The inquiry will examine the practices of firms that aggregate personal information from a range of sources — purchase histories, public records, app activity, and location data among them — and combine it into detailed consumer profiles sold on to advertisers, insurers, employers, and other buyers.
The industry operates almost entirely out of view. Most data brokers have no consumer-facing product, no brand recognition, and no direct relationship with the people whose information they hold. Consumers are generally unaware that a profile exists, cannot easily find out what it contains, and in many jurisdictions have no straightforward mechanism to correct or delete it.
What the inquiry covers#
According to materials describing its scope, the review will focus on several areas:
- Sourcing. Where broker data originates, and whether consumers meaningfully consented to its collection and onward sale.
- Accuracy. How brokers verify their data, and what recourse exists when a profile is wrong. Errors in these systems can affect credit decisions, insurance pricing, and employment screening.
- Sensitive categories. Whether data touching on health, finances, or location is being sold with adequate safeguards.
- Downstream use. Who is buying, and what they are doing with it.
Industry response
Trade groups representing the sector have said they welcome the review and that their members operate within existing law. They argue the data supports fraud prevention, identity verification, and market research, and that overly broad restrictions would damage legitimate uses.
Privacy advocates counter that the sector’s core problem is structural rather than a matter of compliance: a market in which the person whose data is being traded is neither a party to the transaction nor aware it is happening.
The wider context
The inquiry follows sustained pressure from researchers and journalists who have documented how easily sensitive information can be purchased with little scrutiny of the buyer.
Legislative efforts to regulate the sector have repeatedly stalled. An inquiry is not enforcement, and it is not law — but it establishes a public record, and a record is usually what any eventual rule is built on.
The review is expected to run for several months.
