Are Data Brokers Legal? What the Law Actually Says
Reviewed by Jonah Whitfield, Investigations & Data Privacy
Key takeaways
- Legality depends on the jurisdiction, the broker's role, and the data involved; public availability is not a universal exemption.
- GDPR rights apply only where the law and its territorial rules cover the processing, and erasure has exceptions.
- California privacy rights have eligibility and statutory limits; a request is not a universal deletion order.
- Record the data, company, legal basis or response, and escalation route before treating a request as resolved.
Why Data Brokers Are Mostly Legal
Data brokers operate legally in most jurisdictions by relying on a combination of legal loopholes and permissive data frameworks. In the United States, there is no comprehensive federal privacy law that restricts how companies can collect, aggregate, and sell personal data sourced from publicly available records. Because voter registration, property records, and court filings are public by law, data brokers argue, often successfully, that they are simply providing a search service over data that anyone could find independently.
The aggregation problem, that combining multiple individually public pieces of information creates a revealing profile that no single public source would provide, is recognised by privacy scholars but has not yet been widely addressed in legislation. This legal grey area is the foundation on which the data broker industry operates.
What GDPR and UK Privacy Law Say
The GDPR, which applies in the EU and in the UK through the UK GDPR, provides the most comprehensive framework for data broker regulation. Under GDPR, individuals have the right to access personal data held about them, request corrections, and in many cases request erasure. Data brokers operating in Europe must honour these requests and cannot continue to hold data once a valid erasure request is submitted.
UK GDPR also requires data brokers to have a lawful basis for processing personal data. Legitimate interest is the most commonly cited basis, meaning brokers must assess whether their interest in processing your data overrides your privacy rights. This is a weighing exercise that privacy advocates argue most data brokers fail to conduct properly.
The US Legal Landscape
In the United States, data broker law is a patchwork of state-level legislation. California's CCPA and CPRA give residents the right to opt out of data sales and request deletion. Virginia, Colorado, Texas, and a growing number of other states have enacted their own privacy laws with varying rights and enforcement mechanisms. Vermont requires data brokers to register with the state and disclose what categories of data they collect.
The practical effect is that US residents in states with strong privacy laws have meaningful opt-out rights, while those in states without privacy legislation have limited formal recourse. Federal privacy legislation has been debated for years but has not yet passed, making state-level protections the most relevant framework for most US residents today.
Does a public record make every broker use lawful?
No. A record being publicly accessible does not by itself answer whether a company's collection, matching, sale, or use complies with privacy, consumer-protection, or sector-specific law. Consider the whole processing chain and the purpose for which the information is used.
Separate the source record from the searchable profile. A property filing may be public, while combining it with contact details and family relationships creates a more revealing profile. Identify which entity controls each copy before choosing a remedy.
What does GDPR actually let a person request?
The GDPR gives covered people rights including access, rectification, erasure in certain circumstances, and objection, but these are not unconditional commands to delete every record. The controller must assess the request against the applicable provisions and exceptions.
A useful request names the specific data and explains the right relied on. Ask for confirmation of what was done and retain the answer. For a disputed or unanswered request, consult the relevant supervisory authority's official guidance rather than assuming a particular deadline or outcome.
How should a US resident assess state protections?
State privacy laws differ in who is covered, which businesses are covered, and what opt-out or deletion rights apply. California's CPPA explains consumer rights and how to exercise them; other states may define terms and exceptions differently.
Check residency, business applicability, and the kind of processing at issue. A broker may also be subject to narrower laws such as those governing credit reporting or regulated records, so the label 'data broker' alone does not settle the analysis.
What is a practical way to act without overclaiming?
Treat a privacy right as a process: identify the controller, submit a focused request, save evidence, and review the response. Do not assume that removal from a public-facing search page deletes source records or copies held by unrelated companies.
For personal safety, reduce exposed listings while keeping a separate record of public-record sources that may require a different legal or administrative route. This is general information, not legal advice; seek qualified advice for a contested or high-impact matter.
At a glance
| Situation | Potential route | Important limit |
|---|---|---|
| Searchable broker profile | Applicable privacy-law access, deletion, or opt-out request | Coverage and exceptions vary |
| Incorrect personal detail | Rectification or correction request | Identify the controller and exact error |
| Public government filing | Agency-specific suppression or confidentiality process, if available | A broker opt-out does not change the source |
| Disputed processing | Documented complaint to a competent regulator | Jurisdiction and regulator remit matter |
Evaluate a broker's legal position
- Identify the operator and the particular profile or processing purpose.
- Record your location, the data shown, and where the listing links back.
- Check the official privacy law and regulator guidance applicable to you.
- Submit a narrowly framed request and retain its confirmation and response.
- If unresolved, use the regulator's complaint route or obtain legal advice.
Frequently asked questions
Does publicly available mean free for any use?
No. Public accessibility does not automatically remove privacy, consumer-protection, or purpose limits.
Can I demand erasure in every GDPR case?
No. Erasure is subject to conditions and exceptions in the GDPR.
Does one opt-out erase the original public record?
Usually the request concerns the responding service; the source agency and other copies require separate consideration.
Sources
Related privacy guides
- how removal requests are handled
See the service process separately from legal rights; a service process is not a promise that every record can be removed.
- review available service plans
Compare whether managed broker removals suit your needs after checking which rights and sources apply.
- review broker coverage
Check the listed site scope, while remembering coverage does not determine a broker's legal obligations.
- more privacy-law and broker guides
Use related guides for practical context, not as a substitute for jurisdiction-specific legal advice.
- compare privacy-rights frameworks
Read the companion overview for a practical comparison of GDPR and California consumer rights.
More on Privacy & Regulation
- Your Rights Under GDPR and CCPA: A Complete Guide
Privacy regulations give you powerful tools to control your personal data. Learn what rights you have under both GDPR and CCPA, and how to exercise them effectively to force companies to delete your information.
- New Privacy Laws in 2026: What Changed and What It Means for You
Several US states passed new privacy legislation this year, and the EU is tightening GDPR enforcement. Here's a breakdown of the most important changes and how they affect your data rights.
- How to Stop Data Brokers Legally
About the author
European Privacy & Regulation. Theo covers privacy law and regulation, including how evolving rules affect people’s rights and the ways organizations handle personal data.