Data Broker & Privacy Glossary

A company or site that pulls data from many separate sources — public records, marketing lists, other brokers — and merges it into a single profile per person. Most people-search sites are aggregators rather than original data sources.

A report compiling someone's public and semi-public records — criminal history, addresses, court records, employment, and more — usually sold by a data broker or consumer reporting agency.

A company that regularly assembles consumer information into reports used for credit, employment, tenant screening, or insurance decisions, and is therefore regulated under the FCRA.

A company that collects personal information about consumers — often without directly interacting with them — and sells or licenses it to other businesses, advertisers, or the public.

Automatically extracting data from websites or public databases at scale — a common way people-search sites and brokers build their profiles.

A U.S. federal law that regulates how consumer reporting agencies collect, share, and allow correction of information used for credit, employment, tenant, or insurance decisions.

A website — Whitepages, Spokeo, BeenVerified, MyLife, and similar — that lets anyone search for a person's name, address, phone number, relatives, and other details, usually compiled from public records and broker data.

Under the FCRA, a legally allowed reason — like an employment or credit decision — for pulling someone's consumer report. Without one, a CRA can't legally release the report.

Government-held information that's legally open to the public, such as property deeds, court filings, voter registrations, and business licenses — a major raw-data source for brokers.

A search that starts from a phone number or address and returns the associated person's identity and other details.

Investigative techniques — often using broker and public-record databases — to locate a person who has moved, is avoiding contact, or is otherwise hard to find.

When a company shares or sells personal data it collected to another company — how much broker data originates from everyday apps, loyalty programs, and websites.

Public records of registered voters — name, address, and in some states party affiliation — that many brokers scrape as a core data source.

A publicly listed phone number and address associated with a name, historically from printed phone books, now aggregated online.

A California law giving residents rights to know, delete, correct, and opt out of the sale or sharing of their personal information held by businesses.

A 2023 amendment that expanded the CCPA, added a new "sensitive personal information" category, and created the California Privacy Protection Agency to enforce it.

The organization that decides why and how personal data is processed (GDPR terminology).

An organization that handles personal data on behalf of a data controller, without deciding the purpose of the processing (GDPR terminology).

The individual a piece of personal data is about — GDPR terminology, roughly equivalent to "consumer" in U.S. privacy law.

A formal request from an individual asking a company to let them access, correct, delete, or export their personal data.

Data that has had identifying details removed or altered so it can no longer reasonably be linked back to a specific person.

The EU/UK's comprehensive data protection law, giving individuals rights like access, correction, deletion (the "right to be forgotten"), and portability over their personal data.

A consent model requiring someone to actively agree before a company can process their data for a given purpose.

A consumer's right to tell a business to stop a specific data practice — most commonly, stop selling or sharing personal data, or remove a listing.

Any information that identifies, relates to, or could reasonably be linked to a specific person — names, addresses, emails, device IDs, location history, and more.

A narrower, more U.S.-specific term for data that can directly identify an individual — name, SSN, driver's license number, and similar. Often used interchangeably with "personal information," though legal definitions vary by law.

The right to find out what personal data a company holds about you and how it's used.

The GDPR-rooted right to have personal data erased when it's no longer needed, consent is withdrawn, or it was unlawfully collected. U.S. law generally frames the equivalent as a narrower "right to delete."

The right to have inaccurate personal data fixed.

The right to have a company delete personal data it holds about you, subject to certain legal exceptions.

Under laws like the CCPA, exchanging personal data for money or other valuable consideration — a practice that triggers opt-out rights.

Higher-risk data types — Social Security numbers, precise geolocation, health data, race, sexual orientation, biometric data — that get extra legal protection under the CPRA and GDPR.

A CCPA/CPRA-specific term for sending personal data to third parties for targeted-ad purposes, even without a sale — also covered by "do not sell or share" opt-outs.

A company — like DelistMyData — that submits and manages opt-out requests to data brokers on a person's behalf, so their listings get taken down.

The specific opt-out link or request required under laws like the CCPA that stops a business from selling — or, since the CPRA, sharing — a person's data.

A browser or extension signal that automatically communicates an opt-out-of-sale/sharing preference to every site visited, recognized as valid under several state privacy laws.

Step-by-step instructions for removing a specific data broker's listing of you — what page to use, what info to submit, and how long it takes.

The actual submission — form, email, or letter — asking a broker to remove a person's listing or stop selling their data.

When a removed profile reappears on a broker site later, because brokers re-scrape sources or buy data from other brokers. It's why removal usually needs ongoing monitoring, not a one-time request.

The broker's acknowledgment — email, screenshot, or status page — that a listing has actually been taken down, used to verify an opt-out worked.

An internal list a broker maintains of people who opted out, meant to block their data from being re-added — though enforcement varies a lot broker to broker.

The identity-check step — email confirmation, ID upload, and similar — a broker may require before processing an opt-out or access request, to prevent someone else from removing (or fraudulently keeping) your data.

A free lock on your credit report that blocks lenders from accessing it, preventing new accounts from being opened in your name.

A service that scans hacker forums, breach dumps, and dark-web marketplaces for your personal information — emails, passwords, SSN — and alerts you if it turns up.

An incident where personal data is accessed, stolen, or exposed without authorization — often the source of information later sold or leaked and absorbed into broker and aggregator databases.

Publishing someone's private or identifying information online — often pulled straight from people-search sites and data brokers — usually to harass, intimidate, or endanger them.

A free flag on your credit file that requires lenders to take extra steps to verify your identity before extending new credit.

Using someone else's personal information without permission, typically to commit financial fraud, open accounts, or impersonate them.

A scam that uses fake emails, texts, or sites to trick someone into giving up personal information or credentials. Broker-sourced data (name, address, employer) is often used to make phishing messages more convincing.

Manipulating a person — rather than hacking a system — into revealing information or taking an action that compromises their security.

Faking the phone number or identity displayed to a call or message recipient, often paired with broker-sourced personal details in scam calls.

Falsely reporting an emergency at someone's home to trigger an armed police response, typically enabled by doxxing that reveals the victim's real address.