What is consumer data?

The phrase is broad on purpose. It spans anything a business learns about a person in their role as a customer, app user, patient, tenant or resident. Some of it is plainly identifying, like a name and email address.

Some looks anonymous but isn't, like a device ID tied to a daily commute. The European Commission's guidance makes the point that separate pieces of information which together identify someone also count as personal data, and that pseudonymised records that can be re-linked stay in scope.

What it includes

• Identity and contact: names, addresses, phone numbers, emails, dates of birth.
• Transactions: what was bought, where, when and for how much.
• Digital activity: browsing, app use, device identifiers, ad interactions.
• Location: from phones, connected cars and check-ins.
• Inferences: modelled interests, life stages, likely income bands or health interests.

A large industry buys, combines and resells information about people. In its 2014 study of nine data brokers, the FTC described firms collecting consumer information from online and offline sources and selling it for purposes such as marketing and fraud prevention, mostly without people knowing.

Since the FTC study

Since then, states have added registries and deletion rights, and the FTC has brought cases over sensitive data. It sued Kochava in 2022 over location data that could reveal visits to places such as reproductive health clinics and places of worship, and in May 2026 announced a settlement that would bar the company from selling sensitive location data without affirmative express consent.

This example is fictional. A chain of fitness studios holds member records: ages, home postcodes, class bookings and attendance. A sportswear brand approaches the chain wanting member profiles so it can target ads at regular attendees. The chain asks a broker whether that deal makes sense.

Why member-level profiles fail

The broker's first observation is that handing over member-level profiles would turn the chain into a seller of personal information about people who signed up to exercise, not to be marketed to by another company. Depending on the states involved, that could mean opt-out duties, updated notices and possibly data broker registration. The member agreement says nothing about sharing.

So the broker reshapes the product. The chain produces monthly tables of class demand by type, time slot and neighbourhood, with age bands broad enough that no member stands out.

The sportswear brand uses it to decide where to open pop-up stores and which ranges to stock there. The brand still gets insight about consumers, but no individual's record leaves the chain.

• Does the seller have a direct relationship with the people, and what did it tell them?
• Are any fields sensitive: health, precise location, children, financial details, biometrics?
• Would the sale make the seller, or the buyer, a data broker under California, Vermont, Texas or Oregon law?
• Can the buyer's purpose be met with aggregates instead of individual records?
• Is the data being used to decide credit, housing, insurance or jobs? If so, consumer reporting rules may apply.