What is a data broker? How companies collect, sell, and use your personal data

Learn how data brokers collect personal information, where they get it, who buys it, how they make money, and what privacy laws mean for consumers.

Personal data has become one of the world’s most valuable digital assets. Every time you shop online, use a mobile app, join a loyalty program, or browse the web, information about you may be collected, shared, and combined with data from dozens of other sources. Behind much of this ecosystem are data brokers — an industry projected to exceed $327 billion in 2026 as businesses increasingly rely on consumer data for advertising, fraud prevention, analytics, and risk assessment.

This article explains who data brokers are, how they collect and monetize personal information, what types of organizations use their services, why they remain controversial despite growing privacy regulations, and what rights consumers have over their data.

What are data brokers?

Data brokers (also known as information brokers, data providers, and data suppliers) are companies that collect, combine, and sell information about individuals and businesses. They obtain data from sources such as websites, mobile apps, public records, loyalty programs, and commercial partners, then create profiles used for advertising, fraud detection, identity verification, risk assessment, and analytics.

Most people are not even aware such companies exist, yet the data broker ecosystem includes hundreds of companies collecting and trading personal information. For example, California’s official registry lists more than 500 registered data brokers, showing the scale of an industry that operates largely behind the scenes.

What types of data do data brokers collect and what do they do with it?

Data brokers collect personal information from a wide range of online and offline sources. They combine these data points to create detailed consumer profiles and audience segments, which can then be used by businesses for advertising, fraud prevention, risk assessment, and other purposes.

Examples of these sources include:

• Social media
• Web history
• Online and offline purchase history and warranty information
• Credit card information
• Government records (driver’s license and motor-vehicle records, census data, birth certificates, marriage licenses, voter-registration information, etc).

The types of data that brokers collect and sell includes, among others:

• Full name
• Address of residence (and previous addresses)
• Telephone numbers
• Email addresses
• Age and gender
• Social security number
• Data about real estate owned
• Income
• Education
• Occupation

Data brokers combine these pieces of information and create audience segments (aka user segments, or simply audiences) which are then sold to companies.

When used for online advertising purposes (e.g. ad targeting), most AdTech platforms, like demand-side and data-management platforms, are not interested in data such as names, addresses and other sensitive information. Instead, they are interested in a person’s web and purchase history, but may also use age, gender and income to improve targeting.

How do data brokers generate revenue?

Data brokers may use different business models, but at the core of their operations is collecting, aggregating, and selling data to third parties. They purchase data from other companies, gather information from various sources, and turn it into audience segments that can be sold to advertisers, financial institutions, and other organizations. The value of these datasets depends on the type of information they contain and how businesses can use it.

For example, location data has become one of the most valuable categories of information in the data broker industry. In 2026, data broker Kochava faced regulatory action over allegations that it sold precise location information linked to hundreds of millions of mobile devices. The case highlighted how companies can monetize detailed datasets by providing businesses with insights into consumer behavior and movements.

When audience segments are sold to AdTech companies, they are often sold on a cost per mille (CPM) basis, or as a percentage of media.

Even though we often hear stories about data brokers selling sensitive data to advertisers, most data brokers, especially those who sell it to mainstream advertising companies, don’t sell such sensitive data, and focus on the more common categories like “sports enthusiast,” “music lover,” “impulse buyer,” etc.

What types of data brokers are there?

There are thousands of data broker companies around the world that collect information from public and non-public sources and sell it to other organizations. Depending on the type of data they collect, the services they provide, and how businesses use their information, data brokers can be grouped into four main categories: marketing and advertising data brokers, fraud detection data brokers, risk-mitigation data brokers, and people-search sites.

Type 1: Data brokers for marketing and advertising

There are data brokers that focus on marketing, such as Acxiom and Datalogix (recently purchased by Oracle). Other examples of companies that have data brokers as separate divisions include Experian and Equifax.

The role of such companies is to create databases of individuals and use them later for targeted advertising and marketing. Data brokers create audiences that include a person’s age, location, education level, income, web history, purchase history, and interests.

Advertising companies can purchase these audiences and show them targeted ads.

Type 2: Fraud detection data brokers

Some data brokers offer fraud detection – a service typically used by banks and mobile phone operators.

For example, before granting a loan, a bank might turn to a data broker to help it determine whether the information provided is accurate and legitimate, and therefore reduce the risk of granting a loan to a fraudster.

Type 3: Risk-mitigation data brokers

These types of data brokers can use a person’s search history to offer them high-interest (high-risk) loans rather than low-interest (safe) loans. For example, a history of regular online credit-card purchases of luxury products may indicate that a person has a lot of debt, especially if their income is modest.

Likewise, having an active gym membership could land the user in a group with lower risk of having a heart attack, and thus receive lower life-insurance premiums.

Similarly, users of the mobile app Yanosik (a Polish dashcam app informing the driver about speed cameras and providing other useful road information) can get cheaper car-insurance offers, provided they consent to their driving style being tracked. Naturally, reckless drivers pay a premium and careful drivers are rewarded.

The problem is that such risk-mitigation classifications may be based on completely inaccurate information, and because people are rarely aware of such information being collected, there’s no simple process in place allowing them to access the information, amend, correct, or remove it.

Type 4: People-search sites

People-search sites such as PeekYou and Spokeo allow individuals and companies to find information about a person by searching for their name, phone number(s), address, email address and social-security number.

The information can include:

• Aliases
• Addresses (present and past)
• Birthdates
• Interests
• Affiliations
• Education information
• Employment details
• Marital status
• Financial information (e.g. bankruptcy)
• Social-media information (e.g. profiles)

Due to the nature of this information, and the fact that it’s easily and readily available, people often become victims of doxxing.

How do data brokers work?

Data brokers gather information from various sources, including public records, websites, social media platforms, and other companies that collect user data. While some people associate data brokers with questionable data practices, their methods are not necessarily illegal. Instead, brokers often use publicly available information, purchase data from third parties, or receive data from organizations that have collected it directly.

Are data brokers legal?

Data brokers can operate legally when they comply with applicable privacy laws and have a valid legal basis for processing personal data. However, concerns often arise because many people are unaware of how data brokers collect information, where they get it from, how it is combined with other datasets, and who can access it.

The consent to share personal information with third-party brokers may be included as one of the checkboxes users select when registering on a website or hidden in lengthy privacy policies. For example, a person may provide detailed information when signing up for a loyalty program in exchange for a discount, without realizing that their data may also be shared with other companies.

Some people also voluntarily participate in data-sharing programs offered by research companies such as Luth Research. In these cases, users knowingly agree to share detailed information about their habits, interests, and online behavior in exchange for compensation. The collected data may then be used by businesses to better understand audiences and improve their marketing campaigns.

Why are data brokers controversial?

The growth of the data brokerage industry has created new challenges for data privacy and security. As data brokers collect personal information from more online and offline sources, concerns have increased around transparency, user consent, and people’s ability to control how their information is used.

For example, under the European Union’s General Data Protection Regulation (GDPR), organizations must rely on one of six legal bases to process personal data. One of these bases is legitimate interest, which remains one of the most debated legal grounds because of its broad interpretation and potential misuse.

How do data brokers use legitimate interest under GDPR?

Some data brokers and AdTech companies rely on legitimate interest as their legal basis for processing personal data. However, this approach is controversial, particularly when information is used for targeted advertising.

Legitimate interest requires companies to demonstrate that their business needs do not override individuals’ privacy rights. For activities involving advertising and user profiling, organizations may need to obtain clear, specific, and informed consent before collecting and using personal information.

Do data brokers collect inferred and predicted data?

Some data brokers argue that derived, inferred, and predicted information is different from directly collected personal data. However, these data points can still be used to create detailed profiles, categorize individuals, and target users through unique identifiers.

For example, brokers may infer interests, financial circumstances, or preferences based on browsing behavior, purchase history, location information, and other collected data. These conclusions can influence decisions made by advertisers, financial institutions, insurers, and other organizations.

Can you remove personal information from data brokers?

Many data brokers provide opt-out procedures that allow individuals to request access to their information, limit its sale, or ask for deletion. However, these processes have traditionally been fragmented, requiring users to contact individual data broker companies separately.

New privacy initiatives are attempting to simplify this process. In 2026, California launched its Delete Request and Opt-out Platform (DROP), allowing residents to submit a single deletion request to hundreds of registered data brokers instead of contacting each company individually. Data brokers must begin processing these requests through the platform starting in August 2026.

However, removing personal information from data brokers can still be challenging. Some companies may hold different versions of the same data, and removing collected information does not always eliminate profiles or inferences created from it. Because data can be copied and shared across multiple databases, complete deletion from every source remains difficult.

Final thoughts

Data brokers have changed the way companies access and use information. By combining data from multiple sources, they can create detailed audience profiles that support advertising, fraud prevention, and risk assessment. However, the same process raises an important question: how much visibility should individuals have into the data collected about them and the decisions made using it?

As privacy regulations continue to develop, companies working with third-party data need to pay closer attention to where information comes from, how it is used, and how users can control it. Privacy is becoming a core part of data-driven products, not an afterthought.

Contact us to explore AdTech strategies that balance campaign performance, customer privacy, and regulatory compliance.

Rate this article!

Average 0.0 out of 5

Olena Hutak

Technology Researcher

Olena Hutak is a technology researcher covering advancements in AI, intelligent automation, and other emerging areas. She tells stories about tech that matters.