Where your data really goes after a broker buys it

We've all probably seen, read and heard dozens of commercials and articles that say the same thing: data brokers collect your information and sell it. That is a story you are hearing so that you can be sold something, the data broker isn't the destination of your data. Data brokers are essentially just middle-men for data. The whole idea behind their business is to sell the data onward, to people who will actually use it, not just hoard it. Once the data is in their hands though, it can be sold to almost anbody.

Let's talk about the part that nobody really shows you. Where does the data go? Who buys it? And, what do they do with it once they do have it?

What are they even holding?

A serious, industrial-scale data broker doesn't simply just hold your email address and some basic "harmless" information, but that's what most people think it is. The US Federal Trade Commission spent two years looking inside the data broker industry, and in its 2014 report on data brokers (yes, that's 11 years ago- think about how far it has come now), it found companies holding billions of individual data points, on nearly every adult in the country, most of whom had literally never heard of the data brokers. Names, address, every address which you had ever lived in. An estimate of your income, whether you have children, what you're interested in, what you shop for. And even more so, and the one which is genuinely concerning: your own personal phone's geolocation.

Most of this data collection starts with your own accounts. The old forum you signed up to at fourteen, with your real name. A shopping website where you delivered items to your physical address, an app which you share your location to, and forgot about. These are tiny examples, and for most people, there are dozens and dozens of services collecting data on them, 24/7. Each one compounds on the other, and it builds a very accurate picture of your entire life, all in one file, ready to be sold.

Then it gets sold

But here is the uncomfortable part of it all, once a data broker has a file about you, the buyer could literally be anyone with money and a reason. In the end, it is a lot broader than just "advertisers".

Advertisers and the companies that want to target you

You are already expecting advertisers to buy the data, so this part isn't anything groundbreaking. Your interpreted profile is used to sort you into classifications of people, like "buckets", and sell you things, and follow you across the internet while doing it. It is annoying, mostly harmless on its own, you might lose some money from temptations that match your desires. But in reality, it's the unsuspecting start of where your privacy is lost.

Anyone who wants to know where you physically are

You might be wondering how they even get your location in the first place. When a weather app, a game or a map asks to see your location and you press "allow", most people assume that only that app gets to see it, which makes sense. But a lot of these apps quietly sell your location data on to data brokers without making it obvious to you, and then the brokers can sell it on to whoever they want. So you only said yes to one app, but your location ends up getting passed around to people you never agreed to give it to.

In 2024 the FTC took action against a handful of location data brokers, and some of what came out of it is pretty disturbing. One of them, Mobilewalla, was accused of having location data so precise that it could literally pick out the nurses who worked at one specific hospital, follow where they went home to, and then hand that list to a rival employer so they could go and try to poach them. That's somebody being able to work out where you work and where you live, just from the data your phone gave away, which sounds obvious but most people share their location with dozens of apps and services, and would never bat an eye.

That is only one buyer with one idea, which we only know about because a regulator happened to catch it. If somebody has a map of everywhere you go, they can see who you visit, what clinic you go to, whether you've been seeing a lawyer, and which house you leave from every morning. There's most likely dozens of other buyers we will never hear about, and they are all getting the exact same data no matter what they want to use it for.

The FTC also went after Gravy Analytics and Venntel that same year, over location data which showed people visiting reproductive health clinics, places of worship and other sensitive places. Before that, back in 2022, they had already sued Kochava for something very similar. These are actual companies doing just this, that's how they make money, and it got big enough that data regulators had to get involved.

Gov. and Police buying around a warrant

Something a lot of people do not know is that the police usually cannot demand your exact location without getting a warrant first, but in some cases they're able to just straight up buy it from a data broker instead. The Electronic Frontier Foundation has documented how location data goes from apps, to brokers and then to the police, and it took federal action in 2024 before anything actually started being done about it. So the protection which you'd expect to have, does not really count anymore, if they can just pay for the data instead.

People-search sites

A lot of this data also ends up on people-search sites, where anyone can type in your name and find out your age, the addresses you've lived at, who your relatives are, your phone number, and your email address, all for a few dollars (or in some cases for free). There is not really a "buyer" anymore at that point, it is just whoever wanted to look for it, which could be your ex, somebody who has been stalking you, and often just somebody who didn't like something you posted online. Honestly we think this is the biggest risk out of all of them, and it is the one that most of the "data brokers exist" articles don't ever really get to.

Your old accounts are the supply

But why is this important when it comes to removi? All of this starts with your data being collected somewhere, and a lot of it gets collected through accounts you signed up for years ago and have not thought about since. Every old account you have is another company with a copy of your details, and each of them has their own privacy policy, their own data breaches and their own reasons to sell it. You cannot get your data back from every company that's already bought it, nobody can do that, but you can stop it where it starts by getting rid of those accounts.

You can start doing this today, by yourself, it is free. Look up how to delete your Facebook account that you do not use anymore, your old Amazon account, that dating profile you made and forgot about with your full name, general location, or a shopping site you only used once but has your address. Every account you delete your data from is one less company that has your data to sell. It does take a while, and a lot of sites hide the delete button on purpose, but it works.

That is why we made removi. Instead of having to look up how to delete every single account yourself, it automatically finds the accounts that are linked to your email and deletes them for you, so theres less places your data can spread from in the first place. You can't undo the data that's already been sold, but you definitely can make it a lot harder for them to get any more of it, all while protecting your own digital footprint.

Sources: the FTC's 2014 data broker report, its 2024 actions against Mobilewalla and Gravy Analytics, the earlier Kochava suit, and the EFF's 2024 review of the location-data-to-police pipeline.