Personal information has become a valuable part of the modern digital economy. Businesses may collect information about where people shop, what websites they visit, where their devices travel, and what products interest them. Some companies known as data brokers specialize in collecting, combining, analyzing, and sharing this information. Consumers may have little or no direct relationship with these companies, which can make understanding data broker activity particularly difficult.
Whether a data broker may legally sell or share personal information depends on several factors, including the type of information involved, where the consumer lives, how the information was collected, and which federal or state privacy laws apply. Privacy protections continue to evolve across the United States, and consumers in some states have specific rights to access, delete, or restrict the sale of their personal information.
What Is a Data Broker?
A data broker is generally a business that collects information about individuals and makes that information available to other organizations. Unlike a retailer, bank, social media platform, or other company that interacts directly with a customer, a data broker may obtain information from sources that the consumer never knowingly provided to that broker.
According to the California Privacy Protection Agency, data brokers may collect personal information from various sources and sell or share it with other companies even when consumers did not directly interact with the broker for its products or services.
Data brokers operate for many different purposes. Some provide marketing information that helps companies identify potential customers. Others may offer identity verification, fraud prevention, background information, analytics, risk assessment, or location-based information.
The existence of legitimate business uses does not eliminate privacy concerns. Consumers may not know which companies possess their information, where the information originated, or who ultimately receives it.
Where Do Data Brokers Get Information?
Data brokers may obtain information from numerous sources. Some data comes from publicly available records. Other information may originate from websites, mobile applications, retailers, loyalty programs, advertising systems, surveys, online activity, or commercial partners.
A single piece of information may not reveal much. However, combining information from several sources can create a detailed profile of an individual.
For example, location information combined with shopping activity and online interests could provide insight into where someone spends time, what products they may purchase, and what services might interest them.
What Types of Personal Information Do Data Brokers Collect?
The categories of information held by data brokers vary considerably. Some brokers focus primarily on basic marketing information, while others may handle information that consumers consider much more sensitive.
California’s data broker registry notes that information associated with data broker activity may include details such as Social Security numbers, precise geolocation, health-related information, browsing history, and other personal information.
Depending on the company and source, collected information may include names, addresses, email addresses, telephone numbers, demographic information, purchasing behavior, interests, device information, online activity, and location patterns.
Location Information
Location information has attracted significant attention because it can reveal patterns about where a person lives, works, shops, travels, or spends time.
In May 2026, the Federal Trade Commission announced a proposed settlement involving data broker Kochava concerning allegations related to sensitive location information. The FTC stated that certain location data could potentially be used to trace individuals’ movements, including visits to sensitive locations.
The case illustrates why location information can raise legal and privacy concerns beyond ordinary advertising data.
Browsing and Shopping Information
Companies may also collect information about websites visited, advertisements viewed, purchases made, products considered, and other online behavior.
This data may help advertisers decide which products to display to particular groups of consumers. It may also become part of broader profiles that businesses use for market analysis or audience segmentation.
Inferences About Consumers
Not every piece of information in a consumer profile necessarily comes directly from the consumer. Companies may create inferences based on existing information.
For example, purchasing patterns or browsing behavior might be used to estimate a person’s interests, household characteristics, or likely purchasing preferences.
An inference may not always be correct. This can create additional concerns when profiles are used for decisions that affect consumers.
Can Data Brokers Sell Your Information Without Asking You?
There is no single nationwide privacy law that provides exactly the same rules for every type of personal information and every consumer transaction in the United States.
Instead, privacy law consists of federal laws addressing particular categories of information or industries, along with state privacy laws that may provide broader consumer rights.
As a result, a data broker may not always need to obtain direct permission from an individual before collecting or sharing certain information. However, that does not mean data brokers may freely use every type of information for every purpose.
The applicable rules can depend on the nature of the data, where it came from, where the consumer lives, who receives it, and why it is being transferred.
Sensitive Personal Information May Receive Additional Protection
Certain categories of information can create greater privacy concerns. These may include precise location information, financial information, health-related data, biometric information, government identifiers, and account credentials.
Federal laws may apply to particular types of information, while state privacy statutes can establish additional requirements.
In February 2026, the FTC reminded data brokers about requirements under the Protecting Americans’ Data from Foreign Adversaries Act. The agency explained that the law restricts data brokers from providing certain personally identifiable sensitive information about Americans to foreign adversaries and entities controlled by them.
What Privacy Rights Do Consumers Have?
Consumer privacy rights differ depending on state law and the circumstances involved. Some states provide residents with rights concerning the personal information companies maintain about them.
These rights may include the ability to request information about what a company has collected, ask for deletion, correct inaccurate information, or opt out of certain sales or sharing practices.
Consumers should check the privacy laws that apply in their state because rights and procedures vary.
California Provides Broad Data Privacy Rights
California has developed one of the country’s more extensive consumer privacy systems. The California Consumer Privacy Act and later amendments provide eligible California residents with several rights involving personal information.
California has also created specific requirements for data brokers. The state’s California Privacy Protection Agency maintains information about registered data brokers and their obligations.
As of January 1, 2026, California residents may use the state’s Delete Request and Opt-Out Platform, commonly known as DROP, to submit a single deletion request directed toward active registered data brokers. Data brokers became required to begin processing qualifying requests through the system on August 1, 2026.
Can You Ask a Data Broker to Delete Your Information?
In jurisdictions with applicable privacy protections, consumers may have the right to request deletion of certain personal information. The exact process depends on the law and company involved.
Consumers may encounter privacy request links on company websites or privacy policies. Requests may ask for information necessary to identify the consumer and locate matching records.
However, deletion rights are not necessarily unlimited. Laws may contain exceptions that allow businesses to retain information for specified reasons.
For example, a business may sometimes retain limited information for legal compliance, security, fraud prevention, or other authorized purposes.
California’s DROP System
California’s DROP system is intended to simplify the process of requesting deletion from data brokers. Instead of contacting every registered broker individually, eligible California consumers can submit one request through the platform.
Under the California Delete Act, data brokers are required to access the deletion mechanism periodically and process qualifying deletion requests, subject to applicable exceptions.
This development is especially relevant because consumers may otherwise have difficulty identifying every data broker that possesses information about them.
Deletion May Not Remove Every Record Everywhere
A successful request to one company does not necessarily mean every copy of a person’s information disappears from the internet or from every organization.
Information may exist with several businesses, government agencies, public records systems, websites, or organizations operating under different legal requirements.
Consumers should therefore understand what a specific request covers rather than assuming one deletion request removes all personal information everywhere.
How Can You Find Out Whether Data Brokers Have Your Information?
Discovering which companies hold personal information can be challenging because consumers may never have heard of many data brokers.
State registries can provide a useful starting point where available. California, for example, maintains a public data broker registry that includes information submitted by registered companies.
Consumers may also review company privacy policies and notices when they encounter unfamiliar businesses associated with their information.
If a consumer receives marketing messages or discovers personal information on a people-search service, they may investigate which organization operates the service and whether an opt-out or privacy request process is available.
Read Privacy Policies Carefully
Privacy policies may describe categories of information a company collects, purposes for using it, third parties that may receive it, and procedures for exercising privacy rights.
These policies can be lengthy, but sections involving “personal information,” “sharing,” “selling,” “your rights,” and “privacy choices” may be particularly useful.
Consumers dealing with a broader legal concern may also review our guide on what documents to prepare before talking to a lawyer. Organizing privacy notices, screenshots, emails, account records, and other documents can help explain what occurred.
What Should You Do If Your Personal Information Is Wrong?
Data broker information is not necessarily accurate. Records may be outdated, associated with the wrong person, or based on incorrect inferences.
Incorrect data can be particularly concerning if it appears in a context involving housing, employment, lending, insurance, identity verification, or another significant decision.
Depending on the type of information and law involved, consumers may have options for requesting correction or disputing inaccurate records.
Keep Records of Your Request
If you contact a company about inaccurate information or submit a privacy request, keeping records may be helpful.
Save copies of the original information, screenshots of the company’s privacy process, confirmation emails, correspondence, dates, and any responses received.
A clear timeline may become useful if the business does not respond or if a dispute develops later.
What If a Company Refuses Your Privacy Request?
A refusal does not necessarily mean the company violated the law. Some requests may fall outside the scope of a particular statute, and legal exceptions may allow companies to retain certain information.
However, consumers may want to review the explanation provided by the business and compare it with the privacy rights available under applicable state law.
Some privacy laws provide complaint or appeal procedures. State privacy regulators or attorneys general may also provide information about reporting suspected violations.
If the issue involves substantial harm, sensitive information, identity theft, financial loss, or complicated privacy questions, legal guidance may help clarify which rights apply.
Our article explaining how online legal consultations work and when you may need a lawyer provides more information about discussing a legal concern remotely.
How Can Consumers Reduce the Amount of Personal Data Available?
It may be difficult to prevent every company from collecting information, but consumers can take practical steps to reduce unnecessary exposure.
Reviewing app permissions can help identify applications with access to location, contacts, photographs, microphones, or other information. Browser privacy settings and advertising preferences may also provide options for limiting some forms of tracking.
Consumers can also avoid providing unnecessary personal information when creating accounts or completing optional online forms.
Review Old Accounts
Old online accounts may contain personal information long after a consumer stops using the service. Reviewing unused accounts and available deletion settings may reduce the amount of information stored across multiple platforms.
Consumers should consider whether they still need an account before requesting deletion because removing an account may affect access to purchases, documents, messages, or other records.
Limit Unnecessary App Permissions
Mobile applications may request access to location data, contacts, photographs, Bluetooth connections, or other device features. Some permissions are necessary for an app to function, while others may be optional.
Reviewing those settings periodically can help consumers better understand what information apps can access.
When Does Data Broker Activity Become a Legal Concern?
Data broker activity may create legal concerns when information is collected, sold, shared, retained, or used in a manner that conflicts with applicable privacy or consumer protection laws.
Particularly sensitive situations may involve precise location information, financial information, health information, government identifiers, account credentials, or data used for important eligibility decisions.
The legal analysis can also depend on whether consumers received required notices, whether they exercised an available privacy right, and how a company responded.
The Bottom Line on Data Brokers and Personal Information
Data brokers operate largely behind the scenes of the digital economy. They may collect information from numerous sources, combine it into consumer profiles, and provide that information to other organizations. Consumers may never directly interact with many of these companies.
Whether a data broker may sell personal information without direct permission depends on the information involved and the laws that apply. State privacy laws increasingly provide consumers with rights to access, delete, correct, or limit certain uses of personal data. California’s DROP system provides a notable example by allowing residents to submit a single deletion request covering active registered data brokers.
Consumers concerned about their personal information can begin by learning which privacy laws apply in their state, reviewing data broker registries where available, checking privacy policies, preserving records, and using applicable deletion or opt-out procedures. When a privacy problem involves significant harm or complex legal questions, discussing the situation with a legal professional may provide additional guidance.