Data Brokers and Your Teen's Personal Information

What a data broker is

A data broker is a company that collects personal information about people from many sources and sells it — typically to marketers, other businesses, or anyone who pays — without having any direct relationship with the people whose data it holds. California's privacy regulator defines one as a business that knowingly collects and sells the personal information of a consumer it has no direct relationship with. The privacy nonprofit EPIC puts it more bluntly: firms that collect, aggregate, package, and sell huge volumes of personal data, often without consumers knowing they exist.

That last part is the whole point for a parent. Your teen never signed a contract, never clicked “agree,” and in most cases has no idea the company exists. The broker simply gathers pieces that are already out there and assembles them into one record it can sell.

The business runs in three moves: collect, aggregate, sell. Brokers pull from public records (court filings, property deeds, voter rolls), from commercial feeds (loyalty programs, purchases, warranty cards), and from online activity, then merge it all into a profile and sell access to it. The scale is hard to picture. The Federal Trade Commission's landmark 2014 report on the industry found that brokers collect and store billions of data elements covering nearly every U.S. consumer with minimal transparency — one broker held over 700 billion aggregated data elements, and another maintained more than 3,000 “data segments” for nearly every American. Those specific figures are a decade old now, but the industry has only grown, and they remain the clearest picture regulators have published of how deep the profiles go.

How your teen's data gets sold

Your teen's data reaches brokers through ordinary, everyday activity — apps, schools, public records, and breaches — not because they did anything wrong. And unlike a younger child, a teenager has almost no legal shield standing in the way.

That is the fact worth sitting with. The federal children's privacy law, the Children's Online Privacy Protection Act (COPPA), mainly limits how online services collect data from children under 13. There is no comparable federal privacy rule covering 13-to-17-year-olds, so a teenager is far more exposed than a younger child. The FTC's 2024 staff report A Look Behind the Screens studied nine major platforms and found they often treated teens exactly like adult users, collected vast amounts of data, and could retain it indefinitely — including data bought from brokers.

This is not hypothetical for young people specifically. After California began requiring brokers to register and disclose what they sell, roughly two dozen admitted they collect data on minors, and dozens more sell precise location. Duke University researchers documented brokers openly advertising packages of student and teen data — with major names including Equifax, Experian, and TransUnion stating in Vermont's registry that they collect data on minors.

What's in a broker profile

A broker profile is a dossier — far more than a name and an email. It layers together the factual, the historical, and the guessed-at, until a stranger can learn more about your teen in five minutes than most of their teachers know.

EPIC's itemized list of what a people-search profile can contain gives a sense of the range:

• Identity and contact: full name, aliases and former names, birthdate, current and past home addresses, phone numbers, and email addresses.
• Life and records: education, employment, property records, and details drawn from marriage, divorce, bankruptcy, and court filings.
• Relationships: relatives, associates, and links to social-media accounts — the connections that tie an anonymous handle to a real family.
• Inferred traits: beyond the facts, brokers guess. The FTC found they sort people into scored segments and infer sensitive attributes — interests, income band, and more — from patterns in the data.

Two things make this worse than it sounds. First, the profiles can simply be wrong. In a case that reached the U.S. Supreme Court, Spokeo, Inc. v. Robins, a man found the site's profile of him falsely said he held a graduate degree, was a married professional, and was well off — when he was, in fact, unemployed. A guessed-at profile of a teenager can be just as inaccurate, and just as public. Second, the same underlying record is spread across many sites; a 2024 peer-reviewed study found a handful of companies sit behind most of the people-search sites people recognize.

It helps to make this concrete. Picture a 16-year-old who reuses one gaming handle everywhere, mentions their high school in a bio, and appears in a parent's public post celebrating a move to a new house. Separately, none of that seems dangerous. But a people-search site already lists the family's address from property records — so a broker (or anyone reading one) can stitch the handle to the school, the school to the town, and the town to the exact front door. Your teen never handed any single site the full picture; the profile is assembled from them, piece by piece.

The real risks

The risk is not that a profile exists — it is what an exposed profile makes possible: identity theft, doxxing, and scams that feel personal because they are built from real details. It is worth being precise here, because the honest picture is less frightening than the marketing around it, and more useful.

Identity theft. A minor's Social Security number is a clean slate with no credit history, which makes it valuable and lets misuse go unnoticed for years. Child identity fraud is real and sizeable: a 2022 Javelin study estimated 915,000 U.S. children were victims of identity fraud in a single year, and that 1.7 million had data exposed in a breach. But here is the caveat the fear-sellers skip: the single largest source of child identity theft is not anonymous brokers — it is people the child knows, often a relative. Brokers and breaches are the stranger vector; treat them as one exposure to manage, not the whole story.

Doxxing and stalking. This is where broker data does the most direct harm. A people-search listing hands over exactly what someone needs to find a person in the physical world — names, current and past addresses, phone numbers, and linked accounts. The anti-violence network NNEDV describes these sites as a standard tool for locating people, and removing a record is one of the few things that can keep a stranger from learning it. If your teen is ever targeted, our guide on doxxing and how to protect your teen walks through the response step by step.

Tailored scams. Real details make a phishing message or a fake “you've won” text far more convincing. A scammer who already knows a teen's name, town, and school does not have to guess — the personal touch is what gets a guarded teenager to click.

Opting out: a realistic guide

To opt out, you work through the biggest sites one at a time, use search-engine removal tools, and — if you are in California — send a single deletion request to every registered broker at once. You will not clear everything, but you can take down the most sensitive, most-viewed listings, which is where most of the real risk sits.

Start with the largest people-search sites. Each has its own opt-out page, each usually requires you to find the specific listing and confirm by email, and each may hold more than one record — so this is a sit-down-for-an-afternoon task, ideally done with your teen so they learn the habit:

• Spokeo — find your listing, then submit its URL at spokeo.com/optout and confirm by email.
• Whitepages — use whitepages.com/suppression-requests; it adds a phone-verification step.
• BeenVerified, Intelius, and Radaris — each runs its own opt-out: BeenVerified, Intelius (through the PeopleConnect suppression center), and Radaris (free and self-service).
• Acxiom — a marketing broker with no public profile to look up; opt out at acxiom.com/optout.

These opt-out pages and their verification steps change often, so follow the instructions on each site's live opt-out page rather than a saved link. Next, use Google. Its Results about you tool flags search results that expose a home address, phone, or email and lets you request removal — though note it is currently for adults 18 and over, so for a younger teen a parent uses Google's standard removal request forms instead. Google also runs a dedicated process to remove images of anyone under 18 from image results, and a parent or guardian can file it on the child's behalf. Removing a search result does not delete the source, but it makes the detail far harder to stumble onto.

If you live in California, there is now a shortcut worth using. The state's DROP (Delete Request and Opt-out Platform), created under the Delete Act, lets a resident submit one request that directs every registered data broker — over 600 of them — to delete their data. Critically for families, the state agency confirms that a parent may submit a request on behalf of a child. Consumers can submit requests as of January 2026, and brokers must begin honoring them by August 2026 and re-check the platform at least every 45 days. It covers only California residents and California-registered brokers, and it will not erase underlying public records — but it replaces hundreds of separate opt-outs with one.

Finally, a word on paid removal services, because parents ask. They help, but less than the ads imply. A 2024 Consumer Reports study found the services removed only about 35% of a person's listings after four months — and that doing the opt-outs by hand worked around 70% of the time, beating every paid service tested (Optery and EasyOptOuts performed best). Choose carefully: reporting revealed that one service, Onerep, shared ownership with an active people-search broker. Consumer Reports' free Permission Slip app is a low-effort middle path that sends stop-selling requests on your behalf.

Why removal is whack-a-mole

Removal is whack-a-mole because brokers constantly rebuild their databases from the same public sources you can't delete — so a record you take down today can quietly reappear months later. Knowing this in advance is what keeps opting out from feeling like failure.

The FTC is candid about it: opting out does not delete the underlying public records, so if those records change your information can reappear for sale, and it can still surface through the listings of relatives and neighbors. Many privacy laws also carve out “publicly available information,” which means data pulled from public filings often stays fair game even where deletion rights exist. And the sheer number of brokers — an April 2025 analysis counted around 750 across state registries, and that is only the ones that registered — means no family can hand-clear them all.

You can even see the assumption built into the law. California's DROP requires brokers to re-check the deletion platform at least every 45 days — a rule that only makes sense because everyone involved knows the data keeps coming back. So reset the expectation: opting out is not a one-time delete, it is periodic maintenance, twice a year or so. Which is why the most durable protection is not removal at all — it is making sure less gets collected in the first place.

Long-term data hygiene

The durable win is minimizing what gets collected — a handful of habits that quietly shrink your teen's footprint at the source, so there is less for any broker to gather, merge, and sell. Do these with your teen, not to them; the aim is a young person who understands why, not one who feels policed.

• Freeze your teen's credit. Since 2018, federal law lets a parent place a free credit freeze on a child under 16 at all three bureaus (a 16- or 17-year-old usually has to place their own — check each bureau's process). It is the single most effective step against identity theft on that clean-slate SSN, and it stays until you lift it.
• Lock down app permissions — especially location. Apps are a main pipeline of precise location to brokers. Review each app's access to location, contacts, and photos, and set location to “while using” or off. Limit ad tracking too: on iPhone, turn off “Allow Apps to Request to Track” (Settings › Privacy & Security › Tracking) and review Location Services; on Android, delete or reset the advertising ID and turn off ad personalization. Screen Time on iPhone and Family Link on Android can lock these choices in place.
• Minimize what's out there. Use a separate email for shop and sign-up accounts, keep usernames unique so profiles are harder to link, delete old accounts nobody uses, and skip the fun online quizzes — many exist to harvest answers as data.
• Opt out of school directory information. Ask the school how to exclude your teen's details from “directory information” releases; it is usually a single form at the start of the year.
• Re-check twice a year. Put a recurring reminder to re-run the big opt-outs and re-search your teen's name, since listings return.

None of this requires vanishing from the internet, and none of it works as a single heroic afternoon. It works as a rhythm. The same habit that shrinks broker exposure — knowing what is out there and tidying it regularly — is the one that protects your teen everywhere else too. If you want a place to start, sit down together and audit your teen's footprint, then work through the pillar guide's walkthrough on cleaning up and locking down. For the bigger picture of what a footprint even is, start with what a digital footprint is.

Keep the long view. Your teen's data being out there is not a verdict on your parenting or their carefulness — it is the default condition of growing up online in a market built to collect. What you can control is how much is exposed and how routinely you tend it. Do that, and you turn an overwhelming problem into a manageable, twice-a-year habit.

Frequently asked questions