Data Brokers, Credit and Identity

Somewhere, a website you have never visited lists your address, your phone number, your age and the names of your relatives. It built that page from public records and data bought from other companies. Some of the same data gets sold to police, which Data brokers and police purchases covers. Some of it leaks to criminals, who use it to borrow money in your name. You cannot erase yourself from this business. You can shrink what is out there and make the stolen pieces useless.

The threat: how your file gets built and used

How a data broker builds a profile

In 2014 the FTC studied nine data brokers and published what it found. They pulled from government records, from commercial sources such as purchase histories, and from other public sources such as social media and the open internet. The scale is hard to picture. One broker's database covered about 1.4 billion consumer transactions and over 700 billion data elements. Another held about 3,000 data segments for nearly every US consumer. The segments sorted people into marketing buckets with names like "Expectant Parent," "Diabetes Interest" and "Urban Scramble," the last of which the FTC said held a high concentration of low-income Latino and African American consumers.

The trick that makes it work is matching. A broker treats your name, your phone number, your email address and your street address as keys. A magazine subscription has your name and address. A store loyalty card has your phone number and what you bought. A home sale record has your name, address and price. Line them up on the shared keys and they become one person.

Phones added location to the mix. In January 2024 the FTC settled with the broker X-Mode Social, later called Outlogic. The FTC said X-Mode collected precise location data through a software kit built into other companies' apps, through its own apps, and by buying it from other brokers. The data was tied to each phone's advertising ID, so it pointed at individual devices. X-Mode sold it to hundreds of clients, including private government contractors. One clinical research company got data on people who had visited certain medical facilities and then pharmacies or infusion centers around Columbus, Ohio. The order banned X-Mode from selling sensitive location data, such as visits to medical and reproductive health clinics, places of worship and domestic abuse shelters.

The people-search business

People-search sites are the retail counter of the broker trade. They put the same matched records on a page under your name, show a teaser free, and charge for the full report: past addresses, phone numbers, relatives. Anyone with a few dollars and your name can find your front door, including an ex under a protection order. It has ended in murder: in 1999 a New Hampshire man paid the online broker Docusearch for Amy Boyer's Social Security number and work address, then found and killed her, and in Remsburg v. Docusearch (2003) the state Supreme Court held that brokers and investigators who sell such information can be liable for the harm.

Removal is a treadmill. A listing you delete can come back when the site buys its next batch of data. Consumer Reports tested this in 2024: 7 paid removal services against 13 people-search sites, with 32 volunteers, over four months. EasyOptOuts and Optery did best, at 65 and 68 percent. The worst two managed 4 and 6 percent. Manual opt-outs had about a 70 percent success rate within a week. Every participant still had listings somewhere at the end.

Breaches: the data is already out

If you had a credit file in 2017, there is a fair chance your Social Security number has already leaked. In September 2017 Equifax, one of the three credit bureaus, announced a breach that exposed the personal information of 147 million people. Its settlement with the FTC, the CFPB and 50 states and territories was worth up to $425 million.

Then a broker became the breach. National Public Data was a background-check company run by Jerico Pictures, Inc. Its own breach notice said a third-party bad actor tried to hack its data in late December 2023, with possible leaks in April 2024 and summer 2024. The data suspected of being breached included names, email addresses, phone numbers, Social Security numbers and mailing addresses. (The site now carries a banner saying Jerico no longer runs it.) Most people in a background-check file never signed up for anything. The company collected their records from elsewhere, and its customers were the people doing the looking.

How identity theft works

The most common kind is new-account fraud. A thief with your name, date of birth, Social Security number and an old address applies for a credit card or a loan. The lender pulls your credit file from a bureau to decide. If the file comes back clean, the lender approves, and the bills go to an address the thief controls. You hear about it months later from a collector.

The credit file pull is the choke point. A credit freeze blocks it. A lender that cannot see your file will not open the account, no matter how much of your data the thief has. Monitoring only tells you after the fact; the freeze stops it.

The other kind is account takeover, often through a reused password or a hijacked phone number (see Messaging and Calls). A freeze does nothing there; unique passwords and app-based two-factor sign-in do.

The FTC received more than 1.1 million identity theft reports through IdentityTheft.gov in 2024, and consumers reported more than $12.5 billion in fraud losses that year, up 25 percent from the year before.

Synthetic identity: a person who does not exist

Synthetic identity fraud skips the step of pretending to be you. The Federal Reserve's 2019 paper lays out how it goes. The fraudster combines a real Social Security number with an invented name and birth date. The first credit application gets rejected, but the bureau still creates a file for the new identity, and that file becomes its proof of existence. The fraudster keeps applying until some lender says yes, then makes careful payments for months, sometimes paying to be added as an authorized user on a stranger's good account. Then comes the bust-out: max every line and vanish.

The Fed says the victims whose numbers get used are typically children, the elderly and the homeless, because they rarely check credit. A child's number can be misused for years and surface only when the child applies for a first student loan. The paper cites an industry estimate of $6 billion in synthetic identity losses to US lenders in 2016, and another estimate that 85 to 95 percent of likely synthetic applicants were not flagged as high risk by traditional fraud models.

Who is most at risk

Survivors of stalking and domestic violence, for whom a people-search listing can be a map to a new apartment. Public officials, election workers and reporters, who draw angry strangers. Older adults and children, whose credit files sit unwatched.

How to reduce it

Level 1 Everyday

Freeze your credit at all three bureaus. It answers new-account fraud and the credit-building stage of synthetic fraud on your own number. It costs nothing: federal law requires the bureaus to place a freeze free within 1 business day of a phone or online request and lift it within 1 hour. When you apply for a loan, a card or sometimes an apartment, you lift the freeze first. TransUnion says a freeze does not affect your score. It does nothing for accounts you already have, and it does nothing about people-search listings.

A freeze and a fraud alert are easy to mix up:

Freeze your children's files too. The FTC says a freeze for a child under 16 is free and stays until you remove it, though each bureau has its own process for minors. Given whose numbers synthetic fraudsters pick, it is ten minutes well spent. Opting out of prescreened offers cuts the pre-approved card offers that sit in your mailbox for anyone to fish out.

Level 2 Careful

Manual opt-outs answer the people-search problem directly, and in Consumer Reports' test they beat every paid service in the first week. Use an email alias (see Browsing, Search and Email) and give only what the form requires, so the opt-out itself does not feed the broker a fresh email address.

Two smaller moves cut the marketing trail. DMAchoice, run by the Association of National Advertisers, cuts promotional mail; the FTC lists a $6 online fee for 10 years. And if your card issuer offers virtual card numbers, use a separate one for each online store. A breach at one merchant then exposes a number you can cancel without replacing your real card.

Level 3 Private

Paid removal services promise to do the opt-outs for you, again and again. Some help. Pick one from tested results, and keep checking your own name anyway, because none finished the job in Consumer Reports' test.

The Permission Slip app, which files opt-out and deletion requests to companies, was built by Consumer Reports. On May 28, 2026, Consumer Reports announced it was handing the app to the paid removal service DeleteMe, which was to take over operations by July. The app's page still lists a free tier for sending requests yourself, as of October 2026.

If you live in California, DROP does what no app can. One request goes to the more than 600 brokers registered with the state, and since August 1, 2026, registered brokers must check DROP at least every 45 days and delete matching data. It covers California residents only. Idaho has no law like this. As of October 2026, the trade practices title of the Idaho Code has no chapter on consumer data privacy or data brokers, and no state registry of brokers. An Idaho resident's tools are each site's own opt-out process and the federal credit laws above. If that bothers you, say so to your legislators.

Address control answers the next round of records. Brokers learn your address from the forms you fill out, so stop giving them the real one. Rent a Post Office box, or a private mailbox at a mail store, and use it for packages, subscriptions, store accounts and sign-up forms. Update addresses one account at a time, starting with stores that sell data. For a private mailbox, the Postal Service calls the business a commercial mail receiving agency, and you fill out USPS Form 1583 and show two IDs: one government photo ID and one that confirms your address. The store keeps that form, and the Postal Service can disclose it for law enforcement purposes. The cost is a box fee and a trip to pick up mail. Government agencies that require a residence address will still ask for one, and old records stay where they are.

Level 4 Hardened

Idaho's Address Confidentiality Program answers the government-records part of the problem for survivors. It does nothing about people-search sites that already have your address, so pair it with the opt-outs above.

You must be a survivor of domestic violence, sexual assault, stalking, human trafficking or malicious harassment, at least 18 (or a parent or guardian applying for a minor or incapacitated person). No fee is listed. Certification lasts four years and can be renewed. You get a substitute address that state and local agencies must accept on new records (with narrow exceptions), mail forwarding to your real address, confidential voter registration, and an authorization card. You can use the substitute address for your driver's license, vehicle registration, state benefits, schools and libraries. The ACP page also lists survivor resources, including the Idaho Coalition Against Sexual and Domestic Violence.

If identity theft has already happened, file a report at IdentityTheft.gov. The FTC site gives step-by-step recovery advice and produces the identity theft report you need to place an extended fraud alert, which lasts seven years. Keep your freezes in place while you clean up; expect hours of phone calls. If someone has published your address to harass you, follow Doxxing and harassment.

Level 5 Hyper-vigilant

At this level your home address goes on nothing new. Every new account, delivery and form gets the mailbox address, with no exceptions for "just this once." You repeat your opt-out sweep every quarter from your log, and you search for your phone numbers and email addresses as well as your name, because those are the keys brokers match on. It answers the slow rebuilding of your profile. It costs constant upkeep and a mail routine that annoys everyone you live with.

The ladder for this topic