A Guide to Data Brokers and How to Protect Yourself From Data Breaches

If you’ve ever received a flood of spam emails for products you’ve never ordered, and websites you’ve never visited, chances are your personal data has been sold by a data broker. 

Data brokers are part of a legitimate industry, and often sell your general information to companies launching targeted marketing campaigns. However, their practices can prove frustrating and potentially, may even threaten your cybersecurity.

An excellent privacy tool can be the key that keeps the data brokers away, and can give you peace of mind when you’re connected online. 

All you need to know about data brokers

Across the globe, data brokers are a part of a lucrative industry. The current data broker market is valued at $280.82 billion, and is projected to grow by another $100 billion by 2030. Many companies rely on this industry to ensure their marketing reaches their target audience.

Many credible websites use disclaimers to let their customers and account holders know that their information may be sold to a third party, and explain how that data may be used. However, less than credible data brokers might sell your personal data to any third party, for any reason.

What are data brokers?

Data brokers, also known as information product companies, analyze and collect personal data, and then sell that data to third parties. They gather personal information and build profiles on millions of people. 

For example, robocalls may occur as a result of data brokers selling your profile to the highest bidder. Legal data collection might be sold by data brokers so that companies can reach you for the following reasons:

• Advertising
• Call center contact
• Collections
• Marketing
• Push of products and services tailored to a target market

What personal details do data brokers collect? 

Data brokers selling personal data mostly hand over contact information such as your email address, phone number, and physical mailing address. These companies might also collect aggregate demographic data and information about your purchases. 

This information isn’t confidential, and can be collected from any of the following sources:

• Bank databases, credit card companies, and online retailers.
• Cookies used for tracking purposes on most websites. Tracking cookies collect information about your browsing habits, search history, and more.
• Official government and public records, including birth certificates, marriage licenses, and property titles.
• Social media platforms such as Facebook, Instagram, LinkedIn, and TikTok.
• Website surveys like Amazon’s post-delivery survey that may provide information about your purchase history and preferences. 

How do data brokers work?

Data brokers selling personal data may aggregate the information via multiple sources, or they may buy lists from other companies that they turn around and sell to organizations.

Some data brokers have existing relationships with long-term corporate clients, and others may work on a contractual basis. Unscrupulous data brokers may sell your personal information to the highest bidder, including entities that operate on the dark web.

Are data brokers legal in the U.S.?   

Currently, there aren’t federal laws to regulate the data broker industry. However, in 2024, President Biden signed the Protecting Americans’ Data From Foreign Adversaries Act of 2024 (PADFA) into law. 

This law restricts the ability of U.S. data brokers from selling sensitive personal data of Americans to potentially malicious foreign adversaries, including China, Iran, North Korea, and Russia, or to companies that are based in those countries.

What do data brokers do with your personal data?

Data brokers use personal information to compile thorough customer profiles. These profiles are then used for myriad reasons, including:

• Background checks: Employers, financial lenders, and landlords might use data brokers selling personal information to vet candidates or potential tenants.
• Credit scores and risk assessments: Financial lenders may use data obtained from data brokers to check your credit score and identify any potential risks of lending you credit.
• Data appending: Data appending is the method used to update corporate databases with missing or incorrect information. This allows companies to obtain accurate consumer data and target audience information.
• Fraud detection: Financial institutions and retailers may use purchased data to identify and prevent fraudulent transactions.
• Targeted advertising: Data brokers analyze consumer information before creating profiles, which is a cost-effective method to help companies to direct their advertising toward their target audience.

Examples of data brokers

You might be surprised to discover that many trusted companies are also data brokers. First-party companies like Amazon and Facebook may sell information from their databases to a third party. However, third-party data brokers purchase personal data and then sell it to another party.

Some of the most high profile examples of data brokers include:

• Advertising or marketing brokers like Epsilon, Oracle, KBM, and Axicom
• Healthcare brokers such as Experian Health Inc and Healthcare.com
• People search websites like Yellow Pages, Zoominfo, and Spokeo 
• Risk mitigation brokers such as LexisNexis
• B2B companies and credit bureaus like Equifax, Experian,TransUnion and other platforms that allow you to monitor your credit score are also data brokers, and deal mostly with financial data.

How data brokers pose a cybersecurity threat

As data brokers create large databases, cybercriminals can target their vulnerabilities and expose vast amounts of data. The risk of identity theft, financial fraud, and other ways that weaponize personal data, raises larger questions about the security practices and ethics of data brokers.

Here are some of the largest high profile data breaches involving data brokers selling personal data, and the number of individuals they impacted:

• National Public Data: National Public Data is one of the largest online providers of public records. Per TechCrunch, in 2024, a lone hacker claimed a data breach exposing billions of records, and impacting at least 300 million people.
• Aadhar: Based in India, the world’s largest ID database that includes confidential banking account and fingerprint scan information was hacked in 2018. The data breach exposed more than 11 billion records.
• Equifax: In 2017, the data broker suffered a data breach that exposed personal information (including Social Security numbers) of over 145 million people.

You can discover if your information has been compromised in a data breach via Have I Been Pwned.

How to use privacy tools and avoid data brokers

You can’t completely avoid data brokers if you’re online. However, the great news is that there are measures you can take to protect your identity and avoid some brokers’ databases.

Identity monitoring services allow you to track the use of your personal data and will alert you to suspicious activity or use of your information. Some, but unfortunately not all, data brokers also offer opt out services and give people the option of complete removal from databases. 

Some of the most popular identity monitoring services include:

• LifeLock by Norton: Lifelock scans your devices 24/7 and alerts you to any cyberthreats or data breaches. 
• Aura: Aura protects your identity from malicious data brokers and data breach exposure for a reasonable price and under different plan options. Along with identity protection, their services include transaction monitoring and scam call protection. To opt out of data broker databases, you can use the following:
• DataSeal: DataSeal will remove all traces of your personal data from the Internet and alert you if your profile reappears in databases.
• DeleteMe: DeleteMe is a leader in the data removal industry and allows you to remove your personal information from search engines and databases. They also provide an opt out guide with step-by-step instructions on how to remove your data from data broker websites.
• Incogni: Incogni features services that allow you to remove your information from data brokers’ profiles, reduce spam, and prevent cybercriminals from targeting you for scam attacks.

Personal Data Scan from What Is My IP Address

Data brokers are a vital tool for many corporations. However, they can also leave you vulnerable to cyberattacks and data breaches. It’s important to understand how data brokers work, remain aware of their potential risks, and discover the extra layers of cybersecurity you can add to protect yourself.

Along with identity monitoring and opt out tools, What Is My IP Address offers a Personal Data Scan for U.S. residents. This fantastic, free tool searches over 80 websites of data brokers to alert you to your personally identifiable information (PII) that can be found on the Internet. Take control of your online data and use the Personal Data Scan today.