The United States Postal Service sells your change-of-address data to commercial data brokers. When you file a USPS change-of-address form, a routine administrative act, the USPS licenses your new address to companies including Acxiom and Experian. They use it to update the consumer profiles they sell. This has been public knowledge for years. Almost nobody knows it happens.
That’s the data broker economy in one sentence. It is a system so embedded in ordinary infrastructure that its inputs are invisible, its transactions are private, and its scale is almost impossible to grasp.
Who sells your information, and why? A global industry worth more than $200 billion (per industry estimates) collects your data from public records, purchase history, apps, and breaches. It sells that data to advertisers, insurers, employers, political campaigns, and law enforcement. Your profile passes through three to five separate companies before it reaches a buyer, none of whom you consented to. Here is the full chain.
The $200 billion industry you’ve never heard of
The global data broker market exceeded $200 billion in 2025 by most industry estimates. IDC, IBISWorld, and others place it in this range. Exact figures vary because the industry doesn’t disclose revenues uniformly. There are more than 4,000 data brokers in the United States alone, according to widely cited industry estimates. Globally, the estimate is above 10,000.
These aren’t a single type of company. The term “data broker” covers an entire ecosystem — raw data aggregators, data enrichers, audience platforms, analytics firms, and consumer-facing people-search sites. Your data doesn’t go to one broker. It goes through several, being appended, merged, segmented, and resold at each step.
By the time your name, address, income bracket, political affiliation, health indicators, and purchasing behavior reach a marketing platform’s database, they’ve passed through three to five separate companies. You’ve heard of none of them. You consented to none of them. And none of them are required to tell you they hold your data.
Who the buyers are
Understanding who buys data explains why the industry exists at all. There’s no shortage of demand.
Advertisers are the largest buyer segment. Digital advertising is built on audience targeting — serving ads to people with specific demographics, interests, income levels, and purchasing patterns. Data brokers sell the targeting layer. Google and Meta build their own first-party data. Everyone else buys.
Insurers use data to refine risk models. Life insurers have purchased data on consumer purchases, gym memberships, alcohol purchases inferred from receipt data, and health app usage — none of which you disclosed on your policy application. Auto insurers use driving behavior data from apps and connected car systems. This is legal in most jurisdictions.
Employers and landlords run background screening through companies like First Advantage and Checkr, which aggregate public records, court data, credit history, and social media activity. You consented to the check. You didn’t consent to which data sources they’d use.
Political campaigns are heavy buyers. Voter rolls — which are public records in most US states — become the foundation of campaign targeting. Data brokers layer in consumer behavior, geographic data, and household composition to model voter persuasion scores. This is a multi-hundred-million-dollar spend in US election cycles.
Law enforcement purchases commercial data to avoid warrant requirements. This is controversial, legally contested, and real. The FBI, DHS, and local police departments have bought location history, phone data, and social-network graphs from commercial brokers. Buying it sidesteps the court orders they would need to get the same data from carriers directly. Several congressional investigations have examined this practice. The purchases continue.
At the dark end of the market: scammers and identity thieves buy data on dark web markets. This is the tail of the same industry. The same profile that sells for $2 on a marketing platform sells for $50 to $150 on a dark web marketplace when packaged with identity verification data.
What your data sells for
Price depends on specificity and what the buyer can do with it.
A bulk email list — name, email address, general location — sells for $0.01 to $0.10 per record. That’s the commodity end. At scale, advertisers are buying tens of millions of records at a time; the margin is in volume.
A more detailed profile — income bracket, age, household composition, inferred interests based on purchasing history — sells for $0.50 to $2 per record. This is the standard programmatic advertising layer.
Premium profiles with health indicators (inferred from pharmacy purchases, fitness app data, search history), political views, financial stress signals, and relationship status reach $2 to $10 per record. These sell to insurers, political campaigns, and financial services firms doing targeted credit offers.
On dark web markets, a “fullz” package sells for $10 to $150, depending on the target’s creditworthiness and country. A fullz is a full identity: name, date of birth, Social Security Number or equivalent national ID, address history, and sometimes a scan of an ID document. The price goes up for people with clean credit and no prior fraud flags. It’s an irony worth noting: protecting your data is worth more when you have more to lose.
Where the data comes from
Every data stream eventually flows into the broker ecosystem.
Public records are the foundation. Voter rolls, property ownership records, company filing databases, court records (including bankruptcies and civil judgments), marriage and divorce filings, and death records are all public in most US states. Data brokers have systematically digitized, indexed, and cross-referenced all of it.
Loyalty programs and purchase history are the behavioral layer. Every transaction you make with a rewards card — grocery, pharmacy, airline, hotel — is data. The loyalty program knows what you bought, when, and where. This data is licensed to data partners as part of the program’s business model. It’s in the terms you agreed to.
App permissions and tracking pixels are the real-time layer. Free apps that request location, contacts, or storage permissions often embed advertising SDKs that transmit behavioral data to aggregators continuously. Tracking pixels on websites — invisible 1x1 images — log your visit, your device fingerprint, your referring source, and your behavior to third-party databases.
Breach data enters the ecosystem within days of a major leak. In India, breached telecom and financial-sector data regularly appears on dark web markets. From there it gets absorbed into commercial broker databases, as companies buy “data enrichment” from sources they don’t ask questions about. The line between legitimately collected data and breach data blurs quickly inside broker networks.
And then there’s the US Postal Service. When you file a USPS National Change of Address (NCOA) form, the USPS licenses that updated address data to approved commercial mailers and data companies — including major brokers. This is a federal government program selling a piece of your life history to private companies. It is documented. It is legal. It is a scandal.
The data broker tiers
The industry has layers. Each layer adds value (to buyers) by making the data more precise.
Raw data aggregators sit at the base. Companies like Acxiom (now owned by IPG) and LexisNexis (part of RELX Group) collect raw inputs from public records, partner data feeds, and direct licenses. Their databases contain hundreds of millions of consumer profiles. They normalize the data: standardizing formats, deduplicating records, and building persistent identifiers that follow you across address and name changes.
Data enrichers add financial and behavioral context. Experian, TransUnion, and Equifax — known as credit bureaus — sell far more than credit scores. Their marketing data divisions sell lifestyle segments, financial stress indicators, and household demographics to advertisers and insurers. Your credit file is the regulated product. The marketing profile built alongside it is the unregulated one.
Marketing data platforms segment audiences for advertising. Epsilon (owned by Publicis), Oracle Data Cloud (Oracle wound down its advertising-data business in 2024), and LiveRamp are where ad agencies go to buy audiences. They ingest data from aggregators and enrichers, run predictive modeling, and sell segments. A typical segment: “women 35–44 with household income over $100K who bought baby products in the last 90 days.” The audience segment is the product, not the individual record.
People-search sites are the consumer-facing retail layer. Spokeo, BeenVerified, Whitepages, and dozens of others resell aggregated profiles directly to individuals, usually for background checks or contact lookups. These are the sites that list your home address, relatives’ names, and previous addresses. They buy from the upper tiers.
Why this industry is hard to regulate
The data broker industry is not poorly regulated because legislators haven’t noticed it. It’s poorly regulated because it’s structurally resistant to the tools regulators have.
Data crosses borders constantly. A US broker collecting data about EU citizens can process it in a third country the EU has deemed adequate. Or it can route the data through a shell operation in a jurisdiction with no data protection law at all. GDPR applies extraterritorially, but enforcing it against a company with no EU presence is difficult in practice.
Broker-to-broker transactions are invisible. A company that collects your data has an obligation to disclose third-party sharing. The third party it shared with has a more attenuated obligation to tell you anything. By the fourth or fifth transfer, the audit trail is effectively gone.
The industry lobbies heavily against transparency requirements. The California Consumer Privacy Act (CCPA) required data brokers to register with the state — a minimal disclosure requirement. The California Association of Data Brokers fought it. The industry’s opposition to opt-out registries, deletion mandates, and broker-specific legislation has been sustained and well-funded in every jurisdiction that has tried to pass meaningful reform.
Comprehensive federal data broker legislation in the US has been introduced and failed multiple times. The EU’s GDPR applies but enforcement is resource-constrained. India’s DPDPA covers some of this ground but is not yet fully operational. The gap between the scale of the industry and the scale of regulatory response is large, and the industry fills that gap with lobbying, complexity, and speed.
Frequently asked questions
How big is the data broker industry? Industry estimates put the global market above $200 billion a year, with more than 4,000 brokers in the US alone and over 10,000 worldwide. Exact revenue is hard to pin down because brokers don’t disclose it uniformly.
Who buys data from brokers? Advertisers are the largest buyers, followed by insurers, employers and landlords running background checks, political campaigns, and law enforcement. At the illegal end, scammers and identity thieves buy the same profiles on dark web markets.
What does my data sell for? A basic marketing record sells for a few cents. A detailed profile with income and household data runs $0.50 to $2. Premium profiles with health, political, or financial-stress signals reach $2 to $10. A full stolen identity (“fullz”) sells for $10 to $150 on dark web markets.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.