What data brokers are and what they collect

You have almost certainly never signed a contract with a data broker, visited one of their websites on purpose, or handed one your information directly. Yet many of them hold a detailed file on you. This lesson explains what these companies are, where the U.S. Federal Trade Commission’s own study found their data comes from, and why the lack of a direct relationship with you is central to how the industry works.

What a data broker is

In a 2014 in-depth study of nine major data brokers, the FTC defined the industry as “companies whose primary business is collecting personal information about consumers from a variety of sources and aggregating, analyzing, and sharing that information, or information derived from it,” typically for marketing, identity verification or fraud detection. The report’s central finding is what makes this different from an ordinary company you deal with: data brokers “typically collect, maintain, manipulate, and share a wide variety of information about consumers without interacting directly with them.” Because of that, the FTC noted, “consumers are often unaware of their existence, much less the variety of practices in which they engage.”

Where the data actually comes from

The FTC’s study found that none of the nine brokers collected data directly from consumers. Instead, their data came from three kinds of sources:

• Government sources: the U.S. Census Bureau’s demographic data, court and bankruptcy records, professional and recreational licenses, real property and voter registration records, and motor vehicle records where the law allows it.
• Other publicly available sources: telephone directories, press reports, and anything individuals post publicly on the internet, including some social media platforms and blogs, gathered in part by automated web crawlers.
• Commercial sources: purchase details from retailers and catalog companies, magazine subscription lists, customer lists from websites where people register or log in, and — most of all — data bought from other data brokers.

That last point matters: the FTC found that seven of the nine brokers it studied buy from or sell to each other, and most of the commercially sourced data actually originates with brokers outside the study entirely. As the report puts it, this makes it “virtually impossible for a consumer to determine how a data broker obtained his or her data”, since a single data element may have passed through a chain of companies before reaching the one holding your file.

Raw facts, and the guesses built on top of them

Data brokers do not only store facts you gave someone, like a name or an address. The FTC found they also create “derived data”: inferences a broker makes from the raw facts. Its report gives concrete examples drawn from the industry it studied — inferring an interest in boating from a boating license, or brand loyalty from having bought two cars from the same manufacturer. Brokers then group people into named segments built from these inferences, some clearly aimed at products, and others built around ethnicity, income, age or health topics, with segment names the FTC’s report quotes directly, such as “Diabetes Interest” and categories combining low income with specific ethnic groups. The report found that one of the nine brokers alone maintained about 3,000 such data segments for nearly every U.S. consumer.

Data Brokers Collect and Store Billions of Data Elements Covering Nearly Every U.S. Consumer.

Federal Trade Commission, Data Brokers: A Call for Transparency and Accountability (2014)

One broker in the study reported a database covering 1.4 billion consumer transactions and more than 700 billion aggregated data elements, adding roughly three billion new records every month. The FTC also found that some brokers keep this data indefinitely, even once it is outdated, because it can still be useful for verifying identity later — a retention practice the report flagged as its own security risk, since a large stored profile is also a more valuable target if a broker is breached.

A specific, visible kind: people search sites

One category of data broker is easy to see for yourself: people search sites. The FTC’s consumer guidance describes them as sites that “collect personal information about us from a variety of sources, compile it into a report, and sell those reports to anyone willing to pay”, drawing on other data brokers, public social media profiles, and government public records such as property, voting, driving and criminal records. A report on you from one of these sites can include your age, address history, family members, and civil or criminal records, visible to anyone who pays for it — including people you would rather not find you.