Data Brokers Are Legal: Why the Law Protects the Industry, Not You

What Data Brokers Actually Do

The data broker industry is not a shadow economy. It operates in daylight, files with regulators, and generates tens of billions in annual revenue. Companies like Acxiom, Experian, and LexisNexis are not violating any law when they compile detailed profiles on hundreds of millions of Americans. They are following the law as it was written.

That is the problem. The legal architecture surrounding data broker regulation was designed around a pre-internet conception of privacy, where information sharing required physical delivery and contractual relationships. The data broker industry scaled into that legal vacuum and never looked back.

Understanding why data brokers operate legally requires understanding what they actually do at a systems level. They aggregate records from public sources, commercial transactions, and third-party data licensors. They run probabilistic matching algorithms to link records across data sets. They package and resell the output as consumer profiles, risk scores, and behavioral segment data. All of that is legal under current federal law.

Acxiom, Experian, LexisNexis: The Architecture of Commercial Surveillance

These are not fringe actors. Acxiom, now operating under the Interpublic Group umbrella through its LiveRamp subsidiary, maintains consumer data on roughly 2.5 billion individuals globally. Its core product is identity resolution: the ability to link a person's activity across devices, platforms, and time horizons into a unified identity graph.

Experian, better known as a credit bureau, operates a parallel data brokerage business that is legally distinct from its credit reporting function. The credit bureau side is governed by the Fair Credit Reporting Act. The data brokerage side largely is not. Experian markets consumer demographic and behavioral data to advertisers, insurers, and financial institutions under a different legal framework with far fewer consumer rights attached.

LexisNexis Risk Solutions is arguably the most consequential of the three for civil liberties purposes. It sells consumer data to law enforcement agencies, employers, landlords, and insurers. Its products include ThreatMetrix, which performs real-time identity risk scoring during online transactions, and Accurint, which is used by government agencies for investigative research. The civil liberties implications of a private company selling risk profiles to law enforcement with no warrant requirement are significant and underexamined.

The Data They Collect Would Surprise You

The public imagination around data collection tends to focus on browsing history and social media behavior. The actual data broker product catalog is considerably more invasive. A typical commercial consumer profile can include: full legal name and all known aliases, current and historical addresses, phone numbers, email addresses, relatives and household members, estimated income and net worth, property ownership records, vehicle registration data, professional licenses, court records including civil litigation, purchasing behavior across retail categories, magazine subscription history, voter registration data and inferred political affiliation, and derived psychographic segments.

Critically, most of this data is not self-reported. It is scraped from public records, purchased from retailers via loyalty program data-sharing agreements, licensed from app developers, and inferred algorithmically from behavioral signals. You did not consent to any of it in any meaningful sense. You may have clicked an agree button in a terms-of-service flow that referenced data sharing in paragraph 47 of an 80-paragraph document. Courts have generally upheld that as valid consent under current law.

The technical sophistication of these pipelines is real. Modern data brokers run large-scale ETL operations, entity resolution at massive scale, and probabilistic inference models trained on billions of records. This is not a cottage industry. It is applied machine learning deployed against your identity without your knowledge or meaningful control.

Who Buys This Data and Why

The customer base for commercial data broker products spans sectors most people would not associate with personal data purchasing. Insurance underwriters use consumer profiles to price risk outside the constraints that apply to credit reports. Employers use background screening products built on data broker infrastructure. Landlords use tenant screening services that pull from the same underlying data pools.

Direct marketing is still the largest revenue vertical. Advertisers purchase audience segments that allow them to target individuals based on inferred health conditions, financial stress indicators, religious affiliation, and political views. All of that targeting is legal under current U.S. federal law, with narrow exceptions created by the Health Insurance Portability and Accountability Act for certain health data contexts and the Children's Online Privacy Protection Act for users under 13.

Law enforcement purchasing of commercial data deserves separate attention. Federal agencies including the IRS, DHS, and the FBI have purchased location data, identity data, and behavioral profiles from commercial data brokers. Because the data is commercially available, agencies have historically argued no Fourth Amendment warrant requirement applies. The legal theory is that information shared with third parties loses its constitutional protection under the third-party doctrine. The Supreme Court's 2018 ruling in Carpenter v. United States complicated that doctrine for cell-site location data, but the broader question remains contested.

Why Current Regulation Fails

The Fair Credit Reporting Act governs a specific and narrow category of consumer reporting: credit, employment, housing, and insurance decisions. Its protections, including the right to dispute inaccurate records, apply only when data is used for those specific permissible purposes. Data broker products sold for marketing, identity resolution, or law enforcement screening exist in a different legal space where FCRA consumer rights do not attach.

GDPR provides a more coherent framework. Under GDPR's data minimization and purpose limitation principles, collecting personal data without a lawful basis and using it in ways incompatible with that basis are prohibited. The GDPR's definition of legitimate interest is limited and subject to balancing tests. Commercial data brokerage at the scale practiced by Acxiom or Experian would face significant legal headwinds in the EU precisely because the legal basis for processing is unclear and the legitimate interest balancing test would not obviously favor commercial profiling.

CCPA created opt-out rights for California residents, including the right to opt out of the sale of personal information. The enforcement record under CCPA and its CPRA amendment has been limited. The California Privacy Protection Agency, created by CPRA, is operational in 2026 but has faced resource constraints. The opt-out mechanism itself is fragmented: consumers must opt out from each data broker individually, a process that data broker regulation critics correctly identify as designed to fail at scale.

The Federal Gap: No Comprehensive U.S. Privacy Law

The United States remains without a comprehensive federal privacy statute in 2026. The American Data Privacy and Protection Act was debated extensively in Congress but not enacted. The sectoral approach that defines U.S. privacy law, with HIPAA covering health data, FERPA covering education records, and FCRA covering credit, leaves enormous surface area unregulated. Data that does not fit a protected sector category is presumptively available for commercial exploitation.

This is not an accident. The data broker industry spends significantly on federal lobbying. Trade associations including the Data and Marketing Association have argued consistently that self-regulation and notice-and-choice frameworks are sufficient. Notice-and-choice fails empirically: the cognitive load required to meaningfully manage hundreds of data sharing relationships exceeds what any individual can reasonably perform. The framework persists not because it works but because it is politically expedient for the industry it nominally constrains.

State-level legislation is proliferating. Texas, Virginia, Colorado, Connecticut, and Montana have passed comprehensive privacy laws with data broker provisions. None of them fully close the legal gap that makes large-scale commercial surveillance economically viable. Preemption debates over whether a federal law would displace stronger state laws add further complexity to the regulatory outlook.

Proof of Ownership as a Legal Counter-Strategy

At Own Your Data Inc, a nonprofit building infrastructure for personal data ownership, the operating premise is that property rights logic applied to personal data creates legal standing that regulatory frameworks alone do not provide. MyDataKey™ issues cryptographic certificates of data origination under the PDAOS™ framework, the Personal Data Asset Origination System, which is documented in detail at mydatakey.org/pdaos-white-paper/.

The core argument is not primarily about security. It is about legal record. If you can demonstrate with a timestamped, cryptographically verifiable certificate that a given data element originated with you at a specific point in time, that certificate is evidence in any dispute about unauthorized use or downstream misappropriation. Data brokers profit in part because individuals have no comparable documentation of their own data assets. MyDataKey™ changes that asymmetry.

This is the intersection where privacy engineering and property law become practically relevant. Data broker regulation that treats data as protected personal information creates opt-out rights. Property rights frameworks would create something closer to conversion claims when data is used without authorization. Those are different legal theories with different remedies, and the certificate infrastructure MyDataKey™ provides is relevant to both.

What You Can Actually Do in 2026

Practical mitigation exists even under current law. California residents can use the California Privacy Protection Agency's guidance to exercise CCPA opt-out rights systematically. The Global Privacy Control technical standard, a browser-level opt-out signal, is legally required to be honored by covered businesses under CPRA. GPC support in Firefox and Brave is functional in 2026.

For data broker opt-outs outside California, mydatakey.org/opt-out/ provides a structured process for submitting removal requests to major brokers including Acxiom, Spokeo, WhitePages, and Intelius. These requests do not prevent data from re-entering broker pipelines through new collection events, but they reduce your current exposure and create a documented record of your opt-out assertions.

The deeper issue remains structural. Opt-outs address symptoms. The data broker regulation gap at the federal level is a policy failure that individual action cannot fully compensate for. Building a verifiable ownership record for your personal data through a certificate system like MyDataKey™ is one of the few technical interventions that operates at the same layer of sophistication as the industry it pushes back against.