What is a data broker, and how did they get your details?
A company whose business is collecting, combining and selling information about people who have no relationship with it and usually do not know it exists. The industry is large, longstanding and mostly invisible.
Where the data comes from:
Public records — electoral registers, company filings, property and land records, court records, and registries.
Commercial sources — loyalty schemes, warranty registrations, competition entries, surveys, and subscription lists, where the terms permitted sharing.
Online tracking, through advertising and analytics code embedded across millions of sites and apps.
Location data sold on by apps that collected it for another purpose.
Breached and scraped data, which circulates regardless of legality.
Other brokers, since the same records are traded and enriched repeatedly.
What they build. Profiles combining identity, address history, household composition, estimated income, inferred interests, life events — moving, new baby, bereavement — and increasingly sensitive inferences about health, financial difficulty and religion. Inferred data is the part people least expect, and it can be wrong while still being acted upon.
Who buys it: advertisers; insurers and lenders for marketing and in some cases risk; employers and landlords through screening services; political campaigns; debt collectors and tracing agents; and, in several documented cases, government agencies purchasing data they would otherwise need legal authority to obtain.
Why it matters. Profiles built without your knowledge are used in decisions about you, are difficult to correct, and concentrate risk — a broker breach exposes information from thousands of sources at once.
What rights you have, where data protection law applies: the right to know what is held, to obtain a copy, to correct inaccuracies, to object to direct marketing, and in many cases to have data erased. These rights apply to brokers even though you never dealt with them, and using them is the only practical remedy.
Practical steps: submit access and erasure requests to the largest brokers; opt out of the open electoral register where that exists; decline loyalty and warranty data sharing; and limit tracking in browsers and apps.