What is a data broker — and how did they get my info?

Start with where the file comes from. Property deeds, voter rolls, court papers and business filings are public records. That is the skeleton. Public social profiles add the flesh: employers, photos, and the names of friends past and present. Shop data fills the gaps — loyalty cards, warranty cards, subscriptions, app data sold onward. Then comes the move that defines this trade. Brokers buy from each other. One good profile, resold through the network, becomes forty profiles on forty sites. That resale loop is why removal is never a one-shot job. It is the most important fact in this file.

How big is the network? Bigger than anyone can prove. But there is a floor on the public record. California's Delete Act makes data brokers doing business there sign up every year, and the state's 2025 registry lists 522 of them (read 19 Aug 2026). Vermont runs a second list. Most brokers appear on neither, because they sell to other firms and never trip a rule aimed at shoppers. The people-search sites — the ones that alarm you when you Google yourself — are only the tip you can see. The deeper market sells to marketers, recruiters, insurers, landlords, and anyone else who pays.

When this machine fails, it fails big. National Public Data was a background-check broker most Americans had never heard of. It was breached in 2024. Roughly 2.9 billion records, Social Security numbers included, went up for sale. The company collapsed into Chapter 11. The punchline landed a year later. California's privacy agency fined its parent company $46,000 — not for the breach, but for never signing up as a data broker at all (read 19 Aug 2026). A company holding two billion identity records had not filled in the form saying it existed. Hold that thought the next time a broker asks you to trust it.

A public profile with your address and your relatives on it is where a stalker starts. It is a shortcut for anyone who wants to post your details to a crowd. Add a leaked Social Security number and it is a thief's toolkit. Consumer Reports' researchers put it plainly. People-search sites, they wrote, “can pose a real danger by making it easier for stalkers or harassers to find and contact you.” They also help identity thieves, and show the world things you would rather keep private.

The Federal Trade Commission's recent case list shows where the bodies are buried. Kochava, sued in 2022, for selling exact location data. X-Mode and InMarket, under 2024 orders, for the same. Mobilewalla and Gravy Analytics/Venntel settled in December 2024 and were barred from selling sensitive location data. The claim was that they tracked visits to health clinics and places of worship (read 19 Aug 2026). In February 2026 the FTC warned 13 more brokers about selling Americans' data to hostile countries (read 19 Aug 2026). None of that is a small trade behaving well.

In March 2024, security reporter Brian Krebs revealed something about OneRep. It was a removal service, then built into Mozilla's privacy product. Its founder and chief had also started dozens of people-search sites, including the broker Nuwber (read 19 Aug 2026). The removal man owned the exposure business. Mozilla said it was “winding down” the deal. Then it kept selling OneRep for roughly sixteen more months, before finally cutting ties in December 2025 and refunding subscribers (read 19 Aug 2026).

It was not a one-off. Consumer Reports' investigators, in the study we take apart next, found money ties between people-search sites and removal services (read 19 Aug 2026). Sites were advertising the very services that charge to get you off them. The loop is real. Exposure breeds fear, fear breeds subscriptions, and at worst the same hands get paid twice.

This is why trust is a scored part of our scorecard, not a feeling. Who owns a service, what audits it has passed, and what has gone wrong before are all checkable. It is also why we recommend against OneRep, despite a fair price. The deal looks good. That is exactly when the file matters.

In August 2024, Consumer Reports published the first proper field test of people-search removal services (read 19 Aug 2026). The design was clean. 32 volunteers. Four months. 13 people-search sites, checked at one week, one month and four months. Researchers found 332 exposed listings for the 28 people put on seven paid services, costing $19.99 to $249 a year. The headline number: only 117 of those 332 listings — 35% — were actually gone after four months.

Then the awkward footnote. The few volunteers who skipped the services and filed the requests themselves did better than most paid options. Results swung wildly by company. EasyOptOuts ($19.99/yr) and Optery led. DeleteMe, IDX and Kanary landed in the middle. Confidently and ReputationDefender trailed. One detail we love as evidence people: half the volunteers lived in California, to test whether the country's toughest privacy law helped. It did not. New York volunteers, with no such law, got slightly more data taken down. A law on paper and a record off a website are different things.

Two fair caveats before anyone writes off the whole trade. First, the study came before real product changes. Several services have widened their lists and improved their checks since, and Incogni was not among the seven tested. Second, “did badly in four months” is not “useless forever”. The repeat-scan model exists because this is a war of attrition. But the burden of proof sits with the seller. That is why our scorecard weights proven removal — evidence a record is gone, not a count of requests sent — above any coverage claim.

That is the right lens for every marketing number here. “We cover 270+ brokers” is a claim about requests, not results. The counts do not line up between companies either. One counts a network of sites as one broker. Another counts it as thirty. Even careful reviewers mix “sites,” “requests” and “removals” inside one article. So when we score coverage, we first put every count on the same ruler. And when a company will not say what its number counts, the number does not count.

A serious removal service earns its $96–$249 a year four ways. Repetition: it scans and re-files against the loop that grows your profile back. That is the work you were never going to keep doing yourself. Reach: hundreds of brokers, the obscure ones that sell to firms included. Plus hand-done requests at the stubborn sites no robot can crack. Proof: reports, screenshots, dates and times — and, the thing the Consumer Reports study made non-negotiable, a clear view of what failed, not just what was asked. Escalation: for the high-risk cases — doxxing, stalking, harassment, or a public-facing job — plans with a real person on them, at $250–$500+ a year.

Three signs you have crossed from “free routes” into “pay for it”. Your details turn up across many sites. You know yourself well enough to admit the re-check will never happen. Or you have a real safety reason to want this cut back fast and kept down. If that is you, the money makes sense — if the service passes the five questions below.

1. Do they actually remove you, and does it stay gone? — 30%

Requests are cheap. Removals are the product. A profile that turns up again in March was never removed. What moves the score: proof a listing is gone, how often they check again, and whether they show you the failures. Outside audits and independent test results count too, where they exist. This is the part the Consumer Reports numbers hang over. A company that measures itself honestly here earns the benefit of the doubt everywhere else.

2. How many sites, and do they show proof? — 25%

How many brokers do they really reach, counted honestly? Three things move the score. A published list of the sites they cover. Counting the same way every time — a network is one site or thirty, pick one. And hand-done removals for sites not on the list. Plan limits and which countries they cover belong up front. A site they support is not the same as a site they have cleared. A marketing total with no list behind it moves nothing.

3. Can you trust them with your info? — 20%

You hand a removal service your most sensitive file. So it gets the same background check it runs on everyone else. What moves the score: who owns it and what they stand to gain, the privacy terms, and how much you sign away. Then how long they keep your data, how well they guard it, and whether they ask for more of your identity than the job needs. After OneRep, a service whose parent makes money from exposure fails this check before scoring starts.

4. Do they prove the work they did? — 15%

A paper trail you can follow, not a progress bar. What moves the score: direct links to the listings they took down, screenshots, dates and times, and a plain status for each site. Failures stay visible instead of being rounded away. And when a stubborn site says no, there is a clear path to a person who will push it higher.

5. Is it worth the price? — 10%

Money per listing actually taken down, not per bullet on a feature list. We price the plan that does your job, not the cheap teaser. What moves the score: what renewal costs, family options, hand-done removals, which countries are covered, and support. The study's best performer cost $19.99 a year. Its worst cost twelve times more. Price predicts nothing. That is exactly why we score it.

And one question with no percentage on it: what would you get for free? Every service here is buying you time, not access. The opt-out routes in Part five are open to you at no cost. A service earns its fee only if the hours it saves are worth more to you than the price.