Privacy · Online safety · French law

Data brokers: how does your personal data circulate?

Understand how data brokers collect, combine and share personal information, the risks involved and the rights available under the GDPR.

02 · Digital footprint

What is a data broker?

A data broker is a business that collects or obtains information from multiple sources, organises it and may enrich, analyse or share it with other organisations. Some sell datasets or profiles; others provide analytics, verification or audience-targeting services.

Important distinction: not every organisation that processes personal data is a data broker. A social network, advertiser, directory provider or audience-measurement service may process data for its own purposes or those of partners without performing exactly the same role. Responsibilities depend on the actual activities carried out.

How is the information collected?

Data brokers may combine information from a range of sources, including:

Publicly accessible online sources

Directories, professional websites, classified ads, public posts, registers and web pages. Automated tools may extract some of this information, a practice often called web scraping.

Forms and digital services

Information provided when signing up, making a purchase, requesting a quote, entering a competition or using a service, depending on the information collected and permissions obtained.

Partners and commercial datasets

Information shared or made available by companies, service providers, agencies or data suppliers through contractual relationships.

Inferred or enriched information

Different data points may be combined to enrich a profile, such as professional activity, assumed interests, consumer categories or geographical area.

Apps and the advertising ecosystem

Some advertising-technology businesses receive identifiers or signals related to service usage, subject to the rules that apply to trackers and personal data.

Records and historical data

Older information, changes in contact details or data from files accessible within a legal framework may be retained and updated, with varying levels of accuracy.

What information can be brought together?

Depending on the sources and purposes, datasets may contain contact details, professional information, purchase or interest-related data, demographic characteristics, geographical areas or technical identifiers. Some information is provided by the individual; other details are observed, matched or inferred.

A profile is not necessarily accurate or up to date. A namesake, an old record or an incorrect match may lead to information about one person being attributed to someone else. Special-category data under the GDPR receives enhanced protection and cannot be processed freely.

What are these profiles used for?

Commercial prospecting: identifying potential customers, enriching contact lists or selecting audiences for products and services;
Segmentation and analysis: grouping people according to criteria to study behaviours or markets;
Verification and fraud prevention: supporting certain identity checks or risk assessments, within a framework that must be justified and proportionate;
Advertising and measurement: helping some organisations select audiences or measure campaigns, subject to applicable rules.

The fact that information is publicly available does not mean it can be collected, combined, sold or reused without limits. The purpose, legal basis, transparency and respect for individuals' rights remain essential.

Why can this circulation create risks?

With several intermediaries involved, it can be difficult to know who holds information, where it came from and to whom it has been shared. Data provided in one context may be reused in another context that the individual did not expect.

Potential risks include persistent marketing, loss of control over contact details, inaccurate profiles, decisions based on incorrect information and greater exposure when separate details are combined. Data may also be retained longer than expected or circulated among several partners.

What rights do you have in France and the European Union?

Where a data broker processes information that can identify you, the GDPR may apply even if the information came from publicly accessible sources. Information being visible online does not automatically take it outside personal-data protection rules.

Depending on the circumstances, you may be able to request:

Access: confirmation that an organisation processes your data, a copy of the data and available information about its source, purposes and recipients;
Rectification: correction of inaccurate or incomplete information;
Erasure: deletion where the conditions set out in the GDPR are met;
Restriction: limiting the use of data in certain circumstances;
Objection: objecting to certain processing based on legitimate interests. You can object at any time to the use of your data for direct marketing.

When an organisation did not obtain the data directly from you, it must generally provide the information required by the GDPR, including information about the source, subject to the exceptions in the Regulation. The precise requirements depend on the processing and its legal basis.

Step 1

Identify the organisation contacting you

Check the privacy information in the message, website or form. Note the company's name and contact details and, where available, those of its data protection officer.

Step 2

Ask where the data came from and how it is used

Ask what information is held, where it came from, why it is used, which legal basis is relied on and which recipients have received it.

Step 3

Exercise the rights relevant to your situation

Request rectification or erasure where the legal conditions are met. If your data is used for direct marketing, clearly object to that purpose.

Step 4

Keep a record of your requests

Keep a copy of your request, the date it was sent and any reply. In principle, the organisation must respond within one month, subject to extensions allowed by the GDPR.

If the response is inadequate: if the organisation does not reply within the applicable time limit or you are dissatisfied with its response, you can lodge a complaint with the French data protection authority, the CNIL. A request to a data broker does not necessarily remove information from the original website: separate requests may be needed to each relevant controller.

Official resources

CNIL – Reuse of personal data published online for commercial purposes: your rights (French) ;
CNIL – Commercial prospecting and data sharing between businesses (French) ;
CNIL – Your rights over personal data (French) ;
European Data Protection Board (EDPB) – European data-protection guidance.
How personal information is found online.

This page provides general information about data brokers and the law applicable in France and the European Union. It is not individual legal advice. Obligations depend on each organisation's role, the data processed, the purposes and the circumstances.