What Data Brokers Know About You

Pipe one: public records. In many regions, property deeds, court dockets, and voter files are lawful to copy. Brokers do. The record was never "secret"; the surprise is the search engine that glues your old apartment to your current phone. Pipe two: commercial exhaust. Loyalty cards, magazine cards, contest forms, and "optional" checkout fields feed marketing databases. You traded a discount for a row in a table. Pipe three: tracking. Cookies, mobile ad IDs, and pixels from Module 1 do not stay on one shop. They join a graph. Data-sharing clauses in privacy policies are the paperwork for that join. The product is not a single stolen password. It is a stitched identity: your name plus last three addresses plus likely age plus a relative's name. That bundle is valuable for ads, skip-tracing, and — when it leaks — for phishing that mentions a real street you lived on in 2016. A breach at a broker is a breach of people who never created an account there.

People-search sites are the version you can see without a corporate contract: type a name, see addresses and relatives. They refresh from broker feeds and from the open web, including the public social leftovers from the last lesson. That is why locking YOUR audience still matters — it reduces new scrape fuel — and why it does not empty the warehouse overnight. Legal opt-out (CCPA/CPRA-style requests, GDPR access/erasure where you are covered, each broker's official form) is the adult tool. It is slow. Sites republish. You repeat. Anyone selling a one-click miracle in a sponsored result is usually selling panic.

Pick one well-known people-search property and search the name you legally use. You are collecting evidence about YOUR public surface, not building a target list. If the page asks you to pay to "see full report," stop at the free preview — that is enough to note fields. Opt-out is optional in this lesson because some jurisdictions and some sites make you upload ID; never upload ID to a sketchy clone. Use the URL you typed, not a sponsored impersonator.

mkdir -p "$HOME/cyberlium-lab"
NOTES="$HOME/cyberlium-lab/broker-optout.txt"

# 1) Open ONE people-search site in your browser.
#    Search YOUR name only. Stop at the free preview if they paywall the rest.
# 2) Optional: that SAME site's official opt-out / privacy request — not a banner ad.
# 3) Record fields you saw about YOURSELF. No other people's names.

{
  echo "date: $(date -Iseconds 2>/dev/null || date /t)"
  echo "site: (people-search site YOU used)"
  echo "searched: my own name only"
  echo "public_fields_seen: (address / phone / relatives / none in preview)"
  echo "official_optout_started: yes/no"
  echo "paid_a_random_remover: no"
  echo "searched_other_people: no"
} > "$NOTES"
chmod 600 "$NOTES"
cat "$NOTES"

# NEVER: search coworkers, classmates, exes, or strangers "for OSINT"
# NEVER: pay a sponsored "we delete you from 500 sites" scam
# NEVER: submit someone else's data on an opt-out form

You know the three pipes — records, purchases, tracking — and that sold profiles outlive a single privacy toggle. Legal opt-out is a marathon you run on official forms, for yourself, without feeding scam removers. Next — Photo Metadata EXIF — another public leftover: GPS, camera model, and timestamps hiding inside files you thought were "just a picture."