A data broker is a company that collects information about people from many sources and sells or licenses it to others. Most people never deal with a data broker directly. The data comes from public records, apps, loyalty schemes, online tracking and other companies' datasets, and it is sold for marketing, risk scoring, people search, research and AI development. It is a large, mostly legal industry with catalogues, subscriptions and price lists.
An everyday example
Think about one person, "Sarah", over a single week.
- She uses a supermarket loyalty card. Her baskets are recorded.
- A free weather app on her phone shares her location with advertising partners.
- She fills a prescription. The pharmacy's software provider may receive the prescription data for "analytics".
- She signs up for a newsletter with her email address.
None of these companies is a data broker. But each can be a source for one. Combined, the pieces describe Sarah's habits, health, movements and income in detail, and that combined profile, or a de-identified version of it, is the product.
The details, simply
The main types of data broker
- Marketing and advertising brokers build audience segments ("new parents", "frequent travellers") for targeted ads.
- People-search sites compile names, addresses, phone numbers and relatives from public records.
- Risk and fraud brokers supply data for identity checks, credit decisions and fraud prevention.
- Location data brokers buy and resell location signals from apps.
- Health and "real-world data" vendors license de-identified prescriptions, diagnoses, claims and lab results to pharmaceutical companies, insurers, researchers and AI developers.
Where the data comes from
- Public records: registers, court filings, property records.
- Commercial sources: loyalty programmes, purchases, subscriptions, warranty cards.
- Online and app tracking: cookies, advertising IDs, software kits embedded in apps.
- Other companies: businesses that have a licence, often in their terms of service, to share or sell data, sometimes after "anonymising" it.
- Inference: brokers also derive new data, such as predicted income or likely health conditions, from what they hold.
How it is regulated
In the EU and UK, GDPR applies to data brokers that process personal data: they need a legal basis, must be transparent, and must honour access and erasure requests. In the US there is no single federal privacy law; several states, including California and Vermont, require data brokers to register.
This is general information, not legal advice.
What the law does not protect: the de-identification route
This is the part that matters most for professionals. Data protection law protects personal data. Once data is anonymised, it falls outside GDPR (Recital 26) and can legally be sold.
That creates a route into the market for even the most confidential information:
- A practice, law firm or company uses software or an AI tool to do its everyday work.
- The provider's terms grant it a licence to use the content, or to create aggregated or de-identified data from it.
- Names and identifiers are removed. The valuable part stays: diagnosis, dosage, deal value, contract clause.
- The de-identified dataset is licensed or sold to buyers who want exactly that detail.
- If the anonymisation was weak, the records can be linked back to individuals by cross-referencing other data, by hand or with AI.
No law has to be broken for steps 1 to 4. Professional confidentiality and data protection protect the identifiable person; the record without the name is "just data". We built an interactive walk-through of this path on the data trail, and set out each legal step, with sources, on legal to sell.
Re-identification is not theoretical. About 87% of Americans can be identified from ZIP code, birth date and sex alone, and a 2019 Nature Communications study found 99.98% re-identifiable from 15 attributes. See pseudonymisation vs anonymisation for more.
What this means when you use AI tools
Professional and health data is valuable to the data market because it is detailed and rare. When you choose an AI tool for confidential work, check:
- Licence. Do the terms let the provider use, aggregate or de-identify your content?
- Role. Is the provider strictly your processor under a data processing agreement, or a controller for some purposes?
- Training. Is your content used to train models?
- Retention. Is anything kept after the task is done, by the tool or the model provider behind it?
- Ownership. Would the commitments survive if the company were sold?
Wysor is built so your data never enters that market. We take no licence to reuse your content and act only as your processor under Art. 28 GDPR. We never train on it and never sell it, anonymised or not. Those commitments are in the contract and bind anyone who could ever own Wysor. Data is encrypted in transit and at rest, hosted in the EU, and every connected AI model provider runs with zero data retention: processed, then deleted.
FAQ
What does a data broker do? A data broker collects information about people from public records, commercial sources, online tracking and other companies, combines it, and sells or licenses it to businesses for marketing, risk assessment, people search, research or AI development.
Are data brokers legal? Generally yes. In the EU they must follow GDPR for personal data. Anonymised data falls outside GDPR, so selling it is largely unrestricted. Some US states require brokers to register.
How do data brokers get health data? Mostly through de-identified datasets licensed from organisations in the health system and their software providers, such as prescription, claims or lab data, with names removed so data protection law no longer applies.
Can I remove my data from data brokers? In the EU and UK you can use your GDPR rights to ask a broker for access to, and erasure of, your personal data. That does not reach data that has already been anonymised, because it is no longer linked to you in law.
Do AI companies buy data from data brokers? AI developers are among the buyers of large datasets, including licensed and de-identified data. Practices vary widely by company, so check what each provider says about its training data.
Further reading
- Pseudonymisation vs anonymisation
- Patient confidentiality: what it protects and what it doesn't
- Does ChatGPT sell your data?
- The right to be forgotten (GDPR Article 17), explained simply
- The data trail: follow one record
Questions about how we handle your data? Reach us at [email protected] or through the in-app contact form.
