Most people picture a hacker when they imagine someone building a file on them. In practice it is usually not a hacker at all - it is a data broker, running an entirely legal business built on connecting pieces of information you never meant to be connected.
Where the profile actually comes from
No single source hands a broker your life story. They stitch it together from places that each feel harmless on their own:
- Public records - voter rolls, property filings, court documents - that many jurisdictions publish by default
- Old data breaches that keep circulating for years after the breached company has forgotten they happened
- App permissions granted once and never revisited: location history, contact lists, browsing patterns
- Social platforms' public-by-default settings, scraped at scale rather than viewed one profile at a time
- Loyalty programs and "free" services that fund themselves by reselling behavioral data
What happens once they have it
Individually, none of this is remarkable. Combined, it becomes a dossier: your name next to your address next to your relatives next to your old phone number next to a password you reused twice. That dossier gets sold to marketers, resurfaced on people-search sites, and - less advertised - bought by scammers building convincing spear-phishing pretexts.
The data broker's product isn't your information. It's the profile they build by connecting information you never meant to be connected.
What actually reduces your exposure
Opting out with brokers one by one works, technically - until the same data resurfaces from a different source a few months later and rebuilds the profile you just took down. A few things make more durable difference:
- Check the accounts you signed up for years ago and forgot about - those are usually the ones leaking the most
- Send removal requests where the law actually gives you standing, rather than relying on a broker's goodwill
- Treat this as recurring maintenance, not a one-time cleanup - profiles regenerate
That recurring, cross-platform part is the reason we built MyDefense the way we did: scanning across the accounts you actually use and filing the erasure requests your local privacy law entitles you to, instead of doing it one broker at a time by hand.