Most people give more thought to choosing a strong password than to choosing what phone number or email address to sign up with. That’s backwards.
A strong password protects one account. The phone number you use to sign up for a service becomes a persistent identifier that data brokers use to connect your accounts, locations, purchases, social relationships, and behavioral patterns into a profile — one they sell to advertisers, insurance companies, political campaigns, and anyone else who can pay for it.
Your phone number is harder to change than a password, tied to your real identity in ways your email address usually isn’t, and an extraordinarily effective key for correlating data across separate companies’ records.
This is not hypothetical. Multiple Federal Trade Commission enforcement actions in recent years have documented exactly how data brokers collect, correlate, and monetize phone numbers. California’s Delete Act, which established a centralized opt-out mechanism effective in 2026, was written specifically because the existing consent framework wasn’t protecting people from this practice.
Understanding what your phone number enables — and what you can do about it — is a more durable privacy improvement than any individual app permission you might revoke.
Why Phone Numbers Are Such Effective Identifiers
Most identifying information has gaps. Email addresses change. Physical addresses change. People use pseudonyms online. Device identifiers get reset when users exercise their privacy settings.
Phone numbers are different for several reasons.
They’re tied to real identity. In most countries, a SIM card requires identity verification — government ID for prepaid cards, credit check for postpaid. Your phone number is legally tied to your name, address, and identity documents. This information flows back to your carrier, which is a significant data source for brokers.
They’re extremely stable. Most people keep the same phone number for years or decades. Unlike email addresses, which are easy to create and abandon, phone numbers involve enough friction to change that most people keep them through multiple devices, carriers, and life changes.
They appear everywhere. People give phone numbers to employers, medical providers, banks, utility companies, delivery apps, cloud services, loyalty programs, and friends. That widespread sharing creates a rich web of data points that can all be connected under one identifier.
They’re the standard 2FA recovery method. Because so many services use phone numbers for two-factor authentication and account recovery, compromising or correlating someone’s phone number is often the first step in account takeover, and it’s also how brokers confirm that their records for a given number are current and active.
They appear in breach data. Every data breach that included phone numbers — and most major breaches have, since phone numbers became standard account fields — adds to the broker dataset. Your phone number may appear in dozens of breach datasets linked to your name, email, employer, and home address.
What Data Brokers Do With Your Number
Data brokers are companies that collect personal information from public records, purchase data from companies that collect it from users, and compile it into profiles for sale.
The specific brokers vary in what they hold and who they sell to, but the general pipeline works like this:
When you sign up for a cloud storage service using your phone number, that service may share your data (including phone number and email) with marketing partners, analytics vendors, and data enrichment companies — typically under terms that bury this sharing in a broad “affiliates and partners” clause.
Your phone number then enters a broker’s database. Brokers match it against other records: the breach dataset that has your name and home address from a retailer incident, the loyalty program record that has your purchase history, the telecom data that has your location history from cell tower pings. Each match adds more data to the profile associated with your number.
That profile is then sold or licensed to:
- Advertisers who want to target you with personalized ads
- Insurance companies evaluating risk
- Employers doing background checks
- Political campaigns building voter profiles
- Scammers who buy lists for voice phishing (“vishing”) and SIM swap attacks
The last two uses are particularly relevant to recent FTC enforcement. In 2025, the FTC issued formal warning letters to 13 data brokers selling American personal data — including phone numbers linked to location history — to entities with ties to foreign governments. The concern was not just commercial profiling but national security implications of precise location data tied to identified individuals.
How Brokers Fuel AI-Powered Scams
The practical threat from phone number profiling has intensified as voice AI tools have improved.
A data broker profile for your phone number might include: your name, your parents’ names, your employer, your approximate age, whether you own a home, your neighborhood, and any public social media presence. That profile can be purchased for a few dollars.
A scammer with that profile — and AI voice generation — can call your elderly parent claiming to be you in an emergency. The scam works because the caller knows details about your family, your life, and the kinds of things you’d say. The voice sounds like you because AI voice cloning requires only a few seconds of sample audio (available from any video you’ve posted publicly).
This is not a hypothetical future threat. It’s documented in financial crime reporting from 2024-2025 and has been cited in multiple Congressional hearings on AI and consumer fraud. The underlying fuel is data broker profiles built on phone numbers like yours.
Cloud Storage and Phone Numbers
Cloud storage services frequently request phone numbers for account creation, two-factor authentication, and account recovery. Some make it optional. Others make it mandatory or strongly incentivize it.
The reasons for requesting a phone number are legitimate from a service perspective: phone-based 2FA is more resistant to certain attacks than email-based recovery, and phone number verification reduces bot account creation.
But from a privacy perspective, giving a phone number to a cloud storage provider means:
- Your phone number appears in the provider’s systems, potentially in breach data if they experience an incident
- Your phone number may be shared with analytics and marketing partners depending on the service’s terms
- If the provider is acquired, your phone number transfers to the acquiring company’s data infrastructure
The combination of a cloud storage account — which holds personal documents, photos, financial records, and medical files — with your real phone number and email creates an extremely high-value target. If a data broker can connect all of that to your home address and employment information, they have a comprehensive life profile.
The SIM Swap Risk
There is a specific, high-impact attack enabled by phone number profiling that cloud storage users need to understand.
A SIM swap is when an attacker convinces your mobile carrier to transfer your phone number to a SIM card they control. With your phone number, they can receive SMS verification codes for any account tied to your number — including cloud storage, email, banking, and cryptocurrency.
SIM swaps work because carriers verify account ownership through personal information — name, address, account PIN, last four digits of Social Security Number — and data brokers sell exactly that information. An attacker with a broker profile of your number has the raw material to attempt a SIM swap.
The defense is to use an authenticator app (Authy, Google Authenticator, Microsoft Authenticator) instead of SMS for two-factor authentication, and to set a carrier account PIN that isn’t derivable from information in broker databases. Passkeys, where supported, are even more resistant.
For cloud storage accounts that hold irreplaceable files, switching from SMS-based 2FA to app-based 2FA is one of the most durable security improvements you can make.
How to Reduce Phone Number Exposure
Several approaches reduce how widely your phone number propagates across data broker databases.
Use a VoIP or Second Number for Service Signups
Services like Google Voice (US), Hushed, and MySudo allow you to create secondary phone numbers that aren’t tied to your primary carrier account. These numbers can receive calls and texts, including SMS verification codes, without revealing your real mobile number.
The key limitation: some services detect and block VoIP numbers for account verification, particularly financial services and some cloud providers. But many services accept them.
Using a dedicated secondary number for cloud storage signups — and a different one for shopping, loyalty programs, and newsletters — creates the same isolation benefit as email aliases: if one number ends up in broker databases, it doesn’t automatically connect to your other accounts.
Enable Carrier-Level Number Privacy Settings
Some carriers offer number masking or privacy features. In the US, the major carriers have specific anti-SIM-swap measures you can activate — typically a Port Freeze or SIM Lock that requires in-store identity verification before your number can be transferred.
Contact your carrier directly to understand what account protection features are available and enable them.
Opt Out of Data Broker Databases
The FTC’s enforcement actions and California’s Delete Act have accelerated the availability of opt-out mechanisms. Several services — Privacy Rights Clearinghouse, DeleteMe, Privacy Bee — submit opt-out requests to dozens of brokers on your behalf.
California’s Delete Act created a centralized opt-out mechanism through the California Privacy Protection Agency (CPPA), which data brokers operating in California are required to honor. If you’re a California resident, this is a meaningful legal right.
Outside California, opt-out rights vary by state and by broker. The process of opting out from major brokers individually is documented by privacy advocates like Privacy Rights Clearinghouse and takes several hours but is achievable.
Remove Your Number from Existing Accounts Where Possible
Review your cloud storage accounts and check whether your phone number is required or optional. Many services that requested a phone number during signup will allow you to remove it from account settings — or to replace a real number with a VoIP number — if you’ve already established account recovery through other means (an authenticator app, backup codes, a recovery email).
Where phone removal isn’t possible, ensure that the account’s 2FA uses an authenticator app rather than SMS, so that compromising or spoofing your phone number doesn’t automatically give access to the account.
The Regulatory Landscape
The regulatory environment around data broker phone number use is tightening in the United States, though enforcement remains uneven.
The FTC’s Phone Robocall Rules, the Telephone Consumer Protection Act, and state-level privacy laws collectively restrict how collected phone numbers can be used for marketing. More relevant to the broker pipeline specifically, several states have passed comprehensive privacy laws — California (CCPA/CPRA), Colorado, Connecticut, Virginia, Texas, Oregon, Montana — that give residents rights to access, delete, and opt out of the sale of their personal data, including phone numbers.
The PADFAA (Protecting Americans’ Data from Foreign Adversaries Act, 2024) specifically restricts transfers of Americans’ sensitive personal data — including precise location tied to identified individuals — to entities controlled by foreign adversaries. This is the legislation behind the FTC’s 2025 warning letters.
None of this eliminates the broker industry. But it does create opt-out rights worth exercising and signals that the regulatory trend is toward more restriction, not less.
Practical Priority Order
If you want to reduce your phone number’s data broker exposure starting today, the priority order is:
- Switch cloud storage 2FA from SMS to an authenticator app. This reduces the SIM swap risk immediately.
- Set a carrier account PIN and ask about port freeze or SIM lock options.
- Create a secondary VoIP number for future signups where a real phone number isn’t legally required.
- Submit opt-out requests to major data brokers, or use a service that does this on your behalf.
- Remove your real phone number from non-essential accounts in your account settings where possible.
None of these steps are complex. Together they meaningfully reduce the risk that your phone number becomes the thread connecting a data breach, a scammer, and your personal cloud storage account. The threat is real. The defenses are practical. The main cost is a few hours of account hygiene.
For a service like daftei, which stores photos, personal documents, and files you care about, protecting the account with an authenticator app rather than SMS 2FA, and signing up with an alias email rather than your primary address, reduces two of the most common account compromise vectors simultaneously. The security margin is real even if it’s not visible day to day.