MyRecon OSINTHow Data Brokers Collect and Sell Your Personal Data
There is an industry built on holding a file about you. You have no relationship with these companies, most of them you could not name, and several hold more about your household than any organisation you have actually dealt with. Here is where it comes from, what is in it, and what the opt-out process really achieves.
Three industries wearing one name
"Data broker" covers businesses with quite different models, and conflating them makes the whole subject harder to act on.
- Consumer data aggregators. Large companies compiling detailed household-level files, sold to marketers, insurers, financial institutions and risk-scoring products. You will not encounter their interface; their customers are businesses.
- People-search sites. The consumer-facing tier. They publish a profile of you, addresses, relatives, phone numbers, age, as a free teaser, and charge for the full report. These are the ones that appear when someone searches your name, and the ones most worth removing yourself from.
- Identity graph and ad-tech firms. They do not sell a readable dossier; they sell resolution, the ability to recognise that a device, a hashed email address and a loyalty account are the same person. This is the least visible tier and the fastest growing.
Where the data actually comes from
Very little of it is stolen. Almost all of it is collected lawfully, which is precisely what makes it difficult to undo.
- Public records. Property and land registries, voter rolls where public, court and bankruptcy filings, business registrations, professional licences, marriage and divorce records. This is the foundation, and it is the part you cannot opt out of because it is public by statute.
- Commercial transactions. Loyalty schemes, warranty registrations, subscriptions, magazine lists, charity donor lists, many of which grant a right to share with "partners" in terms nobody reads.
- Surveys, quizzes and competitions. Frequently operated for no other purpose. A free prize draw asking for your date of birth and phone number is a collection instrument, not a competition.
- Mobile applications. Embedded advertising and analytics kits transmitting device identifiers and, historically, location at high frequency. Location data has been resold widely enough to have produced repeated scandals about the tracking of individuals.
- Web tracking. Pixels and tags on ordinary websites, increasingly keyed to a hashed email address rather than a cookie, which is what makes the tracking survive cookie deletion and move between your devices.
- Other brokers. The most important source, and the reason removal is difficult: the industry buys, merges and resells from itself continuously, so a record deleted at one company is re-acquired from another within months.
How a file gets built
The technical core of the business is identity resolution: deciding that scattered fragments describe one person. Matching runs on hashed email addresses, phone numbers, device identifiers, names paired with addresses, and household composition, a probabilistic process producing a persistent internal identifier that follows you across sources.
What results is not a transcript. It is a set of inferences, and this is the part people consistently underestimate. Alongside name, address history, age, relatives and phone numbers sit estimates: income band, home ownership, likely education, presence of children and their approximate ages, purchasing categories, and life events, recently moved, recently married, newly a parent, probably expecting, recently bereaved, financially stressed.
Life-event segments are commercially valuable because they mark moments when people change providers. They are also the segments that feel most invasive when encountered, because an inference does not need to have been disclosed by you and cannot be corrected by you in any practical way.
The inferences can simply be wrong, and you will not be told. A file can attribute the wrong address, the wrong relatives, an inaccurate income band or a health-adjacent category derived from unrelated purchases. Where that file feeds a marketing decision, the cost is irrelevant advertising. Where it feeds a tenancy screening, an insurance quote or a fraud score, an error you never saw can produce a decision you cannot explain, which is why the rights of access described below are worth exercising even when you do not intend to opt out.
Who buys it
- Marketers, the original and largest customer.
- Insurers and lenders, for risk modelling and prospecting.
- Employment and tenant screening services, where in some jurisdictions the use is regulated and in others it is not.
- Debt collectors and skip tracers, for whom locating people is the product.
- Government and law enforcement, which in several countries have purchased commercially available data of a kind they would otherwise have needed legal process to compel. The legal debate about this is live and unresolved.
- Fraudsters, who buy the same reports as everyone else. A people-search profile listing your address history, relatives and previous phone numbers is a working script for a social-engineering call to a support desk, and for answering security questions.
Brokers get breached, and their breaches are unusually damaging. In 2024 a background-check data broker leaked a file covering a large share of the United States population, names, address histories and national identifiers, about people who had never heard of the company and had no relationship with it to sever. Ordinary breach advice assumes you can change something at the company that lost your data. Here there is nothing to change and nobody to leave. The case file covers what happened.
Why this is lawful, and what rights you actually have
It varies sharply by where you live, and the practical difference is large.
In the European Union and the United Kingdom, data protection law gives you a right of access, a right to erasure, and an absolute right to object to processing for direct marketing, meaning a broker must stop on request, without balancing it against their interests. A company that obtained your data from somewhere other than you is also obliged to tell you where it came from, which makes an access request the most informative single action available: it maps the supply chain, and the upstream sources are what you then address.
In the United States there is no general federal privacy statute. Sectoral laws cover specific uses, credit, employment screening and health care among them, while general marketing data is largely unregulated at federal level. State law has moved substantially: several states operate broker registries, and California's deletion mechanism under its Delete Act is designed to let one request propagate to registered brokers rather than requiring hundreds of individual ones.
In India, the Digital Personal Data Protection Act establishes consent requirements and rights of correction and erasure, with obligations phasing in through subordinate rules.
Everywhere, the same asymmetry applies: the right exists, and exercising it is manual, repetitive and adversarial by design.
Opting out, realistically
- Find out who lists you. Search your name with your city, your previous cities, your phone number and your email address. The people-search sites surface quickly. Record each one and its opt-out URL.
- Use the official opt-out page only, which is usually buried in the footer or on a privacy page. Never pay the company that listed you to remove you, and be wary of "removal" pages on unrelated domains.
- Expect to give data to remove data. Most require an email address, and some require identity documents. Use an alias address dedicated to this and nothing else, and redact everything not needed to establish identity.
- Exercise the statutory right where you have one. In the EU or UK, a written erasure and objection request to a named data protection contact carries a legal deadline and an escalation route to a regulator; the informal web form does not.
- Check again in three to six months. Records return, because the upstream sources were never removed. This is maintenance, not a task that completes.
- Consider a removal service with clear eyes. They automate a genuinely tedious process and they cannot do more than you could; assess them on the number of brokers covered and whether they re-check, and note that you are handing your details to another company to do it.
What actually reduces the supply
Removal addresses the existing file. These reduce what flows in next:
- A different email alias per service, which breaks the matching key the industry relies on and tells you who leaked or sold your address when one starts receiving spam.
- A secondary phone number for retail, deliveries and forms.
- Declining loyalty schemes, quizzes and prize draws, which exist to collect.
- Restricting app location permissions to "while using", and resetting or disabling the advertising identifier on your phone.
- Opting out of off-platform activity collection on the large social platforms, see the social media privacy guide.
- A credit freeze where available, which does not affect brokers but blocks the fraud their files enable.
- Suppressing public-record disclosure where the law allows it, several jurisdictions permit an unpublished option on electoral or land registers, and it stops the foundational source rather than one downstream copy.
See what is already publicly attached to your email address and handles with the MyRecon tools, or work through the digital footprint routine for the full sequence.