Fundamentals

What Are Personal Data Brokers and How Do They Work?

By Daniel Sardá · Published on October 21, 2026

7 min read1,536 words

Data brokers combine information from many sources to create profiles, audience segments, and other products for third parties. Understanding that chain makes it easier to assess both its uses and its risks.

A purchase, a change of address, and a few browsing signals may seem unrelated. Yet a specialized company can connect them, compare them with other sources, and place a person in a commercial segment. Its client does not necessarily receive a list of every original data point; it may receive a category, a verification, a score, or access to a search tool.

That company functions as a personal data broker, often simply called a data broker. Understanding its role requires looking beyond the phrase “selling data.” What matters is the full chain: where the information comes from, how it is transformed, who buys the product, and how it is used.

What is a personal data broker?

In functional terms, a data broker is a company that collects personal information from different sources, combines or analyzes it, and offers data or derived products to third parties. It often has no direct relationship with the people described in those records.

There is no single legal definition shared by every country. In California, for example, the legal definition focuses on businesses that sell consumer information to third parties while lacking a direct relationship with those consumers. The U.S. Federal Trade Commission (FTC) has examined the category more broadly, considering the collection, combination, and commercialization of information.

The lack of a direct relationship helps distinguish a broker from a store, platform, or app that gathers data while providing its own service. The boundary is not always neat, however: a company may serve the public and also act as a source or intermediary in another context.

Nor does every transaction involve transferring an entire database. The product may be temporary access to a system, enrichment of a customer list, identity verification, interest-based classification, or a risk estimate.

Key idea: A broker does more than store data. Its economic role is to turn scattered information into products that others can query or use.

From scattered sources to a commercial profile

The brokerage process commonly unfolds in four steps.

First comes collection. Brokers may gather information from purchases, publicly accessible records, digital activity, and other providers. A data point being publicly accessible does not mean every later use is unrestricted: the purpose, legal basis, and applicable duties depend on the jurisdiction.

Next comes linking. An address, email address, device, or other identifier may be used to determine whether separate records probably refer to the same person or household. This task is not infallible: people with the same name, former addresses, or shared signals can be mixed up.

The third step is analysis. The company organizes records, creates categories, and draws inferences. Finally, it supplies a product to a client, which may incorporate it into its own processes. It is therefore useful to distinguish four actors: the original source, the broker, the buyer, and the person or entity making the final decision. Sometimes two or more of those roles sit within the same organization.

Scale changes the practical meaning of information. An isolated record may be hard to find or reveal little. When it is combined with other sources, retained over time, and searchable in seconds, it gains descriptive power it did not previously have. That transformation is central to understanding its effect on privacy.

Provided, observed, and inferred data

Not every element in a profile has the same origin or degree of certainty. A useful distinction is:

• Provided data: information a person states, such as an email address or date of birth.
• Observed data: information that arises from conduct or a transaction, such as a purchase or visit to a website.
• Inferred data: probabilistic conclusions drawn from the other two, such as a possible consumer interest or estimated affinity.

The European Data Protection Board uses this distinction in its analysis of social-media targeting. It matters especially because an inference is not the same as an established fact. A profile may estimate, classify, or predict; that does not make its description of a person certain.

It is also important to distinguish profiling from automated decision-making. The European General Data Protection Regulation defines profiling as a form of automated processing used to evaluate personal aspects. Creating a profile, however, does not necessarily mean that a solely automated decision with legal or similarly significant effects has been made.

Useful distinction: The original record says what a source retains; a broker’s profile may combine it with outside signals and add estimates the person never supplied.

What are these products used for?

Uses vary as much as clients do. Some products help select advertising recipients or tailor offers. Others are used to verify identities, locate people, prevent fraud, or supplement commercial assessments.

These activities can create value. Lower search costs, detecting inconsistencies, or directing an offer to an audience likely to be interested are plausible benefits of brokerage. The problem is not that every classification is useless or abusive, but that usefulness, accuracy, and the ability to challenge a result do not always advance together.

Not every use carries the same weight, either. Showing advertising based on a segment is not equivalent to deciding about credit, employment, housing, or insurance. In some countries, those decisions are subject to sector-specific regimes. In the United States, for example, certain reports used to determine eligibility may fall under rules different from those governing marketing. Those rules should not be assumed to exist or work the same way in other jurisdictions.

What risks does data brokerage create?

The most characteristic risk is information asymmetry. A client knows the profile and may act on it, while the person concerned may not know that the broker exists, what sources it used, or how it reached a classification. That invisibility also makes errors harder to identify and correct.

Other possible problems include:

• outdated data or data linked to the wrong person;
• sensitive inferences treated as established facts;
• uses different from those expected when the original information was provided;
• greater exposure to intrusive searches, fraud, or impersonation;
• difficulty determining which organizations retain copies of the same data.

The UK data protection authority’s investigation into direct-marketing data brokerage showed why a lack of visibility can obstruct the exercise of rights. Its findings concern the United Kingdom and one specific sector; they do not automatically describe every broker worldwide.

From a liberal perspective, individual autonomy requires more than efficient exchanges: it also requires understandable information, the ability to correct errors, and meaningful options when consequential uses are involved. That does not deny the value of brokerage. It means a responsible company should be able to explain what it does, keep data reasonably accurate, and provide effective mechanisms when the law or its commitments require them. The same standard applies to government use of profiles, which needs limits and safeguards against opaque or arbitrary decisions.

Rights and ways to reduce exposure

There is no universal button that makes someone disappear from these databases. Rights to information, access, correction, objection, or erasure vary by location, data type, and purpose. Even where a right to erasure exists, it may be subject to conditions and exceptions.

The European GDPR, for example, sets out information duties when data is not obtained directly from the person and recognizes several rights, each with its own scope. California maintains a public registry of brokers and, since 2026, has allowed residents to submit a deletion request to active brokers through DROP. This is a territorial mechanism with legal exclusions, not a worldwide solution.

In practice, a person can:

1. review each service’s privacy policy and its access or opt-out mechanisms;
2. check whether their jurisdiction provides a registry or centralized channel;
3. correct data at the source first, when possible;
4. limit the information they publish and review app and account permissions;
5. keep records of requests and responses to verify their scope.

Removing a profile from one broker does not necessarily erase the original public record, information retained by other companies, or copies acquired earlier. The data can also reappear if the source remains active. Opting out should therefore be understood as a partial reduction in exposure, not a guarantee of complete disappearance. To think more clearly about practical options, it helps to distinguish control over personal data from the oversimplified idea that all data works like ordinary property.

In summary: Effective control starts by making the chain visible: who obtained the information, what they added to the profile, who received it, and what mechanism permits correction or challenge.

Data brokers occupy a largely unseen position between numerous sources and buyers. Their activity can facilitate legitimate services, but it can also amplify errors and unexpected uses when people do not know they are being classified. The most sensible response is neither to assume that every profile is true nor that all brokerage is unlawful. It is to demand conceptual precision, transparency proportionate to the impact, and avenues for correction that let individuals make better-informed decisions about their own exposure.