You did not sign up to be a product. You never agreed to have your location history, your purchase patterns, your health searches, your political leanings, your financial stress levels, and your daily routine packaged into a dossier and sold — repeatedly — to strangers. But that is exactly what is happening, right now, at industrial scale.

What Data Brokers Actually Do

Data brokers are companies whose entire business model is collecting personal information and selling it. Not to you. About you. The largest players — Acxiom, LexisNexis, CoreLogic, Experian, Equifax, TransUnion, Oracle Data Cloud — hold profiles on hundreds of millions of Americans. Some hold profiles on billions of people globally.

These are not hypothetical dossiers. They contain your name, address, every address you have ever lived at, your phone numbers, your email addresses, your family members and their contact information, your estimated income, your credit behavior, your purchasing history, your magazine subscriptions from 2009, your voter registration status, your estimated net worth, your religious affiliation, your ethnicity (inferred), your political affiliation (inferred), your health conditions (inferred from purchase data), and — increasingly — your precise GPS location history pulled from apps you use every day.

The app you use to track your period. The weather app you opened this morning. The game your kid plays. Every one of them may be selling your location data to brokers who aggregate it, clean it, and resell it to insurers, employers, law enforcement, political campaigns, hedge funds, and anyone else willing to pay.

The Legal Structure That Enables It

This is not happening despite the law. It is happening because of the law — or more precisely, the deliberate absence of it.

The United States has no comprehensive federal privacy law. What it has instead is a patchwork of narrow sector-specific laws: HIPAA covers medical records held by healthcare providers (not the health data your fitness app collects), FCRA covers credit reporting for specific purposes, FERPA covers student records in federally funded schools. Everything else is largely unregulated at the federal level.

The FTC has some authority to act against unfair or deceptive practices, but it cannot write comprehensive privacy rules without Congressional authorization — authorization Congress has declined to provide, repeatedly, for decades. Every session, comprehensive privacy bills are introduced. Every session, they die in committee or get stripped of enforcement teeth before passage.

Why? Look at who lobbies against them. The data broker industry, the adtech industry, the major platforms. They spend hundreds of millions of dollars per election cycle ensuring that the regulatory environment remains as permissive as possible.

Law Enforcement Buys What It Cannot Legally Collect

Here is where it gets dark. The Fourth Amendment requires law enforcement to obtain a warrant to track your location. Courts have increasingly held that prolonged location tracking constitutes a search under the Constitution. So there is a legal barrier to warrantless mass surveillance of citizens.

The government solution: buy the data commercially. If a private company collects it voluntarily — from your apps, with terms of service you nominally agreed to — the government can purchase that same data without a warrant. The FBI, DHS, the IRS, the military — all have been documented purchasing commercial location data from data brokers.

This is the privatization of surveillance. The constitutional protection exists on paper. It has been commercially routed around.

The Inference Engine

Raw data is not the most dangerous product. Inferred data is. Modern data brokers do not just sell what you explicitly provided. They run your data through statistical models to infer things you never disclosed: your likelihood of filing bankruptcy, your estimated health conditions, your political persuadability score, your estimated pregnancy status, your susceptibility to addiction, your psychological stress level.

These inferences are then sold as facts. An insurer uses them to price policies. An employer uses them in hiring screens. A landlord uses them in tenant scoring. You never consented to any of it, you cannot see the file, you cannot correct errors, and in most states you have no legal recourse when the inferences are wrong and harm you.

What Opt-Out Actually Means

Most data brokers offer an opt-out mechanism. Read the fine print. Opting out of one broker does not remove your data from any other broker. There are hundreds of brokers. Some do not honor opt-out requests. Some re-acquire your data from other sources after you opt out. The opt-out process is designed to be so burdensome — different forms, different portals, different verification requirements for each company — that virtually no one completes it for more than a handful of brokers.

California CCPA and its successor CPRA created stronger rights for California residents, including the right to know what data is collected, the right to delete, and the right to opt out of sale. These are real improvements. They also apply only in California, require individual action for each company, and are enforced by an underfunded state agency. The data industry has adapted.

The Real Question

The framing you are supposed to accept is: if you have nothing to hide, you have nothing to fear. This framing is a manipulation. Privacy is not about hiding wrongdoing. Privacy is about power. When institutions — corporate or government — know everything about you and you know nothing about them, power flows entirely in one direction.

Every authoritarian system in history has relied on surveillance to enforce compliance. Not just to catch dissidents after the fact, but to chill behavior before it happens. When people know they are being watched, they change what they say, what they read, who they associate with. The surveillance does not have to be used to be effective. Its existence is the mechanism of control.

The data broker industry has built, on a commercial basis, exactly the surveillance infrastructure that authoritarian governments spend billions constructing. It was built here voluntarily, funded by advertising revenue, and it is now available to any entity with a budget to purchase it.

That is not a privacy problem. That is a power problem. And until it is treated as one, nothing meaningful will change.