What a data broker knows about you, and where it got it

Most people meet the data broker business by accident. A friend mentions that your old apartment shows up next to your name on some website. A caller knows the street you lived on ten years ago. It feels like a leak, and usually it is not one. It is the ordinary result of an industry that gathers records which were never secret, joins them together and sells the result.

I spent years in compliance at a consumer lender, and part of that work was reviewing the identity checks we bought from outside vendors. Those vendors knew a lot about our applicants, and almost none of it came from us. This piece explains who these companies are, what they tend to hold and where it comes from, so you can decide what to do about your own file.

Three kinds of brokers, three different files

"Data broker" covers several businesses that rarely mention each other. When the Federal Trade Commission studied nine of them for its 2014 report, Data Brokers: A Call for Transparency and Accountability, it sorted their products into three groups: marketing, risk mitigation and people search. The split still holds up, and it tells you where your effort will count.

People-search sites

These are the sites you can find yourself on by typing your own name into a search engine. They sell reports to anyone who pays, usually without asking why. A report is built around one person: name, age, addresses, phone numbers, relatives. The FTC's consumer page on people search sites explains that they may buy information from other brokers, copy social media profiles that are public and compile federal, state and local government records.

Most of them offer an opt-out. That makes this group the most visible and also the one where your own work pays off fastest.

Marketing brokers

Marketing brokers do not usually sell a report about you to a stranger. They sell lists and audience segments to advertisers: households likely to move soon, new parents, people who buy fishing gear. The FTC report described segments built around income, ethnicity, age and health interests such as diabetes and pregnancy. You rarely see these files directly. You see their effects in your mailbox and in the ads that seem to know you.

Risk and identity brokers

The third group sells to banks, insurers, landlords, employers and fraud teams. Their products answer questions such as "is this applicant a real person" or "does this phone number belong to this name". This is the group I knew from the lending side, and the one most people never think about.

When one of these reports is used to decide on credit, insurance, a job or a rental, it falls under the Fair Credit Reporting Act. That law gives you the right to see your file and to dispute errors. When the same data is used only to screen for fraud, the rules are looser and access is harder to get.

Where the data comes from

None of these companies needs to hack anything. The raw material comes from a short list of ordinary places, most of which you have fed at some point.

• Property records. Deeds, mortgages and county tax rolls name the owner and the property address, and many assessor offices put them online. Buying a home puts your name and your new address into a record that is meant to be public.
• Court records. Civil suits, evictions, liens, judgments, bankruptcies, traffic cases and criminal matters. Dockets list names and often addresses.
• Voter files, where the state allows it. Every state keeps a voter roll, but the states differ on who may get a copy and what they may do with it. Some limit use to elections and campaigns. Others are looser. The National Conference of State Legislatures keeps a state-by-state summary if you want to check yours.
• Other government records. The FTC lists professional licenses, driving records, and birth, marriage, divorce and death records among the sources people-search sites draw on, depending on the state.
• Marketing lists. Magazine subscriptions, catalog orders, sweepstakes entries and the warranty card that came in the box with a new appliance. The FTC report names warranty registrations and magazine subscriptions among broker sources.
• Loyalty programs and purchase data. A store card records what you buy and when. Some programs share that data with partners under terms few people read.
• Apps and websites. Sign-up forms, advertising identifiers and location data from phones. The FTC has taken action against companies that sold precise location data gathered through apps.
• Phone directories. Listed numbers moved online decades ago and became the backbone of reverse phone lookups. Our page on phone directories and unlisting covers that history.
• Other brokers. This is the quietest source and probably the largest. Brokers license data to each other, so a single record can pass through several companies before it lands on a site you have heard of.

The mix matters for removal. A people-search site can stop showing a listing, but it cannot change the county deed it learned your address from.

What a typical listing shows

Here is a made-up people-search listing, the kind you might find for "Jane Example". The right column explains what each line usually means, so you can read your own listing the same way.

Expect a blend of accurate and stale details. A listing that is half wrong still does harm, because the half that is right is usually your address and your relatives.

Why it matters

It is tempting to shrug at this. Your address was never a secret, after all. The trouble is what a combined file makes easy.

Scams get more convincing. A caller who knows your previous street, your age and a relative's name sounds like your bank, your utility or a grandchild in trouble. Every detail they get right lowers your guard a little.

Stalking and domestic violence become simpler. The FTC page points out that survivors of domestic violence or stalking may not want anyone to find where they live or the names and addresses of their family. A people-search report sells exactly those two things to anyone with a card.

Doxxing gets faster. When an argument online turns ugly, posting someone's home address is the usual next step, and a people-search report hands it over in minutes.

Identity theft gets easier. During my lending years, the identity quiz an applicant had to pass often asked about previous addresses or past lenders. Those questions are only as safe as the answers are private, and brokers sell many of the answers.

First steps

You do not need a weekend for this. An evening is enough to start, and the order below puts the quick wins first.

1. Create an email address used only for opt-outs. Brokers will send confirmation links, and there is no reason to hand them your main inbox.
2. Search your name and city on the large people-search sites and note every listing you find. Our opt-out guide lists the sites to start with and how each one handles removal.
3. Take the exposure quiz. It asks about home ownership, listed numbers, voter registration and similar things, and points you to the records that expose you most.
4. Cut the marketing side. The FTC's page on stopping junk mail explains the opt-out for prescreened credit and insurance offers, which the major credit bureaus run, and the DMAchoice registry for catalogs and promotional mail. The FTC notes that giving your Social Security number on the prescreen opt-out is optional.
5. Ask the risk side what it holds. Under the Fair Credit Reporting Act you can request your file from consumer reporting companies, including the specialty ones used for tenant screening, employment and insurance. The CFPB keeps a list of consumer reporting companies with contact details.
6. Start a removal log. A simple table works: the site, the date you sent the request, the listing's web address, how you verified and the date to check again.

A few states, starting with Vermont and California, now require data brokers to register with the state, and California publishes its list. Registries are useful for spotting broker names you have never heard of, but they do not remove anything by themselves.

The one thing to keep in mind: removal is upkeep, not a single cleanup. A file built from public records refills when those records change, so put a reminder in your calendar to check again in three months.