How to Prevent Data Broker Collection in 2026

What Are Data Brokers?

Data brokers are companies that collect, aggregate, and sell personal information about consumers. You’ve likely never heard of most of them, yet they know more about you than your closest friends.

The industry operates largely invisibly:

Nobody knows exactly how many data brokers exist. Estimates run into the thousands
Only a few states make them register. California’s registry lists 603 brokers (CPPA), and Vermont, Oregon and Texas each list a few hundred
Most consumers have no idea these companies exist or hold their data

Some of the biggest names:

Experian: $8.4 billion revenue in the year to March 2026 (Experian), marketing data on 300+ million US consumers
Equifax: $6.1 billion revenue in 2025 (Equifax), plus 209 million active employment records in its The Work Number database
Epsilon: bought by Publicis for $4.4 billion in 2018, says it reaches 200+ million US consumers
Acxiom: bought by IPG for $2.3 billion in 2018, now part of Omnicom, says it covers about 260 million US people
CoreLogic (now Cotality): property data company covering nearly every US property

The typical profile contains:

Hundreds or thousands of data points. Acxiom once said it held, on average, 1,500 pieces of information on more than 200 million Americans (CBS News)
Personal identifiers, contact information, demographics
Purchase histories, browsing behaviors
Location data, social connections, behavioral patterns
Inferred sensitive information (health, politics, religion)

How the Broker Economy Works

The Business Model:

Data brokers don’t sell products to you. They sell you as a product to others.

Collection → Aggregation → Enhancement → Sale

Collection: Gather data from hundreds of sources (detailed in next section)
Aggregation: Combine data points from different sources into unified profiles
Enhancement: Use statistical models and AI to infer attributes that were never directly collected
Sale: Package and sell access to these profiles to buyers

Who buys the data:

Advertisers targeting specific demographics
Insurance companies assessing risk
Employers screening candidates
Landlords evaluating renters
Financial institutions determining creditworthiness
Political campaigns identifying voters
Other data brokers (profiles get resold multiple times)

Market size and growth:

One market research firm, Market.us, puts the global market at $323 billion in 2024, growing to $698 billion by 2034
Other firms estimate 2024 at roughly $278 to $318 billion. Treat all of these as rough estimates

What a shopping extension is worth:

PayPal paid about $4 billion for the Honey coupon extension in 2020. PayPal said the deal would help “simplify and personalize shopping.” What it got was a browser extension installed by millions of shoppers, with a view of:

What people were about to buy, and where
Their browsing on shopping sites
Which affiliate links led to purchases

PayPal now runs PayPal Ads, which targets ads using “actual purchase data” (PayPal).

How Data Brokers Collect Your Information

Data collection happens through dozens of channels simultaneously. Understanding these methods reveals where to focus prevention efforts.

1. Browser Extensions

The Honey example:

Installed by users voluntarily for “savings”
One user’s 2020 data request showed Honey had logged 2,591 page views in about three months (datarequests.org)
Logged the websites visited, with timestamps
The logged web addresses exposed order numbers and search queries
Recorded which affiliate links led to purchases

Other extension threats:

In 2025, Urban VPN Proxy (about 7.3 million users on Chrome and Edge) and three related extensions (8 million users in total) were caught harvesting AI conversations (Infosecurity Magazine)
Targets included ChatGPT, Claude, Gemini and Copilot conversations
Avast collected browsing data through its antivirus software and browser extensions and sold it through its Jumpshot subsidiary. The FTC fined it $16.5 million and banned it from selling browsing data for advertising (FTC)
Extensions with broad permissions can see everything you do in the browser

What extensions can collect:

Complete URL history
Page titles and content
Form inputs before submission
Shopping cart contents
Time spent on each site
Navigation patterns
Device and browser fingerprints

2. Cookies and Tracking Pixels

Cookies:

Small files stored in your browser
Track you across websites and over time
First-party cookies are used more as browsers block third-party ones
In a 2023 study of the 10,000 most popular websites, sites set 5.5x more third-party cookies after visitors clicked “accept” (Rasaii et al.)

Tracking pixels:

1x1 invisible images or scripts embedded in websites and emails
Send data directly to the tracker’s servers
Capture IP address, device type, browsing patterns
The Meta (Facebook) Pixel was found on about 30% of the 100,000 most popular websites (The Markup, 2020)
Still send your IP address, device details and the page you’re on when cookies are blocked

Combined tracking:

Cookies identify you across sessions
Pixels report behavior in real-time
Together they build detailed behavioral profiles
A single page view can share data with many ad companies

3. Mobile Apps and SDKs

Software Development Kits (SDKs):

Pre-built code libraries embedded in apps
Collect data while providing app functionality
Often transmit more data than the app developer realizes

Mobile-specific collection:

Device IDs (IDFA on iOS, AAID on Android)
Rough location from your IP address even with location turned off. Some ad networks have estimated location from nearby Wi-Fi networks after users denied permission
Accelerometer and gyroscope data revealing movement patterns
Wi-Fi networks and Bluetooth for indoor positioning
App usage history
In-app purchase data
Contact lists and communication patterns (when you grant access)

Re-identification capabilities:

In a 2020 study, researchers could re-identify 49% of iOS and 59% of Android ad impressions for under $5 per device per day (Sung et al.)
The same study showed advertisers can leave “marks” in app storage that survive ad ID resets
In a phone dataset of 1.5 million people, just four location-and-time points were enough to single out 95% of them (de Montjoye et al.)

Scale:

Ad auctions share data with many bidders at once
Real-time bidding auctions finish in a fraction of a second
Data broadcast includes location, demographics, behavior

4. IoT and Smart Home Devices

Device surveillance:

The Amazon Alexa app collects 28 of 32 possible data types, and the Google Home app collects 22 (Surfshark, 2024)
Smart TVs use automatic content recognition (ACR) to identify what’s on screen. Texas sued five TV makers over it in December 2025 (Texas Attorney General)
Connected doorbells, cameras, thermostats all report data

What smart devices collect:

Voice recordings of commands
Video/audio surveillance footage
Temperature, lighting, and occupancy patterns
Times you’re home vs away
Device interaction frequencies

Data sharing:

1 in 10 smart home apps use collected data to track users (Surfshark, 2024)
Manufacturers often share/sell usage data
Third-party apps may have access to device data

Platform collection:

Every post, comment, like, share tracked
Unencrypted private messages can be scanned, mainly for safety and abuse
Time spent on different content types
Scrolling patterns and engagement metrics
Photos/videos analyzed for content and people
Location tags from posts and metadata

Extended tracking:

“Sign in with Facebook/Google” tracks across websites
Embedded share buttons and widgets can log your visit without a click. Meta retired its external Like button in February 2026
Pixel tracking on external websites
Mobile app data sharing with Facebook/Meta

What platforms collect:

Complete friend/follower network graphs
Political views inferred from engagement
Relationship status and life events
Shopping interests from browsing/likes
Real-time location from mobile apps

What regulators found:

A 2024 FTC staff report found most large social media and streaming companies collected or inferred demographics such as age, gender, income and marital status (FTC)
The same report found they could keep huge amounts of data indefinitely, including data from data brokers, about users and non-users alike
Profiles shared across Meta/Facebook ecosystem

6. Public Records Scraping

Government and court sources:

Court records (lawsuits, judgments, legal disputes)
Criminal records (arrests, convictions, mugshots)
Bankruptcy filings (debts, financial distress)
Property deeds (real estate ownership, prices, mortgages)
Voter registration (party affiliation, voting frequency) where states release it
Marriage/divorce records (relationship status changes)
Birth and death indexes where states publish them
Motor vehicle records, where the law allows
Professional licenses (occupations, certifications)

Automated scraping:

Specialized services extract public records at scale
Data includes names, addresses, family members
Cross-referenced with other sources for enhanced profiles
Sold in bulk to data brokers

Postal data:

USPS licenses its change-of-address database (NCOALink) to address-update companies (USPS)
Companies that already have your name and old address can get your new one
Moving triggers targeted marketing campaigns

7. Financial Transaction Data

Credit reporting agencies:

Track every credit account, payment, balance
Monitor credit applications and inquiries
Record bankruptcies, collections, foreclosures
Equifax also runs The Work Number, a separate database of employment and salary records sold for income checks
Can add utility and phone bill payments

Transaction tracking:

Point-of-sale systems capture purchase details
Card networks such as Mastercard sell aggregated, “anonymized” purchase data (US PIRG)
Banks can share your transaction data with their affiliates. You can opt out of affiliates using it to market to you
Payment processors log merchant categories

Transaction enrichment:

Raw transactions enhanced with merchant details
Spending categorized (groceries, entertainment, healthcare)
Behavioral insights derived from patterns
Risk assessments based on spending behavior

What transactions reveal:

Income level from deposits and spending
Financial stress from budget brand shifts
Health conditions from pharmacy purchases
Lifestyle changes from new spending categories
Travel patterns from transaction locations

8. Loyalty Programs

Signup data collection:

Name, email, phone, address, birthday
Product preferences and shopping frequency
Family size and household information
Income estimates and demographics

Ongoing tracking:

Complete itemized purchase history
Product brands and categories purchased
Purchase timing and frequency patterns
Price sensitivity and discount responsiveness
Store locations visited (geolocation via app)

Data monetization:

Can be sold or shared with data brokers and advertising networks
Shared with third-party analytics firms
Can be used for personalized pricing (different prices for different customers)
Enables predictive analytics for future purchases

Cross-referencing:

Email links loyalty data to online browsing
Mobile apps connect in-store and online behavior
Payment methods tie purchases across retailers

9. Real-Time Bidding Advertising

How RTB works:

You visit a website with ad space
An auction runs in a fraction of a second
Your data is broadcast to the companies bidding
Highest bidder’s ad displays

Data shared per impression:

IP address (reveals location and ISP)
Device type, OS, browser version
The page you’re on
Demographic inferences from previous tracking
Behavioral profiles from cross-site tracking
Sometimes sensitive categories, such as health interests

Privacy implications:

The Irish Council for Civil Liberties estimated that a US person’s data is broadcast 747 times a day (ICCL, 2022)
No control over who receives your information
Profiles built from aggregate auction data
Cross-device tracking links phones, tablets, computers

10. Additional Collection Methods

Online forms and surveys:

Contests and giveaways require detailed information
Product registration forms capture ownership data
Newsletter signups provide email for cross-referencing
Quizzes designed to gather personality/preference data

Commercial data sharing:

Retailers sell customer lists and transaction histories
Catalog companies share mailing lists
Financial services share credit/banking info
Pharmacies sell de-identified prescription records to data firms such as IQVIA, and studies show such records can be re-identified

Data broker trading:

Brokers buy and sell data between themselves
Single person’s data appears in dozens of databases
Each broker adds value through enhancement
Profiles grow more detailed through aggregation

AI-powered inference:

Algorithms generate new data points without direct collection
Purchase patterns infer health conditions
Browsing behavior reveals political leanings
Social connections suggest demographics
Example: Publicis says its CoreAI system draws on 2.3 billion profiles of people

What gets inferred:

Pregnancy status from purchase patterns
Health conditions from pharmacy/supplement purchases
Political affiliation from browsing and social media
Sexual orientation from app usage and location
Financial stress from spending changes
Education level from vocabulary and browsing
Personality traits from behavioral patterns

The Profile They Build

Combining all these sources, brokers create profiles containing:

Identity:

Full name, aliases, maiden names
Current and previous addresses
Phone numbers (mobile and landline)
Email addresses
Social Security number (from credit header data)
Date and place of birth

Demographics:

Age, gender, race, ethnicity
Education level
Occupation and employer
Income estimate and net worth
Marital status and household size
Homeowner vs renter status

Behavioral:

Purchase history
Browsing habits and search queries
App usage patterns
Social media activity and connections
Location history and movement patterns
Media consumption (TV shows, music, podcasts)

Financial:

Credit-based scores and estimates
Investment and net worth estimates
Debts and payment history
Insurance policies
Tax liens and judgments

Sensitive (Inferred):

Health conditions and medications
Political affiliation and voting likelihood
Religious beliefs
Sexual orientation
Psychological profile
Vices and addictions
Life changes (pregnancy, divorce, job loss)

This data sells for:

As little as $0.0005 per person for basic details like age, gender and location (Financial Times data, via NPR)
About $0.26 per person for lists of people with specific health conditions
Much more for detailed, high-value prospect lists

Now let’s prevent them from collecting this data in the first place.

1. Browser Setup

Choose Your Browser

Best Pre-Configured Options:

Brave - Blocks trackers by default, runs Chrome extensions
LibreWolf - Firefox-based, no telemetry, comes with uBlock Origin installed
Safari + content blocker - For Apple users, pair with AdGuard or 1Blocker

Requires Manual Setup:

Firefox - Good option but needs configuration:
- Settings > Privacy & Security > Set Enhanced Tracking Protection to Strict
- Under Firefox Data Collection and Use, uncheck “Send technical and interaction data to Mozilla”
- Turn on “Tell websites not to sell or share my data”
- Change default search to DuckDuckGo/Startpage
- Enable HTTPS-Only Mode
- Install uBlock Origin extension

Essential Browser Settings

All Browsers:

✓ Block third-party cookies
✓ Clear cookies/cache on exit
✓ Turn on Global Privacy Control where available (on by default in Brave and DuckDuckGo, a setting in Firefox, not built into Chrome or Edge)
✓ Set HTTPS-only mode
✓ Disable location access in browser settings

2. Browser Extensions

Install in this order of priority:

Tier 1: Ad/Tracker Blocking

Choose one:

uBlock Origin - Full version works in Firefox, Opera and, for now, Brave. Chrome and Edge no longer support it, so use uBlock Origin Lite there
AdGuard - Good choice for Chrome (MV3 version), with extensions for other browsers and separate apps

Tier 2: Second Layer

Privacy Badger - Complements uBlock/AdGuard, blocks trackers from a list EFF keeps updated, and sends Global Privacy Control

Tier 3: Script Control (Advanced)

NoScript - Blocks JavaScript by default, steeper learning curve
- Available for Firefox and Chromium browsers (Chrome, Edge, Brave)

Setup:

Install extensions from official browser stores only
Enable all blocking features
Whitelist only trusted sites as needed

3. Hide Your IP Address

Option A: Traditional VPN

Recommended Providers:

Mullvad - No email required, strong privacy (flat €5/month, about $5.60)
ProtonVPN - Switzerland-based, good reputation (free plan; paid from $3.49/month on a two-year plan, $9.99 month to month)
ExpressVPN - Fast, widely supported (three tiers, cheapest on longer plans)

Setup:

Subscribe to provider
Download/install their app
Connect before browsing
Verify connection at ipleak.net

Important: VPNs don’t block trackers. Use with browser extensions.

Option B: Apple iCloud Private Relay

For Apple users only:

Available on iOS 15+, iPadOS 15+, macOS Monterey+
Included with iCloud+ ($0.99-59.99/month in the US)
Enable: Settings > [your name] > iCloud > Private Relay

Limitations:

Covers Safari, DNS lookups and unencrypted web traffic in apps, not all app traffic
Traffic that goes through a VPN skips Private Relay
No server location choice (only “general location” or “country and time zone”)

4. Email Aliasing

Generate unique email addresses for each service to prevent tracking across accounts.

Apple Hide My Email Setup

Settings > [your name] > iCloud > Hide My Email
When entering email on websites, tap “Hide My Email” autofill suggestion
Manage aliases in Settings or iCloud.com

Works with: Sign in with Apple, Safari and Mail, third-party apps (iOS 16+), the contact email in Apple Pay checkouts (iOS 17+)

SimpleLogin/Addy.io Setup

Create account at simplelogin.io or addy.io
Install browser extension
Click extension icon when prompted for email
Generate new alias with one click

Usage Strategy

Create separate emails for:

Banks, government, healthcare (primary address - never give to retailers)
Trusted retailers (secondary address)
Everything else (use aliases)

5. Virtual Payment Cards

Prevent transaction tracking with unique card numbers per merchant.

Privacy.com

Setup (US only):

Sign up at privacy.com
Link a US checking account or debit card
Install browser extension (optional)

Usage:

Generate new card for each merchant
Set spending limits per card
Use merchant-locked cards (card only works at first merchant used)
Close/pause cards instantly if compromised

Card Types to Create:

Single-use cards for one-time purchases
Subscription cards with monthly limits
Category cards for recurring expenses (groceries, utilities)

Alternatives:

Capital One virtual card numbers (in the Capital One app or website)
Revolut virtual cards
PayPal (doesn’t share your full card details with merchants)

6. Secure DNS

Make it harder for your ISP to see and change your DNS lookups. Your ISP can still see the IP addresses you connect to, and often the site names.

Setup Instructions

Windows 11:

Settings > Network & internet > Wi-Fi or Ethernet > your network’s properties
Next to DNS server assignment, select Edit
Select Manual, turn on IPv4
Enter Preferred DNS: 1.1.1.1, Alternate: 1.0.0.1
Set DNS over HTTPS to “On (automatic template)” for both, then Save

macOS:

System Settings > Network > Your Connection
Details > DNS
Add DNS Server: 1.1.1.1 (this changes provider but doesn’t encrypt)
For encryption: install Quad9’s configuration profile or Cloudflare’s 1.1.1.1 app

iOS:

In Safari, download a DNS configuration profile from your provider (Quad9 offers one), or install Cloudflare’s 1.1.1.1 app
Go to Settings > Profile Downloaded
Tap Install and follow the prompts

Android:

Settings > Network & Internet > Private DNS
Select “Private DNS provider hostname”
Enter: one.one.one.one (Cloudflare) or dns.quad9.net (Quad9)

Router (All Devices):

Access router admin (check the sticker on the router, often 192.168.0.1 or 192.168.1.1)
Find DNS settings
Replace ISP DNS with chosen provider
Save and reboot router

7. Mobile Privacy Settings

iOS Configuration

Location Services:

Settings > Privacy & Security > Location Services
Set apps to “Never” or “While Using the App” (not “Always”)
Under System Services, disable Location-Based Apple Ads and Location-Based Suggestions

App Permissions:

Settings > Privacy & Security
Review Camera, Microphone, Photos, Contacts
Restrict to minimum necessary

Tracking:

Settings > Privacy & Security > Tracking
Turn off “Allow Apps to Request to Track”

Advertising:

Settings > Privacy & Security > Apple Advertising
Toggle off “Personalized Ads”

Safari:

Settings > Apps > Safari
Keep “Prevent Cross-Site Tracking” on (it’s on by default)
“Block All Cookies” is stronger but breaks logins on many sites

App Privacy Report:

Settings > Privacy & Security > App Privacy Report > Turn On
Review which apps access sensitive data
Remove excessive data collectors

Android Configuration

Permissions:

Settings > Security & privacy > Privacy > Permission manager (names vary by phone)
Review Location, Camera, Microphone, Contacts
Set to “Don’t allow” or “Allow only while using the app”

Advertising:

Settings > Privacy > Ads
Select “Delete advertising ID” (apps then can’t use it to track you)

Location:

Settings > Location
Disable when not needed
Remove permission from unnecessary apps

Universal Mobile Practices

Monthly routine:

✓ Delete unused apps
✓ Review app permissions
✓ Use mobile browser instead of apps when possible

8. Encrypted Messaging

Replace SMS/standard messaging with end-to-end encrypted apps.

Signal Setup (Recommended)

Download from app store
Verify phone number
Your number is hidden by default. To stop strangers finding you by number, set Settings > Privacy > Phone Number > “Who can find me by my number” to Nobody, and share a username instead
Enable disappearing messages for sensitive chats
Enable screen security (on Android, blocks screenshots on your phone; on iPhone, hides Signal in the app switcher)
Turn on registration lock (needs a Signal PIN)

Essential Settings

✓ Enable disappearing messages for temporary conversations
✓ Turn on screen security
✓ Enable Screen Lock (uses your phone’s passcode or biometrics)
✓ Verify safety numbers for sensitive contacts

9. Additional Practices

Account Management

Use password manager (Bitwarden, 1Password)
Enable 2FA on all important accounts
Delete old unused accounts
Never use “Sign in with Facebook/Google”

Set all profiles to private/friends-only
Minimize personal information on profiles
Never do personality quizzes requesting profile access
Review and revoke app permissions regularly

Shopping

Use email aliases for all retail accounts
Use virtual cards for online purchases
Minimize loyalty program participation
Opt out of marketing/data sharing in account settings

Browsing Habits

Clear cookies/history regularly
Use HTTPS websites only
Avoid clicking unknown links
Use VPN on public WiFi
Bookmark login pages instead of searching

10. Implementation Tiers

Choose your commitment level:

Basic Protection (1-2 hours setup)

Browser:

Install Brave or LibreWolf
Install uBlock Origin or AdGuard
Configure privacy settings

Mobile:

Adjust location settings
Review app permissions
Disable ad personalization and app tracking

Basics:

Use password manager
Enable 2FA
Install Signal

Enhanced Protection (3-4 hours setup)

Everything from Basic, plus:

Network:

Subscribe to VPN or enable iCloud Private Relay
Configure secure DNS (Cloudflare/Quad9)

Email:

Set up email aliasing (SimpleLogin/Addy.io/Hide My Email)
Create primary/secondary/disposable address hierarchy

Payments:

Sign up for Privacy.com (US) or another virtual card service
Generate virtual cards for existing subscriptions

Mobile:

Delete your Android advertising ID, or turn off app tracking requests on iPhone
Delete unnecessary apps
Use browsers instead of apps

Maximum Protection (Ongoing commitment)

Everything from Enhanced, plus:

Advanced:

Use Tor Browser for sensitive activities
Use Privacy Badger + NoScript
Self-host email/cloud storage (if technical)
Use hardware security keys

Devices:

Separate devices for different contexts
Consider GrapheneOS (Pixel phones) or CalyxOS for Android. CalyxOS paused updates from August 2025 to July 2026, so check it’s current for your device
Minimize IoT devices

Behavior:

Monthly privacy audits
Regular alias/virtual card rotation
Strict account minimization

Quick Reference Checklist

Browser Setup:

Privacy-focused browser installed
uBlock Origin or AdGuard installed
Privacy Badger installed
Third-party cookies blocked
Clear data on exit enabled

Network Privacy:

VPN or iCloud Private Relay active
Secure DNS configured
DNS encryption enabled (DoH/DoT)

Identity Protection:

Email aliasing service setup
Virtual card service setup
Using aliases for new accounts
Using virtual cards for purchases

Mobile Security:

Location restricted to “While Using”
App permissions reviewed
Ad personalization and app tracking turned off
Unnecessary apps deleted

Communication:

Signal installed and configured
Contacts migrated from SMS
Disappearing messages enabled

Ongoing Maintenance:

Monthly: Review app permissions
Quarterly: Audit active accounts
Quarterly: Review active aliases/cards

Tool Costs

Free Options:

Brave/LibreWolf/Firefox browsers
uBlock Origin/AdGuard/Privacy Badger extensions
Cloudflare/Quad9 DNS
SimpleLogin/Addy.io (free tier with 10 aliases)
Privacy.com (free plan with 12 new cards a month)
Signal
Bitwarden (free plan)
ProtonVPN (free plan)

Paid Services:

VPN: about $3-10/month, depending on plan length
iCloud+ (with Private Relay and Hide My Email): $0.99-59.99/month
Email aliasing premium: $1-4/month
Password manager: $0 to about $6/month
Threema: one-time payment of about $6

Total monthly cost for Enhanced Protection: about $10-25/month

Verification

Test your setup:

Browser protection:

Visit coveryourtracks.eff.org
Run the tracker test
Check for fingerprinting protection

DNS/VPN:

Visit ipleak.net
Verify DNS servers match your configuration
Confirm IP address differs from actual location (if using VPN)