Data Brokers Explained and How to Opt Out

A data broker gathers personal information about you from many places and sells it to other companies, even if you never dealt with it.

The data can be as sensitive as precise location, and you rarely agree to any of it directly.

This guide explains what data brokers hold, what regulators have done, and where to start opting out.

It follows California's privacy agency and FTC orders, and it points to our step-by-step guides for the opt-out work itself. Checked on October 21, 2026.

The short answer

Data brokers sit between the places that collect data about you and the companies that want to buy it. You cannot avoid them by avoiding the brokers, because they do not need you as a customer.

To reduce what they hold, use California's DROP if you live there, opt out broker by broker if you do not, and cut the data you leave behind. Our guides cover each step.

What counts as a data broker

California's privacy agency, which now calls itself CalPrivacy, defines a data broker as a business that gathers consumers' personal information from different sources and sells it on to other companies.

That holds even if the consumer never used the business for anything.

The agency says the data can include Social Security numbers, precise location, health-related details and browsing history. Any business that meets the definition must register.

How data brokers get your data

Brokers buy, license and collect from many places. In its case against Mobilewalla, the FTC alleged that the company took in information from other data brokers without checking whether consumers had agreed.

In the Gravy Analytics case, the FTC alleged that the company used geofencing, a virtual boundary around a place, to identify and sell lists of consumers who visited healthcare facilities and places of worship.

The orders followed FTC complaints announced in December 2024.

What regulators have done

The FTC said it voted 5 to 0 to approve the Gravy order. The agency's orders cover those companies, not the whole industry, so they do not change what every broker does.

Days before the Gravy order was finalized, the company was reported to have suffered a data breach, according to a law firm's summary. Large stores of location data can leak, which is part of why regulators care about retention.

The orders in detail

The Gravy order gives the company 90 days after it takes effect to end sales, disclosures and use of sensitive location data.

Exceptions apply if it has a direct relationship with the consumer, affirmative opt-in consent, and uses the data only for a service the consumer asked for.

The Mobilewalla order requires it to stop selling, sharing or disclosing sensitive location data. It must also keep a program to identify sensitive locations and prevent that data from being disclosed.

California's registry and DROP

The registry is the nearest thing to an official list of data brokers, so use it instead of an unofficial one. It is published by the state, after registration closes each January.

DROP lets a California resident send one deletion request to every active data broker. Our explainer on California DROP covers how it works, what it asks for and what to expect.

How to start opting out

This section is our advice, built on the sources above.

Data brokers and your phone

Location data is one of the most sensitive things brokers sell. The FTC orders above were about location data. Our guides to iPhone privacy settings and App Tracking Transparency show how to limit what your phone shares.

Should data brokers be illegal?

That is a policy question this guide does not answer. What the sources show is narrower: the FTC has acted against sales of sensitive location data, and California requires registration and offers a deletion tool.

Others want a wider ban on the trade. Check current bills and laws in your own state and country.

How a profile gets built

This is our simplified picture. Different sources describe you in fragments: a purchase here, an app's location pings there, a public record somewhere else. A broker's job is to join the fragments and sell the result.

That is why opting out is a process, not a switch. A removal covers what a broker holds today, and new data can arrive later from the same sources.

Frequently asked questions

What do data brokers do?

They collect personal information from many sources and sell it to other businesses. California's agency says that can include browsing history, precise geolocation and health-related information.

Are data brokers legal?

In general, yes, though some practices are restricted. The FTC has acted against sales of sensitive location data, and California requires brokers to register.

How do data brokers get my data?

From many places. The FTC has alleged that one broker collected information from other brokers without checking consent.

How do I remove myself from data brokers?

Use DROP if you live in California. Otherwise, contact brokers one by one using the steps in our opt-out guide.

Is there a list of data brokers?

California publishes its registry of businesses that operated as data brokers in 2025. It is the most reliable public list.

A quick checklist

• Check whether you can use California's DROP.
• Opt out of the largest people-search sites.
• Consider a removal service if you lack time.
• Limit location and app tracking.
• Recheck periodically, because data returns.

Up nextHow to opt out of data brokers in 2026, including California DROPWant the step-by-step version? Read our guide to opting out of data brokers.→