Data Brokers Don’t Just Track You — They Make Guesses About You, and Sell Them

Most Americans know that data brokers collect basic details like addresses and phone numbers. Fewer realize that these companies also build predictive profiles, sorting people into categories meant to forecast their health, finances, religion and other sensitive traits — often without verifying whether those guesses are accurate.

The Federal Trade Commission documented the practice in a years-long investigation, finding that brokers combined data from multiple sources to infer characteristics including income, religion, political views and health conditions. One of the clearest examples came from Acxiom, which built a segmentation system called PersonicX that sorted households into lifestyle categories such as “Rural Everlasting,” describing older adults with relatively low income and education, along with groups like “Urban Scramble” and “Mobile Mixers.”

The FTC also found that location-data company InMarket offered advertisers audience categories including “Christian church goers,” “parents of preschoolers” and “wealthy and not healthy.” The agency later restricted InMarket’s use and sale of sensitive location data. Oracle’s BlueKai advertising business similarly relied on extensive consumer data for ad targeting before Oracle shut the products down in September 2024.

When Predictions Help Criminals

These inferred categories aren’t just used for marketing. In a case brought by the Justice Department, prosecutors said Epsilon Data Management used modeling to identify consumers likely to respond to solicitations, then sold information on more than 30 million Americans to operators of fraudulent schemes, including fake sweepstakes promotions. Epsilon agreed to pay $150 million under a deferred prosecution agreement.

The stakes for older Americans are substantial. The FBI reported that people age 60 and older lost roughly $7.7 billion to internet crime in 2025, up from $4.9 billion in 2024. Not all of those losses trace back to data brokers, but the Epsilon case shows how targeted lists of consumer information can end up helping scammers pick their targets and sharpen their pitches.

Much of this happens outside the protections people assume apply to their health information. HIPAA covers data handled by healthcare providers and their business associates, but health-related inferences made by other companies — say, from a search about diabetes symptoms — generally fall outside that law, even if the search was done on behalf of a family member rather than the person doing the searching.

California’s New Opt-Out Tool

Unlike a credit report, there is no single national system for reviewing the marketing predictions companies have built around your name. But some states give residents specific rights to access, correct or delete that information.

California is a leading example. Under the California Consumer Privacy Act, eligible residents can request information held by covered businesses, subject to legal exceptions. In January 2026, the state launched the Delete Request and Opt-out Platform, known as DROP, at privacy.ca.gov/DROP/. The tool lets eligible California residents file a single deletion request covering registered data brokers statewide. Those companies began processing requests under the system in August 2026, and matching records — including inferred profiles — generally must be deleted unless an exception applies.

Residents of other states have different levels of protection, so what consumers can do depends heavily on where they live.

Privacy advocates say there’s no way to guarantee every inference about a person disappears, even with tools like DROP. But reducing the amount of personal information available publicly can make it harder for unfamiliar businesses — and scammers — to assemble detailed profiles in the first place.