The unsettling thing about a data broker is that you may never have visited its website.
You may never have installed its app.
You may never have created an account.
The broker can still have a file about you.
That is possible because the business model begins where many of the previous Surveillance Economy articles end: somebody else already collected the fragments.
The FTC documented the assembly line years ago
The Federal Trade Commission’s major 2014 report on data brokers found that brokers obtained information from commercial sources, government records, publicly available sources, websites, and other data brokers. The report said the companies studied combined small pieces from many places into much more detailed composite profiles.
See the FTC’s Data Brokers: A Call for Transparency and Accountability and the agency’s summary of its findings.
The FTC found that brokers could collect purchase information, browsing activity, warranty registrations, public records, and other everyday data. It also found that brokers frequently bought information from other brokers, making the original source difficult for a consumer to reconstruct.
That structure remains important even as the specific companies and technologies change.
The value comes from combination
Suppose five separate systems know five separate things:
- a retailer knows what you bought,
- a public record contains an address,
- an advertising system knows what device visited certain sites,
- a location provider has observations tied to an advertising ID,
- a people-search service has old phone numbers and relatives.
None of those datasets necessarily contains a complete person.
A broker’s value comes from matching them.
Names, addresses, emails, phone numbers, device IDs, household identifiers, probabilistic matches, and other linking fields can turn fragments into a composite.
Combination also combines errors
Profiles do not become true merely because they are large.
A broker can inherit an outdated address from one source, a mistaken household member from another, a purchase made for somebody else, or a device incorrectly assigned to the same person.
Once records are merged, the error can become part of a more authoritative-looking profile.
The FTC’s consumer guidance on people-search sites notes that these services may compile information from other brokers, public social-media profiles, and federal, state, and local public records. See What To Know About People Search Sites That Sell Your Information.
Direct consent can disappear several hops ago
A person may have knowingly given an address to a retailer or installed an app with location permission.
That does not mean the person understands every later broker-to-broker transfer.
The FTC’s 2024 X-Mode/Outlogic case is a concrete example of location data moving through an ecosystem that included third-party apps, SDKs, aggregators, and hundreds of clients. See the FTC’s final order announcement.
This is where the Surveillance Economy stops looking like one tracker following one browser.
The final profile may be assembled by a company the person has never heard of, from records created by companies that never saw the final profile.
No single source has to know everything.
The broker’s product is knowing how to put the pieces together.