Data Brokers in 2026: Why Your Home Address and Phone Number Are Sold on People-Search Sites, What California’s DROP Deletion Platform Actually Removes, and How to Shrink Your Team’s Exposure to Targeted Scams
- Equipo de Internet Pros
- November 11, 2026
- Redes y Seguridad
Este artículo está disponible solo en inglés.
Search your own name on a people-search site and you will probably find your home address, past addresses, mobile number, age, and a list of relatives, often for free or for a few dollars. None of it was hacked. It was collected, combined and sold legally by data brokers, companies whose business is building profiles on people they have never dealt with. In 2026 California started making them delete those profiles on request, and the rest of the country can use the same tools to cut down how much of their staff is exposed.
Where the Profiles Come From
A data broker rarely has one big source. It joins many small ones together, using your name, address and phone number to link records:
- Public records: property deeds, voter files where states allow it, court filings, business registrations and professional licences.
- Commercial data: warranty cards, loyalty programmes, magazine subscriptions, sweepstakes entries and change-of-address lists.
- Online and app data: account sign-ups, location data from apps that share it with advertising partners, and data from other brokers.
- Inferred data: estimated income, home value, health interests and political leanings, worked out from everything above.
Sales between brokers keep profiles alive. Removing yourself from one site does little if three others sell the same record back to it next month. This is why manual opt-outs have always felt like a game of whack-a-mole.
An attacker no longer needs to breach your company to find out who approves payments, where they live and what their phone number is. A people-search subscription often costs less than lunch.
Why This Is a Business Security Problem
Broker data is the research stage of many targeted attacks. It gives criminals the details they need to sound believable:
- Executive impersonation: a text "from the CEO" sent to an employee’s personal mobile, where company email filters cannot see it.
- SIM swaps and account recovery: past addresses, date of birth and relatives’ names are the standard security questions a carrier or bank asks.
- Voice cloning scams: a family member’s name and number make an AI-cloned "emergency" call far more convincing.
- Physical risk: staff who deal with angry customers, such as clinicians, lawyers and debt collectors, can be found at home.
What California’s Delete Act and DROP Actually Do
The California Delete Act (SB 362, passed in 2023) gave the state privacy agency, now branded CalPrivacy, the job of building one free place to ask every registered broker to delete your data. That tool, the Delete Request and Opt-out Platform (DROP), opened to California residents in January 2026. From August 2026 registered brokers have been required to check it regularly (at least every 45 days) and process the deletions.
| Question | Answer |
|---|---|
| Who can use it? | California residents, who verify their identity once. The request then goes to every registered broker. |
| What gets deleted? | Personal information the broker collected about you second-hand, and the broker must keep deleting new matches over time. |
| What is exempt? | Data covered by other laws, such as credit reports under the Fair Credit Reporting Act, and certain public records the broker shows exactly as published. |
| Who is covered? | Only companies that meet the legal definition of a data broker and are on the state registry. Companies you buy from directly are not brokers for your data. |
| What if a broker ignores it? | Fines per request per day, and independent compliance audits for brokers starting in 2028. |
DROP is not a full fix. Brokers that never registered are not covered, and some offshore people-search sites ignore US law. Your data can also come back through a new public record, such as a property purchase. But one verified request now reaches hundreds of companies, which no manual process could match.
If You Are Not in California
Other states are moving in the same direction. Vermont, Texas and Oregon run data broker registries, and many state privacy laws give residents a right to delete data. But none yet has a single deletion button like DROP. Outside California, your options are:
- Manual opt-outs on the biggest people-search sites. These are free, but take hours, and you must repeat them every few months.
- Paid removal services, which send requests to dozens or hundreds of brokers and check again later. Look for ones that show you each request and its result, not just a dashboard score.
- Address protection programmes, which many states offer for judges, police, health workers or victims of abuse, and which can hide property and voter records.
A One-Hour Exposure Check for Your Team
- List the people attackers would target first: owners, finance, payroll, HR and IT admins.
- With their permission, search each name plus city on two or three people-search sites and note what appears.
- Check whether personal mobile numbers are listed. If so, treat SMS-based account recovery for those people as weak.
- Have California staff file a DROP request, and offer a removal service to key staff elsewhere as a staff benefit.
- Add a rule to payment procedures: a request that arrives on a personal phone is checked through a known company channel, every time.
Stop Feeding the Brokers
Removal works better if fewer new records are created. Use a business address or registered agent on company filings where your state allows it. Give a work or virtual number instead of a personal mobile on sign-up forms. Turn off app location sharing with advertising partners, and turn on Global Privacy Control in your browser so sites in states that honour it do not sell what they collect. Each step makes the next profile thinner.
En resumen
Data brokers turn ordinary paperwork into a ready-made research file for scammers. California’s DROP platform is the first tool that lets someone delete their profile from the whole registered industry at once, and it is worth using today for anyone who qualifies. For everyone else, a short exposure check, removal for your most-targeted staff and a verify-before-you-pay rule close most of the gap.
Internet Pros helps businesses assess how exposed their key people are, harden account recovery and build verification steps into payment workflows. Contáctanos to schedule an exposure review for your team.
