Data Broker

Data brokers aggregate personal information from public records, commercial sources, web scraping and sometimes direct-collection channels, then license or sell datasets to buyers for marketing, risk scoring, identity verification, people-search and other uses. California (CCPA/CPRA), Vermont, Oregon, Texas and increasingly other US states operate data broker registries that require annual registration, disclosure of practices and participation in the California Delete Act's one-stop opt-out mechanism.

Outside the US, the term is used less formally but the regulated conduct still falls under general data protection law. In the EU and UK, data brokers must identify a GDPR lawful basis — typically legitimate interests, subject to a documented LIA — and provide the Article 14 transparency notice to each individual whose data they hold where that data was obtained from a source other than the individual. Under India's DPDP Act, the broker is a Data Fiduciary with every Section 8 duty — the consent challenge for a Fiduciary that never meets the Data Principal is unresolved and is one of the industry's unanswered compliance questions.