An investigative deep-dive into the buyers of personal data from brokers, backed by government documents, court cases, and regulatory actions.
Federal, state, and local agencies routinely purchase commercially available data (CAI) to sidestep warrant requirements, accessing precise location, travel, and personal records.
Government agencies purchase data that would normally require a warrant, exploiting the "third-party doctrine" loophole. This allows surveillance without judicial oversight.
FTC Action - December 2024
The FTC took action against Venntel and Gravy Analytics for selling sensitive location data, including tracking people to health clinics and places of worship.
Ongoing Government Contracts
LexisNexis Accurint contracts are extensively used by ICE and other agencies for people-search, license, and utility data access.
2025 reporting reveals that flight reservation data is being sold to CBP/ICE through data brokers, providing detailed travel patterns without warrants.
Watchdog organizations and regulators are pushing back against warrantless government data purchases
The Office of Management and Budget faces pressure to curb agency purchases of commercially available information (CAI).
POGO (Project On Government Oversight) and other watchdogs are demanding transparency and restrictions on warrantless data purchases.
Bipartisan congressional concern over government end-runs around the Fourth Amendment through commercial data purchases.
Proposed legislation would require warrants for government purchase of location and other sensitive commercial data.
Private companies across industries purchase personal data for advertising, risk assessment, customer acquisition, and competitive advantage.
The largest commercial buyers of personal data
Brands, ad networks, and demand-side platforms (DSPs) buy or license audience segments to micro-target ads across web, mobile apps, and connected TV.
The Markup investigation revealed granular targeting categories including:
Oracle's acquisitions of BlueKai and Datalogix demonstrate how retail purchase data links to ad targeting used by major platforms.
New America research shows how this data enables unprecedented micro-targeting across web, mobile, and streaming platforms, fundamentally changing how advertising works.
Customer enrichment and competitive intelligence
Retailers enrich CRM and loyalty files with third-party attributes to model customer churn, lifetime value (CLV), and create look-alike audiences.
Leading data broker Acxiom markets comprehensive customer enrichment services to major retailers.
Risk assessment and customer acquisition
Banks and lenders use brokered data for identity verification, fraud detection, and customer acquisition, sometimes operating under Fair Credit Reporting Act (FCRA) constraints.
Background-check and people-search brokers have faced FTC actions when acting as Consumer Reporting Agencies (CRAs) without proper compliance.
Auto insurers received driving and telematics data (speeding, late-night driving) via automaker data streams and brokers.
FTC settlement banned GM/OnStar from sharing driving data for five years and revealed relationships with LexisNexis and Verisk.
Medical data outside HIPAA protection
Health marketers, pharmaceutical companies, and insurers acquire wearable/app and retail pharmacy-adjacent data from commercial sources—not protected by HIPAA when collected outside covered entities.
Health data collected by apps, wearables, and retailers falls outside HIPAA protection, making it freely tradeable.
Consumer Federation of America warns that brokers may share medical-adjacent signals with insurers and retailers, potentially impacting prices and access to services.
Micro-targeting voters and donors
Data-driven campaigns buy brokered segments and specialized voter files to micro-target fundraising, persuasion, and turnout across platforms.
Occasional data routing mishaps (like Snap/i360 integration) reveal how widely these political data feeds are integrated across platforms.
This micro-targeting capability fundamentally changes political communication, enabling campaigns to deliver different messages to different voters based on detailed personal profiles.
The opaque web of data enrichment
Brokers frequently license data to each other to "enrich" their files, making data provenance increasingly opaque—a long-standing problem identified by the FTC.
Your personal information is bought and sold by a vast ecosystem of organizations. Here's who's purchasing your data and what they're doing with it.
Federal, state, and local agencies routinely purchase commercially available data (CAI)—including precise location, travel/airline, and utility/home records—often to sidestep warrant requirements.
Venntel/Gravy Analytics: FTC took action in Dec 2024 over tracking people to health clinics and places of worship. Buyers included federal agencies.
LexisNexis Accurint: Contracts used by ICE and other agencies for people-search, license, and utility data.
Brands, ad networks, and DSPs buy or license audience segments to micro-target ads across web, apps, and streaming platforms.
650,000+ granular audience labels including "heavy purchasers of pregnancy tests" and "depression-prone" individuals.
Retailers enrich CRM/loyalty files with third-party attributes to model churn, customer lifetime value, and look-alike audiences.
Banks and lenders use brokered data for identity verification, fraud detection, and customer acquisition.
2025 FTC settlement banned GM/OnStar from sharing telematics data with insurers for five years, noting relationships with LexisNexis and Verisk.
Health marketers, pharma, and insurers acquire wearable/app and retail pharmacy data—not protected by HIPAA when collected outside covered entities.
Data-driven campaigns buy brokered segments and specialized voter files to micro-target fundraising, persuasion, and turnout across platforms.
GPS pings, geofences, venue visits to clinics, houses of worship, military bases
Names, aliases, addresses, utilities, licenses, property, relatives, court records
In-store and e-commerce transactions linked to emails/IDs via retail partners
Vehicle driving behavior, app telemetry, connected TV viewing
Fitness, fertility, mental-health app events, sleep/heart metrics outside HIPAA
Psychographics, propensity scores, "life events," political leanings
December 2024: FTC took action over sale of sensitive location data tracking people to health clinics and places of worship.
Impact: First major enforcement against location data brokers selling to government agencies
January 2025: Banned sharing of telematics data used by insurers; terminated broker relationships.
Impact: Set precedent for automotive data sharing restrictions
Watchdog groups and Congress are pressing government agencies to curb purchases of commercially available information (CAI), with new oversight measures being implemented.
This vast ecosystem of data buyers operates largely in the shadows, purchasing and using your personal information for purposes you may never know about.