Data brokers

Working Definition

A data broker is a company that collects personal information about individuals from sources other than the individuals themselves—public records, loyalty programs, mobile apps, advertising networks, and other brokers—aggregates those fragments into detailed profiles or inferences, and sells or licenses them to third parties without maintaining any direct relationship with the people profiled. Three product lines define the boundaries of the industry: marketing and audience segmentation, risk mitigation (identity verification and fraud detection), and people-search directories. In everyday speech, the term is often stretched to cover any corporation that monetizes personal data, including consumer platforms; in its precise regulatory sense, a data broker is defined by the absence of a first-party interface with the consumer, meaning there is no service relationship in which a user could meaningfully read terms or withhold consent—making structural invisibility its defining feature rather than an accidental byproduct.

Genesis and Global Lineage

The concept has no single founding theorist, but rather two administrative milestones. The commercial practice is decades older than the label: Acxiom was founded in 1969 to process mailing lists for direct marketing, and credit bureaus had segmented American households since the 1950s. In the 1970s and 1980s, “information broker” was a benign library-science term for a freelance research specialist who searched databases on a client’s behalf. The shift to its modern meaning was driven by regulatory investigations: beginning in 2009, the U.S. Federal Trade Commission (FTC) pressed Congress for consumer access rights; in December 2013, the Senate Commerce Committee under Jay Rockefeller published a staff report exposing industry practices; and in May 2014, the FTC released Data Brokers: A Call for Transparency and Accountability, an investigation of nine firms (Acxiom, CoreLogic, Datalogix, eBureau, ID Analytics, Intelius, PeekYou, Rapleaf, and Recorded Future) that cemented the definition used worldwide today. In Europe, the industry was confronted not through a dedicated statutory label, but through the architecture of the General Data Protection Regulation (GDPR, enacted 2016, enforced May 2018): while the GDPR never uses the phrase “data broker,” Article 14 (mandatory notice when personal data are obtained indirectly rather than from the data subject) and the strict requirement of a valid legal basis strike directly at the third-party brokerage model.

Central European Lineage

We found no documented link between this concept and the intellectual history or historical experience of Central Europe.

Why Now

Between 2018 and 2026, data brokerage migrated from the beat of consumer privacy into the center of national security and constitutional law. The Cambridge Analytica revelations (March 2018) demonstrated how data harvested through a personality quiz taken by roughly 270,000 users could be combined with voter files and brokered records to build psychographic profiles on up to 87 million people. At the state level in the United States, Vermont enacted the first mandatory data-broker registry in 2018, followed by California in 2019 (AB 1202) and California’s landmark Delete Act (SB 362) in 2023, which mandates a single centralized portal allowing residents to demand data deletion across all registered brokers simultaneously. In parallel, investigative reporting revealed that the U.S. Department of Homeland Security, the IRS, and the FBI were purchasing commercial mobile-phone location data from brokers such as Venntel and Babel Street without judicial warrants, while in 2021 the Catholic newsletter The Pillar outed a senior church official using commercially purchased location data from the dating app Grindr. Russia’s full-scale invasion of Ukraine and escalating tensions with China added an acute geopolitical dimension: in 2024 the U.S. Congress passed the Protecting Americans’ Data from Foreign Adversaries Act, barring data brokers from selling sensitive personal data to designated foreign adversaries. In Europe, enforcement battles spearheaded by Max Schrems’s organization noyb and national data-protection authorities have targeted both traditional credit-and-marketing brokers and the real-time bidding (RTB) ad-tech ecosystem that broadcasts user profiles to hundreds of third-party bidders in milliseconds.

Explanatory Power

The concept exposes the secondary wholesale market that remains invisible when privacy is analyzed solely as a bilateral relationship between a user and an app. First, it explains why “I don’t use Facebook” offers little protection: a comprehensive dossier is assembled from payment-card transactions, property deeds, pharmacy loyalty cards, and weather-app SDKs; the FTC found in 2014 that one studied broker held3,000 data segments on nearly every U.S. consumer. Second, it illuminates the mechanism of “surveillance laundering”: a constitutional state barred from warrantless tracking simply buys the exact same tracking on the open market as a commercial subscription—exploiting a legal blind spot between criminal procedure (which binds the state) and consumer law (which assumes voluntary market transactions). Third, it shows how legally protected categories re-enter decision-making through the back door: a broker segment labeled “Expectant Parent,” “Urban Scramble,” or “Interested in Diabetes Management” is not classified by the vendor as a protected medical or racial record, yet functions identically when ingested by an insurer, landlord, or automated hiring filter.

Axes of Debate

Underappreciated Angle

The most overlooked dimension of the data-broker industry is not the volume of data it holds, but its dismal quality. The FTC’s 2014 report devoted an entire section to pervasive inaccuracies in broker profiles: in marketing segmentation, false positives are cheap while manual verification is expensive, so erroneous inferences are rarely corrected. Public debate assumes that data brokers “know” too much about us; in practice, they frequently circulate falsehoods that the affected person cannot correct because they have no way of knowing which broker generated the score. The resulting harm is not merely the loss of secrecy, but the loss of the right to be described accurately: a rejected rental application, an inflated insurance quote, or a flagged identity check often stems from a sloppy record-linkage artifact rather than an uncomfortable truth. Here Central Europe offers an instructive structural contrast: in countries like Poland, the universal national identification number (PESEL, introduced in the late 1970s) makes deterministic record linkage across leaked or commercial databases trivial, eliminating the fuzzy name-matching errors common in the United States while making it vastly harder for a citizen to escape a linked profile once a database enters circulation. A data broker is ultimately not just a merchant of secrets, but a manufacturer of unappealable, unattributed reputation.