A data broker collects personal information from other sources, combines it and supplies it to third parties. You may never have created an account with that company. Where the GDPR applies, you can request erasure if the conditions in Article 17 are met. Start by identifying where you appear, then choose the requests to send.
At a glance
- Brokers may combine names, addresses, phone numbers, emails, interests and other profile information.
- Their records can support marketing, targeting, scoring and people search services.
- Applicable GDPR rights include access, objection and erasure, subject to the relevant conditions.
- You do not need to buy a paid people search report merely to exercise your privacy rights.
What is a data broker?
A data broker is a business that collects, aggregates and supplies personal information. Depending on the service, this may include contact details, age ranges, relationships or inferred interests. Its customer may be another business rather than the person described in the record.
These databases support direct marketing, advertising audiences, scoring and identity lookup services. In France, public directories and other aggregators may form part of the wider information ecosystem. Read who buys personal data for the next part of the chain.
Our page on identifying brokers and taking action connects detection, relevant rights and request tracking.
Where do brokers obtain information?
Sources vary between businesses and may include:
- public registers and directories;
- commercial forms, accounts, competitions and transactions, where data is shared;
- partnerships, website tracking and app data;
- other brokers supplying lists or segments.
Separately, stolen databases and breached information may circulate through unlawful channels. Their existence does not prove that a particular lawful broker used them.
A footprint scan helps organise findings across public websites, broker sources and known breaches before you contact multiple sites.
People search: your information in a public profile
People search sites may display a record when someone enters a name, number or town. Depending on the service and country, that record can contain addresses, contact details or related people. Some publish information obtained from aggregators; others use different sources.
| Search | Possible result | Potential exposure |
|---|---|---|
| Name and town | An aggregator or individual profile | Name and current or former location |
| Phone number | A reverse directory or telephone listing | Identity associated with a number |
| Public mentions or supported breach-search results | Contact details and information useful for correlation |
A free preview may be enough to confirm a listing. A premium report does not accelerate a GDPR request. See People Finder France and site-by-site people search removal.
To address a listing:
- Record its exact URL.
- Find the privacy, opt-out or rights page, or the DPO contact.
- Send an appropriate erasure request identifying the record and explaining the relevant grounds.
- Keep the acknowledgement and check the result. Follow up after the applicable response period if necessary.
Removing one visible record does not automatically remove copies held elsewhere. Address relevant upstream sources where you can identify them.
Why request erasure?
Reducing exposed records limits information available for:
- marketing calls, texts, emails and post;
- targeting and profiling;
- social engineering or, in serious cases, identity misuse.
The right to erasure lets you request deletion when its conditions apply. A controller normally has one month to respond. Exceptions, including certain legal duties or public-interest grounds, mean that deletion is not guaranteed in every case.
How to remove your data from brokers
- Make a list. Combine your scan results with relevant listings found manually.
- Find the correct contact. Use the privacy notice, opt-out form or DPO details.
- Send the request. Include enough information to identify the record, without disclosing unnecessary additional data.
- Follow up if needed. If the normal response period passes without an answer, use our follow-up and CNIL guide.
You can do this yourself or authorise us to send requests. After reviewing your scan, make your selection in the removal process. See how it works.
Want to see where your information appears? Start a free scan, then choose what to address.
See also: People search removal · People Finder France · Who buys personal data · GDPR Article 17
