How Data Brokers Work and Why You’re Already on Their Lists

If you’ve ever wondered how a company you’ve never contacted somehow has your email address, your phone number, or your home address, the answer is almost always the same: a data broker sold it to them. It’s one of the largest, least understood industries connected to the modern internet, and most people interact with its consequences daily without ever learning the term.

What a Data Broker Actually Is

A data broker — sometimes called an information broker — is a company that collects personal information from a wide range of public and private sources, then compiles, analyzes, and sells that information to other organizations. The National Cybersecurity Alliance describes them plainly: data brokers gather information about people, analyze and organize it, and sell it to other organizations, typically for marketing purposes, compiling everything from basic contact details to extremely detailed personal profiles.

The defining characteristic, and the part that surprises most people, is that data brokers have no direct relationship with the people whose data they collect. You never signed up for anything with most of the companies that now hold your information. They built a profile on you using whatever they could legally — and sometimes not so legally — gather, then sold access to that profile to whoever was willing to pay.

How Your Information Gets There in the First Place

Data brokers pull from a surprisingly broad set of sources, and most people are only aware of a fraction of them. Proton’s privacy research breaks the collection methods into several categories: public records like property ownership and court documents, online activity including web tracking and social media scraping, retail and loyalty program data, mobile app and location data, and information purchased directly from other companies — including credit bureaus, financial institutions, and other data brokers themselves.

That last category is worth pausing on, because it explains why opting out of one broker rarely solves the problem. Industry analysis tracking over 500 active data brokers confirms that brokers systematically purchase data from each other — your profile at one company may include data originally collected by a dozen other companies that sold enrichment packages. The data doesn’t just get copied once. It compounds across an entire ecosystem of buyers and resellers.

The Pipeline From Your Website to a Broker’s Database

The path from a publicly displayed email address or phone number to a data broker’s resale database follows a consistent pattern, even though dozens of different companies sit at different points in it.

• 1
  CollectionAutomated scraping tools — the same category of harvesting bots that target contact pages — crawl websites and extract any contact information they find in the raw HTML.
• 2
  AggregationScraped data gets combined with information from public records, commercial transactions, and purchases from other brokers — building a far more detailed profile than any single source could provide alone.
• 3
  CategorizationBrokers sort aggregated profiles into marketable segments — by industry, by inferred interests, by estimated income — making the data more valuable to specific types of buyers.
• 4
  Resale & Cross-SaleThe finished profile is sold to advertisers, marketers, insurers, and — critically — to other data brokers, who fold it into their own databases and resell it again under a different name.

This is the same fundamental mechanism described in how email harvesting actually works — the harvesting bot is simply the collection step of a much larger industry that exists specifically to monetize exactly this kind of data.

Why a Small Business Website Is a Real Target, Not an Edge Case

It’s tempting to assume data brokers are mainly concerned with consumer data scraped from social media or harvested from large breaches — and a great deal of their volume does come from exactly those sources. But a business’s own public-facing website, including its WordPress contact page, footer, and About page, is a legitimate and ongoing contribution to the same pipeline. Every business email address, phone number, and physical address displayed in plain HTML is a data point a scraping tool can collect just as easily as a consumer’s social media profile.

The consequences compound specifically because business contact information tends to be stable and well-indexed. A business owner’s email or phone number, once scraped, doesn’t disappear when the page is updated — copies have already propagated through however many brokers purchased that specific scrape before any change was made. A WordPress contact page being treated as a spam magnet isn’t a separate phenomenon from data brokering — it’s the most visible downstream symptom of the exact same underlying collection process.

Why Opting Out Afterward Is So Difficult

The honest reality is that once your information has entered the data broker ecosystem, getting it back out is slow, repetitive, and never fully permanent. Privacy Rights Clearinghouse documents that even California’s new Delete Act and DROP platform — the most comprehensive regulatory deletion mechanism to exist so far — only requires brokers to process deletion requests starting August 1, 2026, and only covers brokers registered in California. Outside that narrow scope, removal still typically means contacting each of potentially thousands of individual brokers separately, verifying your identity to each one, and repeating the process indefinitely as brokers continue collecting new data from ongoing online activity.

The Case for Stopping the Scrape, Not Just the Resale

Given how difficult and incomplete after-the-fact removal genuinely is, the more effective intervention point is the one most advice skips entirely: preventing the scrape that feeds the broker pipeline in the first place. If a harvesting bot never successfully extracts your business’s email address or phone number from your WordPress site, there’s no initial data point for any broker to acquire, resell, or cross-sell to a dozen other companies down the line.

This is the specific gap WhoKnew Shield™ is built to close. Rather than focusing on what happens after data has already been sold — which is the limited, recurring battle every after-the-fact removal service is fighting — Shield combines dual-layer obfuscation with active bot detection that catches scraping tools at the collection step itself, before any data point has a chance to enter the broker ecosystem at all.

Who knew the company that somehow has your email address probably never visited your website at all — they just bought it from someone whose bot did.