How data brokers are selling your personal information—and how to stop them

Data brokers are profiting from your personal information—without your consent. These companies collect as much data as possible from your online activity and package it into detailed profiles. Then, they sell these profiles to advertisers, people-search sites, and even unknown third parties.

If you’ve visited a website, downloaded an app, or used social media, you’ve already been targeted. The more information data brokers collect, the less private your life becomes—online and in real life. This also increases your risk of identity theft and financial fraud. Once your data is out there, getting it removed can feel impossible. But it isn’t.

While you can’t erase your digital footprint entirely, you can stop data brokers from accessing your information and remove existing data from the internet. This guide will show you how—and introduce tools like ExpressVPN’s Data Removal feature to make the process easier.

What are data brokers and how do they work?

Data brokers collect as much personal information about you as they can and sell it to advertisers, research companies, and anyone else willing to pay. They don’t always play fair. Some buy data directly from businesses like retailers or subscription services. Others scrape social media platforms, public forums, e-commerce sites, search engines, and websites for any useful details.

Once they’ve gathered enough information, they build a detailed profile about you. These profiles are then sold or licensed to third parties.

Two of the most common buyers are advertising agencies and people-search websites:

• Advertising agencies use data to recommend products, send email offers, or target you with personalized ads.
• People-search websites let anyone look up your personal details, like your address or phone number, often without your knowledge.

The profiles data brokers sell often include a surprising amount of sensitive information, like:

• Your full name and birth date
• Physical address and phone number
• Email address and shared social media activity
• Credit information, criminal records, and even property ownership details

The risks of data brokers selling your information 

Data brokers make money by gathering and selling your personal information, but the risks for you are much greater than just losing a bit of privacy. When your data is out there, it can lead to real-world problems, including:

1. Identity theft and financial fraud

The more data brokers know about you, the easier it becomes for scammers to impersonate you. Details like your full name, address, birth date, and credit information are enough for criminals to open fraudulent accounts or take out loans in your name. Fixing these issues can take months—or even years.

2. Targeted scams and phishing attacks

Scammers use the information sold by data brokers to craft personalized scams. For example, they might send fake emails that look legitimate because they include your name, address, or other personal details. These tailored scams can trick even the most cautious people into clicking harmful links or sharing sensitive information.

3. Unwanted contact and harassment

When your personal information is sold to people-search websites, anyone can easily find your phone number, email address, or even your physical location. This can result in endless robocalls, spam emails, or, worse, harassment from strangers.

4. Stalking and safety risks

Having your address and contact details available online isn’t just annoying—it can be dangerous. If the wrong person accesses this information, your physical safety can be at risk. This is especially concerning for people with public-facing jobs or those dealing with personal safety concerns.

5. Loss of control over your personal data

Once your data is sold, it’s nearly impossible to track where it’s gone or who has access to it. Even if you manage to remove it from one site, it could still be floating around on others. This loss of control leaves you vulnerable to future breaches or misuse.

How to stop data brokers and protect your privacy 

Taking control of your personal data might feel overwhelming, but there are practical steps you can take to reduce your exposure and protect your privacy. Data brokers rely on easy access to information, so the key is to make their job as difficult as possible. Here’s where to start:

Use a VPN

Installing and using a VPN is one of the easiest ways to stop data brokers from accessing your online information. VPNs encrypt your traffic and hide your true IP address to help prevent tracking and data theft. When looking for a VPN, avoid services that don’t have proven no-logs policies, or you may still end up sharing your data.

Some untrustworthy VPNs collect information about what you do online and sell it to third parties. A no-logs VPN, like ExpressVPN, is vital to protecting your online data. It ensures that not even the VPN collects information about your online activity. That way, you know what you do online stays private, including sites you visit, account information entered, purchase patterns, and everything else.

ExpressVPN uses best-in-industry encryption to scramble your data, making it useless to data brokers. It also has apps for all major operating systems, so you can cover your mobile and desktop devices. That way, you have online data protection anywhere—even on the go.

Get ExpressVPN

Read the fine print

It may seem boring, but reading an app or website’s privacy policy and data collection practices, and reviewing permissions requests before you sign up or download any software, goes a long way toward avoiding unnecessary data sharing.

Keep an eye out for any shady permission requests, like a word game app that asks for access to your camera or a website you’re visiting for the first time requesting to send notifications. If any app or website permission request seems suspicious, don’t allow it or revoke the permission in app settings.

Privacy policies and data collection practices often contain details about your data removal rights and links to any forms you’ll need to request data removal. Taking a few moments to review these policies can help you avoid sharing more than you intend to.

Limit data sharing

Social media platforms are a data broker’s dream. People post information about their high school, hometown, spouse, job, relatives, email addresses, phone numbers, and hundreds of photos on these platforms. If you want to share this information with friends and family, use social media privacy settings to limit access.

Updating your settings can stop strangers from viewing your personal profile data, but some details—like your name, profile picture, and cover photo—may still be public. While privacy settings help, limiting what you post online is the best way to protect your data.

Ways to remove your data from the internet

Even if you’re careful about what you share online, chances are your personal information is already floating around on data broker sites. The good news is that you can take steps to regain control. By removing your information from the internet, you can reduce your exposure to scams, identity theft, and privacy risks. Here’s how:

Delete old accounts

Don’t keep any online account you’re not using open. While not every platform allows you to delete your profile completely, most popular email, social media, and e-commerce sites offer the option. If you can’t delete the account, deactivate it and remove any sensitive personal data.

Old accounts can be tricky to access, especially if you’ve forgotten your login details. Try contacting the customer service helpdesk to have your account deleted. Ironically, you may need to provide some identifying information to verify your identity before they process your request.

Make a direct request

Requesting data removal directly from websites or services can be time-consuming, especially if they don’t make data removal rights easy to find. Some platforms provide data removal forms, but these can be complex, and you may need to follow up to ensure the data is actually removed.

You can also send do-not-track requests to search engines and websites. However, it’s worth noting that these requests aren’t legally binding in many cases, so compliance isn’t guaranteed.

Use an online data removal service

The easiest way to remove your data from the internet is an online data removal service. These services send opt-out and deletion requests to data brokers and people-search sites on your behalf, taking the time-consuming process off your hands. When data brokers and people-search sites expose your data, your risk of identity theft, phishing, robocalls, and cyberattacks increases.

Using a data removal service helps you avoid these risks and decreases the amount of unwanted offers you receive via phone, text, email, and social media. Information the service removes may include physical address, phone numbers, and email, as well as birth, financial, and criminal records. It also saves you time and ensures the process is done correctly.

While free data removal services might seem like a good option, many collect and share your personal information with affiliates or third parties, effectively adding to the very problem you’re trying to solve. Choosing a trusted service ensures your privacy is truly protected.

ExpressVPN’s Data Removal feature, part of the Identity Defender suite, is designed to simplify the process of taking control of your personal data. Here’s how it works:

• Scanning: Our data scanning tool searches for your information across data broker and people-search sites.
• Removal: When we find your data, we handle removal requests and follow-ups to ensure the information is fully deleted.
• Prevention: The service helps protect you from future data theft while pairing perfectly with ExpressVPN’s encryption to keep your online activity private.

This service is available for U.S. users and is included for free with a 2-year ExpressVPN plan. You can also add it to any other plan for a small additional fee. With this feature, you can secure your privacy without the hassle of managing removal requests yourself.

Get ExpressVPN