Home / Academy / Is my personal data being sold in the EU?
Is my personal data being sold in the EU?
Updated 9 November 2026
Yes. GDPR didn't stop the trade, it just gave you the right to say no. Sales databases sell work emails and phone numbers, ad data companies trade profiles of your interests, and credit bureaus run marketing lists with your address. None of it shows up in a Google search, so most people never know. You can make each of them delete it, for free.
We do this for you. You don't have to do anything.
- Autopilot sends the request to every company we find, plus dozens of other data brokers that likely hold your data.
- We send the reminders, handle the replies and keep track of the one-month deadline.
- We rescan you every week. If your data comes back, we send a new request.
- All you do is enter your name, confirm your email and give us permission. Free during the beta.
Who holds your data
- Sales and recruiting databases: ZoomInfo, Apollo.io, Lusha, Cognism and others. Your work email, phone and job title.
- Advertising and tracking data: Criteo, LiveIntent, Lotame and others. Your email linked to your interests and devices.
- Credit bureaus and marketing lists: in the UK and Germany especially, address and household data sold for targeting.
- Location data: companies that buy location pings from apps.
Each has a guide in our opt-out guides, with the right contact.
Your rights
Under GDPR you can ask any company what it holds about you (Article 15), have it deleted (Article 17) and object to marketing and profiling (Article 21). It's free, and they have one month to answer.
Why doing it yourself is hard
There are hundreds of these companies, you don't know which ones have you, and many don't answer the first email. That's why HenryProtect sends and chases the requests for you.
Questions
Isn't selling data illegal under GDPR?
Not by itself. Companies can process data if they have a legal basis such as 'legitimate interest', which many brokers claim. But you can object and ask for deletion at any time.
How do I find out which companies have my data?
Ask them with a GDPR access request (Article 15). HenryProtect does this for you with the brokers that hold data on most working adults, and with the sites we find in a scan.
More numbers on data brokers, breaches and scams: privacy statistics 2026.