What is a data broker, and how do you get off their lists?

A data broker is a company that collects personal information about people, combines it into profiles and sells or publishes those profiles. California's Delete Act defines one as "a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship." That missing direct relationship is why most people do not know they are listed.

Where brokers get your data

The FTC's 2014 study of the industry found that brokers collect from "government sources, publicly available sources and commercial sources," and also from "other data brokers," and that they "combine data elements into profiles or categories." In practice that means:

• Public records: property deeds, court records, voter files and business registers. The FTC says people-search sites "compile data from federal, state, and local government public records."
• Other companies: commercial sources such as other businesses and other brokers. California's attorney general puts it as "websites, other businesses, and public records."
• The web: public social media profiles, company websites and anything else that can be crawled.

One record on its own is rarely sensitive. Combined, they become a profile with your home address, phone numbers, relatives and employer.

The main types

Type	What they hold	Examples
People-search sites	Home address, phone, age, relatives	Spokeo, Whitepages, BeenVerified
Contact databases	Work email, direct dial, mobile number	ZoomInfo, Apollo, RocketReach
Data wholesalers	Datasets they license to other companies	Acxiom, People Data Labs
Directories	Phone book and company register data	Das Telefonbuch, North Data

Contact databases say so themselves: ZoomInfo's privacy policy lists "Phone number, including general or direct business numbers, faxes, and/or mobile numbers" among the data it collects. Wholesalers rarely show you anything; People Data Labs sells person and company datasets through APIs and data licence feeds, and Acxiom describes itself as the "connected data and identity foundation" that "prepares data for AI-driven marketing" for brands and agencies. Directories publish what is already public: North Data compiles "company information that is publicly available, obtained from sources such as trade registers," and Das Telefonbuch is a phone directory.

How big is it?

California makes data brokers register. The Delete Act says a business that meets its definition "shall register with the California Privacy Protection Agency" on or before January 31 following each year in which it meets the definition. The registry file had 603 entries when we downloaded it on 9 October 2026. Registered brokers also compile "the number of requests" they "received, complied with in whole or in part, and denied during the previous calendar year," and the registry shows those figures per company. One people-search company, Spokeo, reports 3,795,579 requests to opt out of sale or sharing in its current entry, 3,785,787 of them complied with in whole.

How to get your data removed

You have two routes:

1. Do it yourself. Find each site's opt-out page, submit a request, confirm the email they send and check again later. Our data broker directory has a step-by-step guide for each major site.
2. Use a removal service. It sends the requests on your behalf with your authorization and follows up. Ask how it proves removals: a sent request is not the same as a deleted listing. In Consumer Reports' 2024 evaluation of seven paid services across 13 people-search sites, only 117 of 332 listings, or 35%, were removed within four months. Manual opt-outs by its own researchers removed 33 of 47 profiles, about 70%, and those were gone within a week.

The laws behind both routes set out rights rather than bans. California's attorney general summarises the CCPA as including "The right to delete personal information collected from them (with some exceptions)" and "The right to opt-out of the sale or sharing of their personal information" (oag.ca.gov). In the EU, Article 17 of the GDPR says the data subject "shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay" where one of the grounds it lists applies.

Either way, plan for repeats. The FTC warns that "if the information in your public records changes, your information could re-appear for sale on people search sites."