These 10 Data Brokers Are Selling Your Personal Information Right Now.

There's an entire industry built on collecting, packaging, and selling your personal information. Data brokers aggregate data from public records, social media, purchase history, and other sources to build detailed profiles that anyone can buy — often for just a few dollars.

The Biggest Players

Spokeo, WhitePages, BeenVerified, Intelius, and PeopleFinder are among the most prominent consumer-facing data brokers. But the bigger players operate in the background: Acxiom, Oracle Data Cloud, and LexisNexis sell data primarily to businesses, marketers, and government agencies.

How to Remove Yourself

Every data broker is legally required to honor opt-out requests, though they make the process deliberately tedious. Visit each broker's website, find their opt-out page (usually buried in the footer), and submit a removal request. Expect the process to take 2-4 weeks per broker.

Pushing back at scale

Filing opt-out requests with ten major brokers is a good start, but the long tail is enormous. There are roughly 4,000 data brokers operating in the US alone, and most of them ingest from the same handful of original sources, including credit reference files, voter rolls, real estate records, and breached credentials sold on the open market. Removing yourself from the headline ten makes you harder to find in casual searches. Removing yourself from the long tail takes ongoing pressure or paid services.

Paid removal services like DeleteMe, Incogni, Optery, and Kanary handle the busywork of submitting requests across hundreds of brokers on a continuous cycle. Pricing ranges from about ten to twenty dollars per month depending on coverage and family plan add-ons. They are not magic. They submit the same forms you could submit yourself, but they do so reliably, every month, and across far more brokers than any individual would maintain on their own. The trade-off is convenience for cost.

Legal leverage has improved meaningfully. California's CCPA, Virginia's VCDPA, and a growing list of state level privacy laws give residents an enforceable right to opt out of data sales. The European GDPR remains the strongest framework globally. Even outside those jurisdictions, citing the relevant law in your opt-out email often accelerates compliance, especially with brokers who maintain US and EU customer lists in the same database. A one paragraph template can be reused dozens of times.

Be aware that some brokers operate under multiple brand names. Spokeo, Whitepages, Intelius, BeenVerified, and TruthFinder share infrastructure and data sources at different levels. Removing yourself from one does not automatically remove you from the sibling sites. Keep a spreadsheet of every brand you have requested removal from, the date of the request, the confirmation email, and the followup date 90 days later. Without that paper trail, you will lose track of who has resurrected your record.

Long term, the only durable defense is to feed the brokers less fresh data. Use email aliases, secondary phone numbers, and a virtual mailbox for online retail orders. Minimize what you publish on social media. Buy property through an LLC where feasible. None of this is invisibility. It is friction, layered consistently, that makes the broker industry treat you as a less valuable record. Less valuable records get less aggressive enrichment, and the cycle slowly turns in your favor.

How data brokers actually source your information

The pipeline starts with public records: voter registrations, property deeds, court filings, marriage licenses, and professional licenses. All of these are technically public, but data brokers spend significant money turning scattered county records into a single queryable database. LexisNexis, Acxiom, and Epsilon have spent decades doing this. They then layer in commercial data from loyalty card programs, magazine subscriptions, warranty registrations, and credit header data sold by the major bureaus.

The second tier comes from web tracking. Every time you visit a site with a Meta pixel, a Google Tag, a TikTok pixel, or one of the dozens of smaller ad-tech SDKs, your behavior is hashed and joined into the broker graph. Mobile SDKs embedded in weather apps, flashlight apps, and ridiculous casino games leak location data that gets stitched into the same profile. The result is a single dossier that links your home address, your purchase history, your political leanings, and your medical curiosities.

The third source is breached and leaked data. Many brokers will not publicly admit this, but enrichment vendors that operate in gray markets sell datasets pulled from old breaches, scraped LinkedIn profiles, and bulk-sold phone number lists. Once your data is in that ecosystem, it does not leave.

Why opt-outs don't really opt you out

Removing yourself from one broker does not remove you from the others. The major aggregators license data to hundreds of smaller resellers and consumer-facing sites like Spokeo, BeenVerified, and Intelius. Even after a successful opt-out, your record can reappear within weeks when the source database is refreshed. This is not a glitch, it is the operating model. Brokers describe the data as objective fact pulled from public records, so re-ingesting it after deletion is, in their view, legitimate.

CCPA and the new state laws in Colorado, Connecticut, Virginia, and Texas give you a legal right to delete, but enforcement is uneven. The California Privacy Protection Agency has been active, with fines issued to Sephora and several smaller brokers, but most violations go unreported. Filing a complaint with the FTC or your state attorney general is cheap and occasionally effective, particularly when the broker is large enough to care about reputational risk.

Services that automate the grind

Manually opting out of every broker is a 40-hour project that needs to be repeated quarterly. Services like DeleteMe, Optery, Privacy Bee, and Kanary automate it for $100 to $250 per year. DeleteMe covers roughly 35 sites, Optery's premium tier covers around 120, and Privacy Bee claims over 400. The catch is that broader coverage does not mean better coverage. Most of your exposure comes from the top 20 sites, and the long tail of obscure aggregators rarely shows up in a recruiter or background check anyway.

For most readers, Optery's free tier plus a manual quarterly check of the 10 biggest brokers is enough. If your job involves public exposure, journalism, executive roles, or content creation, paying for the premium tier is reasonable. The time savings are real, and the alternative is that you stop doing the opt-outs after the first two rounds and your data slowly drifts back online.

What people-search sites really know

If you have never typed your name into BeenVerified or Spokeo, do it once. The results are sobering. A typical record contains your full legal name, age, every address you have lived at for the past 20 years, the names of relatives and likely cohabitants, your approximate net worth band, and partial information about phone numbers and emails. Some sites also include arrest records, civil court appearances, and bankruptcy filings.

Much of this is wrong. Address histories often confuse two people with similar names, phone numbers are recycled across owners, and arrest records sometimes belong to a different individual entirely. The brokers do not have a real incentive to correct errors because they are not legally responsible for the consequences. A wrong record on a background check has cost people jobs and apartments, with limited recourse beyond filing a dispute and waiting weeks for a manual review.

Protecting kids and family members who can't act for themselves

Children under 18 generally cannot be searched on consumer-facing people-search sites in the US, but their data is still in the broker pipeline waiting for them to turn 18. The moment a teenager registers to vote or opens a bank account in their own name, the dossier activates. Parents can preemptively opt their kids out of the major data brokers using a parental authorization process; most brokers will honor it, though paperwork requirements vary.

Elderly relatives are another high-risk group, particularly because scammers actively buy data about likely vulnerable seniors. If a parent or grandparent has been targeted by phone scams, run their name through the people-search sites and submit opt-out requests on their behalf. You will usually need a power of attorney or proof of relationship, but the brokers do process these requests. The reduction in junk mail and phone spam is often noticeable within two to three months.

Deceased family members are a separate category. Many brokers continue listing the deceased indefinitely, which enables identity theft against estates. Send a death certificate copy with a written request to the major brokers; this is not automated and requires real follow-up, but it works.

What state laws are actually changing in 2026

California's Delete Act, which began phased rollout in 2024 and is fully active in 2026, creates a single state-run portal where residents can submit a one-time deletion request that propagates to all registered data brokers. Brokers must check the registry every 45 days and honor new requests. Enforcement is funded by registration fees the brokers themselves pay, which is a clever structural choice. Texas, Oregon, and Colorado have introduced similar bills, with Texas's version expected to pass in late 2026.

At the federal level, the American Privacy Rights Act has been reintroduced in Congress, but its prospects remain uncertain. If passed in any form, it would preempt some state laws and create a national private right of action, which would dramatically change broker economics. For now, residents of CCPA states have the most leverage. Use it. File requests in writing, document every response, and escalate to your attorney general when brokers ignore valid deletion demands.