Published: October 28, 2026 Category: Data Brokers, Privacy, Guide Reading time: ~12 minutes Meta description: Data brokers don't just collect facts — they infer income, health and life stage. What an inference is, what California law says about it, and how to find yours.
Most coverage of the data broker industry focuses on collection: the address, the phone number, the relatives, the court record. That part is real, but it is the boring half of the business. The valuable half is what brokers infer from it.
An inference is a guess written down as a fact. You never provided it, you usually cannot see it, and it can decide which job ad you see, which insurance offer you get, and which scam call reaches your phone. In October 2026, Fox News ran a consumer piece titled "Data brokers don't just collect facts. They guess about you", which is an accurate description of how the industry actually works — and a useful reminder that the guesses, not the records, are where most of the harm sits.
This guide explains what a data broker inference is, why it survives most opt-outs, what California law now says about it, and what you can realistically do about the profile attached to your name.
What a data broker inference actually is
A data broker assembles records from many sources — public records, loyalty programs, warranty cards, app telemetry, purchased datasets — and then runs models over them. The output is a set of modeled attributes, sometimes called predicted or inferred attributes. They are not observations. They are probabilities with a label attached.
The industry calls this "audience segmentation." A household might be bucketed into a life-stage category, an income band, a health-interest group, or a "likely to move" flag. The labels are then sold as targeting criteria, which is why the same underlying records get repriced and resold in combinations you never agreed to.
The important structural point: an inference is derived, so it is not limited by what you actually did. A search for a diet plan, a pharmacy visit, a gym app, and a grocery loyalty card can combine into a health-interest label even where no single piece of data would justify one.
| What you actually did | What a model can write down about you |
|---|---|
| Searched a symptom at 2am | "Health-interested" household segment |
| Bought a birthday card and nappies | "New parent" life-stage flag |
| Visited a church once | Religious-affiliation segment |
| Compared retirement plans | "Approaching retirement" income band |
| Used a budgeting app | Estimated income range and credit propensity |
| Looked up a treatment for a relative | Condition-association label attached to *you* |
Why an inference is harder to fight than a record
A record can be checked. "Is this my address?" is a factual question with a factual answer. An inference cannot be checked from the outside, because the model is not published and the label is often not shown to you at all.
Four properties make inferences the harder problem:
1. They are invisible. A people-search site shows you a profile page. A segmentation vendor does not show you the segment you are in. You cannot dispute a label you cannot see. 2. They travel. Once a category is sold, it is copied into other systems — a CRM, an ad platform, a lead list. Deleting the original record does not recall the copies, and the copies can regenerate the inference later. 3. They compound. An inferred income band feeds a model that predicts purchasing power, which feeds an offer, which generates a response, which becomes new data confirming the original guess. Wrong labels can reinforce themselves. 4. They are treated as facts downstream. The buyer of an audience segment usually has no way to know the accuracy rate of the prediction. They buy a category, not a confidence interval.
That last point matters more than it sounds. If a company buys "likely diabetic" as a segment, the person receiving the ad may simply be someone who researched a condition for a parent. The label does not carry its own error bar.
The accuracy problem: a search is not a diagnosis
The most common misconception about broker profiles is that they are wrong and therefore harmless. It is the reverse: they can be wrong and consequential, because the consequence does not depend on accuracy.
Consider the ordinary case of researching a condition for someone else. Searching for diabetes information is not evidence of diabetes. Visiting a church is not evidence of membership. Reading about a political candidate is not support for that candidate. Yet each of those signals can be one input into a category that is then sold to an advertiser, a lead generator, or — historically — worse.
The practical implication is that "I have nothing to hide" is the wrong test. The question is not whether the profile is true. It is whether a model is willing to write something down about you, and whether anyone downstream will act on it.
The legal gap that lets most inferences exist
Health data is the clearest example, because people assume it is protected.
The HIPAA Privacy Rule applies to covered entities — health plans, clearinghouses, and most health care providers — and their business associates. It does not govern a marketing data company that buys a list, models a health-interest segment, and sells it to an advertiser. Inferred health data created outside the clinical system generally falls outside HIPAA's scope, even though it can be more revealing than a diagnosis code.
That leaves other laws to do the work, and they do different jobs:
- The Fair Credit Reporting Act (FCRA) can apply when information is used to make eligibility decisions about credit, insurance, employment, or housing. In that context an inferred attribute can become a consumer report with accuracy and dispute obligations attached.
- State comprehensive privacy laws decide whether inferences count as personal information you can see and delete. This is where California is unusually explicit.
- Sector rules fill small gaps — insurance scoring, lending, employment screening — with their own accuracy requirements.
The result is a patchwork. The same inference can be regulated as a consumer report in one use, personal information in another, and nothing at all in a third.
What California law now says about data broker inferences
California is the clearest jurisdiction on this point, because its own regulator puts inferences inside the definition of personal information.
The California Attorney General's CCPA guidance, updated August 28, 2026, defines personal information as data that "identifies, relates to, or could reasonably be linked with you or your household," and gives as examples your name, records of products purchased, browsing history, geolocation, and "inferences from other personal information that could create a profile about your preferences and characteristics." Inferences are not a side category — they are personal information.
That classification matters because the CCPA rights attach to personal information:
| CCPA right | What it means for an inference |
|---|---|
| Right to know | You can ask a business to disclose the categories and specific pieces of personal information it holds about you — up to twice a year, free |
| Right to correct | Inaccurate personal information can be corrected, which is the closest thing to a dispute route for a wrong modeled attribute |
| Right to delete | You can ask a business to delete personal information it collected from you, subject to the law's exceptions |
| Right to opt out of sale or sharing | You can direct a business not to sell or share your personal information, including via Global Privacy Control |
| Right to limit | You can direct a business to limit its use and disclosure of sensitive personal information to permitted purposes, unless you have consented to broader use |
Two honest caveats. DROP reaches registered brokers, not every company with a profile of you. And the statutory exceptions still apply — deletion is not unconditional.
If you are outside California, the picture depends on your state's law. Several comprehensive state privacy laws include inferences in their definition of personal data; others are narrower. The complete guide to data broker removal covers the mechanics that work in any state; the state-by-state rules are collected in the 2026 privacy law roundup.
Why a people-search opt-out does not remove an inference
This is the single most useful distinction in consumer privacy, and almost nobody explains it: there are two different markets, and they fail in different ways.
Market one — people-search sites. Spokeo, Whitepages, BeenVerified, Radaris and their peers publish a profile page with your name, address history, phone numbers and relatives. Theirs is a per-listing opt-out model: you find your record, you submit a request, the listing comes down. This is what most "remove your data" guides are actually about, and it is genuinely worth doing — that listing is what a stalker, a scammer, or a skip tracer sees.
Market two — marketing and segmentation brokers. These companies do not publish a page about you. They sell audiences, scores, and modeled attributes to advertisers, insurers, and lead generators. There is usually no consumer-facing opt-out page at all, because the product is not a profile of you — it is a category you fall into.
Removing a Spokeo listing does nothing to an income band held by a segmentation vendor. That is not a flaw in the opt-out; it is a different market with a different interface, and most of the time the interface is a legal request rather than a web form.
The same gap explains why "I opted out and I still get spam" is such a common experience. The list you removed yourself from and the list your number was sold on are frequently not the same list.
How to find out what data brokers infer about you
There is no central registry of inferences. What exists is a set of legal rights you can exercise, plus a few practical probes.
Step 1 — pull the free visibility layer first. Start with what is publicly exposed, because it is the raw material for everything downstream. Our step-by-step guide to finding out what data brokers know about you walks through the search-query patterns and the sites that surface a profile. A free scan will show you which broker sites are publishing your details right now.
Step 2 — send right-to-know requests to the companies most likely to model you. The targets that matter are not only the people-search sites. They are the data companies that sit behind advertising and analytics. A right-to-know request under your state law asks for the categories and specific pieces of personal information held — which, in California, includes inferences.
Step 3 — read the response for the category list, not the detail. Most responses will give you categories ("inferred household characteristics") rather than the actual label. That is often legally sufficient for them and frustrating for you. What you are looking for is confirmation that inferred categories exist in the file, because that justifies a deletion or correction request in the same thread.
Step 4 — use DROP if you are in California. One request, 600-plus registered brokers, a 45-day processing cadence, and a status page that can lag by up to 90 days. It is the highest-leverage single action available to a California resident, and it costs nothing.
Step 5 — re-check on a schedule. Deletion is a process, not an event. Records reappear when a broker re-ingests a public source, and an inference can be regenerated from data that was never deleted. A re-check every few months is the difference between "removed once" and "stayed removed." Our guide to how long data broker removal takes explains the realistic timeline.
What actually reduces the number of inferences made about you
You cannot delete a model. You can reduce the inputs, remove the outputs you are entitled to remove, and shrink the surface that gets scraped. In rough order of leverage:
| Action | What it changes | What it cannot do |
|---|---|---|
| Delete broker listings (people-search layer) | Removes the public profile that seeds new records | Does not touch segmentation data |
| Right-to-know and deletion requests to data companies | Removes held personal information, including inferences, where the law allows | Does not recall copies already sold |
| DROP (California) | One request across 600+ registered brokers | Registered brokers only |
| Opt out of sale and sharing, plus Global Privacy Control | Stops future sale and sharing by covered businesses | Does not delete what was already sold |
| Reduce the signal — separate identities, fewer loyalty profiles, tighter app permissions | Lowers the raw material available to models | Cannot undo existing history |
| Re-check every few months | Catches re-listing and re-ingestion | Cannot guarantee permanence |
If an inference is being used against you in an insurance decision, the guide to insurance scoring and broker data covers the dispute route. That is also the argument for treating removal as maintenance rather than a one-off purchase — and for judging any removal service on whether it re-checks, not just whether it deletes once.
Frequently asked questions
Are inferences really covered by privacy law?
In California, yes — the Attorney General's own CCPA guidance lists inferences as a form of personal information, which means the rights to know, correct, delete, and opt out of sale apply to them. Other states vary; some comprehensive laws include inferences explicitly, others are narrower.
Can I see the exact label a data broker assigned to me?
Usually not. A right-to-know response will typically disclose categories rather than the specific model output. You are more likely to learn that inferred categories exist than to see the phrase a marketer sees.
Does deleting my data from people-search sites remove my marketing segments?
No. Those are two separate markets with separate opt-out mechanisms. People-search removal takes down a public listing; segmentation data is typically only reachable through a legal request to the company holding it.
Is HIPAA protecting my inferred health data?
Generally not, if the inference was created outside a covered health care provider, plan, or clearinghouse. HIPAA governs covered entities and their business associates; a marketing data company modelling a health-interest segment is usually outside that scope.
Does DROP delete everything?
No. It reaches registered data brokers in California's registry — more than 600 of them — and the statute's exceptions still apply. It is the broadest single action available to a California resident, not a complete erasure.
Start with what is actually visible
Inferences are built on top of exposed records. The fastest way to shrink the profile is to start with what is published about you right now — then use your legal rights to reach the layer that never publishes anything.
CyberForget is free to use: a scan shows you which broker sites are holding your details, and you can work through the removals without a subscription. If you want the full picture before you start, read the complete guide to data broker removal, or check the opt-out list for the sites most likely to be carrying your record today.
*This article is for informational purposes and does not constitute legal advice. Privacy law varies by state and changes frequently; confirm the current requirements for your jurisdiction before relying on any specific right or deadline.*
🔒 Take Control of Your Data
Ready to remove your personal information from data broker sites? CyberForget scans 200+ sites in seconds and hands you the opt-out link for each one, free.
Start Free Scan →