How data brokers build a file on you

Almost every guide to this opens with cookies. Cookies are around the fifth most valuable input into a broker file, and putting them first is why people spend years hardening a browser while the two largest feeds run completely untouched.

Disclosure, since it should change how you read the rest. I sell mobile proxy infrastructure: physical SIM cards sitting in modems, rented to businesses, and some of my customers use them to collect data at scale. I am not an observer of this industry. I sell it one of its inputs.

Which is also how I know the unit economics. A line on a Singapore carrier costs me about ten dollars a month for the SIM, plus roughly a dollar fifty in modem depreciation. Collection at that price is the reason a file exists on people who have barely used the internet.

The inputs, in order of what they actually contribute

Public records first, and it is not a close race. Property and land titles, company directorships and annual filings, court records, insolvencies, professional registrations, and an electoral roll where the country publishes one.

This layer is accurate, already attached to a legal name, already structured, and legally purchasable. A company search in most jurisdictions costs less than a coffee and returns officers plus registered addresses. That is deliberate. Registries exist so you can check who you are about to wire money to.

The uncomfortable consequence is that a design decision made for accountability also hands a commercial data business a clean, name attached spine to hang every other fragment on.

Loyalty and rewards programmes are second. Think about a pharmacy card rather than a supermarket one and the value becomes obvious immediately: item level purchase history, timestamped, attached to a real name and a real delivery address. Behaviour, not declaration. People fill in forms carelessly and optimistically. Nobody misleads a shopping basket.

The signup terms you did not read permit sharing with partners. That single word carries most of the weight in this entire market.

Third are the apps on your phone, and this one deserves more sympathy than it usually gets, because the permission almost always was genuinely needed. A parking app needs your location to find the bay you are standing next to. A delivery app needs your address.

What follows is the part nobody agreed to in any useful sense. The developer includes a software kit from an advertising firm, that kit inherits whatever access the app already holds, and location readings start leaving the handset on a cadence that has nothing to do with parking. The developer is usually not a villain. They get paid per install for shipping the kit, and for a two person team that cheque decides whether the app survives.

Location is worth more than it looks. Where a handset rests overnight is a home address. Where it sits on Tuesday afternoons is an employer. Those two coordinates become a name without anybody needing to supply one.

Fourth, purchase and payment data sold onward. Some retailers sell direct, others go through intermediaries who clean it and match it against everything else. Genuinely aggregated counts are harmless. The versions that retain a transaction level trail with a stable identifier attached are not, because a handful of purchases with times and amounts on them will single you out of a very large population.

Fifth, finally, ordinary web tracking. Cookies, pixels, fingerprinting, the advertising ID on your phone.

It generates the most volume and the worst quality. It is bound to a device, it decays every time a browser tightens up, and it splits apart the moment you switch from laptop to phone. The industry prices it accordingly. Where it earns its keep is as connective tissue: excellent at spotting that two things belong to one person, poor at saying who that person is.

Joining is the product

Everything above lands as fragments. A basket history here, a title deed there, a location trail somewhere else. Sitting apart they are worth almost nothing commercially.

They become a file the moment something links them, and that linking is the real technical product these companies sell. It is considerably harder than collection, which is why the firms that do it well are the ones with the margins.

Three fields do nearly all the work: your email address, your phone number and the place you live. They are stable, unique enough in combination, and you type them into everything. Email is strongest because it crosses borders and survives every house move. The address is strongest for households, clustering people who get marketed to as a unit. The phone number sits between them.

Everything else is optional. The file gets built around whichever of those three a buyer can hand over.

What hashing actually does

When these files change hands the email is often hashed rather than sent in the clear, and that gets described as anonymisation.

A hash produces the same output for the same input, every time, in every system. So the industry ends up holding an identifier that looks like gibberish to a human and functions perfectly as a join key for a machine. It stops a leaked file from being casually readable. It does nothing whatsoever to prevent matching you across ten sources.

The columns that are guesses

Here is the part I think most coverage misses.

A broker sells what it concluded about you alongside what it observed. Income decile. Likely health conditions. Whether you look like a new parent, a recent divorce, someone financially stretched, someone in market for a car in the next ninety days.

Those are model outputs. In the delivered file they sit in the same table as the observed columns, in the same format, with no confidence score and nothing marking which is which. So a guess gets purchased, stored and acted on carrying the exact weight of a receipt.

My own file put me in a country I had left two years earlier, in a household with a person I have never lived with, and in an income band nowhere near right. I only saw it because I asked.

There is no dispute process for any of this

People confuse broker files with credit files constantly, and the difference is the whole point.

A credit file in most countries is regulated. You can see it, challenge an entry, and there is a statutory clock on the response. It is slow and it works often enough to matter.

Marketing and identity data mostly falls outside that regime. No obligation to show you the inferred fields, no obligation to justify one, and in most places no route to correct one. So you can be screened for a tenancy, quoted for insurance, or shown a worse price on the basis of a conclusion you cannot read and cannot challenge. The decision reaches you as a number. It never arrives with the field that caused it.

Deletion requests, assessed honestly

Both of the standard positions on these are wrong.

They are real. I sent a batch, several came back confirmed, and my record stayed gone across the months I checked. Anyone telling you the whole thing is theatre has not tried it.

They are also partial. There are hundreds of these companies, and the handful you have heard of are the visible layer, with resellers underneath holding copies you will never enumerate.

The thing that settles it: deletion removes your record, and leaves the upstream source producing. The land registry still lists you. The pharmacy still holds your basket. The location feed keeps running. Next refresh cycle you get rebuilt out of the same material. So it is maintenance, quarterly at best, rather than a repair. And the opt out forms frequently demand more identifying detail than the company held in order to verify you, which is funny exactly twice.

Four changes that reduce the input

Run a separate email address for commerce. Every purchase, every account, every form goes to it. A plus sign variant of your main address gets normalised straight back, so it needs to be a genuinely different mailbox. Highest value item on this list, because it breaks the strongest join key you own.

Do the loyalty arithmetic. Most supermarket schemes return somewhere around one or two percent in ordinary weekly use. Decide whether item level purchase history under your real name is worth that. Sometimes it is, and there is nothing wrong with saying yes. The failure is not realising a trade happened. Where you do want the discount, join with the commerce email and a number you use nowhere else.

Spend twenty minutes on phone permissions. Location set to while using instead of always, maps excepted. Contacts access revoked from everything that is not a messaging or calling app, since your address book exposes other people more than it exposes you. Reset the advertising ID and switch it off where the setting exists.

Give your phone number out less than your email. It is the join key that follows you between the offline and online halves of the file, and unlike an email you cannot cheaply run a second one. The tool comparisons I keep updated are here.

What I had backwards

For years I told people to focus on browsers, blockers and cookies. I was optimising the fifth most important input on the list.

I had the ordering wrong because web tracking is the visible layer, it involves technology I find interesting, and it is the part I could act on from a keyboard at midnight. The two biggest feeds are a public registry and a loyalty card. Neither is a technical problem, and neither yields to anything I know how to configure.

I also used to tell people deletion requests were pointless. They are limited. I said something a good deal stronger than that, and it was not accurate.

The floor nobody gets under

Public records are public, and they should be. Searchable company ownership is how you check a counterparty before paying an invoice. Property registration is how ownership disputes resolve. You cannot opt out of your mortgage being registered, and it would be a worse world if you could.

So a floor sits under all of this that personal discipline never touches. What you control is the layer above it: volume and freshness. A file assembled from registry data alone is thin and it ages badly. One topped up weekly with basket data, location pings and an email address that matches everywhere else is the one worth paying for.