Short answer: yes, in the US, it’s generally legal for data brokers to collect and sell your personal information, as long as it comes from public or otherwise lawfully-obtained sources. That surprises a lot of people who assume this must be illegal. It isn’t, and understanding why helps explain why opt-outs (not lawsuits) are the practical fix.
Where the data actually comes from
Data brokers build profiles from sources like:
- Public records, property records, court records, voter registrations, marriage/divorce filings, professional licenses
- Social media and other public web content
- Purchased or shared data from other brokers and companies
None of this requires your consent under current federal law. The US has no single comprehensive federal data-privacy law governing data brokers the way the EU’s GDPR does.
What’s actually regulated
A few specific situations ARE regulated:
- Credit, employment, tenant screening decisions, covered by the Fair Credit Reporting Act (FCRA). Companies using data for these purposes are “consumer reporting agencies” with stricter obligations. Most people-search sites explicitly say they are NOT consumer reporting agencies and can’t be used for these purposes.
- State-level data broker registries, California, Oregon, Texas, and a growing list of other states require brokers to register and, in some cases, offer opt-out mechanisms.
- State privacy laws, CCPA/CPRA (California), and similar laws in Virginia, Colorado, and other states give residents rights to know what’s collected and to opt out of sale/sharing.
What this means for you
Because collection itself is largely legal, there’s no lawsuit or complaint that makes it stop. The practical path is opting out broker-by-broker, either manually (free, see our
opt-out guides) or through an automated removal service that does it at scale and re-checks periodically, since brokers re-collect data over time.
Who the California Law Actually Applies To
Because “state privacy laws” is doing a lot of work in the section above, it is worth being precise about the most-cited one. The CCPA, as amended by the CPRA, applies to businesses that meet at least one of three tests: more than $25 million in annual gross revenue; buying, selling, or sharing the personal information of 100,000 or more California residents or households; or deriving 50% or more of annual revenue from selling California residents’ personal information.[1] Two details in that sentence trip people up. The middle test turns on buying, selling, or sharing, not on merely holding data. And the revenue test is specifically about California residents’ personal information, not about data sales generally.
Registration Is Mandatory, Not Voluntary
A separate and stricter obligation applies to data brokers themselves. Any business meeting California’s definition of a data broker must register with CalPrivacy annually, between January 1 and 31, and report on the prior calendar year’s activities.[2] This is a legal requirement, not an industry courtesy, and the resulting public registry is the closest thing that exists to a census of the industry.
The Newest Layer: California’s Delete Act
The most significant change to the legal landscape did not make collection illegal. It made deletion mechanical. Under California’s Delete Act, CalPrivacy built the Delete Request and Opt-out Platform, or DROP, which lets a California resident send a single deletion request to more than 600 registered data brokers at once.[3] It launched for consumer submissions on January 1, 2026, and brokers were required to begin processing requests on August 1, 2026.[2] From that date they must check the platform at least once every 45 days.[3]
This is the practical answer to the question in this article’s title. Collection remains broadly lawful. What changed is that in one state, refusing to act on a deletion request is now itself the unlawful part. Our
full guide to CCPA, CPRA, and the Delete Act walks through how to file.
The FCRA Line Is Sharper Than Most People Realize
The other genuinely enforceable federal boundary is the Fair Credit Reporting Act, and it binds the user of a report as much as the seller. An employer using a consumer report must tell the applicant or employee, in writing and in a stand-alone document, that it may use the report for employment decisions, and must get written permission before obtaining it.[4] Before taking an adverse action based on that report, such as rejecting an application, denying a promotion, reassigning, or terminating, the employer must first give the person a copy of the report and a summary of their FCRA rights.[4]
That advance-notice step is the part with teeth: it exists specifically so you can dispute an inaccurate report before the decision becomes final. It is also why people-search sites disclaim being consumer reporting agencies. The disclaimer is not modesty, it is an attempt to stay outside the statute that would impose those duties.
What Is Legal Is Not the Same as What Is Unavoidable
Three conclusions follow from all of this, and they are more useful than the headline answer:
- Suing is not the lever. Because collection from lawful sources is generally permitted, there is no complaint that ends the practice in general.
- Deletion is the lever, and it is increasingly statutory. Opt-outs started as a courtesy the industry offered. In California they are now a legal duty with a 45-day cadence attached.
- Purpose determines your rights. The same underlying record carries almost no protection when it is sold as marketing data, and substantial protection the moment it is used for a credit, employment, insurance, or tenant-screening decision.
References
- California Consumer Privacy Act (CCPA). California Office of the Attorney General
- Data Broker Registry. California Privacy Protection Agency
- Delete Request and Opt-out Platform (DROP). CalPrivacy, State of California
- Using Consumer Reports: What Employers Need to Know. Federal Trade Commission
