What a data broker actually is
A data broker is a company that collects your personal information and sells it to other companies — without ever having a direct relationship with you. You didn’t sign up for their service or knowingly hand them anything; they got your data from somewhere else, and now they’re selling it.
The FTC’s landmark study of nine major brokers found the industry works largely in the dark: companies “collect and store billions of data points about nearly every U.S. consumer,” pulling from social media, retailers, DMV records, and other brokers, then reselling profiles down a chain nearly impossible to trace back to its source (FTC Chairwoman Edith Ramirez, opening remarks on data brokers).
As of 2026, four states — California, Vermont, Oregon, and Texas — require brokers to register publicly, which is the main reason we know who these companies are at all; California’s platform alone covers over 600 registered brokers (California DROP, about the Delete Act). Search DeSpy’s Data Broker Directory, built from state registries, to see what specific companies say about themselves.
Where the data actually comes from
Brokers rarely collect information directly. It arrives secondhand:
- Apps on your phone. Many apps include advertising or analytics code that reports your activity, sometimes including precise location, to third parties. See advertising IDs for how a single device number gets tied to your name.
- Purchases and loyalty programs. Retail transactions, warranty cards, and loyalty accounts feed marketing databases.
- Public records. Property deeds, voter files, court records, and business licenses are legally public and are the primary raw material for people-search brokers.
- Other data brokers. Your information gets resold broker-to-broker, which is why tracing where a broker got its data means you’d have to “sift through a complex maze of companies” (FTC Chairwoman Edith Ramirez, opening remarks on data brokers).
What ends up in the file
The FTC’s review of nine brokers found profiles that go well beyond name and address — income range, health conditions, ethnicity, religious and political affiliation, and inferred categories like “Diabetes Interest” and “Expectant Parent” (FTC, 2014 report, pp. 42–43) — inferences built from patterns in purchase and browsing data, not things you told anyone directly.
Location has become one of the most sensitive categories. In several enforcement actions, the FTC alleged brokers were selling precise location data revealing visits to reproductive health clinics, places of worship, addiction recovery centers, and domestic violence shelters — specific enough to trace a phone from a shelter to a home address (FTC v. Kochava). Similar allegations were resolved in the FTC’s 2024 settlements with Gravy Analytics/Venntel (FTC press release) and X-Mode Social/Outlogic (FTC order). The FTC concluded this data exposes people to real risk of stigma, discrimination, or violence — not hypothetical harm.
Why this matters for stalking, specifically
Most broker data is built and sold for marketing or risk-scoring. One category — people-search products — works differently: it exists to let anyone look up a name and get an address, phone number, relatives, and often a map of past homes. The FTC singled this category out as needing its own rules, distinct from marketing data, because it isn’t used to target ads — it’s used to find people (FTC 2014 report).
If someone already knows your name, a people-search site can hand them your current address in minutes, for a small fee or free — the direct line between the broader data-broker economy and stalking risk. DeSpy covers this in how people-search sites expose your address.
Can you get your data deleted?
Partially — it depends on where you live.
California has the strongest tools available. Under the CCPA, residents can tell any business that sells their data to stop, and can request deletion, with some exceptions (California AG, CCPA overview). In 2026, California added the Delete Request and Opt-Out Platform (DROP) — a state-run tool where a verified resident submits one deletion request that reaches every registered broker at once (CPPA, DROP). Brokers must start checking DROP and processing deletions every 45 days beginning August 1, 2026 (CPPA, information for data brokers).
Vermont, Oregon, and Texas require registration and disclosure of opt-out methods, but none offers a universal deletion tool like California’s. Vermont’s current law requires brokers to state whether they offer an opt-out at all — some legally don’t have to (Vermont data broker statute, 9 V.S.A. chapter 62). Vermont’s governor signed a broader overhaul, Act 138, on June 16, 2026, but its data-broker changes don’t take effect until January 1, 2027 (Vermont Legislature, H.211/Act 138) — a statewide deletion mechanism was put under study rather than built (H.211 Senate proposal of amendment).
Most other states have no deletion right aimed specifically at data brokers, though many now have broader state privacy laws giving residents a general deletion right that covers brokers too. Where neither applies, some large brokers still offer voluntary opt-outs, and FTC guidance holds regardless: check app permissions and reset device ad identifiers (FTC, how apps collect and use your information).
Realistic expectations
Even where opt-out rights exist, they come with real limits worth knowing before you spend hours on this:
Opt-outs aren’t permanent. People-search brokers continuously reingest public records, so removed listings can resurface. Consumer Reports recommends repeating the opt-out process about twice a year (Consumer Reports, people-search removal).
In Consumer Reports’ 2024 test, manual opt-outs beat paid services, but took longer. The best paid removal options reached only 65–68% success after four months, while manually submitting opt-out requests succeeded about 70% of the time — though that took several hours to several days across dozens of sites (Consumer Reports, removal service evaluation). Results for other services or years may differ.
One opt-out doesn’t cover other brokers. Outside California’s DROP, opting out of one people-search site does nothing for the others. That gap is exactly what California’s universal platform was built to close.
Some data can’t be deleted at all. Even under California’s Delete Act, a broker isn’t required to delete information that’s exempt under the statute, or that falls under existing CCPA exemptions such as certain medical information, regardless of your request (CPPA, accessible deletion mechanism regulation text).
None of this makes opting out pointless — reducing what’s findable in a five-minute search raises the bar for casual lookups. It just means no single request makes your footprint disappear for good.
Start with the Data Broker Directory to see which registered brokers are most likely to hold your information, and check advertising IDs to cut off one of the main pipelines feeding new data into these files.