Spanish YouTuber Carles Tamayo has touched a nerve again, in his usual informal, funny, and pointed style. In the final episode of Se nos ha ido de las manos (“It’s gotten out of hand”), a documentary series that premiered on Spanish public television in April 2026, he looks at how companies buy and sell personal data.

The episode, titled El activo eres tú (“You’re the asset”), puts an uncomfortable question on the table: Who has our data, and what is being done to it? And what are we willing to give up in return for the promise of something free? After getting spam calls from companies that knew too much about him, Tamayo turned his own production company into a data broker to see from the inside how personal data is collected and traded.

Here’s how the data broker business works, and what rights the GDPR (General Data Protection Regulation) gives you.

What a data broker is, and how they make money

A data broker is a company that collects, analyzes, and sells information about people and organizations. What makes that information valuable to buyers is how it can be combined and analyzed. Habits, interests, location data, and other signals can be stitched together, increasingly with the help of AI, into something usable. Data brokers sell the raw material that makes it possible to build a profile of almost anyone.

In Tamayo’s report, for example, one data broker offers him information on people who have recently had a baby. Those new parents had handed over their details at the hospital in exchange for entry into a prize draw for newborn products.

Data brokers typically collect email addresses, IP addresses(new window), approximate location, online purchases, internet searches, interests selected inside an app, and the devices someone uses.

Ever had a call from a phone company (or any company) and wondered where they got your number? It’s simpler than you think. Cookies, mobile apps, and online forms can gather your information and pass it to data brokers. So can offline sources, such as loyalty cards, prize draws, and public records.

What cookies are and what they’re for

You’ve seen them on every website you visit: a small pop-up asking you to accept or reject cookies. You probably skim it, accept cookies(new window) and move on, without ever asking what cookies actually are(new window) or what you just agreed to let companies do with your data.

Cookies are small files that a website stores in your browser to remember information about your visit. The ones data brokers care about are advertising cookies, designed to build behavioral profiles and serve personalized ads.

But you can now be tracked by methods that go well beyond cookies. Browser fingerprinting, for instance, creates a unique signature from the characteristics of your device, while cross-site tracking follows your activity as you move between websites. On mobile, advertising IDs do something similar by tying your behavior to a persistent identifier.

Rejecting cookies improves your privacy, but it doesn’t fully guarantee it. And once you start asking where your data goes, who holds it, and how it gets used, you inevitably run into the question of whether trading in your data is legal at all.

How the GDPR protects you

The GDPR is the European Union rulebook governing how organizations and companies collect, use, share, and store the personal data of anyone in the EU. It also applies to companies based outside the EU that target people there. In Spain, compliance is overseen by the Spanish Data Protection Agency (AEPD), which also handles complaints when a company breaches these rights.

The GDPR establishes several fundamental rights:

Right of access: Find out what personal data a company holds about you, what it’s using it for, who it has shared it with, and where it got it. You can also request a copy.

Right to rectification: Have incorrect or out-of-date information corrected.

Right to erasure: Known as the “right to be forgotten,” this lets you request that your data be deleted when the company no longer needs it, when you withdraw consent or object to its use, or when it was processed unlawfully.

Right to object: Refuse certain kinds of processing, such as the use of your data for advertising. For direct marketing, this right is absolute: once you object, the company must stop.

Right to data portability: Receive the personal data you gave a company in a structured, commonly used, machine-readable format so you can move it to another service provider. This applies when the company processes your data based on your consent or a contract, by automated means.

The GDPR gives people enforceable rights, backed by fines, yet many people don’t realize they can exercise these rights free of charge. A company can charge a fee or refuse only when a request is manifestly unfounded or excessive.

As Tamayo’s report shows, there’s a wide gap between the guarantees the law offers and what the average citizen knows about protecting their personal information. That gap makes it harder for people to use the legal tools available to them and take back control of their data.

How to use your GDPR rights against data brokers

The rights above only work if you use them. None of them needs a lawyer or a special form: an email to the company’s privacy contact is enough.

Ask where your data came from. If a company contacts you and you never gave it your details, ask it for its source. Under the right of access, it has to tell you, and that answer often leads straight to a data broker.

Send an access request. Ask the company or broker what data it holds about you, what it uses it for, and who it has shared it with, and ask for a copy. The request is free, and the company must reply within one month. It can extend that by two more months for complex requests, but it has to tell you.

Object and ask for erasure. In the same email, you can object to your data being used for marketing and ask for it to be deleted. The company must also pass the deletion on to anyone it shared your data with, unless that’s impossible or would take disproportionate effort.

Sign up for the Lista Robinson. In Spain, companies that send direct marketing must check this advertising opt-out list before contacting you. Signing up is free.

Complain to the AEPD. If a company ignores you, refuses without a valid reason, or misses the deadline, you can file a free complaint with the Spanish Data Protection Agency.

Limit what data brokers can collect in the first place

Your GDPR rights clean up what’s already out there. A few simple habits reduce how much new data reaches brokers.

Review your app permissions and switch off any access an app doesn’t need to work, especially the ones with access to your location, contacts, or photos.

Reject non-essential cookies. On EU websites, rejecting should be as easy as accepting, and it blocks the advertising cookies that feed behavioral profiles.

Stay signed out of websites and services when you’re only browsing. When you’re signed in to Google, YouTube, Amazon, or a news site, everything you search, watch, read, or buy is tied to your account. Browsing while signed out gives companies less to connect to you.

Use a privacy-focused browser such as Firefox or Brave, which block many trackers by default. You can also explore European alternative web browsers focused on privacy.

Switch to Proton Mail, our private and secure email service that can’t read your emails and doesn’t scan your inbox for ads, tracking, or surveillance. It also blocks tracking pixels, which marketers typically use to see when you open a message (plus other indicators).

Use a VPN(new window) to hide your IP address from websites, apps, and ad networks, so they can’t use it to estimate your location or link your activity across websites. Proton VPN also has a feature called NetShield, which blocks ads and trackers before they load. It has an independently audited no-logs policy(new window), so it doesn’t keep a record of what you do online.

Use an encrypted password manager to create strong, unique passwords, so one breached account doesn’t expose the rest. Proton Pass also gives you hide-my-email aliases for newsletters, prize draws, and online shops. If one starts getting spam, you can see who may have shared or leaked it, then disable the alias.

As Tamayo’s report makes clear, data brokers are part of a business model built on our data. But the GDPR and the tools that protect our privacy give us ways to take back control. The goal isn’t to disappear from the internet but to be intentional about who is allowed to access our data and for what reason.