Shadow Merchants: Inside the Billion-Dollar Industry Profiting From Your Personal Information

Somewhere in a data center you will never visit, a company you have never heard of is selling a profile of your life to a buyer you will never meet. Your age, your home address, your estimated income, your political leanings, your chronic health conditions, your shopping habits — assembled from dozens of sources, packaged into a neat commercial product, and auctioned off for fractions of a cent per record. Multiply that transaction by hundreds of millions of Americans, and you begin to understand the scale of an industry that operates almost entirely without your knowledge.

Data brokers — the intermediaries who aggregate, refine, and resell personal information — collectively generate tens of billions of dollars in annual revenue in the United States. Yet most Americans could not name a single company in the sector. That anonymity is not accidental. It is, in many respects, the business model.

How the Pipeline Actually Works

The data broker ecosystem is not a single market but a layered supply chain. At its foundation are raw data sources: public records filed with county courthouses, voter registration databases maintained by state governments, real estate transaction records, professional licensing filings, and bankruptcy court documents. These are legally accessible to anyone willing to retrieve them — and data brokers have built industrial-scale infrastructure to do exactly that.

Above that public-records layer sit commercial data streams. Loyalty card programs, retail purchase histories, app permissions granted on smartphones, website cookies, and connected-device telemetry all feed into a secondary marketplace where companies sell behavioral data they have collected from their own customers. A grocery chain sells your purchase history. A weather app sells your precise GPS coordinates. A free mobile game sells the demographic inferences its algorithms have drawn about you.

Brokers purchase feeds from all of these sources, run them through identity-resolution algorithms that link records across databases, and produce unified consumer profiles. The finished product is then licensed to advertisers, insurance underwriters, financial institutions, landlords, employers, political campaigns, law enforcement agencies, and — critically — other data brokers who repeat the cycle.

The result is an ecosystem where a single individual's information may pass through dozens of commercial hands before it is ever used for any identifiable purpose.

What They Know — and Why It Matters

The categories of data traded in this market extend well beyond the basics. Research by the Federal Trade Commission and independent privacy advocates has documented broker files that include inferred health conditions derived from purchase patterns, financial distress scores, religious affiliation estimates, relationship status, household composition, and even personality trait scores generated by machine-learning models.

For most consumers, the immediate reaction to this revelation is discomfort. The downstream consequences, however, can be substantially more serious.

Identity theft and fraud represent the most direct financial risk. When a data broker suffers a breach — and several major brokers have, including a 2024 incident at National Public Data that exposed hundreds of millions of Social Security numbers — the aggregated profiles they hold become ready-made kits for fraudsters. Unlike a single breached password, a comprehensive broker profile may contain enough detail to open credit accounts, file fraudulent tax returns, or circumvent identity verification systems.

Pricing discrimination is a subtler but pervasive harm. Insurance companies, landlords, and online retailers have all been documented using data broker scores to offer different prices or terms to different consumers based on inferred creditworthiness, health risk, or purchasing eagerness — none of which the consumer was aware was being evaluated.

Physical safety risks are among the most alarming consequences. Domestic violence survivors, stalking victims, witnesses in criminal proceedings, and public figures who face harassment have all been endangered when their addresses and daily routines appeared in broker databases accessible through low-cost people-search services. Several documented cases in the United States have involved stalkers using commercially available broker data to locate victims.

The Regulatory Gap

The United States currently has no comprehensive federal data privacy law governing the broker industry. Unlike the European Union's General Data Protection Regulation, which requires affirmative consent for most personal data processing, American law approaches privacy through a patchwork of sector-specific statutes — HIPAA for medical records, FCRA for credit reporting, COPPA for children's online data — that collectively leave data brokers largely unregulated in their core activities.

A handful of states have moved to fill the vacuum. California's Delete Act, signed into law in 2023, requires brokers registered in the state to honor deletion requests submitted through a centralized mechanism by 2026. Vermont and Texas have enacted broker registration requirements. But absent federal action, these protections are geographically inconsistent and enforcement remains limited.

The Federal Trade Commission has pursued individual enforcement actions against brokers who violated existing statutes — most notably a 2023 settlement with data broker Kochava over the sale of sensitive location data — but the agency's authority to impose structural rules on the industry remains legally contested.

What You Can Do Right Now

The absence of comprehensive legal protection does not mean consumers are entirely without recourse. Several practical steps can meaningfully reduce your exposure.

Submit opt-out requests directly. The largest data brokers — including Acxiom, LexisNexis, Spokeo, Whitepages, BeenVerified, and Intelius — maintain consumer opt-out portals required by state law or company policy. Submitting requests to the top twenty brokers by traffic volume addresses a significant portion of the most commercially active profiles. The process is time-consuming but free.

Use a data broker removal service. Companies such as DeleteMe, Kanary, and Privacy Bee automate the opt-out submission process and conduct periodic re-checks, since broker databases are frequently repopulated from new source feeds. These services carry a subscription cost but reduce the ongoing maintenance burden considerably.

Limit upstream data collection. Reducing what brokers can acquire begins with tightening the sources they draw from. Decline loyalty program enrollment where practical, review and restrict app location permissions on your smartphone, use a privacy-focused browser with tracker blocking enabled, and opt out of interest-based advertising through the Digital Advertising Alliance's consumer tool at optout.aboutads.info.

Place a security freeze on your credit files. While this does not remove you from marketing databases, it prevents the most serious financial fraud enabled by broker data by restricting new account origination in your name. Freezes are free at all three major bureaus and can be lifted temporarily when needed.

Monitor people-search sites specifically. Services like Spokeo, FastPeopleSearch, and TruthFinder publish home addresses and phone numbers in formats directly accessible to anyone with a web browser. These represent the highest physical-safety risk and should be prioritized in any opt-out effort.

Clarity in an Opaque Market

The data broker industry thrives on its own invisibility. Its business model depends on consumers remaining unaware that their information is a commodity, that it has already changed hands dozens of times, and that the profiles assembled about them may be materially inaccurate in ways that nonetheless carry real consequences.

Legislative reform at the federal level remains the only durable solution — one that privacy advocates, consumer groups, and a growing number of lawmakers have called for repeatedly. Until that reform materializes, the responsibility falls disproportionately on individuals to navigate a system that was never designed with their interests in mind.

Understanding that the system exists is the necessary first step. The shadow merchants depend on you not taking it.