The Invisible Market: Inside the Unregulated Industry That Knows More About You Than Your Doctor

Somewhere in a data center you will never visit, a file exists with your name on it. It likely contains your address history going back fifteen years, a record of your prescription purchases, an estimate of your household income, flags for financial distress indicators, your political affiliation as inferred from consumer behavior, and dozens of additional data points assembled from sources you never consciously authorized. The company that compiled this profile has almost certainly never contacted you. Under current federal law, it is under no obligation to.

This is the data broker industry — and it is one of the most consequential unregulated sectors in the American economy.

A $200 Billion Market With No Rulebook

The data brokerage business generates an estimated $200 billion or more in annual revenue, according to figures cited by the Federal Trade Commission in its most recent sector study. It encompasses hundreds of companies — some household names like Acxiom and LexisNexis Risk Solutions, many others operating under names deliberately designed to obscure their function. Together, they collect personal information from an extraordinary range of sources: public records, loyalty programs, social media platforms, mobile applications, retail transactions, credit card purchases, insurance filings, and increasingly, data purchased from other brokers.

The resulting profiles are sold to virtually any buyer willing to pay: insurers assessing risk, employers screening candidates, landlords evaluating tenants, political campaigns targeting persuadable voters, law enforcement agencies seeking to circumvent warrant requirements, and debt collectors pursuing individuals through contact information that the individuals themselves may have tried to conceal.

What distinguishes data brokers from other industries that handle personal information is the near-total absence of a direct relationship with the people whose data they trade. A bank or a hospital collects your information in the context of a service you have chosen to use. A data broker may have acquired your information through a chain of transactions involving a dozen intermediaries, none of which you knowingly authorized.

The Legal Architecture of Non-Accountability

The United States has no comprehensive federal privacy law governing data brokers. The regulatory landscape is instead a patchwork of sector-specific statutes — the Health Insurance Portability and Accountability Act covers certain medical records, the Fair Credit Reporting Act governs credit-related data, the Children's Online Privacy Protection Act addresses data collected from minors — each with significant gaps and none designed with the modern data broker model in mind.

The FTC has authority to pursue data brokers for deceptive or unfair trade practices under Section 5 of the FTC Act, and it has exercised that authority in a handful of cases. But those cases represent enforcement at the margins. The agency has repeatedly called on Congress to pass comprehensive legislation establishing baseline rights — the right to know what data is held, the right to correct inaccuracies, the right to opt out of certain uses — and Congress has repeatedly declined to act.

The lobbying apparatus behind that inaction is substantial. The data broker and digital advertising industries spent more than $100 million on federal lobbying activities in 2022 and 2023, according to disclosures compiled by OpenSecrets. Trade associations representing the industry have successfully argued that data collection and sale constitute protected commercial speech under the First Amendment — a legal theory that has gained traction in some federal courts and complicated the regulatory picture considerably.

Political Weaponization and the Consent Fiction

Perhaps nowhere is the gap between public awareness and actual practice more stark than in political data operations. Campaigns at the federal, state, and local level now routinely purchase commercial data broker profiles to supplement their voter files — layering consumer behavior data, financial stress indicators, and inferred psychological profiles onto traditional demographic information to enable targeting of extraordinary precision.

Voters who believe they understand why they are receiving particular political messages — because of their party registration, their zip code, their television viewing habits — frequently have no awareness that their commercial data profile has been matched to their voter record and used to craft messaging specifically calibrated to their documented anxieties and preferences.

The consent mechanisms that nominally govern this process are, in practice, largely fictional. The terms-of-service agreements through which many data collection relationships are technically authorized run to tens of thousands of words. Research by the Annenberg School for Communication has found that reading every privacy policy an average American encounters in a year would require approximately 76 full working days.

State-Level Resistance and Its Limits

In the absence of federal action, a small number of states have moved to establish rights around data broker activity. California's Delete Act, signed into law in 2023, created a mechanism allowing residents to request deletion of their data from all registered brokers through a single portal — a significant step, though implementation remains incomplete. Vermont requires data brokers to register with the state and disclose basic information about their operations. Several other states have passed broader consumer privacy laws with provisions that touch on broker activity.

But state-level solutions face a fundamental limitation: data has no borders. A California resident's profile, once sold to a broker operating in a state with no privacy law, receives no protection. And companies have shown considerable creativity in structuring their operations to minimize exposure to the most stringent state regimes.

The people whose information underlies this entire economy remain, in the main, unaware of its existence — which is, for many of its participants, precisely the point.