Inside the Data Broker Industry: How Your Name Becomes a Product
How data brokers turn public records, commercial data, and identity matching into searchable profiles—and what an opt-out can and cannot change.
Type your name into a people-search site and you may see an address, phone number, old email, or relatives in seconds. The page looks like a simple search result. Behind it is usually a supply chain: records from many places are collected, matched, sold, and displayed through a consumer-facing site.
This is a map of that system—not a claim that every site uses the same provider or that every field is accurate. The names, sources, ownership, and legal obligations change. Check the linked first-party sources and the current notice on the site you are using.
The short version
- A people-search page is a retail view. The underlying record may be assembled from public records, commercial data, and other data suppliers.
- Identity matching joins records by identifiers such as a phone number, email, address, or name. A match can be wrong, stale, or attached to another household member.
- An opt-out usually addresses one company or one display layer. It does not erase a public record, a breach, another broker’s copy, or a search-engine cache.
- A successful request is an activity signal. The user-visible result still needs a later check.
- California’s Delete Request and Opt-out Platform (DROP) lets California residents submit one request to registered data brokers. It launched in January 2026; brokers began processing requests in August 2026. Coverage and timing remain bounded by the program’s rules.
Three layers to keep separate
1. Source feeds
Potential inputs include property and court records, voter files, professional licenses, phone directories, marketing lists, loyalty programs, app data, and information supplied by another broker. The FTC’s Data Brokers report documents how data can move through multiple commercial parties before a consumer sees a profile.
“Public” does not mean “complete” or “correct.” A county record may be public while the connection a broker infers between that record and your family is not something the county published. State privacy laws also differ in how they define public information and exemptions; do not treat one state’s rule as universal.
2. Matching and aggregation
The next layer turns separate records into an identity graph. Exact matches can be deterministic; weaker matches can be probabilistic. Shared addresses, phone numbers, or household history may produce a “possible relatives” section even when those people never created an account with the broker.
The result is useful to marketers, investigators, or a searcher only when it is accurate enough for their purpose. A stale phone number can still become a linking edge. A recycled number can also produce a false connection. Treat a profile as a lead to verify, not as proof that every field belongs to you.
3. Consumer-facing sites
People-search and directory sites put a friendly search box over the assembled record. Some offer a free preview and charge for more detail. Others license search, identity, or lead data to businesses. Different logos can show similar information because they share data suppliers, ownership, or downstream feeds—but a similar page does not prove a particular backend relationship.
The useful question is not “which one company has everything?” It is “which exact pages are visible, which company controls each page, and what evidence would show the page changed?”
Why a profile can contain family members
Identity resolution uses relationships that are easy to observe but difficult to interpret. A shared address, phone line, business filing, or historical record can create an association. The broker may label that person a relative or associate even when the relationship is old, indirect, or wrong.
That is why an exposure review should record the exact URL, the fields shown, the date observed, and whether the match is confirmed. Do not copy a family member’s sensitive information into a removal request simply because a page displayed it. Use the narrowest information the provider’s official process requires.
Why opt-outs feel temporary
An opt-out can suppress a page while the source data remains elsewhere. A broker may also receive a refreshed record, change its page structure, or publish a new URL. Search engines can retain a result after the source page changes. Those are different states and should not be reported as one “removed” status.
Common friction includes a buried removal link, a profile URL requirement, email verification, identity matching, unclear confirmation, and no durable request history. These steps may be required for matching or may simply make a request harder to finish. Save the confirmation, request ID, date, and exact URL; then recheck the page later.
The Data Broker Opt-Out Proof Log is a practical record template. The Identity Verification guide explains how to think about a provider’s request before sharing more information than necessary. If a listing returns, use the relisting guide rather than assuming the first request failed.
What changed in California in 2026
California’s DROP is an important change, but it is not a universal eraser. The official DROP overview says the service sends a deletion request to registered data brokers, and the DROP terms say brokers must process requests at least once every 45 days beginning August 1, 2026. The program does not make every unregistered, offshore, first-party, or exempt source disappear.
The CFPB published a proposed rule in December 2024 addressing when data brokers’ sales of sensitive personal and financial information may fall under the Fair Credit Reporting Act. The Bureau withdrew that proposed rule on May 15, 2025, saying it would not take further action on that notice. Read the current CFPB FCRA resources rather than treating the withdrawn proposal as current law.
A useful workflow tonight
- Search yourself using the identifier you are comfortable providing. Record the exact page and date; do not assume a search result is a confirmed match.
- Start with pages that expose a current home address or create a concrete safety concern.
- Use the provider’s official removal or privacy-rights route. Read what it requests before submitting sensitive information.
- Save the confirmation and recheck the exact page after the provider’s stated window.
- Repeat on other companies only when you have evidence that their page is a separate exposure.
My Privacy Agent can organize authorized, supported-source work and show statuses such as filed, pending, needs review, or verified removed. Provider forms, CAPTCHAs, phone steps, and legal identity questions can require a human step. We do not claim to erase breach databases or the internet, and we do not call a record removed until a later check supports that status.
Sources and update note
This guide was reviewed on September 11, 2026. Start with the FTC data-broker report, California DROP information, DROP terms, and the Federal Register withdrawal notice. Product pages and legal obligations can change after this review.