01The business you never see
Data brokers — also known as information brokers or data resellers — are companies that collect, analyse, aggregate and sell or license personal data about people to third parties. In most cases, the people concerned neither know about it nor have consented.[05][06]
They are also referred to as Information Product Companies, Data Resellers, Data Suppliers or Data Vendors. The system is entirely invisible to most people: there is no direct business relationship between the broker and the person whose data is being collected.
According to forecasts, the market is expected to grow to $448–617 billion USD by 2030–2031.[01][02] For comparison: the total revenue of the German automotive industry in 2024 was around €460 billion.
02 — Business model02How to make billions from other people's data
Data brokers make money in several ways:[01][07][13]
- Bulk sale of entire datasets — companies purchase millions of profiles at once, e.g. all women aged 30–45 in Bavaria with children
- Subscription-based direct access for corporate clients — paying customers get a permanent live connection to the database and can retrieve up-to-date profiles at any time (41% of the market, 2025)
- Online data marketplaces — digital exchanges where data packages are offered and traded like goods; the fastest-growing segment (+14% per year)
- Analytics services: ScoringScoringThe calculation of a metric expressing your creditworthiness, risk profile or value as a customer. In Germany via SCHUFA: 0–100%. Determines access to loans, housing, phone contracts — often without your knowledge., profiling, risk assessment
- Usage fees for permanent access — similar to a software subscription, except it grants access to other people's personal data
The business model is vertically structured:
- First-party providers: Collect data directly from you — these are platforms like Facebook, Google or online retailers that record your behaviour on their own sites
- Third-party resellers: Buy data from many first-party providers, combine it into detailed profiles and sell it on — these are the actual data brokers (e.g. Acxiom, Experian, Epsilon)
- People-search engines: Websites where anyone can, for a fee, search for a specific person and obtain their address, relatives and phone numbers (e.g. Spokeo, Intelius)
03What brokers know about you
An average data brokerData BrokerCompanies that collect personal data, compile it into profiles and sell it to third parties, without the people concerned knowing or having consented. There are around 5,000 such firms worldwide. profile contains approximately 1,500 data points per person. Acxiom claimed in 2023 to hold data on 2.5 billion people with over 3,000 data points per person.[07][08]
Basic information
Name, address, phone number, email, date of birth, age, gender, Social Security number (USA), ID numbers.
Demographic & socioeconomic data
Marital status, household size, children, education level, occupation, income, assets, creditworthiness, homeowner or renter status.
Behavioural & purchase data
Purchase history (online & offline via loyalty cards), browsing behaviour, search history, consumer preferences, brand affinities, subscriptions, donation behaviour.
Location data
GPS movement profiles from advertising SDKsSDKSoftware Development Kit — a programming toolkit that app developers embed in their apps. Advertising SDKs collect location data, device information and usage behaviour in the background and send it to ad networks or data brokers. in apps — frequently visited places such as home, work, church, doctor's surgery, school.[09][12]
Health & lifestyle data
Inferred from purchase data: plus-size clothing → body status, tendency toward illness. LexisNexis offers a health scoring product that calculates expected healthcare costs from consumer behaviour.[08]
Political & religious data
Voter registration, donation history, inferred religious affiliation, political leaning.
Psychographic & life-event data
Life events: marriage, divorce, house move, new baby, university, job change. Personality types, interests, hobbies. Experian sells weekly updated lists of "names of expectant parents and families with newborns".[08]
Cynical categorisations
Brokers label people with names like "American Royalty" (Experian, for wealthy suburban families), but also "X-tra Needy", "Meager Metro Means" or "Small Town Shallow Pockets".[08] In Germany: "High earner", "Organic consumer", "Mallorca holidaymaker", "Stomach patient", "Migration background".[62]
04Where does the data come from?
Public sources
Voter registrations, census data, land registry records, court files, vehicle registrations, driving licence databases, death certificates, marriage certificates.
Commercial sources
Retailers and loyalty card programmes — Datalogix holds data on over $1 trillion USD in consumer spending from 1,400+ brands. Also: banks, credit institutions, insurance companies, estate agents, landlords, telecoms companies.[08]
Digital sources
Social media platforms, online quizzes, prize draws, surveys, ad networks & cookiesCookiesSmall text files that websites store in your browser. Third-party cookies track you across different websites and send your browsing behaviour to ad networks and data brokers., mobile apps with embedded advertising SDKs, including prayer apps and dating apps, e-commerce transactions.[09][12]
Data purchases from other brokers
Brokers also buy from one another — creating a data chain that is practically untraceable. Acxiom, Experian and Epsilon refused to disclose their specific data sources or buyers to the US Senate.[14]
05 — The companies05The world's biggest data traders
| Company | Annual revenue | Core business |
|---|---|---|
| Experian | ~$9.7B USD | Credit reportingCredit ReportingThe systematic collection and analysis of financial data about consumers: payment behaviour, outstanding loans, debt collection proceedings. In the US dominated by Experian, Equifax and TransUnion — in Germany by SCHUFA., marketing |
| Equifax | ~$5.1B USD | Credit reporting, analytics |
| Epsilon | ~$2.9B USD | Marketing, advertising data |
| Acxiom / LiveRamp | ~$2.7B USD | Consumer data, profiling |
| CoreLogic | ~$2.3B USD | Real estate, insurance |
Estimates ~2022–2024. Sources: [07][15]
06Who buys the data?
67% of companies purchase external data for customer targeting (2025).[11][33]
| Sector | Purpose |
|---|---|
| Advertising & marketing | Targeting, segmentation, personalised advertising. Largest sector — all major brands plus Google, Meta, Amazon Advertising. |
| Banks & insurance | Creditworthiness checks, fraud detection, risk assessment before contract. Also landlords (credit checks before tenancy) and employers (background checks before hiring). |
| Healthcare sector | Risk assessment of insured individuals. Blue Cross Blue Shield of North Carolina purchased data on the consumer habits of 3 million of its own members for health risk calculations.[08] |
| Real estate sector | Mortgage lenders, estate agents (CoreLogic). |
| Other brokers | Brokers buy from each other and combine datasets. |
07When the state buys your data
US authorities exploit the so-called "data broker loopholeLoopholeA legal gap: since commercially sold data is considered "publicly available", US authorities need no court order to buy it. This is how the FBI, ICE and DHS circumvent the 4th Amendment.": because publicly available data requires no court order, agencies buy data from brokers to bypass the privacy protections enshrined in the 4th Amendment4th AmendmentFourth Amendment to the US Constitution: protects citizens against unreasonable searches and seizures. For physical searches, police need a court order, for purchasing data from brokers, they currently do not. of the US Constitution.[17][20][22]
| Agency | Data purchased | Purpose |
|---|---|---|
| DHS / CBP | Mobile phone location data | Tracking migrants |
| ICE | Location data, utility data, licence plate reader data | Deportation operations |
| FBI | Location data (Venntel), automated alerts on social media activity of specific individuals (ZeroFox) | Law enforcement; investigated >1,000 media outlets, politicians, religious groups |
| DEA | Location data | Drug investigations |
| US Special Operations Command | Location data | Military intelligence operations |
| Defense Intelligence Agency | LexisNexis contract | Intelligence analysis |
| US Navy | Sayari Analytics (network analysis service) | Tracking individuals and companies violating international sanctions |
| DHS | Web of Science (world's largest academic database) | Identifying and monitoring foreign researchers working at US universities |
Documented cases
Legal situation
The Fourth Amendment Is Not For Sale Act (FANFSA) passed the US House of Representatives in 2024 and would have required a court order for data purchases. It failed in the Senate. The Protecting Americans' Data from Foreign Adversaries Act (2024) was enacted, but only prohibits selling certain data to foreign adversaries, not to US agencies.[20][32]
08When data traders get hacked
According to a report by the US Congress Joint Economic Committee (February 2026), just four data broker breaches cost American consumers an estimated $20.9 billion USD through identity theft.[25][26]
| Company | Year | Affected | Data |
|---|---|---|---|
| Equifax | 2017 | 147.9M | Names, SSN, dates of birth, addresses, driving licences, credit cards |
| Exactis | 2018 | 230M | Phone, email, interests, children |
| National Public Data | 2023/2024 | 270M (2.9B records) | Names, addresses, SSN, dates of birth, phone numbers |
| TransUnion | 2025 | 4.4M | Not fully documented |
| LexisNexis | March 2026 | ~3.9M DB records | Names, addresses, government accounts (incl. US federal judges, DoJ attorneys, SEC staff). AWS misconfiguration exploited. Confirmed 4 March 2026. |
Equifax 2017 — In detail
Cost to Equifax: $1.38 billion USD (security upgrades + settlement). FTC settlement: $575 million + free credit protection for those affected. Notable: to this day, no one from the stolen data has been demonstrably harmed by identity theft — China apparently used the data for intelligence purposes, not fraud.[27][29][31]
National Public Data 2024 — In detail
09USA vs. Europe: Two worlds
US states: Leading legislation
| State | Law | Key content |
|---|---|---|
| California | Delete Act (2023) + SB 361 (2025) | All brokers must register. From January 2026: a single central deletion request is sufficient to be removed from all registered brokers simultaneously. Brokers must comply within 45 days. |
| California | CCPACCPACalifornia Consumer Privacy Act — California's data protection law since 2020. Gives consumers the right to know what data is collected and to prohibit its sale./CPRA (consumer protection laws) | Right to access, right to erasure, right to object to the sale of one's own data |
| Vermont | Data Broker Registration | Mandatory registration + disclosure |
| Texas | Data Broker Law | Registration requirement; AG investigation with fines up to $1.4B |
| Colorado | Privacy Act | Opt-out rights |
| Oregon | Consumer Privacy Act | Similar to CCPA |
New EU legal developments 2025/2026
- EU Data Act (fully applicable since 12 Sept. 2025): Regulates who may access data from connected devices (smart TVs, fitness trackers, smart home) and how.[36][39]
- Digital Omnibus (Nov. 2025): The European Commission proposes consolidating several data protection laws (GDPR, cookie rules, Data Act) into a single simplified package; to be debated by the EU Parliament in 2026.[38]
- Coordinated EU data protection action 2026: European data protection authorities are jointly examining whether brokers are fulfilling their obligations to inform people about data collection — an issue that directly affects brokers.[37]
- New EU procedural rules (Nov. 2025): Data protection authorities from different EU countries will be better able to cooperate when a broker is active in multiple countries.[36]
10What you can do — and what you can't
LexisNexis: risk.lexisnexis.com/consumer-and-data-access-policies
Experian (marketing): experian.com/privacy/opting_out
Having yourself removed from LexisNexis risks some security questions with bank accounts or government services no longer working — because these services use LexisNexis data to verify your identity.
Art. 17 GDPR: Right to erasure ("right to be forgotten")
Art. 21 GDPR: Objection to data processing for advertising purposes
Art. 22 GDPR: Protection against exclusively automated decisions[41]
Limits of opt-out
Opt-out often only applies to marketing, not to credit reporting or risk assessments. Data returns — brokers constantly re-aggregate from public sources. Inferred dataInferred DataData not collected directly but derived from other data points. Example: you buy cholesterol guides → the broker infers a heart condition. Such inferences can be wrong — and are usually not erasable. (derived data) is usually not erasable. Authorities buy regardless of opt-out — no protection against state use.[09][11]
11The German data broker ecosystem
Germany has its own established data broker industry — divided into two categories: credit reference agenciesCredit Reference Agency (Auskunftei)Companies that collect creditworthiness data about consumers and sell it to banks, landlords and retailers. In Germany: SCHUFA, Creditreform, CRIF, infoscore. They indirectly determine access to loans, housing and contracts. (credit data) and address/marketing data traders (consumer profiles for advertising).[57]
The major credit reference agencies
Credit reference agencies are the most powerful data brokers in Germany. They indirectly determine whether someone gets a flat, can sign a mobile phone contract or receives a loan. All are members of the association "Die Wirtschaftsauskunfteien e.V."
What is stored: Bank accounts, credit cards, mobile phone contracts, instalment loans, payment defaults, debt collection proceedings, insolvency proceedings.
Data error problem: A Stiftung Warentest sample (2010) found ~37 million outdated and 4.6 million simply incorrect records. More recent studies confirm high error rates.[47]
Positive dataPositive DataData about regular contract agreements (mobile phone contract, bank account) — as opposed to negative data (payment defaults, debt collection). Controversial: mobile providers transmit contract agreements to SCHUFA without consent. The Munich Regional Court ruled this unlawful. controversy: Vodafone, Telekom, Telefónica/o2, Blau.de, Aldi Talk and Freenet transmit contract agreements to SCHUFA without the consent of those affected. The Munich Regional Court ruled: this transmission is unlawful.[60]
Data protection criticism (NDR Info): Unauthorised parties could retrieve sensitive data on millions of consumers using just a name, date of birth, address and a mobile number (not necessarily their own) — for around €20 per query. The Baden-Württemberg data protection commissioner described this as a "serious data protection violation".[55]
Address and marketing data traders
Alongside credit reference agencies, there is a second category: companies that sell consumer profilesProfilingThe automated creation of detailed personality profiles from collected data: purchase behaviour, income, health, political leaning. Defined and regulated as "profiling" under GDPR, but difficult to enforce. for direct marketing. Their legality under GDPR is highly contested.[61][63]
The majority of German state data protection commissioners consider commercial address trading for advertising purposes without consent to be non-compliant with GDPR. North Rhine-Westphalia takes a diverging position, which data protection experts attribute to the fact that Bertelsmann (AZ Direct) and Deutsche Post (Post Direkt) are headquartered in NRW.[63]
Scandal: NOYBNOYBNone Of Your Business — a European privacy organisation founded by Max Schrems. Systematically files GDPR complaints against companies that violate data protection. Has sued Facebook, Google and data brokers, among others. complaint: AZ Direct allegedly sold millions of consumer addresses to the credit agency CRIF without consent.[61]
The SCHUFA scoring scandal and ECJ rulings
The SCHUFA scoring system was completely opaque for years: neither those affected nor courts knew how the score was calculated. A series of ECJ rulings and German court decisions have shaken the system.[47][50]
Federal Cartel Office sector inquiry
The Federal Cartel Office (Bundeskartellamt) investigated creditworthiness scoring in online retail in 2024 and found that scoring — largely unnoticed by consumers — runs automatically in the background and affects a significant part of German e-commerce.[54]
The Databroker Files — Germany and Europe
The Databroker Files is an investigative research project running since summer 2024 by netzpolitik.org and Bayerischer Rundfunk as well as international partners (WIRED, Le Monde, L'Echo, BNR). Awards: Grimme Online Award 2024, Data Protection Media Prize 2024, European Press Prize 2025.[42]
Key finding
Location data that apps claim to collect only for advertising purposes is freely sold by data traders worldwide, including as free "taster samples". Names are not included but can easily be assigned by laypeople using the location data: place of residence = home address, regularly visited places = workplace, doctor, etc.[42]
EU Commission: "We are concerned." Axel Voss (CDU/EPP): "In the current geopolitical situation we must take this very seriously." Alexandra Geese (Greens): "Europe must ban large-scale data profiling." NATO: "We are aware of the general risks" — concrete measures unknown. An internal EU circular email subsequently warned EU staff of tracking risks.[43][44]
Legal assessment by the Bundestag Research Service: The Federal Criminal Police Office (BKA) and Federal Police lack a legal authorisation basis for purchasing data from brokers. No explicit legal basis found for intelligence services (BND, Verfassungsschutz, MAD) — purchase could be justified in individual cases under very limited circumstances.[45]
GDPR in Germany: Theory vs. practice
Your rights: requesting your credit file
| Credit agency | Self-disclosure (free of charge, Art. 15 GDPR) |
|---|---|
| SCHUFA | meineschufa.de — free once per year. Caution: the paid version is visually highlighted! |
| infoscore | experian.de/selbstauskunft |
| CRIF Bürgel | crifbuergel.de/konsumenten/selbstauskunft |
| Creditreform | creditreform.de (for business owners) |
Tip
Since November 2024, consumers can view their credit-relevant SCHUFA data digitally and free of charge via bonify. To reduce advertising mail: register on the Robinson List at robinsonliste.de.[65]
Conclusion
Data brokers are a global industry with hundreds of billions in revenue that intervenes in every life situation, from credit applications to flat-hunting to the surveillance of political activists. In Germany, GDPR in theory provides strong protection, but rights only become truly enforceable through ECJ rulings and legal pressure.
The fundamental problem remains: the system is designed to be invisible. Most people do not know it exists — let alone what is stored about them.
All statements to the best of our knowledge, verifiable.
Mordor Intelligence — Data Broker Market 2026–2031
Market forecasts: size, growth, segments (API, cloud, analytics). CAGR 7–10%, growth to $448–617B USD by 2031.
Research and Markets — Data Broker Forecasts
Global market size and growth rates for the data broker industry, multiple time periods.
Maximize Market Research — Data Broker 2025–2032
Estimate: up to 5,000 broker companies worldwide (as of 2025). Market size and CAGR analysis.
GlobeNewswire — Data Broker Market 2030
Market report 2025: size, segmentation by use case and region.
National Cybersecurity Alliance — What Are Data Brokers
Explanation: what data brokers are, how they work, how consumers can protect themselves.
Wikipedia — Data Broker
Overview article: history, types, business models, regulatory developments.
Built In — Top 10 Data Broker Companies
Ranking and profiles of the largest data traders: revenues, core businesses, data practices.
ProPublica — Everything We Know What Data Brokers Know About You
Detailed investigative analysis of data practices: Acxiom profiles, Experian categories, LexisNexis health scoring, Joanna Moll dating profile purchase, Datalogix spending data.
JoinDeleteMe — Comprehensive Guide to Data Brokers
Comprehensive guide: data types, sources, limits of opt-out, practical protective measures.
Fast Company — Data Brokers Quietly Buying and Selling Your Information
Investigative: prices for datasets, USDate case (1M dating profiles for $150), industry overview.
OneRep — What Are Data Brokers 2026
Current guide 2026: how brokers make money, 67% statistic, opt-out services compared.
Malwarebytes — Data Brokers: A Complete Guide
Accessible guide: data types including location data from SDKs, observed vs. inferred data, protective measures.
Tom Kemp / Medium — Types of Data Brokers
Detailed analysis of the various broker types and business models: API, cloud, first/third party.
US Senate Hearing — Data Broker Practices (PDF, GovInfo)
Official US Senate hearing transcript: refusal by Acxiom, Experian and Epsilon to disclose data sources and buyers.
MyDataRemoval — Top 10 Data Brokers Opt-Out Guide
Ranking of the largest brokers by revenue and reach, with opt-out instructions.
The Intercept — ODNI One-Stop Data Shop (May 2025)
ODNI centralised data portal for all US intelligence agencies — access to commercially acquired data including location and search histories.
Brennan Center — Federal Agencies Secretly Buying Consumer Data
Comprehensive analysis of the data broker loophole: FBI dossiers on journalists, Muslim apps, BLM protests, confirmed government purchases.
NBC News — US Government Buys Data with Little Oversight
Investigation into Equifax "The Work Number" (38% of all US employees) and government data purchases with inadequate oversight.
Lawfare — Data Brokers, Military Personnel and National Security
Legal analysis: security risks from location data of soldiers and intelligence personnel on the open market.
Roll Call — Congress to Block Agencies from Buying Americans' Data
FANFSA history: House passage in 2024, failure in Senate, Protecting Americans' Data from Foreign Adversaries Act.
MS Now — DHS, ICE Buy Up Personal Data for Surveillance
ICE surveillance of US citizens, DHS tracking of students, student protester cases 2025.
WBUR On Point — The New American Surveillance State
Podcast analysis: data broker loophole, ICE and intimidation of critics, 4th Amendment circumvention.
ProtectPrivacyNow — Government Purchases of Very Personal Data
Overview of confirmed government data purchases: DHS, CBP, DEA, Secret Service, Special Operations Command, Defense Intelligence Agency.
The Record — Data Brokers Selling Military Secrets
GAO report: FBI assessments on 1,000+ news organisations, politicians and religious communities without court order.
CalMatters — Data Broker Leaks Cost Americans $21 Billion (Feb. 2026)
Report by the US Congress Joint Economic Committee: 4 data breaches, $20.9B USD damage through identity theft.
Common Dreams — Congress Finds 4 Breaches Cost $20B
Congressional report: four data broker breaches and their financial consequences for US consumers.
Wikipedia — 2017 Equifax Data Breach
Detailed article: attack timeline, 76 days undetected, CVE-2017-5638, Chinese PLA as perpetrators, $1.38B USD costs.
Wikipedia — 2024 National Public Data Breach
Jerico Pictures / National Public Data: 270 million persons affected, insolvency following the leak.
EPIC — Equifax Data Breach
EPIC archive: FTC settlement $575M USD, free credit protection, legal classification.
UpGuard — Biggest Data Breaches in US History
Ranking of the largest US data breaches including People Data Labs (1.2B records 2019), Experian 2015 (15M T-Mobile customers).
CSO Online — Equifax Data Breach FAQ
Complete FAQ on the Equifax hack: timeline, expired SSL certificate, intelligence use of the data by China.
VeraSafe — Privacy Obligations with Data Brokers (Jan. 2026)
Current legal obligations when dealing with brokers: FANFSA, CCPA, GDPR requirements, compliance recommendations.
Usercentrics — Data Brokers and Privacy (Nov. 2025)
67% statistic for corporate data purchases, monetisation models, GDPR requirements for broker clients.
SecurePrivacy — Privacy Laws 2026
Overview of US data protection laws 2026: California Delete Act, DROP platform, state-by-state summary.
EDPL — Data Brokers and European Digital Legislation (2023)
Peer-reviewed: analysis of GDPR compliance of broker business models — structural problems with informed consent.
CMS Law Now — EU/German Data Protection 2025
EU Data Act (Sept. 2025), GDPR procedural regulation, enforcement developments in Germany and EU 2025.
Gibson Dunn — Europe Data Protection January 2026
EDPB Coordinated Action 2026: transparency obligations Art. 12–14 GDPR, cross-border enforcement improvements.
McDermott — EU Digital Omnibus Reforms
EU Commission proposal Nov. 2025: simplification of GDPR, cookie rules, Data Act — Parliament process 2026.
Morrison Foerster — European Digital Compliance Nov. 2025
Full applicability of EU Data Act (12 Sept. 2025): IoT data access, harmonised framework, compliance requirements.
Consumoteca — 2026 Compliance Deadlines
Overview: California DROP platform deadlines, 45-day deletion obligation, audit requirements from 2028.
Wikipedia — General Data Protection Regulation (GDPR)
GDPR overview: legal bases, data subject rights Art. 15–22, fine framework, scope of application.
netzpolitik.org — Databroker Files (overview)
Award-winning investigative research (Grimme Online Award 2024, European Press Prize 2025): location data from advertising SDKs, 11 million German devices, WetterOnline case.
netzpolitik.org — Targeting the EU (Nov. 2025)
EU security scandal: 278 million location data points from Belgium, EU Commission staff, 9,600 NATO pings, diplomat addresses.
netzpolitik.org — Databroker Files: Espionage risk EU
Summary of EU espionage risk via mobile location data: reactions from EU Commission, MEPs, NATO.
netzpolitik.org — German government classifies data purchases as state secret
Parliamentary question Vogtschmidt (FDP): government refuses to answer. Bundestag Research Service: BKA and Federal Police lack legal authorisation basis.
netzpolitik.org — Ramstein / NATO (Databroker Files: Data trading is poison)
Ramstein Air Base: 164,000 data points from 1,275 devices in the sample dataset. US soldiers identifiable, brothel visits documented.
Stiftung Warentest — ECJ ruling SCHUFA score
ECJ C-634/21: score as automated individual decision, prohibition without safeguards, Stiftung Warentest sample data errors (37M outdated, 4.6M incorrect).
WBS.Legal — Bayreuth Regional Court: €3,000 compensation against SCHUFA
Az. 31 O 593/24: SCHUFA must disclose score, €3,000 compensation, score without human oversight = GDPR violation.
Dr. Schulte — ECJ rulings SCHUFA 2025
Overview ECJ C-203/22: algorithm disclosure obligation. Cologne Regional Court, Cologne Court of Appeal 2025: scoring unlawful, new deletion deadlines.
Dr. Datenschutz — ECJ SCHUFA scoring ruling: consequences for consumers
Analysis of C-634/21 and C-203/22: algorithm transparency, rights of those affected, practical implications.
Lower Saxony State Data Protection Commissioner — ECJ press release
Official press release on the ECJ's restriction of SCHUFA score use — regulatory classification.
CMS Datenschutz — The SCHUFA ruling of the ECJ and its implications
Legal classification of C-634/21: implications for lenders, telecoms companies, landlords.
Stiftung Datenschutz — ECJ SCHUFA webinar
Webinar documentation: turning point through ECJ ruling, practical implementation questions for credit agencies and lenders.
Bundeskartellamt — Sector inquiry: scoring in online retail (PDF)
Official report: automated scoring in online retail runs unnoticed in the background — affects a significant part of German e-commerce.
Datenanfragen.de — Boniversum/infoscore merger
Merger of Creditreform Boniversum into infoscore Consumer Data GmbH (2025): NDR Info data protection scandal, "serious data protection violation".
AdvoAdvice — New deletion deadlines for credit agencies
Cologne Court of Appeal + Aachen Regional Court: deletion obligation for settled debts within days, max. 6 months after settlement.
finanzen.net — Credit agencies compared
Overview of SCHUFA, CRIF, infoscore, Creditreform: differences, data holdings, areas of application.
Wikipedia — Schufa
SCHUFA overview article: history since 1927, ownership structure, 943 million records, 67.7 million persons, 165 million enquiries/year.
Winfuture — SCHUFA up for sale
Sale negotiations with EQT and Hellman & Friedman 2021: valuation ~€2B (full acquisition per Bloomberg).
Steinbock & Partner — Data sharing with credit agencies
Mobile provider positive data: Munich Regional Court ruling — transmission without consent to SCHUFA is unlawful.
activemind.de — Address trading and deletion requests
GDPR deletion obligations for purchased addresses, NOYB complaint AZ Direct/CRIF: millions of addresses shared without consent.
selbstauskunft.com — Data trading under scrutiny
How data collectors put consumers in boxes — targeting categories such as "Stomach patient", "Migration background", "Mallorca holidaymaker".
selbstauskunft.com — Address trading banned?
Data protection authorities want to ban address trading: NRW special role (Bertelsmann, Deutsche Post), majority position of data protection commissioners.
AZ Direct LinkedIn
Company profile AZ Direct GmbH: 72 million consumers, 37 million household addresses, AZ DIAS targeting system.
Handbook Germany — SCHUFA (for newcomers)
Practical guide: SCHUFA self-disclosure, bonify, Robinson List, rights under GDPR, for people new to Germany.