Data Brokers and AI Profiling

A data broker collects or derives information about people, often combining public records, commercial transactions, apps, websites, and other datasets. Brokers may sell records or inferred audience segments to marketers, campaigns, insurers, employers, lenders, or people-search services. A segment may describe an interest or predict an event; AI can scale these inferences, while conventional matching also remains common. The information used to build a profile may be incomplete, stale, or linked to the wrong person. A prediction such as “likely new parent” is an inference, not a fact about an individual. Profiles can still affect what advertisements, offers, prices, or opportunities a person receives. Whether a particular use is lawful depends on sector-specific and jurisdiction-specific rules; there is no single U.S. law that gives every person the same broker rights. California’s Delete Act is one example of a state intervention. The California Privacy Protection Agency launched DROP on January 1, 2026; consumers can submit one request to registered brokers, and brokers began processing requests August 1, 2026, accessing the system at least every 45 days. Deletion requests are subject to legal exceptions, and the platform covers registered brokers rather than every company holding data. Privacy laws can cover inferences as well as directly supplied details. California’s CCPA includes certain inferences in personal information, and its sensitive-information rules cover inferences used to create profiles reflecting specified sensitive categories. The EU GDPR also gives special protection to specified categories of personal data. The exact definition, legal basis, and consumer rights differ. A broker profile may fall under one rule for collection and a different rule when used for credit, employment, housing, or advertising. Consumers can inspect privacy notices, use opt-out or deletion tools where available, correct source records, and limit precise-location or ad tracking. Businesses should document sources, inference logic, downstream sharing, and rights processes.