By Matthew Huang
Matthew is a high school senior from Alpharetta, Georgia.
Our world is undeniably digital. For a growing number of us, life online is the primary stage for learning, connecting, and playing. Yet, each tap, click, and search in this immersive environment contributes to an underground ecosystem, quietly collecting and cataloging our digital footprints.
Every October, my school hosts “Skelebration,” an event where student organizations host activities for elementary schoolers. As a Science Olympiad team member, I found myself brainstorming our club’s contribution. This year, our group chose a Pokémon theme, prompting a day spent online searching for Pikachu-themed decorations and prizes.
A few days later, Pokémon ads began appearing on unrelated websites, such as news and weather pages. The precision of these ads unsettled me, sparking a deeper dive into how they appeared. What I found was not a coincidence, but a massive industry at work: data brokerage.
Data brokerage is a multi-billion-dollar industry
Your data is big business. In fact, it is the foundation for a multi-billion-dollar industry built on the buying, selling, and aggregation of consumer data to third parties. Data brokers, the entities involved in the data economy, collect many types of personal information, including but not limited to name, age, gender, marital status, and profession. Brokers often use this data to create inference data, tagging individuals with a range of labels. Some are relatively innocuous, like “Summer Activity Enthusiast,” but others more intrusive, such as “Cholesterol Focus” or “Expectant Parent”. These profiles are then sold to marketers, financial firms, and virtually any legitimate entity that is interested.
At face value, data brokerage might not seem entirely problematic. In fact, it has its fair share of positive uses. For example, marketing companies might use user data to send targeted coupons for products based on an individual’s inferred needs. Additionally, data can be used for purposes such as fraud detection, which might use a user’s behavioral data to flag suspicious account activity.
However, data brokerage also has its fair share of negative implications. Several cases illustrate instances where unscrupulous actors have leveraged profiles to facilitate stalking, harassment, and discrimination. In a very high-profile case during the 2016 election, the firm Cambridge Analytica was accused of harvesting the data of millions of Facebook users without explicit consent to target voters with personalized political messages, undermining democratic integrity. As of summer 2025, we are still grappling with the fallout from this incident. Chances are, the average person isn’t familiar with companies like CoreLogic, Venntel, and Epsilon, all of which are among the highest revenue data broker companies. These private institutions operate with few restrictions, as the U.S. still lacks a comprehensive federal law regulating the industry.
For current teen users, this lack of oversight becomes even more concerning. Unlike older generations, who remember a time before digital tracking, as a member of Gen Z, I have never experienced a life without it. In a time where nearly every action is mediated by technology, I can’t help but wonder: What does the unchecked expansion of data brokerage mean for our youth, and how will it shape their futures? To truly grasp the scope of this evolving data ecosystem when situated in the context of today’s users, it is important to first understand the scale of our generation’s digital engagement.
An ever-expanding footprint of youth data
Youth online presence has grown larger than ever before. A study by Pew Research Center found that nearly half of teens report being online almost constantly, more than double the 24% reported just a decade ago. Even more striking: more than one-third of parents with a child under 12 say their child began interacting with a smartphone before the age of 5. This trend leads to two key changes in how data brokers operate.
First, a shift in scale. More teens are online earlier, giving data brokers access to a growing number of youth profiles. This is especially prominent in sectors such as education and entertainment. As such, studies forecast the data brokerage market to expand from approximately $433.9 billion in 2025 to $616.5 billion by 2030.
Second, a shift in depth: these profiles are more detailed and personal because tracking starts at a younger age. Consider how children interact with platforms like YouTube or Google. From a young age, their data reveals learning styles, interests, and reactions to content. These findings become increasingly robust as the individual ages and expands their presence to other platforms such as Instagram and TikTok. Unlike people born before the 2000s boom in internet and social media, whose online profiles often took off later in adolescence, today’s teens create a near-unbroken chain of insights from childhood onward.
Data prediction practices make this trend even more complex. First, the more comprehensive nature of youth profiles will enable the creation of better inferences due to the increased intimacy and quantity of data points available to make assumptions off of. This is relatively intuitive. However, studies such as the Adolescent Brain Cognitive Development Study show that access to early-life data can significantly improve the accuracy of longitudinal inferences about an individual’s future traits and outcomes.
At this point, it’s worth noting that while policymakers at both the state and federal levels have made attempts to address youth data protections, these efforts fail to keep pace with the sophistication of modern data ecosystems. For instance, take the Children’s Online Privacy Protection Act (COPPA), which was designed to protect children under 13 by requiring parental consent before data collection. While well-intentioned, COPPA’s provisions have proven inadequate in today’s digital landscape, struggling against sophisticated data collection methods and lacking specificity on what constitutes compliance.
A mismatch between system design and user needs
As a result of the increased online presence of post-millennial users, a central concern in youth data brokerage is the amplified vulnerabilities these users face. These systems were built for adults and don’t do enough to protect teens and younger users. A clear example of this is the “broken” consent systems in place today.
At some point, everyone has faced a dense wall of terms while trying to browse a website or access an app. A study found that just 9% of US adults read terms and conditions, with that number plummeting to 3% amongst those aged 18-34. But if the overwhelming majority of adults don’t read these legal documents, how can the digital youth be expected to read them as well? In the context of data collection, terms of service (TOS) documents often outline the legal terms for data collection. Without reading the TOS and clicking “accept,” users effectively consent to data collection without understanding its scope.
Another major risk comes from the mismatch between young users’ development and the design of digital platforms. Specifically, many online platforms such as YouTube and TikTok are intentionally designed with features such as infinite scroll, notifications, and algorithmic recommendations to capture attention. While these retention mechanisms affect all users, they disproportionately impact youth who are still developing critical functions such as impulse control and long-term decision-making. This ultimately keeps young users stuck in a system that collects their data without their awareness.
The biggest change today is that people are pulled into the data system earlier and stay more connected to it over time. As such, this new generation of data brokerage carries familiar risks, except amplified in scale and impact.
For instance, a major problem concerning data collection is the risk of data breaches. However, as the data profiles become increasingly robust with the rise of youth online engagement, a long-term consequence lies in both privacy – corporate access to sensitive information – but also the exacerbated consequences of something like a data breach. Similarly, the intimacy of adolescent profiles makes long-standing risks such as identity theft and discrimination more severe.
Beyond personal risks, there’s also a bigger issue: constant surveillance is starting to feel normal. As teen and pre-teen users grow up viewing data extraction as a standard trade-off for convenience or without knowledge of the industry, the threshold for an acceptable level of data collection may erode. Over time, this risks creating a future where deeply intimate data profiles are normalized, paving the way for increasingly intrusive targeting, manipulation, and control.
Toward accountability and control in the data economy
All things considered, data brokerage remains a complex and pervasive problem, especially in the context of the increasingly technical nature of our world and the young users who engage with it. Despite this, there has yet to be a single comprehensive federal data brokerage law. Additionally, current federal regulations surrounding data brokerage, such as the Electronic Communications Privacy Act, as well as COPPA, remain outdated and inadequate in ensuring the protection of consumer data.
But that’s not to say that there isn’t hope.
Several U.S. states have begun enacting data brokerage regulations, such as California’s Consumer Privacy Act and Connecticut’s Data Privacy Act. These laws emerged in response to opaque data brokerage practices and the increasing commodification of consumer information. California led the way in 2018 with the passage of the CCPA, which other states followed by building their own laws.
In states such as California, these laws have been effective in that large companies have become more transparent with their data practices and enable greater consumer control. Additionally, studies have shown that the CCPA has substantially increased consumer awareness around data brokerage, compelling many to take control over personal information. However, many of these laws possess flaws as well. For instance, CCPA’s opt-out model is often reported as poorly regulated, in some cases being deliberately obstructed by poor interface design. Additionally, the vague nature of the CCPA, particularly its definition of the term “sale,” allows companies to find legal loopholes and continue their data practices.
On the federal level, the Federal Trade Commission (FTC) has taken action against leading data brokers such as Gravy Analytics. Additionally, efforts to institute federal data broker laws, such as the Fourth Amendment is Not for Sale Act, which aims to close loopholes surrounding the ability of intelligence agencies to purchase data, remain strong. While effective, this law remains limited in scope, regulating government entities rather than reforming the commercial data broker industry. A comprehensive federal law, such as the General Data Protection Regulation (GDPR) passed by the European Union, could provide this much-needed consistency and baseline protection.
Beyond law, data deletion products and services have increased tremendously over the last decade. Companies such as DeleteMe, Incogni, and Hush specialize in helping individuals and businesses remove personal data from the internet. These services use automated tools to scan the web for an individual’s personal information and send automated opt-out requests, making it easier for users to manage their data.
That said, these solutions aren’t perfect, and with the dawn of artificial intelligence, solutions must continue to evolve. Another important data brokerage solution lies in data cooperatives, which allow users to, by their own decision, pool their data and collectively negotiate how that data is shared with or monetized by third parties. This reduces the need for a corporate intermediary, while also allowing participants to regain control over their data.
As society approaches an increasingly digital era, we must be cognizant of what is happening behind the scenes with our data. Through this collective awareness, we are not only better equipped to make informed decisions but are also better prepared to question opaque data practices, educate others, and demand greater transparency in the data ecosystem.
So while “Pokemon Interest” may forever be etched into my data profile, it also serves as a call to action for all of us to engage thoughtfully with our data, advocate for more robust protections, and build a more secure digital future together.