Who Is Selling Your Personal Data?

When people ask who is selling their personal data, they picture one shadowy company. The reality is a layered industry where your information changes hands many times, and each layer takes a cut. Understanding the layers is what lets you aim your defense, because you cannot opt out of a company you do not know exists.

Collectors are where it starts. These are the businesses that gather raw information directly: the app that wants your location, the loyalty program that logs every purchase, the warranty card, the sweepstakes entry, the website that drops tracking cookies, and the public agencies whose records, such as property deeds, voter files, court filings, and licenses, are open by law. Collectors are not always selling on their own, but many quietly license what they gather.

Aggregators are the heart of the business. These are the large data brokers, including names like Acxiom, Experian’s marketing arm, Epsilon, LiveRamp, and Oracle’s former advertising data unit, that buy from thousands of collectors and stitch the fragments into a single profile keyed to your name, address, and household. They are the ones who can say that the person at your address is a forty-something homeowner with two kids, a dog, a recent move, and an interest in fishing gear, and then sell that conclusion.

List brokers and compilers slice those profiles into targeted lists for sale: new movers, new parents, recent divorcees, people with a given health condition, seniors with savings. This is the layer that powers a lot of unwanted mail, robocalls, and predatory marketing, because a list of vulnerable people is worth more than a generic one.

Ad-tech and real-time bidding is the fastest-moving layer. Every time a web page loads an ad, your profile can be broadcast to dozens of bidders in milliseconds so they can decide whether to show you something. Most of those bidders keep a copy. Finally, people-search front ends like the sites you find by Googling a name repackage broker data into a consumer-facing lookup, which is the part of the chain most people actually see. For the deeper question of what these profiles contain and how complete they get, our look at how an address gets pieced together from records shows the same assembly process from the research side.

Opt-out and deletion requests. Most data brokers maintain an opt-out process, often a form or an email, that lets you demand they stop selling and delete your record. Under the privacy laws now in force across a growing list of states, your core rights typically include the right to access what is held, to correct it, to delete it, and to opt out of its sale and of profiling. Companies generally must respond within thirty to forty-five days. The catch is that you historically had to do this broker by broker, which is exactly the friction the industry relies on.

The Global Privacy Control signal. One of the most efficient moves takes a few minutes. The Global Privacy Control, or GPC, is a browser-level signal you switch on once that automatically tells every site you visit not to sell or share your data. In California, Colorado, Connecticut, and other states with similar laws, businesses are legally required to honor it as a binding opt-out of sale. You enable it through a privacy-focused browser or extension, and it works in the background from then on.

California’s Delete Act and the DROP platform. The biggest shift for California residents arrived in 2026. The California Delete Act created the Delete Request and Opt-Out Platform, known as DROP, which went live on January 1, 2026. With a single verified request through the state’s identity gateway, a California resident can demand deletion from every data broker registered in the state at once, free of charge. Brokers must begin honoring those requests on a recurring cycle starting later in 2026, pulling new deletion requests at least every forty-five days and processing them within ninety days, with steep daily penalties for ignoring them. DROP is the first tool that replaces hundreds of separate opt-outs with one. For non-California residents, the good news is that most national brokers run a single opt-out workflow and will usually process a request from any United States resident, even where the law does not strictly require it. If a broker’s listing has exposed your home, our walkthrough of how a number and address get linked in records shows which fields to prioritize removing first.

We are not a data-removal subscription, and we do not promise to scrub every broker on earth, because no one honestly can. What we do is the research half of the problem: using lawful public-records and skip-tracing methods, we help you see what is exposed about you, which listings are the most revealing, and where they trace back to, so your opt-outs and deletion requests land where they count. We work strictly for lawful, permissible purposes, we tell you honestly what the records can and cannot show, and if you are dealing with active identity theft we will point you to the FTC’s recovery resources and, where appropriate, your local authorities. For a legitimate request, an initial exposure read typically comes back within 24 hours. Our full skip tracing services sit behind the same lawful framework, and for a broader self-audit, our guide on how people-search results are built pairs naturally with this one.