Data brokerage companies have been operating in the shadows of the internet for a long time, quietly gathering unprecedented amounts of personal information about billions of people worldwide, but few realize just how deep this data collection process is.

In an era where every step you take online - every click, every purchase, every "like" - is meticulously harvested, packaged, and sold for profit, the collected personal data has become a valuable commodity, and the global data brokerage industry is a testament to that.

The increasing capabilities of artificial intelligence pose a greater threat by collecting even more personal information from the internet, making the already murky world of data brokerage more aggressive, raising concerns about data privacy.

A study conducted by the Pew Research Center in 2023 found that the American public is increasingly saying they do not understand what companies do with their data. According to the Pew study, 67% of Americans say they "understand very little or do not understand anything at all about what companies do with their personal data," compared to 59% in their previous survey on the topic in 2019. The majority of Americans (73%) believe they have "little or no control" over what companies do with their data.

Many individuals are unaware that something as simple as a phone number can be used by data brokers and malicious actors to uncover highly sensitive information, including social security numbers, addresses, emails, and even family details, according to Arjun Bhatnagar, co-founder and CEO of the Cloaked app that hides your personal information by creating a unique "identity" for each of your online accounts.

Data Brokerage Companies

According to Roger Grimes, a cybersecurity educator at NoBe4, many data brokers - especially the more well-known companies - sell information responsibly, but some smaller, lesser-known brokers violate laws, push ethical boundaries, and exploit data in ways that could lead to misuse or harm. This is partly due to the murky regulatory framework around data brokerage, making it easier for these practices to remain unchecked.

These companies operate across multiple industries, dealing with both publicly available information and sensitive consumer data. They offer a variety of services, ranging from marketing analytics to credit assessments and background checks, all of which have procedures for requesting your data or asking for it to be deleted. However, depending on the state you live in, they may not have to comply with that.

While many consumers know these companies for the credit services they provide, those services have now become just one part of their revenues, as the broader digital marketing of data has become more important, according to Jeff Chester, founder and executive director of the Center for Digital Democracy, a consumer privacy advocacy group based in Washington, D.C.

The data collection process spans broad areas across the economy, with companies, ranging from grocery stores offering discount programs to streaming video services, collecting data that others must pay for.

Chester said, "Today, everyone is a data broker. Accessing and targeting someone online has become a fundamental part of business."

Bruno Korteck, president and CEO of Bedrock Security, a data security firm, added, "I try to secure everything as much as I can, but I'm also aware that despite being a security expert, I may still be at an increased risk."

As a fundamental step to mitigate financial risks, he recommends freezing credit reports for all individuals as a proactive measure against identity theft and to prevent malicious attackers from opening new accounts or loans in their names.

Inside the Data Brokers' Vaults

Cybersecurity experts estimate that data brokers collect an average of about 1,000 data points for every individual who has an online presence.

Chris Henderson, senior director of threat operations at Hunters, a cybersecurity company founded by former NSA employees, said, "They have to collect as much data as possible about you, because the larger and more specific the dataset about you is, the more expensive that data becomes."

Here’s a look at the types of information data brokers typically collect, according to privacy experts interviewed by CNBC:

Basic identifiers: full name, address, phone number, and email.
Financial data: credit scores and payment history.
Purchase history: what you're searching online, what you're buying, where you're buying it, and how often you buy certain products.
Health data: your medications, health status, and interactions with health-related apps or websites.
Behavioral data: insight into what you like and dislike and the types of ads you’re likely to click on.
Real-time location data: GPS data from apps that track your movements, shopping locations, and how often you visit certain places.
Inferred characteristics: based on your browsing and media consumption, the sites you visit, articles you read, videos you watch, data brokers infer insights about your lifestyle, income, preferences, religious or political beliefs, hobbies, and even your likelihood to make charitable donations.

Relationships with family, friends, and colleagues: By analyzing your social network of friends, followers, and contacts on social media platforms and messaging apps, data brokers can map your relationships and even track how often you interact with certain individuals to gauge the strength of your ties.

How to Control Your Data

To better protect your privacy, it’s important to rethink how much personal information you share daily, says Arjun Bhatnagar, co-founder and CEO of Cloaked. While we can’t hide completely, consumers need to develop new habits and tools to limit what they disclose, starting from turning off permissions that track your location, to rejecting cookies, and refraining from posting personal details online. Additionally, tools like secure browsers, virtual private networks (VPNs), and tracking blockers can help protect your privacy.

Some of the largest tech companies we interact with daily, such as Apple, are constantly updating and adding privacy options, as seen in the new iPhone models and the latest iOS update.

Commitment to Digital Hygiene Practices

Regularly reviewing and updating your online security practices is essential. Securing your passwords, using two-factor authentication, and encryption tools can help protect your information. Using virtual identities, such as alternative email addresses and phone numbers, also provides additional protection for your personal information.