You sign up for a free ebook, use a coupon code once, or enter a contest. Months later, your inbox is receiving promotions from companies you've never given your address to. This isn't coincidence or a security breach. It's a $200-billion-a-year industry operating entirely within the law.
What is a data broker?
A data broker is a company whose business model is collecting personal information about individuals and selling it to other companies. The product is you — your email address, your name, your approximate location, your purchase history, your browsing patterns, your estimated income range, and hundreds of other data points aggregated from dozens of sources.
The largest data brokers — Acxiom, Experian, Oracle Data Cloud, LiveRamp, and others — maintain profiles on hundreds of millions of people. Most consumers have never heard of them. They don't need to; their customers are the marketers who buy access to these profiles, not the individuals those profiles describe.
Where your email address comes from
Data brokers assemble their email lists from multiple channels, most of which are legal.
Direct purchase from publishers. Many websites and apps sell their user lists to brokers as a revenue stream. The terms of service you clicked through almost certainly permitted this. The clause is usually something like "we may share your information with trusted marketing partners." That phrase is load-bearing. "Trusted marketing partner" means data broker.
Co-registration. When you sign up for a newsletter or create an account on a content site, a small checkbox at the bottom of the form — pre-checked — opts you into sharing with "offers from our partners." Most people don't notice it. Every time someone doesn't uncheck that box, their data flows to whoever paid for the placement.
Web scraping. Email addresses published on websites — in forum posts, blog comment sections, professional directories, public records databases — are scraped at industrial scale. If you've ever posted your email publicly anywhere, it's been harvested.
Data breaches and gray markets. Not all data broker feeds are above board. Breached databases end up on underground markets. Some brokers knowingly purchase this data; others receive it laundered through intermediaries. Either way, your email from a breach at a company you used years ago may be circulating in broker databases today.
Inference from existing data. If a broker knows your name and home address, they can often infer your email using pattern matching against known email formats ([email protected]) or by cross-referencing against other datasets.
What they sell and to whom
The simplest product is an email list: hundreds of thousands of addresses segmented by demographics, interests, or behavior. A vitamin supplement company might buy a list of women aged 45–60 with an interest in health and wellness. A car dealership might buy a list of households within 50 miles that recently searched for car-related terms.
More sophisticated products include audience matching — you upload your own customer list and the broker finds matching profiles to reach new people who resemble your existing customers. This is called "lookalike targeting" and it's how a brand you've never visited can show you an ad that feels strangely relevant.
Brokers also sell email validation services — confirming that addresses in a marketer's list are still active — and email enrichment, where a company gives the broker a list of names and the broker returns the matching email addresses.
The spam cascade
Once your email is in a broker database, the cascade is hard to stop. Each company that buys the data may resell it. Marketing campaigns run, engagement is measured, and the most engaged addresses are worth more — driving further resale. An email you gave to a minor website in 2019 may have passed through fifteen hands by 2026.
The spam you receive directly is only part of the picture. Your email is also used for profile building — connecting to your social media accounts, your shopping history, your location data — to create a profile that is worth far more than the address alone.
How to opt out
The US has no comprehensive federal law requiring data brokers to honor opt-out requests, but many major brokers do offer them — usually buried deep in their privacy policies. The process is tedious: you must submit individual requests to each broker, verify your identity, and repeat the process periodically because new data is added continuously.
Several services automate this process. DeleteMe, Privacy Bee, and others will submit opt-out requests on your behalf for a subscription fee. They're not perfect — some brokers don't cooperate — but they reduce the volume substantially.
In Europe, GDPR gives you stronger rights. You can demand deletion of your data from any company operating in or targeting the EU, and they must comply within 30 days. The challenge is knowing which brokers hold your data.
The permanent solution: don't give them the address in the first place
Retroactive opt-outs treat the symptom. The durable solution is ensuring your primary email address is never in the pipeline at all.
For websites where you have no ongoing relationship — contests, free downloads, content that requires an email to unlock — a disposable address is a complete solution. There's nothing to opt out of because the address you gave doesn't connect back to you. When it expires, it takes any trace of that interaction with it.
This doesn't solve everything. Your employer, your bank, your government services, your actual subscriptions — these genuinely need a real address. But the long tail of sites that require an email for no good reason? That's exactly where disposable addresses earn their keep.
Concerned about privacy? Try Temp Mail Now — disposable inboxes that leave no trace.