0

Type to search the shop and Field Notes.

Data Brokers Explained: Who Buys Your Data, and the Way Out

Last reviewed

By Dark Flock

There is a file on you. Several, in fact, kept by companies you have never dealt with. It lists where you have lived, the phones you've owned, your relatives, your car, and sometimes your debts. None of it was stolen. Much of it came from public records, purchases, apps, and other files, and all of it is for sale.

The buyers are the interesting part. The same industry serves a landlord, a debt collector, a marketer, a private investigator, a stalker with a credit card, and Immigration and Customs Enforcement. This guide covers who the brokers are, why government agencies buy from them, which laws apply as of October 20, 2026, and which ways out actually work.

How we sourced this: statutes, agency rules and orders, court opinions, contract records, and company product pages first, then reporting and independent research; company claims are labeled as the company's, and anything only reported is marked as reported.

What is a data broker?

A data broker collects personal information about people it has no direct relationship with and sells or licenses it. In practice, three overlapping businesses share the label:

No federal law requires them to register, and no federal law gives you the right to opt out of people-search sites, as Consumer Reports notes. California alone counts more than 600 registered brokers.

What do people-search sites sell, and to whom?

To anyone. That is the product.

In June 2025, Minnesota state representative Melissa Hortman and her husband were shot and killed at their home, and a state senator and his wife were wounded at theirs. According to the FBI affidavit, the suspect's notebook listed 11 people-search sites, including TruePeopleSearch, Spokeo, and Whitepages, alongside the names of more than 45 officials. Fairness requires the rest: WIRED, citing The New York Times, reported that both lawmakers' home addresses were already published on campaign or legislative pages. The brokers weren't the only source. They were on the list.

The pattern is old. In 1999, a man bought Amy Boyer's Social Security number and work address from an internet investigator, Docusearch, and killed her outside her job. In 2003, the New Hampshire Supreme Court held that an investigator selling personal information owes a duty of reasonable care to the person it describes.

People-search sites usually say their reports can't be used for hiring or tenant screening, because that would bring them under the Fair Credit Reporting Act. The FTC has said some didn't hold that line: in 2023, TruthFinder and Instant Checkmate agreed to pay $5.8 million to settle charges that they marketed reports for employment and tenant screening without following FCRA's accuracy rules.

Who buys from LexisNexis, Thomson Reuters, and TransUnion?

What is LexisNexis Accurint?

LexisNexis describes Accurint for Law Enforcement as rapid access to "an extensive identity records database" that helps police "swiftly identify individuals, their assets, addresses, phones, relatives, and associates," compiled "from thousands of sources." It markets the service for patrol cars and for checking "who is associated with an address" before officers arrive.

ICE has subscribed since at least 2021. In August 2026, Biometric Update reported on an ICE notice of intent to award LexisNexis an estimated $6.7 million sole-source bridge contract, with requirements for up to 11,200 users and connections to ICE systems including Palantir and Penlink. It also called for jail booking data for up to 7,500 deportation-branch users. A notice of intent is not a signed contract; the requirements show what ICE wants. Names, addresses, Social Security numbers, and license plates are all on its list of searchable identifiers. Buying access needs no warrant. The data is licensed, not seized.

What is Thomson Reuters CLEAR?

CLEAR is Thomson Reuters' investigative database. In July 2026, WIRED reported that ICE planned to renew its contract with Thomson Reuters Special Services at up to $25 million a year for five years, citing a federal notice that the company is "the only contractor" able to provide "continuous monitoring of up to one million individuals and entities." The data includes license plate reader records, which WIRED reported Thomson Reuters has sourced from Vigilant Solutions, now owned by Motorola, since 2017. FedScoop reported in September 2026 that the contract, worth up to $125 million, was days from starting.

Thomson Reuters' position, from its April 2026 statement: its investigative tools "are not surveillance tools," CLEAR "does not contain the types of information that law enforcement traditionally need a warrant to obtain," and it does not include citizenship or immigration status. It says customers are credentialed and misuse leads to suspension. Those are the company's claims. Continuous monitoring of a million people is the government's description of what it is buying.

What is TransUnion TLOxp?

TransUnion, one of the three credit bureaus, sells TLOxp to "attorneys, investigators and law enforcement officers." By its own description, it draws on "10,000 public and proprietary databases refreshed every day," maps relationships "among family, associates, assets and businesses," helps "locate difficult-to-find individuals," and supports debt recovery. The same file, many customers.

Can the government buy your data instead of getting a warrant?

Yes. It is not a secret, and it is mostly legal.

The clearest account comes from inside. A senior advisory panel to the Director of National Intelligence wrote in January 2022, in a report declassified in June 2023, that under Carpenter police generally need probable cause to get one person's persistent location from a phone company, yet "the same type of information on millions of Americans is openly for sale to the general public," so intelligence agencies may buy it. The panel warned that such data "can be misused to pry into private lives, ruin reputations, and cause emotional distress," and in the wrong hands "could facilitate blackmail, stalking, harassment, and public shaming."

Other examples are on the record. In January 2024, Sen. Ron Wyden released documents showing the NSA buys Americans' internet metadata, including which websites they visit, from brokers without a warrant. Police and ICE purchases of phone location data are in our phone tracking guide.

The Supreme Court's June 2026 decision in Chatrie v. United States held that obtaining a person's cell-phone location history from Google is a search. It concerned data police compelled. Whether buying the same kind of data is also a search is undecided. In his Chatrie dissent, Justice Alito asked where the line now falls for things like purchase histories and search logs, and noted that the Court's holding about "cell phone location information" doesn't on its face disturb them.

What happened to the Fourth Amendment Is Not For Sale Act?

The bill would bar federal law enforcement and intelligence agencies from buying Americans' data from brokers when they would otherwise need a warrant, court order, or subpoena. Its history is a series of near misses:

As of October 20, 2026, the data-purchase ban is not law. The next 702 fight is its likeliest vehicle.

What federal rules apply to data brokers?

What happened to the CFPB's data broker rule?

In December 2024, the Consumer Financial Protection Bureau proposed treating many data brokers as consumer reporting agencies under the Fair Credit Reporting Act. That would have brought accuracy duties, dispute rights, and limits on who may buy. On May 15, 2025, the CFPB withdrew it, saying rulemaking was "not necessary or appropriate at this time" and that it would propose a new rule "when and if" it decides one is needed. Nothing has replaced it.

What do PADFA and the DOJ bulk data rule cover?

Washington's firmest broker rules concern foreign adversaries. The Protecting Americans' Data from Foreign Adversaries Act of 2024 bars brokers from selling Americans' sensitive data, including location, health, financial, and biometric data, to North Korea, China, Russia, Iran, or entities they control. In February 2026, the FTC sent warning letters to 13 brokers, noting that some had offered data on people's status as members of the armed forces. Violations can cost up to $53,088 each.

The Justice Department's Data Security Program, in effect since April 8, 2025, adds limits on bulk transfers of Americans' sensitive data to countries of concern and people tied to them, with due diligence and audit duties since October 6, 2025.

Both have the same gap. They govern who abroad may buy. Sales to domestic buyers, including U.S. agencies, are untouched.

One study shows why. In 2023, Duke University researchers bought data on active-duty servicemembers and veterans from U.S. brokers, some of it through a .asia domain and a Singapore IP address, for as little as $0.12 per person, with little vetting.

Which states regulate data brokers?

The states have done most of the work.

Know the limits before signing up for DROP. California's privacy law excludes "publicly available" information, such as lawfully released government records, and the Delete Act leaves other exemptions in place. A broker may be able to delete what it bought and keep the address it copied from the county assessor.

What is Daniel's Law?

In July 2020, a gunman who had found U.S. District Judge Esther Salas's home address on the internet came to her door in New Jersey, wounded her husband, and killed her 20-year-old son, Daniel Anderl. New Jersey's Daniel's Law lets judges, police officers, prosecutors, and other covered officials, and their families, demand that anyone stop disclosing their home address or unpublished phone number. The company has 10 business days to comply.

Since a 2023 amendment let covered people assign their claims, one company, Atlas Data Privacy, has filed suits against many brokers. On August 12, 2026, the New Jersey Supreme Court answered a question from the Third Circuit: a broker that misses the deadline owes actual damages even without negligence or intent, though punitive damages require willful or reckless disregard. Whether the law is constitutional is still before the Third Circuit.

It protects a short list of professions. Everyone else is still searchable.

How to remove yourself from data broker sites, and what actually works

Removal works partially and has to be repeated.

For the record, our own privacy page says: "We don't sell your information, and we don't run ad trackers." We would like to stay out of the file business.

The broker industry is not a conspiracy. It is a supply chain, and the government is one of its best customers. The rules that bind it are written in Sacramento and Trenton more than in Washington, and the one federal bill that would close the warrant gap has passed one chamber once. Until that changes, the opt-out form is the tool you have. It is tedious. It works some of the time.

Sources

Federal government

Congress

Courts

States

Company documents

Research

Journalism and legal analysis

FAQ

Is it legal for data brokers to sell my personal information?

In most of the U.S., yes. No federal law gives people the right to opt out of people-search sites. California, Vermont, Texas, and Oregon run broker registries, Connecticut and New Jersey have passed registry laws that start in 2027, and California's Delete Act lets residents demand deletion from every registered broker at once.

Can police and ICE buy my data without a warrant?

Agencies have done so for years, and the federal bill that would stop it has not become law. The Supreme Court's 2018 and 2026 cell-phone location rulings dealt with data police compelled from companies, not data they bought. ICE buys investigative data from LexisNexis and Thomson Reuters, according to federal contract notices and reporting.

Do paid data removal services work?

Partly. In a four-month Consumer Reports study, the seven services tested removed 35% of the profiles found overall, with the best two, Optery and EasyOptOuts, at 68% and 65%. Profiles can also reappear after removal.

How do I remove myself from data broker sites?

Californians can file one request through the state's free DROP platform. Everyone else can opt out site by site using each broker's own form, starting with the big people-search sites and using state registries in Vermont, Texas, Oregon, and California to find brokers' opt-out links. Recheck every few months.

What is Daniel's Law?

A New Jersey law that lets judges, police officers, prosecutors, and other covered officials, and their families, require data brokers and others to stop disclosing their home addresses and unpublished phone numbers within 10 business days of notice. It is named for Daniel Anderl, the son of a federal judge, who was killed at the family's home in 2020.

Does the federal government restrict data brokers at all?

Mainly for foreign adversaries. A 2024 federal law enforced by the FTC bars brokers from selling Americans' sensitive data to North Korea, China, Russia, Iran, or entities they control, and a Justice Department rule limits bulk data transactions with countries of concern. Domestic sales, including to U.S. agencies, are largely untouched.