How to Report a Data Broker to the FTC

Understanding Data Brokers and Your Right to Report Them

Data brokers are companies that collect, aggregate, and sell personal information about individuals without their knowledge or consent. They gather data from public records, online transactions, social media, and countless other sources, then package this information for sale to marketers, employers, landlords, and other third parties.

If you've discovered that a data broker is collecting and selling your personal information, you have the right to take action. One of the most effective ways to protect your privacy is to report a data broker to the FTC (Federal Trade Commission), the primary federal agency responsible for enforcing privacy laws in the United States.

This comprehensive guide will walk you through the process of filing an FTC complaint data broker report, explain the legal framework that protects you, and show you how to avoid common mistakes when reporting. Whether you're dealing with a single data broker or multiple companies selling your information, understanding how to properly report these violations is essential to reclaiming your privacy.

The Legal Framework Protecting Your Privacy

Federal Laws Governing Data Brokers

Data brokers operate in a complex regulatory landscape. While there's no single comprehensive federal law specifically regulating all data brokers, several key laws provide protection:

The Fair Credit Reporting Act (FCRA)

The FCRA, enacted in 1970, is one of the oldest and most important privacy laws affecting data brokers. It regulates companies that compile and distribute consumer reports used for credit decisions, employment, insurance, and housing. Under the FCRA, data brokers must:

• Maintain reasonable procedures to ensure accuracy
• Provide consumers with access to their files
• Allow consumers to dispute inaccurate information
• Remove unverified or inaccurate information within 30 days

If a data broker violates FCRA requirements, you can file an FTC privacy complaint directly with the Commission.

The Gramm-Leach-Bliley Act (GLBA)

The GLBA applies to financial institutions and regulates how they handle consumer financial information. While primarily focused on banks and financial companies, it establishes important standards for data security and privacy that influence broader industry practices.

State Privacy Laws

Several states have enacted their own data broker laws:

• California Consumer Privacy Act (CCPA): Gives California residents the right to know what personal information is collected, the right to delete information, and the right to opt-out of data sales
• Virginia Consumer Data Protection Act (VCDPA): Provides similar rights to Virginia residents
• Colorado Privacy Act (CPA): Offers Colorado residents privacy rights and data broker transparency requirements

The Role of the FTC

The Federal Trade Commission has broad authority to investigate unfair or deceptive practices affecting consumers. When you file a federal data broker complaint, the FTC can:

• Investigate the data broker's practices
• Take enforcement action if violations are found
• Require the company to modify or cease problematic practices
• Impose civil penalties
• Refer cases to state attorneys general for additional action

The FTC maintains a public database of complaints, which helps identify patterns of misconduct across multiple companies.

Who Is Covered and What's Protected

Types of Data Brokers Subject to FTC Oversight

Not all data brokers face the same level of regulation. The FTC's authority depends on the type of data broker and how they use consumer information:

Consumer Reporting Agencies (highest level of regulation)

These companies compile consumer reports used for credit, employment, insurance, or housing decisions. Examples include:

• Credit reporting agencies (Equifax, Experian, TransUnion)
• Employment screening companies
• Tenant screening services
• Insurance underwriting companies

Data Brokers (general category)

These companies collect and sell personal information for marketing, lead generation, and other commercial purposes. They face less regulation than consumer reporting agencies but are still subject to FTC oversight.

Specialty Consumer Reporting Agencies

These compile reports for specific industries, such as:

• Check verification services
• Medical information companies
• Rental history services
• Insurance claims history services

What Information Is Protected

The types of personal information that trigger FTC protection include:

• Full name and contact information (address, phone, email)
• Social Security numbers and financial account numbers
• Credit and financial history
• Employment history and income information
• Health and medical records
• Online browsing and purchase history
• Location data
• Biometric information
• Criminal history and background information

Step-by-Step Process for Filing an FTC Complaint About a Data Broker

Step 1: Gather Evidence and Documentation

Before filing your complaint, collect comprehensive documentation of the data broker's violations:

• Identify the specific data broker - Write down the company name, website, and any identifying information
• Document what information they have - Note what personal data you found on their platform
• Screenshot or save evidence - Take screenshots of your information on their website or database
• Note the date you discovered it - Record when you first found your data listed
• Check if they claim authorization - Review their terms of service and privacy policy
• Document any harm - Note any consequences you've experienced (identity theft, unwanted solicitations, discrimination)
• Keep copies of all communications - Save emails, chat logs, or letters exchanged with the company

Step 2: Determine the Type of Violation

Understanding what specific violation occurred will strengthen your complaint. Common violations include:

• FCRA violations - If the data broker is a consumer reporting agency that failed to provide access, allow disputes, or maintain accuracy
• Deceptive practices - If the company falsely claims to have authorization to collect or sell your data
• Failure to honor opt-out requests - If you requested removal and they didn't comply
• Data security failures - If your information was exposed due to inadequate security measures
• Unauthorized collection - If they collected data without legal basis or consent

Step 3: Access the FTC Complaint Portal

The FTC makes filing complaints straightforward through their online system:

• Visit reportidentitytheft.ftc.gov for identity theft complaints or reportfraud.ftc.gov for general privacy complaints
• Select "Other personal information" or the category that best matches your complaint
• Create an account or log in if you already have one
• Follow the guided form to provide your information

Alternatively, you can file a complaint at ftccomplaintassistant.gov for non-identity theft privacy issues.

Step 4: Complete the Complaint Form

When filling out the FTC complaint form, provide:

• Your contact information - Name, address, phone, email
• Details about the data broker - Company name, website, phone number, mailing address
• Description of the violation - Explain specifically what the company did wrong
• Timeline of events - Include dates when you discovered the issue and any actions you took
• Evidence - Attach screenshots, emails, or other documentation
• Impact statement - Describe any harm or inconvenience you've experienced
• Steps already taken - Explain any attempts to resolve the issue directly with the company

Step 5: Submit Your Complaint

• Review all information for accuracy
• Attach supporting documents
• Submit the complaint through the FTC portal
• Save your confirmation number for your records
• Note that you'll receive a confirmation email

Step 6: Follow Up If Necessary

After submission:

• The FTC will send you a confirmation email with your complaint number
• Your complaint enters the FTC's database and may be reviewed by investigators
• If your case is selected for investigation, an FTC representative may contact you
• You can check your complaint status using your confirmation number

Common Pitfalls and How to Avoid Them

Mistake 1: Filing a Complaint Without Proper Evidence

The Problem: Vague complaints without documentation are less likely to result in action.

How to Avoid It:

• Take screenshots of your information on the data broker's website
• Save URLs and dates
• Document the specific data points the company is selling
• Keep copies of any communications with the company

Mistake 2: Confusing Data Brokers with Other Privacy Issues

The Problem: Filing about the wrong entity wastes time and may not lead to resolution.

How to Avoid It:

• Verify that the company is actually a data broker (not a social media platform, search engine, or your bank)
• Understand the difference between consumer reporting agencies and general data brokers
• Check whether the company's primary business is selling personal information

Mistake 3: Not Including Specific Details

The Problem: Generic complaints lack the specificity needed for investigation.

How to Avoid It:

• Name the exact data points being sold (SSN, address, phone, etc.)
• Provide specific dates and times when possible
• Explain the exact harm you've experienced
• Reference specific violations of laws like the FCRA or CCPA

Mistake 4: Failing to Document Attempts to Resolve Directly

The Problem: The FTC prefers to see evidence that you've attempted to resolve the issue with the company first.

How to Avoid It:

• Contact the data broker's customer service before filing an FTC complaint
• Request removal of your information in writing
• Save all responses (or lack thereof)
• Document how long they took to respond or whether they refused

Mistake 5: Not Following Up on Your Complaint

The Problem: Complaints that don't receive follow-up information may not receive full investigation.

How to Avoid It:

• Save your FTC complaint confirmation number
• Check the status of your complaint periodically
• Respond promptly if the FTC contacts you for additional information
• Consider filing complaints with your state attorney general as well

Templates and Resources for Filing Your Complaint

Sample Complaint Template

Use this template to organize your complaint before submitting it to the FTC:

---

Complaint Against: [Data Broker Name]

Date of Discovery: [Date]

Type of Violation: [FCRA/Deceptive Practices/Other]

Description:

I discovered that [data broker name] is collecting and selling my personal information without my authorization. Specifically, they are selling the following information about me:

• Full name: [Your name]
• Address: [Your address]
• Phone number: [Your phone]
• Other data: [List specific data points]

Timeline of Events:

• [Date]: I first discovered my information on their website
• [Date]: I attempted to contact the company to request removal
• [Date]: The company responded (or failed to respond)

Evidence:

I have attached the following documentation:

• Screenshots of my information on their website
• Copies of emails sent to the company
• Copies of their response (or lack thereof)

Harm Experienced:

As a result of this violation, I have experienced:

• [Unwanted solicitations/Identity theft/Employment discrimination/Other]

Request:

I request that the FTC investigate this company's practices and require them to:

• Remove my personal information from their database
• Cease selling my information
• Implement proper authorization procedures

---

Key Resources

FTC Resources:

• Report Identity Theft: reportidentitytheft.ftc.gov
• File a General Complaint: reportfraud.ftc.gov
• FTC Complaint Assistant: ftccomplaintassistant.gov
• FTC Data Broker Information: ftc.gov/databrokers

State Resources:

• California Attorney General Privacy Division: oag.ca.gov
• Your state attorney general's office (search "[your state] attorney general data privacy")

Helpful Organizations:

• Consumer Reports: consumerreports.org
• Privacy Rights Clearinghouse: privacyrights.org
• World Privacy Forum: worldprivacyforum.org

When to Seek Professional Help

Signs You Need Professional Assistance

Consider working with a privacy professional or attorney if:

• You've experienced identity theft or fraud - An attorney can help you pursue legal remedies beyond FTC complaints
• Multiple data brokers are involved - Managing removal from numerous sources becomes complex
• You've been denied credit or employment - This may indicate FCRA violations requiring legal action
• The data broker refuses to remove your information - You may need to escalate to state attorneys general or pursue litigation
• Your complaint involves sensitive information - Medical records, financial data, or biometric information may require specialized handling
• You want to ensure complete removal - Professional services can verify removal across all platforms

How GhostMyData Can Help

Rather than navigating the complex process of reporting individual data brokers and managing removal requests, many people find it more efficient to use a professional data removal service like GhostMyData.

GhostMyData specializes in identifying which data brokers have your information and handling removal requests on your behalf. Our service:

• Scans multiple data brokers - We check hundreds of sources to identify where your information is being sold
• Files removal requests - We submit opt-out and removal requests directly to data brokers
• Verifies removal - We confirm that your information has been actually removed
• Provides ongoing monitoring - We check periodically to ensure your data doesn't reappear
• Handles complex cases - For data brokers that resist removal, we escalate appropriately

If you're dealing with multiple data brokers or want professional assistance with the removal process, start with a free scan to see exactly where your information is being sold.

FAQ: Reporting Data Brokers to the FTC

What's the difference between reporting to the FTC and requesting removal from a data broker directly?

When you request removal directly from a data broker, you're asking one company to stop selling your information. When you file an FTC complaint data broker report, you're asking the federal government to investigate whether the company's practices violate privacy laws. Both approaches are valuable—direct removal requests often work faster, but FTC complaints create a record of misconduct and can lead to broader enforcement action that protects other consumers.

How long does it take for the FTC to investigate a data broker complaint?

The FTC doesn't have a set timeline for investigations. Some complaints are resolved quickly if the violation is clear, while others may take months or years. The FTC prioritizes cases involving widespread harm, large companies, or repeated violations. Your complaint enters a database that FTC investigators use to identify patterns, so even if your individual case isn't formally investigated, it contributes to enforcement efforts.

Can I file a complaint if the data broker is located outside the United States?

Yes, the FTC has authority over foreign companies that collect and sell information about U.S. consumers. However, enforcement may be more challenging. You can also file complaints with your state attorney general or, if the company is subject to GDPR (European General Data Protection Regulation), file complaints with European privacy authorities if you have EU residency or data.

What should I do if the data broker doesn't respond to my removal request after I've filed an FTC complaint?

Document the non-response and file a follow-up complaint with the FTC. You can also file a complaint with your state attorney general, who may have more aggressive enforcement authority. If the company is a consumer reporting agency covered by the FCRA, you may have grounds for a private lawsuit. Consider reaching out to a consumer protection attorney for guidance on legal options.

Is filing an FTC complaint the same as reporting identity theft?

No. Filing an identity theft report is appropriate if someone has actually used your personal information fraudulently (opened accounts, made purchases, etc.). Reporting a data broker to the FTC is appropriate when a company is collecting and selling your information without authorization, even if no fraud has occurred. However, if a data broker's negligence led to identity theft, you should file both an identity theft report and a complaint about the data broker's practices.

---

Take Action Today

Reporting a data broker to the FTC is an important step in protecting your privacy and holding companies accountable for unauthorized data collection and sales. By following the steps outlined in this guide, you can file an effective complaint that contributes to enforcement efforts and creates a record of the company's misconduct.

However, if you want to go beyond reporting and actually remove your information from data brokers' databases, consider taking a more comprehensive approach. Rather than managing individual removal requests and FTC complaints across dozens of data brokers, GhostMyData's automated removal service handles the entire process for you.

Ready to take back your privacy? Start with a free scan to discover exactly which data brokers have your information. Then let our team handle the removal requests, follow-ups, and verification—all while you focus on what matters most.

Your personal information is valuable. It's time to stop letting data brokers profit from it.