Data Brokers Build Profiles From Public Records, Not Just Hacks, FTC and Industry Records Show

Your data is public before anyone hacks anything

Most people assume a data broker profile means someone's information was stolen. In a lot of cases, it wasn't. It was published.

According to reporting from Fox News' CyberGuy team, data brokers routinely build consumer profiles using public records that were never touched by a phishing email or a breached password. A home purchase, a marriage license, a divorce filing or a voter registration all create a public record in most states. Once filed, that record becomes raw material a broker can buy, scrape or license.

You don't need to click a bad link or reuse a weak password to end up on a people-search site. You just need to buy a house, register to vote or get married in a state that treats those records as public.

Everyday consumer habits feed the same machine

Government records are only half the pipeline. Commercial activity does the rest.

Registering a product warranty, entering a magazine sweepstakes, signing up for a store loyalty card or filling out a survey can all generate a data point that commercial aggregators combine with public records, according to the CyberGuy reporting. None of those actions are reckless. They're just how modern consumer life works, and each one leaves a trail.

The two streams merge into what data brokers sell as an "enriched" consumer profile: current and past addresses, relatives, phone numbers, and records that make a scam call or phishing text sound personal and believable.

Why cybersecurity habits alone don't fix this

Two-factor authentication and strong passwords protect your accounts from being broken into. They do nothing to stop a data broker from buying a county property record or a state voter file and reselling it.

This is a design feature of the underlying transparency laws, not a security failure. Public records exist so property transactions, court proceedings and voter rolls stay auditable and accountable. Property assessors, journalists and law enforcement rely on that same openness. A reasonable defender of open-records laws would say the alternative, locking down deeds, marriage licenses and voter files from public view, would make government harder to check and elections harder to audit.

Openness that keeps government accountable is the same openness that lets a data broker build a profile on someone who never gave consent for commercial resale. Nothing in the available reporting suggests any illegal hacking or breach is involved in this pipeline. It's a legal gap, not a crime.

What actually reduces exposure

There's no single switch that removes a name from every broker database, because there's no single federal law governing data brokers. States have moved unevenly. California, Vermont, Texas and Oregon have data broker registration laws that require brokers to register and, in some cases, offer opt-out mechanisms. Most states have no such requirement at all.

That leaves consumers doing manual opt-out requests broker by broker, a process privacy advocates and security writers have criticized for years as slow, repetitive and easily undone when a new data feed refreshes the profile a few months later.

Federal action remains stalled

Congress has debated a comprehensive federal data privacy law for years without passing one. Until that changes, or until more states follow California's and Vermont's registry model, the burden of scrubbing a public profile falls entirely on individuals willing to file opt-out requests with dozens of brokers, one at a time, indefinitely.