Targeted advertising, dark patterns and omnipresent data collection as the primary business model of the global online world have been the subject of an ongoing legal debate. One particular consideration involves the secondary use of data subsequent to its initial collection and exploitation. Data has proven to be a valuable commodity for actors previously unnoticed in digital environments: data brokers who trade in data. Their non-transparent business model carries structural legal, ethical and societal implications. This article analyses the data broker business model and the resulting conflicts with the European Data Protection Regulation (GDPR), incorporating interdisciplinary findings and the new legislative procedures at Union level into the legal analysis.