Your Data, Their Profit, Your Problem

This is the last note in the series about what Anthropic was trying to protect…

Researchers at Duke University wanted to know how easy it was to buy personal data on American military personnel. They found a broker, placed an order, and received name, rank, location history, financial profile, and behavioral data on active-duty service members and their families. The price was twelve cents per record. The seller asked no questions. There was no verification of who was buying or why.

I want to stay with that number for a moment before we go further. Twelve cents. For the file on a person who carries a weapon in service of the country, who lives on a base whose location is supposed to be at least operationally discreet, whose financial stress and movement patterns and personal associations are the kind of information a foreign intelligence service would pay considerably more than twelve cents to obtain. The broker charged twelve cents because that is what the market will bear, and because nothing in American law required them to charge more, or to ask who was asking, or to refuse.

The same market sells your file. The price may be different. The principle is identical.

The previous two notes in this series described what the government wants to do with commercially purchased data when AI is applied to it, and what private companies are already doing. This note is about the companies that built the market those buyers depend on, what each of them actually does, how they responded when Congress considered regulating them, and what happened next. The answer to that last question is the thing I most want you to carry away from this series.

The data broker industry is not a shadowy underworld. It is a publicly traded, legally operating sector of the American economy worth roughly $315 billion globally in 2026 and growing at nearly 8 percent annually. Most of its major players have names you recognize from other contexts, which is part of why their data operations receive so little scrutiny.

Equifax, Experian, and TransUnion are the companies that generate your credit score. What is less understood is that they are also three of the largest behavioral data brokers in the country. TransUnion holds profiles on approximately 98 percent of American adults and owns a subsidiary called Neustar that draws from more than 200 third-party data providers. Equifax, whose 2017 breach exposed sensitive records on 147 million Americans, has continued expanding its data operations, acquiring Vault Verify in November 2025 to deepen its hold on employment and income verification data. Experian launched a marketplace in January 2025 that allows buyers to combine its files with external data sets for targeting purposes. These are not fringe operations. They are the infrastructure of American consumer finance, and they have been quietly expanding into behavioral surveillance for years.

Then there is Acxiom, which is the company most Americans have never heard of and which has, in many ways, defined what a consumer data profile actually is. Acxiom claims files on more than 2.5 billion people globally and on virtually every adult in the United States. Its product compiles location history, purchase behavior, household composition, inferred political and religious orientation, financial vulnerability scores, and hundreds of other attributes into a single sellable record. It is owned by an advertising holding company and counts Spotify, Meta, and Hulu among its clients. It is not a technology company in the sense Silicon Valley uses that phrase. It is a dossier company.

RELX is a British firm that owns LexisNexis Risk Solutions, which operates what it describes as the largest electronic database of legal and public records in the world. LexisNexis is the company behind the identity verification questions that banks and insurers ask when they want to confirm you are who you say you are: which county did you live in before, which bank issued your car loan, what was your previous address. It owns ThreatMetrix, which tracks 4.5 billion devices globally, and holds a $22 million contract with Immigration and Customs Enforcement that immigration advocates have challenged in court. Most people interact with LexisNexis data multiple times a year without knowing the company exists.

Oracle spent more than a decade and over four billion dollars building what it described as the data broker for the generative AI age, acquiring companies like BlueKai, Datalogix, and Moat to assemble a comprehensive consumer surveillance platform. In June 2024, it quietly shut the whole operation down. Advertising revenue had collapsed from $2 billion in 2022 to $300 million in 2024, driven by GDPR enforcement in Europe, the loss of Facebook's data partnership after Cambridge Analytica, and a class action lawsuit alleging Oracle had built digital dossiers on millions of Americans without consent.CEO Safra Catz announced the closure on an investor call in a single sentence. It was not mentioned again during the call. Oracle's exit is worth noting not as evidence that the system corrects itself, but as evidence of what it takes to dislodge a major player from this market: years of European regulatory enforcement, a major scandal that forced Facebook's hand, and a pending lawsuit. None of those forces produced a new American law. None of them required Oracle to delete the data it had already collected and sold. The buyers kept everything they had.

CoreLogic holds records on 99 percent of American property owners and is the primary data source that landlords, mortgage lenders, and property insurers use to evaluate applicants. SafeGraph and Veraset are location data specialists whose entire revenue model is the sale of precise movement histories derived from smartphone apps. Fog Data Science and Anomaly Six are smaller operators in the same location data market, less visible to the public and, for that reason, more attractive to law enforcement and intelligence buyers who prefer not to be scrutinized. InMarket became briefly visible in 2023 when the FTC filed a complaint against it, which is how the public learned that InMarket had collected location data from apps on more than 390 million devices and sold audiences categorized as 'Christian church goers,' 'wealthy and not healthy,' and 'parents of preschoolers' to financial institutions and advertisers. InMarket signed a consent order and did not admit wrongdoing. It continues to operate.

And then there are the companies that affect daily life most directly but are rarely included in the public conversation about data brokers at all. HireRight compiles employment screening reports that employers use to evaluate job candidates, drawing on criminal records, prior employment, and public records databases. Zest AI builds the underwriting models that determine whether you qualify for a loan and at what rate, applying machine learning to consumer profiles assembled from purchased data. These companies do not sell your data. They use it to make binding decisions about your employment and creditworthiness, and you have no meaningful right to know what data drove those decisions or to contest it if it was wrong.

Before I turn to what happened when Congress considered regulating any of this, I want to describe one change that has made the entire system more dangerous in the past two years, because it is the change that connects this note to the others in this series.

The files I have been describing are records of what you have done: where you went, what you bought, what you searched for, who you called. A human analyst reviewing such a file can draw inferences, but the inferences are limited by human bandwidth and the analyst's ability to identify patterns across thousands of variables simultaneously. An AI system has no such limitation. Brokers now sell what the industry calls propensity scores, predictions generated by AI from behavioral data about what you are likely to do next. The scores estimate the probability that you will develop a specific illness, default on a loan, respond to a particular emotional message, or quit your job. They are derived not just from your purchases and your location history but from behavioral signals most people would not recognize as data at all: how fast you scroll through your phone, the battery level when you open certain apps, the time of day you make decisions online. Your file is no longer a record of your past. With AI applied to it, it becomes a forecast of your future, generated without your knowledge and sold to whoever is willing to pay.

This is precisely the capability the Pentagon wanted when it asked Anthropic to delete one phrase from their contract, the phrase about analysis of bulk acquired data. The data pipeline already existed. The brokers already had the files. What the Pentagon wanted was the AI layer that would turn those files into predictions. Anthropic refused. The brokers, for thirty years, have been saying yes to everyone who asked for anything less.

Congress has had multiple opportunities to regulate this industry and has declined every one of them. The pattern of those failures is not random.

When the American Data Privacy and Protection Act began gaining real traction in 2022, becoming the most credible federal privacy bill in decades, the industry responded immediately. The Markup found that 25 data broker companies had spent a combined $29 million on federal lobbying in 2020 alone, rivaling the individual lobbying spend of Facebook and Google. When the bill moved, RELX increased its lobbying by 26 percent in a single quarter. Acxiom's chief privacy officer wrote to legislators requesting carve-outs explicitly protecting what he called the 'responsible use of third-party data for advertising.' TransUnion's deputy general counsel described its lobbying as protecting 'fraud prevention products.' By 2023, RELX was spending $3.1 million annually on privacy lobbying alone, Equifax over $1.5 million, Experian $1.4 million. Those three companies together outspent most consumer advocacy organizations in this space by a factor of ten to one.

The ADPPA died without a floor vote. Its successor, the American Privacy Rights Act, died in the same Congress. A legal review of the entire 2025 legislative session found that Congress had considered several privacy proposals but none gained meaningful traction. The United States remains the only major democracy without a comprehensive federal consumer data privacy law. Every serious attempt to create one has collapsed at the same moment: when it became clear the bill would actually constrain what the industry does.

There is one episode in this legislative history that I find myself returning to, because it clarifies something about the relationship between the people making these decisions and the people they represent.

In 2023, buried in deliberations over the annual defense bill, Congress considered an amendment that would have restricted data brokers from selling the personal information of certain individuals. The amendment defined the protected class carefully. It covered members of Congress. It covered their spouses, their children, their siblings, their parents, and any congressional employee that the relevant security official identified as facing a credible threat. It did not cover a single one of the constituents those members were elected to represent. Every American whose home address, financial vulnerability score, and location history is sitting in a broker's database for sale to anyone with a credit card was left entirely outside the protection being contemplated for the people who had spent two years refusing to pass a law protecting them.

The amendment did not pass. The instinct behind it is the point.

When confronted with any of this, the industry's response is the opt-out. You can remove your data from broker databases, they say. The system is transparent. You have choices.

The opt-out is a fiction maintained for legal and rhetorical convenience. There are thousands of data brokers operating in the United States. Opting out of one has no effect on any of the others. Most opt-out processes require you to submit identifying information to the broker in order to request removal, creating a fresh data record in the process. Many brokers rebuild their databases from new source data within weeks, requiring the process to begin again. The brokers that sell primarily to government, insurance, and financial clients frequently offer no opt-out mechanism at all, because there is no law requiring them to.

California has attempted a different approach. Its Delete Act, which goes live in August 2026, creates a single platform through which California residents can submit one verified deletion request requiring every registered broker in the state to remove their records. It is the most serious consumer privacy mechanism any American state has enacted. It applies to California. It applies to registered brokers. It does not constrain what the federal government purchases. It does not reach the brokers that operate without registering. It protects none of the 320 million Americans who live in other states. The fact that this partial, state-level protection represents the current high-water mark of American privacy law is its own kind of verdict on what Congress has chosen to do.

The fragility of this system becomes visible when it breaks. In April 2024, a hacker group breached a company called National Public Data, which had built background check files by scraping public records on virtually every American adult. The hackers extracted 2.9 billion records and offered them for sale on the dark web for $3.5 million. The records included Social Security numbers, full names, current and past addresses going back decades, and dates of birth. The company filed for bankruptcy in October 2024 and shut down in December 2024. The data remains in circulation. Congressional investigators estimated that the four largest data broker breaches in recent years cost American consumers more than $20 billion in identity theft losses. There is no federal law that would have prevented National Public Data from compiling those records. There is no federal law that emerged from its collapse.

The companies named in this note would each, if asked, describe themselves as providing essential services: credit access, fraud prevention, identity verification, audience analytics. They are not wrong that those services exist and that some people benefit from them. The question that description avoids is whether those services require assembling files on every American adult without consent, selling movement histories to whoever has a credit card, generating AI predictions about people's medical futures and financial vulnerabilities, and spending tens of millions of dollars to ensure that no law ever required them to do any of it differently.

Oracle decided, under sustained legal and regulatory pressure, that this business was no longer worth the risk. It is the only major player that has made that calculation. The others have looked at the same pressure and decided that the lobbying is cheaper than the compliance, and that Congress will continue to agree with them.

The twelve-cent soldier is in the database. So are you. The companies that put you both there have names, addresses, and lobbyists. The difference between them and you is that they know exactly what is in your file, and they spent the money to make sure you never get to see it.