Our personal information is for sale on the internet. We know — we bought it

Attention Thieves

Attention and time are today’s currency. Straight Arrow explores how technology is built to capture both, using human psychology to keep us hooked.

---

The phone rang, but nobody answered, so salesman Steve Madej left a voicemail. He shot off a quick email, too, just to be sure his pitch had landed.

Madej’s call came just minutes after a visitor created an account with his employer, a marketing company called Exact Data, and opened a search for reams of personal information about people the visitor didn’t know. Exact Data probably flies under the radar for most people — but that hasn’t stopped it from amassing detailed dossiers about them. 

Madej is in the business of selling in-depth, tailored profiles about consumers: their shopping habits, their hobbies, their vices. And on this particular afternoon in early July, he was eager to close a sale. 

“We really do everything, both data- and marketing-related,” Madej said in the voicemail. “We’d love to see what we can customize for you.” 

Exact Data isn’t a one-off website: it’s part of a booming data broker industry worth an estimated $270 billion globally in 2024 — and that’s poised to surpass $470 billion by 2032. Every day, people’s lives are documented — and shaped — by data brokers like Exact Data. The companies, including larger firms like Equifax and LexisNexis, collect and sell information extracted from hundreds of millions of people.  

Including you.

Every time a person gives their attention to a device in their hands or on their desktops, their behaviors are tracked. This includes every time they visit a website, tap a “like” button on social media, download a free game from the app store or place an online order. Then, in the form of targeted advertisements and tailored recommendations, it’s all served back to them. 

The purpose of this aggregation of what gets people’s attention is straightforward: to determine what interests them and, ultimately, to get them to open their wallets. 

The data aren’t limited to targeted marketing campaigns. The information pipelines fuel insurance company risk assessments, employer background checks, criminal investigations and political campaigns. In some cases, they have been abused to power criminal operations, including fraud, stalking and murder. Some of the data — about whether someone is pregnant, suffers from mental illness or resides in the country illegally — has been weaponized for political gain. 

All of it is up for sale online, right now. And, Straight Arrow found, each of those personal data points can be yours — with little more than a credit card (and, perhaps, an employer willing to pay the tab). 

Names, addresses and contact information included. 

For $161, Straight Arrow confirmed that a journalist — or, perhaps, just about anybody — can acquire a spreadsheet full of intimate details about affluent New York suburbanites who smoke cigarettes. 

Detailed profiles, for a fee

In the weeks after Straight Arrow created an Exact Data profile, a flood of subsequent check-ins from Madej followed. 

“Steve calling again from Exact Data on that trial registration,” he said in one voicemail. “I was hoping we could connect this week to better understand your specific needs.” 

Exact Data, which describes itself as a “multi-channel data brokerage and direct marketing firm,” sells “highly targeted mailing, email and telephone marketing lists” to advertisers.

In total, the company claims on its website it sells the data of some 230 million people, searchable by some 700 different categories, such as whether they play golf, own a home or have children. 

Data are collected from more than 2,000 sources. Some are public, such as government records. But most are culled from people’s purchasing behaviors, magazine subscriptions, event registrations, online surveys and more. 

Exact Data may also be a source of the spam calls flooding your phone. “Telephone records,” the company claims, “are called regularly for connectivity and contact accuracy.” 

The company is a subsidiary of another data broker, Data Axle, which in turn is owned by the private equity firm Court Square Capital Partners. Court Square and Data Axle didn’t respond to requests for comment. 

A smartphone app may be free to download, but ultimately, it comes at the cost of your location records and information about your consumer habits. Privacy policies, the lengthy documents filled with legal jargon that nobody reads, spell it out, said attorney Caroline Kraczon of the Electronic Privacy Information Center, a Washington-based nonprofit research center. 

“Sometimes they say, ‘OK, by downloading this solitaire app, you’re giving us access to your full camera roll and your location data at all times,’” Kraczon told Straight Arrow. “That app is then making revenue by selling that data to data brokers.” 

Marketing firms, in turn, use the records to create lists of people based on hyperspecific criteria: Whether a person has an above-ground swimming pool, enjoys gambling, owns a boat, donates to environmental causes or smokes cigarettes.   

While Exact Data allows the purchase of one-off lists, the company also offers monthly plans for as little as $99 — a deal the company says is “ideal for day-to-day prospecting and market exploration.” 

Data brokers are everywhere, whether you know it or not

Hundreds, perhaps thousands, of data brokers are currently in business. Emory Roane, the associate director of the nonprofit Privacy Rights Clearinghouse, has been sounding the alarm about their implications for years. 

“Data brokers are the central cog around which every privacy problem that we have revolves,” Roane told Straight Arrow, including law enforcement access to abortion clinic visitors. In one case, the data were used by a conservative Catholic organization to expose gay priests. 

Data brokers take several forms, including people-search websites, which Consumer Reports has dubbed “the fast-food outlets of the industry.” Such sites, like Whitepages, allow people to easily purchase the contact information of just about anyone. Marketing brokers, like Exact Data, compile comprehensive consumer profiles to power targeted ads. Then there are the credit reporting agencies — Experian, TransUnion and Equifax — that collect financial information about people and sell it to lenders and banks. 

“Most of the time it’s not like calling Steve and having the equivalent of a digital drug deal,” Roane said. Major corporations benefit from a lax digital privacy landscape that also breeds an industry that operates through “sketchy conversations with a guy named Steve” willing to sell highly targeted lists “like wealthy New Yorkers that smoke cigarettes and own French bulldogs or were Kamala Harris supporters.” 

While the data can be leveraged by advertisers to identify New Yorkers with the disposable income for a carton of Marlboro Red cigarettes, it’s also been used to facilitate crime — including murder. Data brokers played a role in the case of Vance Boelter, who, in July, was sentenced to two life sentences in prison for assassinating former Minnesota House Speaker Melissa Hortman and her husband, Mark, and for carrying out an attack on state Sen. John Hoffman and his family. 

Boelter turned to as many as 11 data brokers to track down the home addresses of Democratic lawmakers he targeted over their political positions, according to court records.

Information from data brokers also helped power scams and identity theft to the tune of an estimated $20.9 billion in losses to consumers, according to a report released in February by Sen. Maggie Hassan, D-N.H. In some instances, cybercriminals have stolen people’s information through data breaches, which have affected the industry multiple times in just the last few years. In 2024, for example, a breach at National Public Data exposed nearly 3 billion sensitive records affecting as many as 270 million people. 

The breach highlights the vast capabilities — and vulnerabilities — of both major corporations and smaller companies, said Roane, of the Privacy Rights Clearinghouse. 

“It’s one of the largest data breaches in history and it’s by a data broker that was essentially one guy” whose “extremely small operation” had amassed “extremely sensitive data” about “an extremely large number of people,” Roane said. 

“When they were breached and people were trying to recover from it, it was like squeezing blood from a stone,” Roane said. “There’s nothing to do there.”

Inside the patchwork of state data broker laws

Handing data brokers your personal information is easy. Getting it back is another story entirely.

Despite numerous failed attempts, no federal data privacy laws exist to regulate the brokers, leaving a patchwork of state laws and rules with varying degrees of protections for consumers. 

Last year, the Trump administration scrapped a Biden-era proposal by the Consumer Financial Protection Bureau to limit how data brokers sell Americans’ sensitive information. The proposal would have required data brokers to get consent from consumers before selling their financial data — a rule that already applies to credit agencies like Experian under the federal Fair Credit Reporting Act of 1970. 

Texas, Vermont and more than a dozen other states have consumer privacy laws that give people the right to opt out of having their information collected and used for targeted advertising. Yet it’s often difficult for people to identify who has their information and who is buying it, said Kraczon, of the Electronic Privacy Information Center. An investigation she released in May found that, in some cases, data brokers have intentionally complicated the online opt-out process through the use of “manipulated design practices.”

To Roane, his home state of California is leading the charge against data brokers. He helped write the Delete Act, which passed in 2023 and created an online database of data brokers operating in the state. State laws establishing data broker registries now exist in seven states. 

Among some 600 registered data brokers is Exact Data, which, according to the online portal, collects information about children and sells the data to artificial intelligence companies. 

Through an online portal that went live in August as part of the law, California residents can now ask every registered data broker in the state to delete their information. Companies that fail to comply could face fines. 

“The Delete Act is a very big deal that is about to become an even bigger deal,” Roane said. If data brokers face fines if they fail to comply, he said, it has “the power to really radically change the market.” 

Advertising groups, meanwhile, have leveraged data broker records to mount opposition campaigns against regulations. Among them is the Consumer Data Industry Association, which argued against the California data broker law in the name of consumer safety. Dan Smith, the trade group’s president and CEO, has argued the law “undermines consumer fraud protections, hurts small businesses’ ability to compete and solidifies the big platforms’ data dominance,” the trade group’s president and CEO, Dan Smith, said in a statement at the time.  

The association declined to comment for this story. 

Given the pushback from business groups, Roane said federal data broker rules are unlikely in the near future. But the companies have run into regulatory scrutiny on several occasions from the Federal Trade Commission, which investigates unfair and exploitative data broker practices. 

Exact Data has gone by multiple names since it first got into the brokerage business more than two decades ago. Among them is ConsumerBase, which was warned by the FTC in 2013 that it may have violated the Fair Credit Reporting Act after a broader undercover operation.  

The agency warned the company that if it sold consumer data to target people with pre-approved credit offers, it was required to verify the identities of the people seeking the data — and to ensure the records were being purchased for a legitimate purpose. 

‘Come back when you need more’

Straight Arrow built a custom list, entered a credit card number and hit purchase. Just like that, this reporter thought, a targeted list of nicotine-crazed residents from New Rochelle, New York, with household incomes of at least $250,000 would become available for download.

Not quite. That is, not without a phone conversation with Madej, the zealous salesman. 

For “online orders,” he explained in a remarkably punctual email, “we do need to verify on a phone call.”

The identity verification process was cleared up on a four-minute phone call with Madej, who told Straight Arrow he needed to make sure “you’re not some fraudster and everything is legit.” 

The check seemed to stem from that 2013 FTC Fair Credit Reporting Act warning. In a follow-up email, Madej said the phone screening was an internal process to “avoid processing a payment for someone using a fraudulent card” and to ensure “the person on the line is a legit business and using the data for the correct purpose.” He said the company does “not sell any customer credit info, history or credit rating.” 

Straight Arrow notified Madej that he was speaking to a journalist, but he wasn’t deterred. If anything, he leaned in harder into his sales pitch. 

“Well you’re in the right place, then, if you’re looking for quality data,” Madej said. “We’re the No. 1 compiler in the industry.” 

Madej explained that Exact Data is “not a credit-based company” and that its “primary line of work is data compilation.” 

The next day, the data was ready for download, complete with the data for 60 wealthy tobacco users who met Straight Arrow’s specific criteria. Included with each individual were 86 distinct data points, including their estimated household income, political affiliation, marital status, ethnicity and purchasing behavior. 

Among them is Beth, for example, a Republican who owns a $600,000 house just a few doors down from a neighborhood park and is a “very aggressive investor.” And there’s Craig, who, along with enjoying an occasional smoke, is listed in the spreadsheet as a Democrat with a net worth of $13 million. 

Whether the data — all unknowingly given up by Beth and Craig and their neighbors — are accurate is another question. Using Exact Data, one can look up their own information. A review by Straight Arrow reveals the database includes information that is outdated and, in some cases, plainly incorrect.    

Whether a journalist’s purchase of the data is legitimate is a point of disagreement. Kraczon said there are valid arguments for providing data to researchers or journalists, but including personally identifiable data “definitely doesn’t seem legitimate.” 

“It’s just so creepy,” she said. “If you were doing research for a story about people who use tobacco products in that country or that city, there would be other ways for you to do research about that. And, you know, more ethical ways to get that information.”

But to Madej, approving the sale of the data was an easy decision. 

“So this particular order just looks like a one-time small email list,” he said. “You pay the fee, we release the file, and then you come back when you need more.”

Round out your reading

• All your questions about napping, answered.
• Trump’s $5,000 promise echoes past payouts that never materialized.
• Inside the effort to make data centers pay their share of electricity costs.
• Why did the Feds seize the ’largest Martian meteorite on Earth’?
• Photos and video show exactly where and when Trump visited Ground Zero after 9/11.