Data Brokers Do Not Just Collect Facts — They Guess About You and Sell the Guesses

Data brokers do not only collect addresses and phone numbers; they also analyse that information and build guesses about people's health, finances and religious beliefs, and those profiles may be sold or shared with businesses the person has never heard of.

The companies use algorithms, compare records from different sources and sort people into categories that predict their interests, circumstances and behaviour. Some of those predictions may be wrong, while others could reveal sensitive details the person never intended to share.

The US Federal Trade Commission documented this practice years ago. Its investigation found that brokers combined information from multiple sources to infer sensitive characteristics, including income, religion, political views and health conditions.

Acxiom, a major data company, developed a segmentation system called PersonicX that grouped households into lifestyle categories. One documented historical category was called 'Rural Everlasting', which the FTC said described older adults with relatively low income and educational attainment. Other categories included 'Urban Scramble' and 'Mobile Mixers'.

The FTC also documented how companies used location information to create even more specific advertising audiences. InMarket offered audience categories such as 'Christian church goers', 'parents of preschoolers' and 'wealthy and not healthy'. The FTC subsequently restricted InMarket's use and sale of sensitive location data.

Oracle's BlueKai advertising business helped advertisers use extensive consumer data for targeting. Oracle shut down its advertising products in September 2024, but its history illustrates how sophisticated the industry became. A label does not have to be accurate to influence how a company views a person.

A major concern is that health-related classifications can originate outside the medical system. HIPAA protects health information handled by covered healthcare organisations and their business associates, but health-related information independently gathered or inferred by other businesses may fall outside those protections.

Searching for information about diabetes, for example, does not mean a person has diabetes; they could be researching the condition for a family member. Advertising systems may nevertheless use that activity as one of several signals when building a profile.

Financial categories have also been documented. In the Justice Department's case against Epsilon Data Management, federal prosecutors said the company used sophisticated modelling to identify consumers likely to respond to solicitations and sold information about more than 30 million Americans to operators of fraudulent schemes, including fake sweepstakes promotions. Epsilon agreed to pay $150 million as part of its deferred prosecution agreement.

The FBI reported that Americans age 60 and older lost approximately $7.7 billion to internet crime in 2025, up from $4.9 billion in 2024. Those losses were not all connected to data brokers, but the documented sale of targeted consumer lists shows how personal information can end up in the hands of fraudsters.