People Data Labs Faces a Massive Reckoning Over Data Privacy

If you have ever wondered how a cold email landed in your inbox with your exact job title, or how a sales tool seemed to know your phone number before you ever gave it out, there is a decent chance a data broker like People Data Labs was involved somewhere along the way. The company builds and sells massive datasets on people and companies, and developers plug that data into their own products through an API.

People Data Labs has also become a familiar name in privacy circles for reasons the company would probably rather avoid, including a headline-making 2019 data exposure and a 2026 class action settlement. This guide covers what People Data Labs actually does, how its pricing works, who its competitors are, and what happened in the incidents that keep bringing the company’s name up in privacy news.

What Is People Data Labs

People Data Labs, often shortened to PDL, is a San Francisco-based data broker and API provider. It builds large datasets covering people and companies, then sells access to that data through a developer-focused API rather than a polished sales dashboard.

The company’s core dataset includes roughly 1.5 billion unique person profiles and more than 74 million company records—a model used across both commercial datasets and defense platforms like Vannevar Labs in AI national security to process intelligence. Customers use that data to enrich existing records, meaning they take a partial data point like an email address and fill in missing details such as job title, employer, location, or social media profiles. Named customers and integration partners include S&P Global, Clay, HireEZ, Anaconda, and Insight Partners.

Unlike consumer-facing tools such as Apollo.io or ZoomInfo, People Data Labs does not offer much of a user interface. It sells raw data infrastructure that other companies and developers build their own products on top of, which is part of why its name is less familiar to average consumers even though its data quietly powers products many people use.

How the People Data Labs API Actually Works

People Data Labs offers several distinct API products rather than one single tool, each built around a different type of lookup.

Person and Company Enrichment

The Person Enrichment API takes a partial identifier, such as a name and company or an email address, and returns a fuller profile including contact details, employment history, and social profiles where available. The Company Enrichment API works the same way for firmographic data like headcount, industry, and revenue estimates.

Search and Identify APIs

Beyond simple enrichment, PDL offers Search APIs that let developers query its dataset using filters like job title or location to build targeted lists, along with a Person Identify API and IP Enrichment API that can resolve identity information from more limited signals such as an IP address.

Credit-Based Usage

Billing runs on a credit system. According to PDL’s own help documentation, most enrichment and identity API calls consume one credit per successful match, meaning a match that returns a valid profile with a 200 status code. Bulk endpoints can consume up to 100 credits per request, and features like the Autocomplete API do not consume credits at all.

People Data Labs Pricing

People Data Labs pricing is built around three tiers, with separate plans for person data, company data, and IP enrichment.

• Free plan: $0 a month, includes up to 100 person or company lookups and 25 IP lookups. Contact fields like email and phone are returned only as true or false flags rather than actual values, which limits it mostly to testing.
• Pro plan (Person Data): starts at $98 a month for 350 person enrichment credits, working out to roughly $0.28 per record on monthly billing. Annual billing brings that down by about 20 percent. This tier includes full contact field access.
• Pro plan (Company Data): starts at around $100 a month for 1,000 company lookups, working out to roughly $0.10 per record.
• Enterprise plan: custom pricing that industry estimates put at roughly $2,500 a month and up, offering unlimited or high-volume credits, bulk data licensing, dedicated account management, and SSO support.

A detail worth knowing before budgeting is that unused monthly credits on the Pro plan do not roll over, and a credit is consumed even when a match returns sparse data. PDL also runs 30-day free trials with 500 API credits for supported products, separate from the always free plan.

The People Data Labs Data Breach Explained

The People Data Labs breach is one of the largest personal data exposures ever documented, though the details are more complicated than a typical hack.

In October 2019, security researchers Vinny Troia and Bob Diachenko discovered an unprotected Elasticsearch server hosted on Google Cloud, containing roughly 1.2 billion records spread across 4 terabytes of data. The exposed information included names, email addresses, phone numbers, job titles, employers, geographic locations, and social media profiles tied to an estimated 622 million unique email addresses.

The twist is that the exposed server was never confirmed to belong to People Data Labs itself. The data within it was labeled as sourced from PDL, and researcher Troia noted the dataset matched records PDL held, but PDL’s own API infrastructure runs on AWS, while the leaking server was hosted on Google Cloud. The most widely accepted explanation is that a PDL customer, who had licensed the underlying data, failed to properly secure their own database, which then exposed PDL-sourced records without PDL’s systems ever being directly breached.

That distinction matters for understanding the incident, but it did little to soften the headlines at the time, and it is still the top result many people find when researching whether their own data has been exposed through data enrichment services.

The Colorado Settlement and Recent Privacy Lawsuits

More recently, People Data Labs agreed to pay $6,362,167 to settle a class action lawsuit, Cochrane v. People Data Labs Inc, filed in relation to Colorado residents’ cellphone numbers. The suit alleged that PDL included Colorado area code phone numbers in a commercial database and shared them with third parties without consent, in violation of state privacy law.

The settlement covers people who owned a Colorado area code cellphone number between September 2022 and March 2026. Affected consumers had until September 29, 2026, to file a claim for a cash payout through the official settlement site. People Data Labs did not admit wrongdoing as part of the settlement, which is standard in cases like this, but the size of the payout reflects how seriously courts are starting to treat data broker practices under newer state privacy laws.

This settlement is separate from the 2019 breach and reflects a different legal theory entirely, tied to how PDL sources and distributes phone number data rather than how securely it stores it.

Is People Data Labs Safe to Use

Whether People Data Labs is safe depends heavily on which side of the transaction you are on. For businesses using the API responsibly and in compliance with relevant privacy laws, PDL is a legitimate, ISO and SOC 2 Type 2 compliant data provider used by well-known companies. For individuals wondering whether their own personal information sits inside PDL’s dataset, the more relevant question is usually how to check and how to opt out.

People Data Labs maintains a data removal request process for individuals who want their information excluded from its dataset, in line with obligations under laws like the California Consumer Privacy Act. If you are concerned about how AI-powered tools and data brokers use personal information more broadly, our explainer on what an AI chatbot actually is and our guide to how AI agents get built both touch on how enrichment data like this ends up feeding predictive models and automated systems.

People Data Labs Competitors

People Data Labs sits in a crowded field of B2B data and sales intelligence providers, and the right alternative usually depends on whether you want raw API access or a full sales platform.

Apollo.io bundles a B2B contact database with built-in outreach tools like email sequencing and a dialer, starting around $49 a month per user, making it a popular all-in-one choice for smaller sales teams that do not want to build their own tooling around raw data.

ZoomInfo is the enterprise heavyweight of the category, offering the deepest org chart and intent data coverage but at a significantly higher cost and with less pricing transparency than PDL.

Clearbit, now folded into HubSpot’s Breeze Intelligence, works well specifically for teams already inside the HubSpot ecosystem but offers little value outside of it since HubSpot sunset Clearbit’s standalone tools in 2024.

Cognism and Lusha tend to be favored for GDPR compliant European coverage and mobile-verified contact data, which makes them a common choice for outbound teams targeting international markets rather than just the United States.

The general pattern across reviews is that PDL wins on raw data scale and developer flexibility at a relatively low per-record cost, while competitors like ZoomInfo and Apollo win when a team wants a finished product with a user interface rather than infrastructure to build on.

Common Mistakes People Make Researching People Data Labs

A few points of confusion come up often enough to address directly.

Assuming the 2019 breach means PDL’s own systems were hacked. As covered above, the exposed server was traced to a customer’s misconfigured database, not a direct compromise of PDL’s own infrastructure, though the data itself did originate from PDL.

Confusing the 2019 breach with the 2026 Colorado settlement. These are two separate incidents involving different legal issues, years apart, and conflating them leads to an inaccurate picture of the company’s history.

Expecting a polished dashboard. PDL is a developer-first API product with no significant self-serve user interface, which surprises people expecting something closer to Apollo or ZoomInfo.

Overlooking the free plan’s contact data limits. The free tier returns contact fields only as true or false flags rather than actual email addresses or phone numbers, so it is only useful for testing, not real enrichment work.

Frequently Asked Questions

What is People Data Labs?

A San Francisco-based data broker and API provider that sells access to a dataset of roughly 1.5 billion person profiles and over 74 million company records for use in enrichment, search, and predictive modeling.

How much does People Data Labs cost?

Pricing starts free for limited testing, with Pro plans starting around $98 a month for person data and $100 a month for company data, and custom Enterprise pricing typically starting around $2,500 a month.

Was People Data Labs breached?

In October 2019, an unprotected Elasticsearch server containing PDL-sourced data on roughly 622 million people was discovered by security researchers. The server was traced to a PDL customer rather than PDL’s own systems.

What was the People Data Labs settlement about?

PDL agreed to pay $6,362,167 to settle a 2026 class action lawsuit alleging it unlawfully included Colorado residents’ cellphone numbers in a commercial database without consent.

Who are People Data Labs’ main competitors?

Apollo.io, ZoomInfo, Clearbit (now HubSpot Breeze Intelligence), Cognism, and Lusha are the most commonly compared alternatives, each suited to different team sizes and use cases.

Can I remove my data from People Data Labs?

Yes. People Data Labs offers a data removal request process for individuals who want their profile excluded, consistent with requirements under laws such as the California Consumer Privacy Act.

Conclusion

People Data Labs occupies an unusual spot in the tech industry. It is genuinely useful, developer-friendly infrastructure that powers products used by well-known companies, and it has also been at the center of one of the largest data exposures on record along with a multimillion-dollar privacy settlement. Anyone evaluating PDL as a data provider should weigh its low per-record pricing and dataset scale against its privacy track record, and anyone worried about their own data showing up in a broker’s dataset now has a clearer picture of what that actually means in practice. For more background on how data brokers operate as an industry, Wikipedia’s overview of data brokers is a solid starting point.