Data Brokers & People-Search Sites

A company that collects information from many separate sources and combines it into a single profile. Aggregation is what turns harmless individual records into something sensitive: your name on a property deed, your number in a marketing list, and your relatives in a voter file are each unremarkable alone, but merged they become a map to your household.

Most people-search sites are aggregators rather than original collectors — they rarely gather anything firsthand. That matters when you opt out: removing your profile from an aggregator does not remove the underlying records from the sources it pulled from, which is why listings so often reappear after the next data refresh.

Full explainer: How Do Data Brokers Get Your Information? Inside the Data Broker Supply Chain →

A report compiled about a person, typically covering criminal records, employment, education, and address history.

The distinction that matters legally is purpose. When a background check is used to decide about employment, housing, credit, or insurance, it is a consumer report under the FCRA, and the company producing it is a consumer reporting agency with real obligations: accuracy procedures, dispute rights, and adverse-action notices. Many consumer-facing "background check" sites explicitly disclaim FCRA use precisely to avoid those duties — selling a similar-looking report with none of the accountability, and no obligation to fix it when it is wrong.

A company that regularly assembles consumer information into reports used for credit, employment, tenant screening, or insurance decisions, and is therefore regulated under the FCRA.

The three national credit bureaus are the best-known CRAs, but the category also covers tenant screening, employment screening, and insurance claims databases. CRA status carries duties: reasonable procedures to ensure accuracy, a free annual file disclosure, and an obligation to investigate disputes. It is also why most people-search sites insist they are not CRAs — that disclaimer is what lets them sell profiles without accuracy obligations or any dispute process.

A company whose business is collecting personal information about people who are not its customers, then selling or licensing it to others.

Brokers rarely interact with the people they profile. They buy public records in bulk, purchase marketing data, scrape the web, and license from other brokers, then resell the combined result. Several states now require registration: California and Vermont both maintain public registries, and California's Delete Act obliges registered brokers to honour deletion requests filed through its DROP portal. Those registries are the only comprehensive public lists of which companies hold data about you.

Full explainer: How Do Data Brokers Get Your Information? Inside the Data Broker Supply Chain →

Automated extraction of information from websites, usually at scale.

Scraping is how much of the people-search industry acquires social profiles, directory listings, and public-record portals that offer no bulk download. Its legality is unsettled and fact-specific: scraping publicly visible pages has survived several US court challenges, while scraping behind a login or against a site's terms of service is considerably riskier. For an individual, the practical consequence is simple — assume anything visible without an account has been collected, and remember that deleting a profile later does not retrieve the copies already taken.

The 1970 federal law (15 U.S.C. § 1681) governing how consumer reporting agencies collect, share, and use consumer information.

The FCRA gives you the right to see your file, dispute inaccurate entries, and be told when a report was used against you. It also limits who may obtain a report and for what — see permissible purpose.

Crucially, the FCRA applies only to consumer reports. Marketing profiles and people-search listings generally fall outside it, which is why an error on a people-search site carries no dispute right the way a credit report error does.

A consumer-facing website that lets anyone look up a person by name, phone number, or address and returns a compiled profile — typically current and past addresses, phone numbers, approximate age, and relatives, free and without an account.

These sites are the visible storefront of the broker industry; most are aggregators reselling data acquired elsewhere. They are also the usual starting point for doxxing, because they require no payment and no stated reason. Nearly all offer an opt-out, though the process is frequently made awkward on purpose.

Under the FCRA, the specific reasons someone is legally allowed to obtain a consumer report: extending credit, employment screening, tenant screening, insurance underwriting, a court order, or your own written authorisation.

Curiosity is not among them. Obtaining a consumer report without a permissible purpose is a federal violation. But the concept only bites where the FCRA applies — which is exactly why people-search sites disclaim consumer-report use. A profile sold as "not for FCRA purposes" can be bought by anyone, for any reason, with no purpose stated at all.

Government-held records open to public inspection by law: property deeds, court filings, marriage and divorce records, business registrations, professional licences, and in most states voter rolls.

Public records are the foundation of the data broker industry. They were opened for accountability reasons in an era when inspecting one meant physically visiting a courthouse — a friction that provided practical obscurity. Bulk digital access collapsed that. This is the hardest category to remove yourself from, because the records are lawfully public; the realistic goal is limiting what your future filings expose.

A search that starts from a phone number — or an address or email — and returns the person associated with it, rather than the other way round.

It matters because it breaks the assumption that giving out a phone number reveals only a phone number. A number handed to a retailer, typed into a form, or used for two-factor authentication can be resolved back to a name, a home address, and a list of relatives. Most people-search opt-outs suppress reverse lookups as well, but you generally have to opt out separately for each number you have used.

The practice of locating someone who cannot be found at their last known address — originally developed for debt collection, process serving, and bail recovery.

Skip tracers combine credit header data, utility connections, address histories, and relatives' records. The techniques and underlying sources are largely the same ones people-search sites now resell to the general public. The difference is accountability: a licensed skip tracer works under professional obligations and for a stated purpose, while the retail version of the same capability has neither.

Passing personal information to a company other than the one that collected it.

Most privacy laws distinguish sharing from selling, and most consumer confusion lives in that gap. Data transferred for "business purposes" or to "service providers" often falls outside the legal definition of a sale, so opting out of sales may not stop it moving. California's CPRA added a separate right to opt out of sharing for cross-context behavioural advertising precisely because the sale-only framing left such a large hole.

State-maintained records of registered voters, typically including name, residential address, party affiliation, and voting history — meaning whether you voted, never how.

Availability varies enormously. Some states sell the full file to anyone who asks, others restrict it to political committees, and many permit confidential status for survivors of stalking or domestic violence. Voter files are a favoured broker input because they are current, address-verified, and cover most adults. Address confidentiality programmes exist in a majority of states but are rarely advertised — check your own state's rules.

A published listing pairing a name with a phone number and address, descended from the printed telephone directory.

The print original was opt-out by request and limited to landlines. Modern directory sites carry the name but none of the constraints: they aggregate mobile and VoIP numbers, previous addresses, and relatives, with no annual publication cycle to wait for. Being unlisted with your phone carrier does not remove you from these sites, because they no longer source from carriers — you have to opt out of each site directly.