Data Brokers Are Working on Borrowed Time

The data broker business has always relied on consumer silence. They built a business on the foundation of consumers having lives—and better things to do than worry about the latest digital innovations. That did not mean data brokers had consumer approval. 

The piñata filled with our data was the center of the big money fun for the data broker industry and it has been for almost three decades. But it no longer looks so festive to consumers. 

Welcome to payback part of the data broker story: consumer pushback on the personal information free-for-all. 

I know it sounds extreme, but this week’s episode of What the Hack really bolstered a suspicion I’ve had for a while now: A lot of people in the data economy are about to lose their jobs. 

Data Broker Wind Down?

The truth is the data broker industry has been working on borrowed time since the late nineties when it first started to be built in earnest. Rarely designed with consumer consent in mind—Seth Godin’s permission marketing being the best example of the right path summarily ignored—the sad but reasonable conclusion reached by most people was that there was nothing they could do about what was being done to their data, so they might as well live with it. 

That conclusion is changing. Not because people are learning something new, but because they’ve been living with it long enough and we’ve entered the “there ought to be a law” part of the data broker story.

My guest this week on What the Hack is Craig. He is 71, a former teacher turned contractor from southern Connecticut who can build anything. 

He is not on Facebook, not on X, just a little YouTube. He has never played a video game. He gets up early, still works hard, and has a chainsaw for every occasion, including a vintage 36-inch Homelite that was made right across the state line in Port Chester, New York, back when, according to Craig, Homelite was still a good brand. 

Craig knows his age, phone number, address and the value of his home are sitting on data broker sites for anyone to find. I pulled that data up on my phone while we were sitting in his house. Craig watched me, and was not surprised. He said he’d always thought it should be illegal. He also said he didn’t think there would ever be a law to protect him. So he lived with it.

And that’s the unwise calculation the data broker economy was built on, because unlike the tobacco industry that depended on ignorance of the risks, the data broker industry is relying on something more fickle: public opinion. 

Data Brokers Assumed Wrong

We’re talking about an entire industry that is built on an assumption that the gap between knowing something is wrong and believing you have the power to change it is insurmountable. That gap funded the targeting algorithms, the broker sites, the advertising networks, the entire invisible infrastructure of digital surveillance that now underlies most of what happens when you go online. It is a business model built on resignation, and resignation is not a permanent condition.

The tracking infrastructure that makes a fifteen-second personal information lookup possible was not built by villains. It was built by engineers solving immediate problems with no one looking ten years down the road and no one asking whether any of it should be regulated. 

The cookie, invented by Netscape engineer Lou Montulli in 1994, was designed to solve a simple UX problem: the web had no memory, and every time you visited a site it treated you like a stranger. The tracking pixel came shortly after, a transparent one-by-one image that your browser would fetch from a remote server, triggering a request that carried your identifying information with it. Neither technology was conceived as surveillance. Surveillance just turned out to be their value proposition, and there were no laws against it, and by the time the public understood what was happening the pop-up warnings were so relentless that people turned them off just to make the web usable. 

That is not consent. That is a slowly boiling frog hostage situation dressed up as a terms of service agreement. 

Data brokers were sort of inevitable in a world that was so wowed by the Internet that it didn’t ask enough questions about how it worked, and what its backend could be used for. Companies were started that just aggregated information created by the tracking infrastructure and started selling it. No questions. No real understanding of what it all meant.

What’s changing is not public awareness. Public awareness has been there for a long time. Maybe what is changing the tide here is the AI layer on top of all of it, which is making the consequences more personal and harder to ignore. 

Craig’s Fake Walmart Call

Nine hundred and nineteen dollars for a PlayStation5 and a 3D headset, targeting a 71-year-old man who has never touched a video game. Stupid. That was the call Craig got. It was almost certainly built from the same kind of data broker lookup I did in his living room. Age, location, phone number. Enough information to make the call worth making to a scammer with a script ready for the Craigs of the world. A charge for a PlayStation would feel wrong to him, wrong enough to make him press one. 

That is the data broker economy at street level, and more and more people are seeing it for what it is: a public hazard that should be illegal.

Craig thinks what’s being done with his data should be illegal, too. He is not an activist and he is not particularly angry about it in the way that people who write about data privacy for a living tend to be angry about it. He is practical. He looks at it the way he looks at a drainage problem or a bad foundation: something was built wrong, it has been causing damage for a long time, and it is going to have to be fixed eventually whether anyone wants to deal with it or not. 

The people whose jobs depend on the current arrangement have been assuming that the Craigs of the world would stay busy with their actual lives and leave the digital landscape alone. Craig is busy. He has blueberries to net and grandkids coming over and a canoe that needs restoring for the second time in sixty years. But busy is not the same as indifferent, and indifferent is not the same as okay with it.

Craig is not an outlier. He is the majority. And the majority has been quietly not okay with this for a very long time. California’s Delete Act is one sign of it. The bipartisan traction that data privacy legislation is finding in state houses around the country is another. The data broker industry has been treating consumer silence as a renewable resource for a long time. It isn’t.

What You Can Do about the Data Broker Problem

If this got your attention and you want to see where you stand, get the free scan at DeleteMe and while you’re at it go to haveibeenpwned.com and enter your email address. Then search your name on Spokeo or Whitepages and see what a data broker has assembled about you. Your age, your address, your phone number, your relatives, the value of your home — all of it pulled from public records that were never meant to be this accessible. Don’t be okay with that. 

It needs to be said here that you can opt out of data brokers individually, and you should, but the information comes back almost as fast as you can clear it because the underlying public records never go away and the scraping never stops. That’s what personal information removal services like DeleteMe exist to do: continuous, automated data broker removal that keeps your personal information off the sites that sell it. It’s not a permanent fix because there is no permanent fix, not without federal legislation that treats personal data the way we treat other things that belong to people. But it’s the difference between fighting this alone and not fighting it alone.

Craig scratched the location of his water shutoff into his lamppost so the next owner of his house would know where to find it. He built his drainage system himself. He solves problems that are in front of him and doesn’t spend a lot of time on problems that aren’t. The data broker economy has been counting on that. It shouldn’t anymore.

Learn more

• Learn more about online scams and how to keep yourself safe online.
• Read through our five-minute privacy tips to reduce your digital footprint. 
• Discover how to remove your info from the internet