If you ask why it is still legal for a company to publish your home address and sell your profile to marketers, the honest answer has several layers. There is no single law that says brokers can do this, and there is no single law that says they cannot. There is a patchwork of sector rules, state statutes, consumer protection principles and long-standing legal treatment of public records, and brokers operate in the spaces between them. This guide explains why the industry persists, what has begun to change and what that means for what you can do today. For the practical how-to, see data brokers are selling your personal information.
1. Reason 1: No comprehensive federal privacy law
Europe adopted a general data protection regulation. The United States has not passed an equivalent federal law. Instead it has laws for particular sectors: credit reporting, certain health information, children’s online data, some financial data and a few others. A broker that compiles non-regulated data, such as your address history, purchase interests or inferred preferences, may fall outside every one of them. See are there any government entities protecting our private data online and what is GDPR.
2. Reason 2: Much of the data comes from public records
Property deeds, court filings, professional licenses and in some places voter registrations are public by design, to support transparency and accountability. Brokers collect them in bulk and make them easy to search. The records themselves are lawful to publish in many cases, and courts are wary of restricting information that is already public. That leaves little room for a general law that stops the republishing without also affecting journalism and research. The tension is real: the same openness that lets a reporter check a deed lets a stalker find a home.
3. Reason 3: Consent is cheap to obtain and hard to see
Many commercial data flows begin with a consent you did not notice. You accept terms when you sign up for a loyalty program, download an app, enter a sweepstakes or register a product. Those terms may permit sharing with partners. See guarding your personal data: the perils of sweepstakes. Regulators have criticized this model, but the legal system treats clicking agree as consent even when no one reads the text.
4. Reason 4: The economics reward collection
Collecting and reselling data costs little and earns a lot. The same record can be sold repeatedly. The harms are spread across many people and are difficult to trace, while the profits are concentrated. That is a classic setup for under-regulation. See how much money data brokers make.
5. Reason 5: The market is large, fragmented and global
Hundreds of companies operate in the space, from household names to tiny firms. Records flow among them, so stopping one does not stop the others. Some are overseas and hard to reach. A broker that shuts down may be replaced by another that buys its data.
6. Reason 6: Enforcement is limited and reactive
Agencies such as the Federal Trade Commission can act against unfair or deceptive practices, and they have taken actions against companies selling sensitive data without proper consent. You can follow its work at ftc.gov. But the FTC has limited resources, and cases take years. State attorneys general also enforce state laws. Most brokers, however, are not the subject of any current action.
7. Reason 7: Government is also a customer
Some agencies buy commercial data, which gives them a stake in the market. The legal and policy questions about that practice are active. See does our government buy our private data from data brokers.
Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.
8. What is changing
Pressure has led to real movement, mostly at the state level.
State comprehensive privacy laws
A growing number of states give residents rights to access, correct, delete and opt out of the sale or sharing of personal data and of targeted advertising. Details differ, including which businesses are covered and which exemptions apply. The California Privacy Protection Agency, at cppa.ca.gov, enforces California’s law and publishes guidance.
Data broker registries
Several states require data brokers to register, which creates a public list and a basis for regulation. California’s registry is the most developed.
California DROP
California’s Delete Request and Opt-out Platform lets residents submit one request that goes to all registered brokers. It opened to residents on January 1, 2026. Registered brokers must begin processing requests from August 1, 2026, and must continue to do so on a recurring cycle of about every 45 days. You can learn more at privacy.ca.gov/drop. It is the first large-scale attempt to turn the individual opt-out slog into a single request.
Enforcement and court actions
Regulators have pursued sellers of sensitive data. In 2026 a court ordered the seizure of the people-search site Radaris, an example of how legal action can reach even long-running brokers. Such events are still the exception.
Proposals at the federal level
Federal lawmakers have introduced bills on privacy, on limiting government purchases of data and on regulating brokers. Whether any will pass is uncertain, so plan around what exists today.
9. What this means for you
Because the system is changing slowly, you need to protect yourself in the meantime.
- Use opt-outs. Official pages include Spokeo, the PeopleConnect suppression center and That’s Them. See how to opt out of the most popular people search sites.
- Use your state’s rights. If you are in California, use DROP. In other states, send deletion and opt-out requests under your state’s law where available.
- Reduce what you give. Decline optional data sharing, use alias emails and skip sweepstakes.
- Freeze your credit. See what is a credit freeze.
- Opt out of prescreened offers at 1-888-5-OPT-OUT and register at donotcall.gov.
- Monitor. Listings come back. See why does my information keep getting re-added online.
- Report problems. Scams go to reportfraud.ftc.gov, and identity theft to identitytheft.gov.
10. Myths and facts
| Myth | Fact |
|---|---|
| Data brokers are illegal | Many operate lawfully under current US law, with limits in specific areas |
| One opt-out ends it | Records can be refreshed and resold; maintenance is needed |
| Laws will soon fix it | Change is real but slow and uneven |
| Only the careless are exposed | Public records and purchased data expose almost everyone |
| Deleting social media removes me | Brokers collect from other sources |
| Complaining to the broker is pointless | Documented requests can support regulatory complaints |
11. What a better system could look like
Reformers propose a few changes that would shift the balance. A national deletion mechanism would let people send one request that reaches every broker, like California’s platform but nationwide. A default of data minimization would require companies to collect only what they need. Limits on the sale of sensitive data such as precise location and health information would reduce the most harmful trades. Stronger penalties would make violations costlier than compliance. Restrictions on government purchases of data that would otherwise need a warrant would address the public sector side. None of these is guaranteed, but each already exists in some form in at least one state or country, which makes them realistic goals.
12. How to keep up with changes
Rules change quickly, so follow a few reliable sources. The Federal Trade Commission posts consumer guidance and enforcement news at consumer.ftc.gov and ftc.gov. California’s regulators publish updates at cppa.ca.gov and privacy.ca.gov/drop. Your state attorney general’s website explains local rights. Review them a couple of times a year, and update your opt-outs when new tools appear.
13. Three scenarios and what to do
Scenario 1: You live in California. Submit a DROP request, and also opt out directly of the people-search sites that matter most. Re-check after each processing cycle.
Scenario 2: You live in a state with a privacy law but no deletion platform. Send individual requests to the biggest brokers, cite your state’s law and keep records. Contact your attorney general if requests are ignored.
Scenario 3: You live in a state without a comprehensive law. Rely on voluntary opt-outs, which many brokers offer, and consider a service to handle the repetition.
14. Common mistakes
- Waiting for a law to fix the problem.
- Assuming that a broker that has a privacy page must be honoring requests.
- Forgetting relatives.
- Believing that a registry means the data is gone.
- Not keeping records of requests.
- Giving up when a profile returns.
15. Questions worth asking your representatives
Do you support a comprehensive federal privacy law with a right to delete? Will you restrict government purchases of data that would otherwise require a warrant? Will you require brokers to register nationally and honor a single deletion request? What penalties will apply to violations? Civic pressure helped create the state laws that exist today, and it remains one way to change the system in the long run.
16. How Wiperts fits
While the law catches up, people still need removal done. Wiperts scans more than 100 data brokers and people-search sites for your name, address and phone numbers, submits removal requests, removes your personal results from Google and Bing, blurs your home on maps and monitors continuously so profiles that return are removed again.
See what is public about you with the free diagnosis.
100% Free Diagnosis: Check Your Exposure
Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:
- First Name
- Last Name
- Select State
- Email Address
- Website
Scan Databases Now — no payment is needed to see your exposure report.
17. Key takeaways
- Brokers persist because of the lack of a federal privacy law, public records, buried consent, strong economics and limited enforcement.
- State laws, registries and California’s DROP are the main source of change.
- Opt out now, use your state rights and monitor for relistings.
- Treat protection as ongoing maintenance, not a one-time event.
Pick the Wiperts plan that fits your household
| Plan | Covers | One-time deep scrub | Then |
|---|---|---|---|
| Individual | 1 person | $89 | $14/month |
| Couples (most popular) | 2 people | $149 | $24/month |
| Family | Up to 4 people | $199 | $39/month |
Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal
18. Frequently Asked Questions
Why can’t data brokers be stopped from selling my data?
Because there is no comprehensive federal privacy law, much of the data is public or collected with consent hidden in terms of service, selling data is very profitable and enforcement resources are limited. State laws are beginning to change this.
Is it legal for data brokers to sell my information?
In most of the United States, yes for many categories, subject to specific laws such as the Fair Credit Reporting Act and state privacy and registry rules. Some data types face stricter limits.
What is a data broker registry?
Some states require brokers to register with the government. California’s registry is managed by the state’s privacy regulator and underpins its deletion platform.
What is California DROP?
The Delete Request and Opt-out Platform lets California residents send one deletion request to all registered data brokers. It opened to residents on January 1, 2026, and brokers must begin processing requests from August 1, 2026, repeating about every 45 days.
Do federal laws protect me at all?
Sector laws protect some data, including credit reports, health records held by covered entities and children’s data online. There is no general law covering all personal data.
What can I do while laws catch up?
Opt out of brokers and people-search sites, use your state rights, limit data you share and monitor for relistings.
Sources
- ftc.gov
- cppa.ca.gov
- privacy.ca.gov/drop
- Spokeo
- PeopleConnect suppression center
- That’s Them
- donotcall.gov
- reportfraud.ftc.gov
- identitytheft.gov
- consumer.ftc.gov
Related Reading
- Data Brokers Are Selling Your Personal Information. Here’s How
- Who Are the Biggest Data Brokers? A 2026 Guide
- Everything You Need to Know About Data Brokers in 2026
- How Much Money Do Data Brokers Make From Your Information?
- Does the Government Buy Your Private Data From Data Brokers?
- Which Government Agencies Protect Your Data Online?
- What Is GDPR? Will It Protect You?
- Personal Privacy Standards: Rules to Live By Online
Ready to erase your footprint?
Stop letting data brokers profit from your personal life. Start your removal today.
Start Removing