Data brokers: what a data broker is and how they work

A data broker makes money from information it didn't collect from the people it describes. Some gather it themselves from public records and websites; most also buy it from retailers, apps, lenders, other brokers and anyone else who will license it.

They clean it, link records that belong to the same person or household, add guesses about interests and income, and sell the result to companies that want to market, verify, screen or analyse. The buyers are businesses; the people in the files usually never hear the broker's name.

The other kind: arranging data deals

The term also covers a smaller and older trade: data brokerage in the sense of arranging deals. A broker in this sense finds a company that holds a useful dataset, such as years of support tickets, a niche trade directory or an abandoned codebase, finds a buyer, and negotiates the licence between them, often with no personal information involved at all.

What this page covers

That is the kind of brokering DataBroker teaches. The rest of this page is mostly about the first kind, because that is what the laws, the registries and most of the coverage are about. For a one-paragraph answer, see the short definition.

The most detailed public look inside the industry is still the Federal Trade Commission's 2014 study, which ordered nine brokers (Acxiom, Corelogic, Datalogix, eBureau, ID Analytics, Intelius, PeekYou, Rapleaf and Recorded Future) to explain their practices. It found the same pattern the state registries show today.

Five sources the FTC found

• Government sources, such as bankruptcy information and voter registration records.
• Other publicly available sources, from websites to licences a person has had to apply for.
• Commercial sources: purchase data, warranty registrations, magazine subscriptions and web browsing activity, licensed from the companies that collected them.
• Other data brokers: the nine brokers obtained most of their data from other brokers rather than the original source, and seven of the nine supplied data to each other.
• Their own inferences: derived data such as "interested in boating" from a boating licence, or brand loyalty from two car purchases, which become segments sold to marketers.

How much data they hold

Scale was the other finding. One broker's database held information on 1.4 billion consumer transactions and over 700 billion data elements; another added three billion new records a month; one had 3,000 data segments for nearly every US consumer.

The FTC sorted broker products into three groups: marketing, risk mitigation and people search. The registries add two lines that matter more every year, location data and sales to AI developers. The counts come from the yes or no answers brokers gave on California's 2026 registration form.

Governments and foreign buyers

Buyers outside the private sector matter too: 56 brokers said they sold or shared data with the federal government in the past year, 56 with other state governments, 30 with law enforcement outside a subpoena or court order, and 26 with a foreign actor.

If you are on the buying side, read the checks to make before you buy consumer data from any of them.

Nobody knows exactly, because only four states make brokers register and each defines them differently. California's registry held 625 for 2026 when we downloaded it, up from 543 in each of its 2024 and 2025 files. Vermont's registry, the first in the country, had 292 on 8 April 2026.

Privacy Rights Clearinghouse matched the state lists in April 2025 and found about 750 distinct broker groups, with hundreds of them missing from each state's registry. You can browse every broker on California's registry, with what each says it collects and who it sells to.

• Licences and subscriptions: a buyer pays for access to a file or a feed for a set period and set uses, and renews. This is how most marketing and business data is sold.
• Per check or per call: identity, fraud and background products are priced per lookup or per API call, so revenue follows the buyer's volume.
• Reports: people-search sites sell single reports or memberships to the public.
• List rental and data appends: a marketer rents a list for one use, or sends its own customer file to have missing fields filled in.
• Resale to other brokers: as the FTC found, much of the trade is brokers selling to each other.

The biggest groups

The largest data broker companies by reported revenue are groups whose brokering sits beside bigger businesses: S&P Global, Experian, Moody's, Equifax and TransUnion each have units on California's 2026 registry. None reports revenue from selling personal data on its own.

There is no general federal data broker law in the United States. Instead, a broker's duties depend on what it sells, who to, and which states its data covers.

California's Delete Act and Vermont's registry are the two that shape the trade most: California because its deletion platform lets residents reach every registered broker with one request, Vermont because it started the registry model in 2018 and keeps tightening it.

Not every data deal looks like the consumer trade above. Companies increasingly license data they built in the course of their own business, such as code, documents, sensor logs or transaction histories, to AI labs, hedge funds and analytics firms. Often no consumer file changes hands, and the deal is closer to licensing intellectual property than to selling profiles.

What a broker does in these deals

Brokers in this market are matchmakers: they find the holder, check what it may lawfully license, value it, and run the deal through a confidentiality agreement and a written licence. It looks more like a data aggregator's role than a consumer broker's, minus the database.

If that is the side of the trade you're interested in, start with how to become a data broker. If you run a business and want to license data their company already holds, as most of our readers on the seller side do, the selling guide covers it step by step.