Data broker privacy guide: collection, profiles, people search, marketing lists, risk, opt-outs, and monitoring

What to take away

A data broker collects or receives information about people, organizes it, and supplies data, profiles, or scores to other parties.
People-search sites are one product line in a market that also sells marketing segments, fraud signals, and consumer reports.
A listing is a lead, not proof that a field is current or attached to the right person.
An opt-out can hide a listing without touching the court file, a relative's page, or a copy held by another broker.
Log every request with its date, confirmation number, outcome, and next review date.

A public record, a purchase, a loyalty card, or a survey can become an input. A mobile identifier or a mailing list can also become an input. The broker standardizes that input, joins it to other records, infers a category, and sells the result. Nobody in that chain asks the person named in the file.

What the term covers

"Data broker" carries different legal and commercial meanings. In ordinary use it describes a company that gathers information about people from multiple sources and makes the data or analysis available to others. A statute may define it more narrowly and exempt regulated businesses such as credit unions or insurers.

Data Broker Product Lines

Marketing profile

Typical use: ad targeting
Rules that apply: marketing rules
Opt-out reach: may stop sale

People-search page

Typical use: public lookup
Rules that apply: varies by state
Opt-out reach: may hide listing

Consumer report

Typical use: housing decision
Rules that apply: consumer-reporting rules
Opt-out reach: may restrict product

The product lines are not interchangeable:

audience and marketing segments;
identity matching and contact enrichment;
people-search reports;
fraud and risk signals;
background, tenant, employment, or insurance reports;
location or device audiences;
business and professional contact lists.

A marketing profile, a people-search page, and a consumer report used for a housing decision raise different questions and fall under different rules. Do not assume one request reaches all three.

How a profile is assembled

A broker may hold direct identifiers such as a name, email address, phone number, or postal address. It can also work with device IDs, household links, hashed contact information, purchase categories, and modeled traits.

Document a Profile Field

Write down the field
Record the broker-stated source
Note the date you saw it
Explain why it concerns you

Matching is uncertain. Common names, recycled phone numbers, shared addresses, family relationships, and stale files can join the wrong records. An inference can be plausible and still false. Before you challenge a field, write down the field, the source as the broker states it, the date you saw it, and why it concerns you.

People search is unusually visible

People-search sites are the most visible broker product because the file sits on a free page that search engines crawl and republish. A typical result lists a name, an age or birth year, current and past addresses, phone numbers, email addresses, relatives, and links to property or court records.

Some pages add photos, social profiles, and possible matches built from people who share a name or an address.

Never Use People Search Alone

Do not accuse someone
Do not verify employment
Do not screen a tenant
Do not establish family relationship

A result may also merge two people who share a name or an old address. Never use a people-search page alone to accuse someone, verify employment, screen a tenant, or establish a family relationship. Confirm anything consequential through a lawful primary source.

Map the risk before opting out

Rank listings by harm, not by how annoying they are. A current home address tied to a safety concern comes before an obsolete interest category.

Rank Listings by Harm

Is the information accurate?

Yes

accurate data enables targeting

wrong data can harm someone else

Question	Why it matters
Is the information accurate?	Accurate contact data enables targeting; wrong data can harm someone else.
Is it publicly visible?	A preview creates exposure with no purchase.
Is it used for a decision?	Consumer-reporting rules may govern eligibility decisions.
Is there a safety threat?	Victim services and police may need to join the response.
Can the source be corrected?	Fixing the source reduces repeated downstream errors.

Understand the limits of removal

An opt-out may hide a public listing, stop a stated sale, restrict a product, or delete matched data under a particular law. Those are four different outcomes, and the confirmation email usually names only one.

What an Opt-Out Can Do

Hide listing

Scope: public view
Confirmation names: usually one
Copies remain: court file

Stop stated sale

Scope: one sale
Confirmation names: usually one
Copies remain: recorder office

Restrict product

Scope: one product
Confirmation names: usually one
Copies remain: licensing agency

Delete matched data

Scope: one law
Confirmation names: usually one
Copies remain: other brokers

The Federal Trade Commission's data broker study and recommendations documented collection from online and offline sources.

It documented marketing products, risk-mitigation products, and people-search products.

It raised transparency, access, correction, and opt-out concerns. The 2014 report describes the market as it stood then. It is not a current directory, a finding about every broker, or advice on your request.

More than a decade later, enforcement is the better guide. In 2024 the FTC settled with X-Mode Social and InMarket over the sale of sensitive location data and sued Gravy Analytics and Mobilewalla.

Roughly twenty states now have comprehensive privacy laws, led by California, where the CCPA as amended by the CPRA gives rights to know, delete, correct, and opt out of sale or sharing. California's Delete Act adds a single deletion platform, DROP, with broker duties in 2026.

The court file, the recorder's office, and the licensing agency keep their copies. A relative's page may still show the association. A search engine may hold the result until it recrawls. Another broker may hold a separate copy.

Use a controlled request process

Broker Request Log Fields

Listing URL and identifiers shown
Published privacy route and submission date
What you supplied and confirmation number
Stated response period and outcome
Next review date

Reach the broker's site yourself rather than through a removal link in an unsolicited message. If the process asks for identity proof, confirm the recipient and the requirement first, and mask any field it does not need. A Social Security number, passport, or driver's licence is not owed to a generic email.

Start with the categories that hold your name:

people-search sites, including Spokeo, Whitepages, BeenVerified, and TruePeopleSearch, each with its own removal form;
marketing compilers, including Acxiom and Epsilon, which publish opt-out forms;
advertising audiences, through the Digital Advertising Alliance and the Network Advertising Initiative;
prescreened credit and insurance offers, through OptOutPrescreen.com;
telemarketing, through the National Do Not Call Registry.

Record these fields for every request:

Field / What to record

Broker: Company and product line.
Date: Day you sent it.
Confirmation number: Reference returned, or none.
Outcome: Removed, suppressed, refused, or no reply.
Next review: Date to check again.

Monitor without feeding the profile

Search from a signed-out browser and skip paid reports unless you need one. Try name variations, old addresses, email addresses, and phone numbers selectively. Typing every field into an unfamiliar site hands it fresh data.

Check at 30, 90, and 180 days, then at an interval set by your risk level. Save only the evidence that shows the request and the outcome. Guard the log, because it becomes a compact map of someone's identifiers and addresses. Set a calendar reminder for each review date, and repeat the search from a second engine.

Common questions

Is every company that sells information a data broker?

No. Definitions vary by product and by law. Start with what the company collects, where it came from, what it supplies, and how the buyer uses it.

Does opting out remove a government record?

Usually not. The broker's copy or display can change while the official record stays available under the source agency's rules. Correcting the source is a separate job.

Should I pay an opt-out service?

It is optional. Compare coverage and the evidence it gives you. Check rescan frequency and how it handles your identity documents. Review cancellation terms and what happens to your data after the contract ends.

Can I prevent every future profile?

No single request guarantees that. Reduce upstream exposure, use the rights available in your state, document outcomes, and recheck the high-risk listings.

If a request is refused or ignored, several authorities can help. They can tell you what applies to your situation:

In the United States:

the Federal Trade Commission, which acts against deceptive or unfair data practices
your state attorney general, who enforces state privacy and consumer protection laws
the California Privacy Protection Agency, which enforces the CCPA as amended by the CPRA
a licensed lawyer in your state

Canada, as a secondary market: