Everything you do — what you buy, where you go, who you vote for — can be turned into data. That data is quietly collected, sorted, and sold by shadowy operators most people have never heard of: data brokers.

These intermediaries don’t need your name to know who you are. They track fragments of your behavior — your GPS pings, app habits, purchases, social ties — and stitch together a profile that says more about you than your passport ever could. And then they sell it.

In a functioning democracy, laws are supposed(new window) to offer protections or, at the very least, the right to know just who’s buying and selling(new window) your personal life. But in the US, there are virtually no limits. Anyone can buy the data: advertisers, bounty hunters, law enforcement, and up until recently(new window), even foreign governments.

And in this legal vacuum, surveillance has gone private, sold off to the highest bidder(new window). When corporations and governments can monitor the public without consent, due process, or oversight, democracy as we know it erodes.

What is a data broker?

A data broker is a company that collects, aggregates, and sells information about individuals — often without their knowledge or consent. These companies compile reams of data, beyond what’s on your social media profiles or in public records. It can include your movement patterns, your purchase history, your prescriptions, your political beliefs, and more(new window).

Learn more about data brokers

According to a 2021 report(new window) by Justin Sherman for the Duke Tech Policy Lab, data brokerage in the United States is “a virtually unregulated practice.” Major firms sell information ranging from banal and benign to deeply personal and even incriminating without meaningful legal restrictions on who can buy that information or why.

Sherman notes, “virtually nothing in current US law limits [data brokers] selling that data to a range of actors, from insurance firms to US law enforcement agencies to foreign entities.” In practice, this means that sensitive personal information — including your location, health conditions, religious affiliation, or even mental health struggles — can be bought and sold on an unregulated market. Hedge funds, health insurers, political campaigns, and even foreign governments can all legally purchase dossiers on Americans, no warrant required. This unchecked trade in personal data has become so alarming that the Biden administration(new window) called it a national security threat.

This ecosystem operates in the shadows. While some brokers scrape public databases or track cookies, others buy directly from apps, financial institutions, and consumer services. As Sherman notes, even “anonymized” data can be easily re-identified when combined with other datasets.

A recent Wired investigation(new window) revealed that ad buyers used Google’s DV360 platform to target “decision makers” at US national security agencies, alongside people with chronic illnesses or financial struggles. These segments—sold by third-party data brokers—were tied to mobile IDs, allowing advertisers to zero in on highly specific and sensitive groups.

Because no single federal law(new window) comprehensively regulates this trade, data brokers in the US operate with almost no transparency, accountability, or ethical boundaries. Unlike Europe with its General Data Protection Regulation (GDPR)(new window), which gives individuals clear rights over their data and restricts how it can be collected, shared, or sold, the US has no equivalent safeguard. This regulatory vacuum has allowed a vast, largely invisible data economy to flourish.

How data brokers threaten national security and civil rights

The danger isn’t just that your data is being sold. It’s that it’s being sold to people with power. Sometimes that’s marketers. Sometimes it’s the police. Sometimes it’s a foreign intelligence operative trying to map the behavior of public officials.

A 2025 report from the UK government(new window) warned that foreign adversaries can easily purchase sensitive data on citizens, infrastructure, and political targets using brokers as the middlemen. In the US, there’s no law stopping them. No oversight board. No requirement to notify the person whose data is being sold — unless that buyer happens to be from one of six officially designated “adversary” countries. Everyone else, from hedge funds to health insurers to political campaigns, is fair game.

The national security risk is only part of the story. The political threat may be even more corrosive. Data brokers sell detailed information about people’s political leanings, religious beliefs, and behavioral patterns. All of this valuable data can be used to fuel campaigns designed to exploit, inflame, and divide.

In the 2016 US election, Cambridge Analytica(new window) harvested data from Facebook to build psychographic profiles of voters and target them with divisive content. But most of the data they used didn’t come from hacking — it came from brokers. In 2024, Cards Against Humanity released an experiment(new window) showing how much information PACs and Super PACs can legally purchase about voters, raising alarms over just how open the US data market really is.

Sen. Ron Wyden (D-Ore.) warned that foreign actors can (new window)weaponize(new window) data to destabilize democracies, flood communities with propaganda, or even locate and target specific groups. When data becomes political ammunition, elections stop being contests of ideas and start becoming contests of manipulation. In Trinidad and Tobago’s 2010 election, for example, apathy campaigns targeted specific communities(new window). In Hungary in 2022, the ruling party tapped brokered and public service data to construct detailed voter profiles(new window).

But it’s not just foreign actors. The US government itself has become a top customer. According to a 2024 analysis from the Brennan Center for Justice(new window), agencies like the Department of Defense and local law enforcement have routinely purchased location and behavioral data from brokers to sidestep constitutional limits on surveillance. Because the data is technically available on the open market, the government argues it doesn’t need a warrant.

This loophole is exactly what the Fourth Amendment Is Not For Sale Act(new window) tries to close. The bill would prohibit law enforcement from purchasing data they’d otherwise need a warrant to obtain. But like most privacy legislation in the US, it’s stalled in Congress. Meanwhile, the few protections that do exist are being rolled back — most recently when the Consumer Financial Protection Bureau quietly scrapped a proposed rule that would have forced data brokers to follow basic transparency and fairness standards, as reported by Wired.

And so the trade continues. In a system where purchasing data can sidestep legal safeguards, privacy is treated less as a right and more as a product. Without stronger oversight, the line between legitimate investigation and unchecked surveillance begins to blur, raising real questions about transparency, accountability, and the health of a democratic society.

There are ways to fight back

The data economy may be invisible, but it’s not unbreakable. Some companies are already rejecting its premise entirely, proving that surveillance doesn’t have to be the cost of being online. Services like Mozilla, Signal, and Brave have built their models around protecting users, not profiling them.

And at Proton, we offer end-to-end encrypted email, calendar, file storage, and a VPN(new window) that blocks trackers and anonymizes your browsing. Based in Switzerland, Proton is protected by some of the world’s strongest privacy laws and has openly committed to never selling user data, ever. Proton Sentinel, Proton Pass, and Proton Drive are built for exactly this moment — to shrink your attack surface and give you full control over your digital footprint.

We need, however, more than private solutions. The fight for privacy isn’t just about stopping ads or deleting cookies. For democracy to function, individuals need autonomy. They need the ability to think, choose, and act without being constantly profiled and manipulated. That autonomy is undermined when advertisers, political campaigns, and even foreign governments can purchase sensitive information about your life in an attempt to shape your choices.

The surveillance economy thrives because it’s invisible, profitable, and largely legal. But that doesn’t make it right.

Opting out isn’t just an act of self-preservation. It’s a stand for something bigger. Because in the end, privacy isn’t about hiding. It’s about deciding who you are and who gets to decide for you.