How do data brokers get rich off your back?
It's a fairly murky business, to be honest. Most internet users have never even heard the term "data broker" — and yet these companies probably know more about us than our own friends do. Here's how the invisible market for privacy actually works, and why GDPR alone isn't enough to push it back.
Data brokers are companies that collect your purchase histories, clicks, locations and social interactions to resell them as targeted profiles. The average user is targeted by several hundred trackers a day (CNIL). GDPR gives you the right to demand erasure, but you have to contact each broker one by one — which is exactly why automated services like Sheeldy exist.
The vast invisible market for privacy
When you browse, you leave traces. A lot of them. Data brokers are companies whose sole business model is to vacuum up those crumbs of information, cross-reference them and resell them as ultra-targeted profiles. According to the CNIL (France's data protection authority), the average user is targeted by hundreds of trackers every day.
The real problem is that you feel like you gave consent by clicking "Accept" on a cookie banner written in deliberately confusing language. Except data is often resold in cascade: you hand your email to an e-commerce site, it lands at a broker, who resells it to advertisers, recruiters, insurers or even political marketing agencies.
Cascading resale: one email, ten brokers
The mechanism is simple, and that's exactly what makes it so effective. At each step, your data gains value because it gets enriched by other sources:
- Collection: you hand over your email to grab a 10% discount on an e-commerce site.
- Commercial sharing: that site shares your profile with its ad partner to measure its campaigns.
- Aggregation: a broker cross-references that email with your purchase history, approximate location pulled in by a weather app, and an estimated age inferred from your Facebook activity.
- Resale: the broker sells that enriched profile to several ad networks, which then resell it to the end advertisers.
- Recycling: your profile ends up in databases used for cold prospecting, informal credit scoring, or worse — aggressive cold-calling.
At every step, you lose the thread. And that's precisely why GDPR provides a right to erasure: to let you walk that chain back and cut it.
The types of data they collect
If you think "just your email" isn't worth much, take a look at what a broker can attach to that single identifier:
| Category | Concrete examples | Typical source |
|---|---|---|
| Identity | Full name, date of birth, gender, marital status | Forms, public records |
| Contact | Email, phone, postal address, social accounts | E-commerce, loyalty programmes, data breaches |
| Financial | Estimated income bracket, purchase history, credit behaviour | Partner banks, loyalty programmes |
| Behaviour | Sites visited, searches, session length, devices used | Third-party cookies, mobile app SDKs |
| Location | Places visited, commute routes, travel | Weather apps, GPS, public Wi-Fi |
| Inferences | Interests, presumed political opinions, health, orientation | Statistical models cross-referencing everything above |
That last row is the most problematic: data brokers don't just resell what you gave them. They infer things about you from statistical correlations. You might find yourself classified as "probably pregnant", "probably job-hunting", or "probably in debt" without ever having declared any of it.
GDPR: a strong enough shield?
On paper, the General Data Protection Regulation (GDPR) in Europe is strict. You have the right to request erasure of your data (Article 17), a right of access (Article 15), a right to object (Article 21). And penalties can climb up to 4% of global annual revenue.
In practice though, good luck. Trying to contact every broker one by one is a full-on slog when there are thousands of them:
- Find the form: each broker has their own page (often buried), their own request format, their own ID-proof requirements.
- Prove your identity: you often have to send a copy of ID — which paradoxically creates fresh exposure.
- Follow up: the law sets a 30-day deadline. In practice, many brokers simply don't respond and you have to file a complaint with the data protection authority.
- Start over: six months later, your data can reappear at another broker that had bought it before the erasure went through.
That's why the fight against spam and abusive advertising has to happen upstream, using masking tools (email aliases, virtual shields) so these brokers only get junk data to work with — and by automating GDPR requests with the major players.
Taking back control, concretely
Three concrete actions, sorted by effort/impact ratio:
1. Systematically reject third-party cookies
A click on "reject all" instead of "accept all" on every banner. It's free, takes two seconds, and shuts off the very first source of collection. EU law since 2021 requires the "reject" button to be just as accessible as the "accept" one.
2. Use email aliases
Instead of handing over your real address, create a unique alias for each service. If a site gets breached or resells your email, you immediately know where the leak came from, and you can disable the alias without touching your main inbox.
3. Trigger GDPR requests at the major brokers
This is exactly what Sheeldy automates: we contact the main data brokers (European and international) to demand the erasure of your data on your behalf, track the legal deadlines, and follow up if they don't respond. No commitment, from €5/month.
Frequently asked questions
What is a data broker?
How many data brokers hold my data?
Is GDPR enough to protect against data brokers?
How do data brokers get my data?
How can I limit my exposure to data brokers?
In a nutshell
Data brokers thrive on invisibility. Understanding their business model — mass collection, cross-referencing, cascading resale — is the first step in protecting yourself. GDPR provides the right legal tools, but exercising them by hand is well out of reach for a single user. That's exactly why platforms like Sheeldy exist: to turn a theoretical right into actual erasure.