What is a data broker?

The phrase covers a wide range of businesses. At one end are large firms that assemble profiles on hundreds of millions of consumers from public records, purchase histories and online activity. At the other are small intermediaries who never store anything themselves: they find a company that owns a useful dataset, find a buyer, and arrange a licence between them. What they share is that information is the product, and someone other than the people or companies it describes is paying for it.

Most news coverage and most state laws are about the first four rows, which deal in personal information about consumers. The last row is a different trade: brokering datasets that a company created in its own business, usually between companies, increasingly for training AI models.

• Public records: property deeds, court filings, voter files where states allow it, business registrations and licences.
• Commercial sources: retailers, loyalty schemes, warranty cards, subscriptions and apps that share or sell what they collect under their terms.
• Online activity: cookies, mobile advertising IDs and location signals gathered through ad networks and software kits inside apps.
• Other brokers: much of the industry buys, combines and resells each other's files.
• Companies' own operations: for dataset brokers, the source is the seller's own records, archives or code, licensed with its permission.

The value usually comes from combining sources. A single file of names is cheap; the same names matched to households, purchase categories and locations is what marketers pay for. For dataset brokers, the value comes from the opposite direction: a single coherent source that a buyer can't easily recreate.

A consumer example: a shopper signs up for a store loyalty card. The store shares purchase categories with a marketing data broker, which matches them to the shopper's address and age range from other files and sells an audience of likely new parents to a baby-products brand. The shopper never dealt with the broker directly, which is exactly the situation the state registry laws were written for.

A business example: a software company winds down a product with eight years of code and issue history. A dataset broker confirms the company owns the code, checks the third-party licences inside it, and arranges a licence to an AI lab that wants real-world code for training. No consumer is profiled; the questions are about ownership, licences and price.

There is no single federal data broker law. Instead several rules overlap, and which ones apply depends on what is sold and how it is used.

• State registries: Vermont created the first data broker registry in 2018. California, Texas and Oregon followed with their own. They require businesses that sell personal information about consumers they have no direct relationship with to register and disclose basic facts each year.
• California's Delete Act: it moved California's registry to the state privacy agency and created a single deletion request system, so one request from a resident reaches every registered broker.
• The Fair Credit Reporting Act: when data is used to decide credit, employment, insurance or housing, the seller can be treated as a consumer reporting agency, with duties on accuracy, disputes and permitted use.
• State privacy laws: comprehensive laws in California, Colorado, Virginia and a growing list of other states give consumers rights to opt out of the sale of their data.
• The FTC Act: the Federal Trade Commission pursues unfair or deceptive practices, including selling sensitive location or health data without proper consent.

The terms overlap and are often used loosely. A data aggregator emphasises collecting and combining many sources into one product, such as a database of every business in a country. A data marketplace is a platform where many sellers list datasets and buyers browse them, with the platform taking a fee. A data broker is the broadest term: any business selling or arranging the sale of data, whether it assembled the data itself or matched a seller with a buyer.

If you are thinking about this as a career, the kind you choose decides almost everything: the capital needed, the legal exposure and the buyers you talk to. Running a consumer data operation means collection infrastructure and compliance in many states. Brokering company datasets needs far less money up front, because you never hold inventory, but it depends on judgement: knowing whether a seller really owns what they are offering, keeping personal data out of deals that can't support it, and pricing something with no list price.