What Data Brokers Know About You

A few months ago I requested my file from one of the big data brokers, mostly out of curiosity. What came back was a small horror story. My current address and the four before it. My approximate income. The names of people I’ve lived with. A list of “associates” that included a college roommate I haven’t spoken to in fifteen years. None of it came from anything I’d signed up for. It was assembled, packaged, and for sale to anyone willing to pay.

What data brokers know about you is, in short, almost everything — and if you live in the US, a file like that almost certainly exists for you too. The question isn’t whether you’re in a data broker’s database. You are. The question is what’s in the file, who’s buying it, and what you can actually do about it.

What Data Brokers Know About You: The Full File

Data brokers are companies whose entire business is collecting, packaging, and selling information about individuals. You’ve probably never knowingly interacted with one, which is the point. They operate in the background, buying data from sources you do interact with: retailers, app developers, public records offices, warranty card registrations, loyalty programs, and other brokers.

The composite file is more detailed than most people expect. It typically includes your full name and every address you’ve held, phone numbers, email addresses, estimated income and net worth, home value, the names of relatives and known associates, purchasing habits, and inferred categories like “expectant parent,” “recently divorced,” or “financially stressed.” Some brokers assign hundreds of attributes to a single person. The Federal Trade Commission, in a study of nine major brokers, found one that held data on over 1.4 billion consumer transactions and 700 billion data elements.

This is the same centralization problem that makes large-scale surveillance systems powerful — fragments that are harmless on their own become a detailed portrait once someone stitches them together. The difference is that this version is entirely commercial, legal, and aimed at you as a consumer rather than a target.

Who’s Buying Your File, and Why It Matters

The buyers fall into a few buckets, and some of them affect your money directly.

Advertisers and marketers are the obvious ones — they buy segments to target ads. Annoying, but low-stakes. The more consequential buyers are the ones making decisions about you. Insurers use broker data to inform pricing. Employers and landlords run background-check products built partly on broker data. Lenders buy “trigger leads” the moment you apply for a mortgage, which is why applying for one loan suddenly generates a flood of competing offers. Debt collectors and law firms use brokers to locate people and assets.

Then there’s the genuinely dangerous tier: scammers. People-search sites are the starting point for a huge share of phishing, social engineering, and identity theft. The same profile that helps a marketer also hands a fraudster your address history, your relatives’ names, and enough detail to impersonate you convincingly. This is exactly how a SIM-swap attack gets its raw material, and it’s why your phone number is more of a financial-security liability than most people realize.

The Two-Tier System: Marketing Brokers vs. People-Search Sites

It helps to split brokers into two groups, because the removal process differs.

The first group is the large marketing and risk brokers — Acxiom, Epsilon, Oracle, LexisNexis, and similar. These are mostly business-to-business. You’ll rarely see them, but they hold the deepest files. They generally honor opt-out requests, though you have to find and submit each one.

The second group is people-search sites — Spokeo, BeenVerified, Whitepages, Radaris, and dozens more. These are the ones that show up when someone Googles your name, displaying your age, address, and relatives behind a “see full report” paywall. They’re more visible, more directly dangerous, and the most tedious to clear because there are so many and they often re-list you after a few months.

How to Get Yourself Out: The Real Playbook

You can meaningfully reduce your exposure. You probably can’t get to zero, and anyone promising that is selling something. Here’s the order of operations that gives you the most protection per hour spent.

Start with the prescreen opt-out, because it’s the single highest-leverage move and takes two minutes. Go to optoutprescreen.com — the official site operated by the credit bureaus — and opt out of firm credit and insurance offers. This is the one the FTC explicitly endorses, and it cuts off the trigger-lead pipeline that turns a loan application into a mailbox full of junk. Five years with the online form, permanent if you mail the signed version.

Next, freeze your credit at all three bureaus. A freeze is free, reversible, and it’s the strongest single protection against new-account identity fraud — the thing your broker file makes easier. It doesn’t remove you from broker databases, but it neutralizes the worst outcome if your data is misused. I walk through the mechanics in the piece on financial privacy, but the short version is: do it today, it’s the best free hour in personal finance.

Then work the people-search sites. Each one has an opt-out page, usually buried. You search for your listing, copy the URL, and submit a removal request — sometimes with email confirmation. Prioritize the big ones first: Whitepages, Spokeo, BeenVerified, Radaris, Intelius, TruePeopleSearch. Budget an afternoon. Set a calendar reminder to recheck in 90 days, because re-listing is common.

If the manual grind isn’t realistic, paid removal services (DeleteMe, Incogni, and others) automate the submissions and re-submit on a cycle. They cost roughly $100–$150 a year. They don’t do anything you couldn’t do yourself, but they do it continuously, which is the part most people abandon. Whether that’s worth it depends on how you value the time — the same calculation I’d apply to any recurring subscription.

If You’re in a State With Privacy Laws, Use Them

Where you live changes your leverage. California’s Consumer Privacy Act gives residents the right to know what’s collected, to delete it, and to opt out of its sale — and brokers operating in California generally extend the mechanism rather than build two systems. California also runs a Delete Act and a data-broker registry, so you can see who’s registered and hit them directly. Texas, Colorado, Connecticut, Virginia, and a growing list of states have passed their own consumer-privacy laws with similar rights. The nonprofit Privacy Rights Clearinghouse keeps current guides on what each state allows. Even if you’re not in one of these states, many brokers apply the same opt-out tooling nationwide because maintaining separate pipelines is more expensive than just honoring the request.

The Realistic Goal

You’re not going to disappear from every database, and chasing that will only make you miserable. The realistic goal is to break the highest-risk links: cut the trigger-lead pipeline, freeze the credit that fraud depends on, clear the people-search sites that scammers and stalkers actually use, and keep a light recurring habit of rechecking. That’s the 80/20.

The deeper point is the one worth sitting with. A detailed file on you already exists, you didn’t consent to most of it, and it’s bought and sold by people making real decisions about your insurance, your loans, and your safety. You can’t undo the system. But you can make your own file a lot less useful — and in a world where your data is the product, that’s the move that’s actually within your control. If you want to go further than brokers, the next step is learning how to scrub your wider digital footprint.