behave very differently, and the difference decides what they hold, who buys it and what rights you have. Most confusion about the industry comes from treating them as one thing.

Kind	Typical content	Who buys	Can you usually see it
Marketing data	Household details, purchases, interests, predicted traits	Retailers, banks, insurers, advertisers	Sometimes, by request where a law gives the right
Risk and verification	Identity checks, fraud scores, eligibility signals	Lenders, landlords, employers, platforms	Often, if a decision went against you
People search	Name, age, past addresses, relatives, public records	Anyone who pays	Yes, the report is the product
Location and device	Movement patterns tied to a phone or advertising ID	Advertisers, analytics and data resellers	Rarely

The FTC's 2014 study used a similar split. It sorted the nine brokers it examined into products for marketing, for risk mitigation and for people search, and made different recommendations for each. The risk products matter most when a score limits a transaction: for those, the FTC recommended that Congress consider requiring the company to tell consumers which broker's information it relied on, and that the broker allow access and correction, as appropriate. People search is the category the FTC's consumer page covers: sites that compile reports and sell them to anyone willing to pay.

A fifth group sits beside these: the credit bureaus. They are regulated separately, and the FTC explains that you can get your credit reports for free, from one authorized site only. Treat a credit report as one narrow, official slice of your data, not as the whole file.

The layers in a typical file

Think of a file as five layers stacked on one identity. The top layers are fairly factual. The bottom layers are speculative.

Layer one: who you are

Name, other names you have used, date of birth or age, current and past addresses, phone numbers and email addresses. The FTC says people search reports can include your age, other names, addresses, marital status, education, employment history and the names and addresses of family members. The Markup's reporting on broker files found identifiers including Social Security numbers in some of them.

Layer two: what the state has recorded

Property, driving, voter registration, criminal and civil records, and professional licenses are listed by the FTC as public records that people search sites compile. These are factual in origin. They are also the slowest layer to change, because the source is an official register, not the broker.

Layer three: what you bought, joined and returned

Purchase history, warranty registrations, magazine subscriptions, loyalty cards and survey answers. The FTC's study named consumer purchase data, social media activity, warranty registrations and magazine subscriptions among the sources. The Markup reported files showing when a person last logged into a computer and how much they spent on clothes, furniture and dining.

Layer four: devices and movement

Advertising identifiers and similar device identifiers, which let a buyer link activity across a phone, a computer and other devices. This layer is how a file about a household becomes a file about a person. The sources read for this guide do not itemize which identifiers any one broker holds, so treat the list as a category, not a catalogue.

Layer five: predictions

Whether you are "blue collar" or white collar, your religion, ethnicity and political leanings, how well you sleep, whether you smoke, whether you have health insurance and whether you are in the market for cryptocurrencies. The Markup reported that the reports it examined contained more than a thousand "educated guesses and predictions" about a person's traits and habits. None of it is something you told anyone.

700 billiondata elements held by one broker in the FTC study

95%of U.S. adults profiled, by one large broker's own claim

1,000+guesses and predictions in the reports The Markup examined

FTC press release of May 27, 2014 (the 700 billion figure, for one of nine brokers studied) and The Markup's 2026 investigation (the 95 percent figure, which is Acxiom's own claim, and the more than a thousand predictions).

Where the data comes from, and why you never agreed to it

The FTC's study found that brokers draw on extensive online and offline sources "largely without consumers' knowledge," and that data also moves between brokers: seven of the nine had shared information with another broker in the study. Put plainly, you rarely give a broker anything. A retailer, an app, a registry or another broker does.

There is no single door. A deletion at one company does not reach the copies it has already sold. The Markup noted that opting out with one broker does not delete copies already passed to others, and the FTC adds that opting out of people search sites does not remove information from public records.

The source is usually a business you did deal with. A loyalty program, a warranty card, a quiz, a free app or a publicly visible profile can each start a chain. That is where the flow can be narrowed at the start.

Your own public choices count too. Public social profiles are one of the sources the FTC lists for people search sites, and they are the easiest input to change.

Registered, regulated and invisible brokers

Some brokers are required to say they exist. California requires any business that meets its data broker definition to register each year with the California Privacy Protection Agency, according to the registry page. That makes California the clearest place to learn who is selling. It does not make the industry visible: a broker outside the registry, or outside California, is not on the list.

Who buys the file, and what it changes for you

A file is bought to predict your behavior. The Markup's investigation described the buyers as hundreds of businesses, including more than 100 of the largest U.S. companies, and described uses that matter to ordinary people:

Lenders target people who may need a "financial lifeline," often on high-interest terms.
Banks market add-on products such as identity protection and credit monitoring that a customer may not need.
Banks tailor offers to your profile, including the sign-up bonus on a credit card.

The FTC described the same pattern in 2014 with an example worth remembering: a segment called "Biker Enthusiasts" could support a motorcycle discount, or it could be used by an insurer as a sign of risky behavior.

For most readers the effect is quiet: a different offer, an advertisement that seems to know too much, and no sight of the file behind it. The harm that does the most damage is rarer: a profile that names where you live and who is related to you is also what a harasser or a scammer would want. That is why the safety section below changes the order of work.

The guesses are the weakest part, and they can be wrong

The lower layers are statistical. The Markup reported that data in the files was often inaccurate, with one report listing six different guesses about a single person's age. Estimates of this kind are modeled rather than observed, and the Markup noted that the health details in the reports were inferred without access to any medical record.

Two things follow. First, an inference is not a record of something you did. A predicted health condition or a "likely to need credit" label is a pattern match. Second, a wrong inference can still be used. If a modeled score influences a price or a decision, the harm is real even when the guess is false.

Location data: the layer with the highest stakes

Location signals deserve their own section because they can reveal things a person never said. On January 14, 2025 the FTC announced a final order against Gravy Analytics and Venntel over the sale of sensitive location data. The press release says the order prohibits Gravy and Venntel from selling, disclosing or using sensitive location data, with exceptions for national security and law enforcement. It describes the data at issue as including visits to health-related locations and places of worship. These were the FTC's allegations in a consent order, not findings after a trial.

A stream of movement data tied to a phone's advertising ID can imply a diagnosis, a faith, a relationship or a routine. Two habits reduce it: restrict location permissions to the apps that need them, and reset or turn off your phone's advertising identifier in its settings. Neither stops a broker that already holds history, and both are outside the scope of a legal request.

How to see what a business holds about you

The only reliable way to know what a specific business holds is to ask it, using a right your law gives you. No single request shows you the whole industry.

Where you are	Right to use	Deadline to answer	Main limit
California	Right to know, delete, correct, opt out of sale or sharing	45 days, extendable by 45	Know requests free up to twice a year
EU	Access under GDPR Article 15	One month, extendable by two	Controller may refuse manifestly excessive requests
Elsewhere in the US	Depends on the state and the business	Varies	Check your state's law and the business's policy
Credit data	Free credit reports	Online or by request	Covers credit files only

The California Attorney General's CCPA page lists the five rights: to know, to delete, to opt out of sale or sharing, to correct and to limit use of sensitive information. It says businesses must respond to know, delete and correct requests within 45 calendar days, with one extension of up to 45 more if they tell you, and that you can make a request to know up to twice a year, free of charge. Opt-out requests have a shorter limit of up to 15 business days.

Under GDPR Article 15, you can ask a controller to confirm whether it processes your data and, if so, to give you a copy plus the purposes, the categories of data, the recipients, the retention period and, where the data was not collected from you, any available information about its source. Article 12 sets the deadline of one month, extendable by two further months where necessary, and says the information is provided free of charge unless the request is manifestly unfounded or excessive. For a UK request, the ICO's guidance is the place to confirm current procedure; its subject access pages could not be read in full for this guide.

For credit files, the FTC says to use AnnualCreditReport.com, the only authorized site, and warns that neither it nor the bureaus will email you asking for your Social Security number.

Ask for your file without handing over more than you must

Make a list of businesses that already have a relationship with youBanks, retailers, loyalty programs, apps and employers. These are the likeliest sources of the data that later reaches brokers.
Use one dedicated contact address for requestsA separate inbox keeps replies together and avoids tying your main account to a new mailing list.
State the right you are using and the dateName the law, ask for a copy of the personal data and its source, and note the day you sent it so you can count the deadline.
Give only what proves who you areA business may need to verify identity. Offer the least that works and refuse requests for documents unrelated to the match.
Keep every replyA short record of who answered, what they said and what they refused lets you escalate with the facts.
Check what is wrong, then correct or deleteMark wrong details and file correction or deletion requests for those items, using the same rights.

What an access request will not show you

Expect an incomplete picture. A request reaches only the business you send it to. It does not trace the sources that fed that business, and it may exclude data a business is allowed to keep or has legitimately withheld. A broker that does not recognize you from the details you gave can answer that it holds nothing, which may be true or may be a matching failure. Treat an empty answer as a result from one company, not as proof that your data is not in circulation.

When the file becomes a safety problem

A profile that ties your name to where you live, who you live with and how to reach you is a different thing from a marketing record. If someone is harassing, threatening or following you, or you have reason to expect it, the order of work changes. Safety comes first, tidying second.

The steps that follow are protective and do not involve locating anyone.

Tell the police or a victim support organization in your country what is happening, and ask what protective options exist for your address on public registers. These differ by state and country, so use the official office.
Change what you control that links you to a place: public social profiles, tagged photos, shared location settings and any business listing that uses your home.
Keep a dated log of messages, listings and screenshots, because an authority or a platform will ask for dates and addresses of pages.
Where a listing is being used to threaten you, report it to the platform hosting it and to the search engine, citing the threat. Removal at the source matters more than removal from a search result, because the page itself stays online.
Consider a trusted person who can send and read requests for you if looking at the material is itself distressing.

An invented scenario

This example is invented. A woman we will call Dana has left a difficult workplace and has had two odd phone calls from unknown numbers. She asks a business she buys from for a copy of her data. The reply shows her phone number, a past address, an estimated household income and a list of predicted interests. She finds the phone number is the one the callers used and the address is where she lived two moves ago. She does not need to trace who bought the data to act: she asks the retailer to delete the record, asks it to name its recipients, changes her number with her phone provider, and tells the police about the calls.

A realistic timeline for understanding your own exposure

The first decisions take an afternoon. The answers take weeks, and the second look takes months. These are typical ranges from experience, not promises, and they change by law and by business.

Phase	Usually takes	What happens
Day one	A few hours	List the businesses that know you, check your public profiles and location permissions, order your free credit reports
Week one	A few days	Send access requests to the businesses on the list and note the deadline for each
Weeks two to eight	Up to the legal limit	Replies arrive, some partial; follow up on missed deadlines; file corrections for wrong details
Month three	One sitting	Compare replies, decide which deletions and opt-outs to pursue, and note what you could not see
Every few months	An hour	Repeat the check on your public profiles and review new accounts or apps that ask for data

Expect new entries to appear after a deletion, since the sources keep supplying brokers. The goal is a smaller, more accurate and less reachable file, not an empty one.

What this means for your reputation

A broker file is not the same thing as search results, but the two interact. Profiles that name your family, your past addresses or an old employer are the raw material for mistaken identity, for scams that sound informed and for pages that rank when someone searches your name.

The reputational damage seldom comes from the file itself. It comes from the places it surfaces: a listing that appears when a client searches for you, an inaccurate profile that an AI assistant repeats, a leaked record in a dispute. For that reason the work splits in two. One part reduces what is reachable. The other part makes sure that when someone does search, the first things they find are accurate and written by you.

Your next step: ask one business, and secure one profile

You do not have to understand the whole industry before you act. Pick one business that clearly holds your data and send the access request described above, then change one public profile that shows more than it needs to. Those two moves tell you more about your own exposure than any list of broker names.

If this is happening to you now

If a file or listing is being used to harass or threaten you, begin with the safety steps above and tell the police. If you are worried about what appears when someone searches your name, a private review can show what is reachable and in what order to act on it. Request a private audit.

Reputation Partners works on the search and AI side of this problem, helping people see what appears under their name and correct what is inaccurate, alongside the legal and safety steps above. The requests in this guide are yours to make without a firm.

Questions people ask

Do data brokers have my Social Security number?

Some files may include it. The Markup's investigation reported broker files that held identifiers including Social Security numbers, though a given broker may or may not hold yours. Credit bureaus are regulated separately. To see what is on your credit files, use the one authorized free report site named by the FTC, and be cautious of any message asking you to type the number into a page you did not open yourself.

Are data brokers legal?

In many places, yes, within limits that depend on the country, the kind of data and the buyer. California requires brokers to register, and EU law gives you a right of access to your personal data under GDPR Article 15. Some uses, such as credit decisions, are covered by specific rules. Whether a particular broker complies is a question for a lawyer or the regulator.

Can data brokers see my medical records?

The Markup reported that the files it examined included inferred health information, such as sleep quality, smoking and insurance status, without access to medical records. That means the broker predicts from other data, such as purchases and location. The prediction can be wrong, but it can still reach an insurer or an advertiser, so it is worth asking what a business holds under your access rights.

Does deleting my social accounts remove me from broker files?

It cuts one source but does not reach copies already sold. The FTC lists public social media profiles as a source for people search sites, so closing or locking a profile reduces future inputs. Records already held, public records and data from retailers and apps remain. Use deletion requests and access requests for the businesses holding the data, and keep public profiles minimal.

How do I know which brokers have my data?

You usually cannot find out with one search. A request to a business you deal with shows what it holds and, under GDPR, any available information on where it got the data. In California, the registry shows which companies are registered as data brokers, and you can ask any business which categories it collects and sells. Treat the result as a partial map, not a full list.

Is it worth paying a service to find out what brokers know?

Maybe, but check what you would get. Any service needs your name, address and other details to act for you, so you hand over more data to find out what exists. Ask what it covers, how it verifies who it is acting for and what it does after a removal. Whatever it offers, your own access rights cost nothing and work without a third party.