Companies selling your data to third parties is legal in most situations in the United States, but you have real tools to stop it: federal laws cover specific categories like financial, health, children’s, and video-viewing data, and roughly 20 states now give consumers the right to see what’s been collected, opt out of its sale, and demand its deletion. Which rights you have depends on where you live and what kind of data is involved. What follows is how the rules actually work and what you can do today.
What Data Actually Gets Sold
The information traded about you starts with basic identifiers: name, home address, email, phone number. On top of that, companies package financial indicators like credit score ranges, estimated income, and debt levels, along with age, gender, and ethnicity used to build marketing segments.
The more revealing material is behavioral. Location history pulled from phone GPS can show which stores you visited, how long you stayed, and how often you return. Browsing records capture search queries, products viewed, and time spent on each page. Purchase histories from online and brick-and-mortar retailers reveal brand preferences, spending patterns, and even prescription drug categories. Biometric data such as facial geometry and fingerprint patterns is also traded, though a few states restrict selling it.
Data brokers sit at the center of this market. They never interact with the people they profile; they buy from companies that do, combine what they get with public records like property assessments, voter registrations, and court filings, and sell the resulting dossiers. The global data broker market is projected to reach roughly $363 billion in 2026. Brokers sort consumers into audience segments with labels like “expectant parents,” “high-risk borrowers,” or “wealthy and not healthy,” which insurers, lenders, and advertisers then buy.
The Federal Rules That Actually Restrict Sales
There is no single federal law banning the sale of personal data. Congress has instead passed sector-specific statutes, and if your information falls into one of these categories, the company holding it has to follow tighter rules than a typical retailer or app.
Financial Information
The Gramm-Leach-Bliley Act covers banks, lenders, investment firms, and other financial institutions. Before sharing your nonpublic personal information with an unaffiliated company, the institution has to clearly disclose that it may do so, explain how you can opt out, and give you a chance to block the disclosure before it happens.1Office of the Law Revision Counsel. 15 USC 6802 – Obligations With Respect to Disclosures of Personal Information The law also prohibits sharing account numbers for marketing purposes. The protections apply automatically, but you still have to exercise the opt-out when the notice arrives.
Health Records
HIPAA restricts the sale of protected health information by hospitals, insurers, and their business partners. A covered entity cannot sell your health data without first obtaining your written authorization, and that authorization must specifically state that the disclosure will result in payment to the entity.2eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required This is genuine consent, not a buried clause in a terms-of-service. The form must describe the information involved, name who will receive it, and include an expiration date. If a breach of your health data occurs, the entity must notify you within 60 days of discovering it.3HHS.gov. Breach Notification Rule
Children’s Data
The Children’s Online Privacy Protection Act makes it illegal to collect, use, or disclose personal information from children under 13 without first obtaining verifiable parental consent.4Office of the Law Revision Counsel. 15 USC 6502 – Regulation of Unfair and Deceptive Acts and Practices in Connection With the Collection and Use of Personal Information From and About Children on the Internet It applies to websites, apps, connected devices, and third-party advertisers that knowingly gather data from children.
Video and Streaming History
The Video Privacy Protection Act prohibits video service providers from disclosing what you watch. Originally written for video rental stores, courts have applied it to modern streaming platforms. A provider can only share your viewing history with a third party if you give separate, written consent that is distinct from any other agreement. That consent can last no longer than two years, and you must have a clear way to withdraw it at any time.5Office of the Law Revision Counsel. 18 USC 2710 – Wrongful Disclosure of Video Tape Rental or Sale Records
If your data doesn’t fall into one of those buckets, the federal government has nothing broad to say about whether it can be sold. That gap is why state law matters.
Your Rights Under State Privacy Laws
Roughly 20 states have enacted comprehensive consumer privacy laws, with California’s Consumer Privacy Act serving as the template most others follow. The details vary, but the core obligations are similar: businesses have to disclose what categories of personal information they collect, explain what they use it for, and say whether they sell or share it with third parties. Notice has to appear at or before the point of collection. If you don’t live in one of these states, you may have no state-level right to opt out at all.
Right to Know
You can submit a request asking a covered business to disclose the categories and specific pieces of personal information it has collected about you, the sources, the business purposes, and which third parties received it.6State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act Under most state laws, the business must respond free of charge within 45 days, and the disclosure typically covers the preceding 12-month period. You can generally make this request up to twice per year.
Right to Opt Out of Sales
This is the direct lever. State privacy laws that include this right require businesses to post a clear link on their website, with language along the lines of “Do Not Sell or Share My Personal Information,” that lets you submit an opt-out request without creating an account. Once you opt out, the company cannot sell your data again unless you later re-authorize it.6State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act
The Global Privacy Control is a browser-level signal that communicates your opt-out preference to every website you visit automatically. Several state laws now require businesses to honor this signal as a legally valid opt-out request.7Global Privacy Control. Global Privacy Control You enable it through certain browsers or extensions, which saves you from filing individual requests with every company holding your data.
Right to Delete
You can request that a business delete the personal information it collected from you, and the company must direct its service providers to do the same. Exceptions apply for data the business is legally required to keep or that it needs to complete a transaction you initiated.6State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act A business cannot punish you for exercising any of these rights by charging higher prices, degrading service, or denying you access.
What Enforcement Looks Like
Penalties can add up. Under California’s framework, each violation can carry an administrative fine of up to $2,500, or $7,500 for intentional violations and violations involving the data of consumers known to be under 16. These are per-violation penalties, so a company mishandling data for thousands of people faces exposure that scales fast. Separately, consumers may be able to sue for statutory damages of $100 to $750 per person per incident if a data breach results from a company’s failure to maintain reasonable security. That private right of action applies specifically to breaches caused by inadequate security, not every privacy violation.
How to Actually Stop the Sales
Exercising your rights matters, but the sheer number of companies holding your data means individual opt-out requests only go so far. A layered approach works better.
Turn on Global Privacy Control in your browser so opt-out signals go out automatically as you browse. Review app permissions on your phone and revoke access to location, microphone, and contacts for any app that doesn’t genuinely need them; free apps often obtain background access when you sign up and keep collecting whether you’re using them or not. Loyalty programs are a direct trade of privacy for discounts, since the retailer logs every purchase tied to the phone number or email you handed over; decide whether the savings are worth it.
For data already circulating, place a credit freeze with all three major credit bureaus. A freeze prevents anyone from opening new accounts in your name, costs nothing to place or lift, and does not affect your credit score.8Federal Trade Commission. Credit Freezes and Fraud Alerts It stays in place until you lift it, and you can lift it temporarily when you need to apply for credit. A freeze doesn’t stop companies from selling your browsing history or purchase records, but it blocks one of the most damaging downstream consequences of your information circulating: fraudulent accounts opened in your name.