Every time you sign a lease, apply for credit, hook up a utility, or anything else a service provider or landlord would run a credit check about, it gets reported to the credit bureaus.
The bureaus then sell the "header" info--the non-financial data like your birth date, address and phone number--to proprietary database companies. Those companies also gather info from public records, and even some protected records, which may include court cases, marriages, births, voter registration, DMV info and property.
The database companies then package all of that information and sell it to law enforcement agencies, licensed debt collectors, private investigators, process servers and others.
Some data brokers even sell stripped-out versions of your information to unlicensed sleuths, like your stalker-ish ex.
This has been a business practice for decades already, even before the Internet, and there isn't much you can do about it except never buy property, rent an apartment, apply for credit, get a job, vote, pay taxes, get married, or even be born in the first place.
But in the last several years, data brokers have also been grabbing info from social media accounts. This could potentially include not only your photos, but everything you "like," who you're friends with, what news you follow, and all the photos and information you post about your children without their consent. Privacy controls may hide your voluntarily provided social media data from public Internet searches, but not from being shared with data brokers. And, information from a social media profile can be subpoenaed for court cases and potentially become public information. This is what we trade for using Facebook and other social media sites for "free."
While there's very little any of us can do to stay entirely out of an information database, we can at least limit what we volunteer.