4 MIN READ
Your name, your address, your shopping history, your health conditions, the names of your children. All of it sitting in roughly 4,000 databases you have never heard of, bought and sold in a market that took shape while the average person was busy clicking accept on cookie banners. The exact number varies by privacy researcher and by country, but the order of magnitude is consistent. Acxiom, Experian, Epsilon, and the data arms of the credit bureaus sit at the top of the market map. Below them runs a long tail of brokers who specialise in a vertical, a region, or a single data type, and they all have one thing in common: the bill never reaches the person being traded. The market is mature, global, and profitable, and it has been operating for the better part of two decades, fed by every app, every website, every loyalty program, every health portal, and every credit application that quietly traded personal data for the service. The cost to the individual shows up everywhere except on a price tag.
What the data broker economy actually looks like in 2026
Three layers make up the market, ordered by revenue. The consumer data broker sits at the top. Acxiom, Epsilon, Experian Marketing Services, the Oracle Data Cloud, LiveRamp. They pull from public records, loyalty programs, app SDKs, and the long tail of sources, then package the data into segments (high income homeowners with children, frequent travellers, credit seeking millennials) and sell access to advertisers, political campaigns, and credit issuers. Revenue runs in the billions, and the aggregate accuracy sits in the useful range, just inaccurate enough to be defensible in court when the rare complaint lands.
Below them, the risk and fraud broker. The credit bureaus (Experian, Equifax, TransUnion) plus the fraud data aggregators and the device fingerprinting companies. They sell identity verification, fraud scoring, and the data that decides whether your credit application gets approved. The data here carries more sensitivity, the regulations sit tighter, and the breaches land larger when they happen (Equifax 2017, the Experian and T Mobile incidents over the last decade).
At the bottom of the stack, the people search broker. Spokeo, Pipl, Whitepages, and a long tail of smaller regional players. They aggregate public records (voter registration, property records, court records, marriage and divorce records) and resell the lookups. The product looks free, because the customer paying for it is rarely the person being looked up. Revenue comes from bulk access, from API integrations, and from the advertising layer that monetises the people who never see a bill.
What the cost really is
Only one of the costs shows up in a price. The financial cost sits in the diffuse category: credit decisions, insurance premiums, job application rejections, all of them quietly influenced by broker data. The person who gets denied credit because a data broker flagged them as high risk (often based on a data error, sometimes on a correlation with no causal basis) has no recourse and often no idea the broker served as the cause. The privacy cost runs deeper. Every broker has a dossier on the rest of us, detailed enough to reconstruct significant parts of a life from data that was never knowingly shared. That cost shows up in the structural erosion of what counts as private. Then the manipulation cost, which sits in the category we are only starting to see. Personalised advertising, political microtargeting, social engineering attacks that use the broker data to build a convincing pretext. That one will run largest over the next decade.
What you can actually do about it
Three moves, in priority order. Start with the opt out, because most of the major brokers run an opt out page. CCPA in California, GDPR in Europe, and the state level privacy laws in a growing number of US states give you the legal right to opt out and to request deletion. The opt out is not retroactive, and the broker will re collect your data within months, so this works as ongoing friction rather than a one time fix. Layer the privacy preserving services on top. Apple Private Relay, DuckDuckGo, the privacy focused DNS providers, the burner email services. None of them stop the data collection outright, but they reduce the data fidelity and shrink the surface area available to brokers. The remaining move sits at the policy level. The American Privacy Rights Act and the EU ePrivacy Regulation have been working through the process in 2024 and 2025. The data broker economy will not shrink until the law makes it expensive to operate, and that part of the work lives at the ballot box rather than the opt out form.
The bottom line
Opt out where the law gives you the right, layer in the privacy preserving services, and put a vote behind the legislative push. The broker economy will keep running as long as the data stays cheap to collect and profitable to resell. The cost shows up in the credit decision, the insurance premium, and the social engineering attack that knew your name before the call started. None of this stops the broker market. All of it raises the cost of doing business, and that has always been the only pressure that works on a profitable market.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
