How to remove your personal information from data brokers

Search your own name on a couple of major people-search sites to see what is already exposed, then work through each one's opt-out form — most are a request form on the broker's own site, and the people-search sites (the ones showing your address and relatives to anyone who looks) are the highest priority. If you are in California, the state's Delete Request and Opt-out Platform (DROP) can request deletion across registered brokers in one pass. Expect it to be partial and to need repeating: profiles rebuild as new data arrives, so this is maintenance, not a one-time fix.

You have a relationship with the companies you signed up to. You have no relationship at all with the ones holding the most detailed profiles of you.

A data broker collects information about people it has never dealt with, assembles it into a profile, and sells access to buyers you will never interact with. Nothing about this requires your participation, and in most cases nothing about it is unlawful — which is exactly why the aggregate is so large.

Where the data comes from

Public records

Property transactions, voter registration, court filings, business registrations, professional licences, electoral roll data. Individually public and unremarkable; collectively a detailed history.

Purchase and loyalty data

Loyalty schemes are a data collection mechanism with a discount attached. That is not a criticism — it is the business model, and it is disclosed in terms nobody reads.

App SDKs

Free apps frequently embed third-party code that reports location, device identifiers and usage. The app's developer is paid; the data leaves through a channel unrelated to the app's function.

Warranties and surveys

Registration cards and competition entries asking about household income and interests exist for this purpose.

Other brokers

Profiles are enriched by merging with purchases from other brokers, which is how a profile grows more detailed than any single source.

What a profile contains

The details vary by broker, but a typical consumer profile includes:

• Name, current and previous addresses, phone numbers, email addresses
• Age, date of birth, household composition, relatives and associates
• Estimated income, property value, homeowner or renter status
• Vehicle records
• Purchase categories and brand affinities
• Inferred interests, including health-related ones
• Life events — a recent move, a new child, a bereavement, a marriage

Why this is a security subject, not only a privacy one

This is the part usually missing from articles about data brokers.

Broker data is the raw material for a convincing scam. A spear phishing message naming your employer, your recent move and your neighbour is not the product of a sophisticated intrusion. It is the product of a purchase.

It also supplies:

• The details that make an impersonation call credible — your address, your card's last four digits, your recent activity
• The personal facts that answer security questions, which is one reason NIST now prohibits knowledge-based authentication
• The information used in SIM swap attempts against your mobile provider
• Targeting for scams aimed at people who have recently been bereaved, moved, or come into money

People-search sites

A specific subcategory worth prioritising: brokers that publish profiles openly, searchable by name, showing addresses, phone numbers, ages and relatives to anyone.

These are the highest-priority removals, because they require no purchase and no technical skill to exploit. Anyone with your name can retrieve your address and your family members in seconds.

Opting out

How it works

Each broker has its own process, usually a form, sometimes requiring identity verification — which is its own irritation, since you are submitting identification to a company you are asking to hold less about you.

Where to start

The people-search sites first, then the largest aggregators. Search your own name and see what appears; those results are your priority list.

Legal routes

Some jurisdictions do better. California's Delete Request and Opt-out Platform provides a single mechanism to request deletion across registered brokers, which is the most developed approach so far. The GDPR gives EU and UK residents a right to erasure, exercisable per company.

Paid services

Several companies will submit opt-outs on your behalf, repeatedly. Whether that is worth paying for depends on how much your time is worth; the process is genuinely tedious, and repetition is what makes it work.

Reducing what flows in

Opt-outs address what already exists. These reduce the inflow:

• Decline loyalty schemes you do not genuinely benefit from
• Review app permissions — location and contacts in particular
• Use a separate email for shopping and registrations
• Skip optional fields, especially date of birth and income
• Do not enter competitions that ask about your household
• Limit what you publish — the FTC's first recommendation for avoiding social media scams is to restrict who can see your posts and contacts

The full version of that last point, including which details are worth guarding hardest and why, is in how to protect your personal information online. For the removal side — search results, people-search listings, old accounts and California's DROP platform — see how to remove your personal information from the internet.