What Is a Data Broker? – Definition and How It Works
Learn what data brokers do, where their data comes from, how they are regulated, and how to evaluate one as a supplier.
A data broker collects information about people or organisations and sells it to parties with no direct relationship to the subjects. The defining feature is that indirect relationship.
1. What They Sell
| Category | Examples |
|---|---|
| Business data | Firmographics, technology use, funding, hiring |
| Consumer data | Demographics, interests, purchase history |
| Contact data | Names, roles, business email and phone |
| Location data | Movement patterns from mobile applications |
| Public records | Property, courts, licences, registrations |
| Credit-adjacent | Financial indicators, in regulated forms |
Business data is the least contentious; location data derived from mobile applications is the most, and the category attracting the most regulatory attention.
2. Where the Data Comes From
- Public records, which are lawfully published.
- Web collection from public sources.
- Partnerships with services holding first-party data.
- Application SDKs, where a library in an app reports data back.
- Loyalty and survey programmes.
- Purchases from other brokers, which is how provenance gets lost.
- Inference, deriving attributes from patterns rather than observing them.
The last two are why provenance is the hard question. Data resold through several intermediaries often arrives with no verifiable account of how it was originally obtained, and inferred attributes are presented alongside observed ones without distinction.
3. The Consent Problem
People whose data is brokered generally have no relationship with the broker, frequently do not know it holds data about them, and did not meaningfully agree to that specific use — consent, where it exists, was given to an app or a service for a different purpose.
That gap is what regulation addresses, and it is the reason this industry is under increasing legal pressure rather than a mature settled market.
4. Regulation
GDPR requires a lawful basis for processing, transparency to the subject, and rights of access and erasure. Legitimate interest is the basis usually claimed, and it requires a balancing test that is difficult to satisfy for undisclosed brokering.
CCPA/CPRA grants rights to know, delete, and opt out of sale, and requires brokers to register in some jurisdictions.
Sector rules apply to credit, health, and financial data specifically.
Registration regimes exist in several jurisdictions, so a broker's registration is checkable.
The direction of travel is consistently toward more obligation, not less — which matters when building a product on brokered data.
5. As a Buyer, You Inherit the Problem
Purchasing data does not transfer away responsibility for using it lawfully. Under GDPR a buyer processing personal data is a controller with its own obligations: a lawful basis, transparency to the subjects, and the ability to honour access and deletion requests.
"We bought it from a broker" is not a lawful basis. If the original collection was unlawful, the buyer's processing generally is too.
6. Evaluating a Broker
Questions a serious supplier can answer:
- Where did this data originate, specifically, per field?
- What lawful basis applies, and what were subjects told?
- How is accuracy measured, and how stale is a typical record?
- Which fields are inferred rather than observed?
- How are deletion requests propagated to you as a customer?
- What are the licence terms — permitted uses, redistribution, retention?
- Are they registered where registration is required?
- What indemnity is offered if the data proves unlawfully sourced?
Vagueness on 1, 2, or 4 is disqualifying. A broker that cannot separate inferred from observed attributes is selling you guesses labelled as facts.
7. Brokers Versus Direct Collection
| Buying from a broker | Collecting yourself | |
|---|---|---|
| Speed | Immediate | Build time |
| Coverage | Broad | What you collect |
| Provenance | Often opaque | Fully known |
| Freshness | Varies, often poor | Under your control |
| Compliance | Inherited, unverifiable | Your own design |
| Cost | Per record, ongoing | Engineering, then marginal |
Direct collection from public sources gives known provenance and current data, which is precisely what brokered data most often lacks. For business data in particular, collecting public sources yourself frequently produces fresher records at lower cost.
8. Summary
A data broker sells information about people or organisations to parties with no relationship to them, sourced from public records, web collection, partnerships, app SDKs, resale, and inference.
Provenance and consent are the weak points, resale erases the audit trail, and inferred attributes are sold beside observed ones — and because a buyer becomes a controller with its own obligations, "we bought it" is not a lawful basis, which makes verifiable provenance the thing to insist on.