Data Broker Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen (Cybersecurity) | Last updated: October 16, 2026 | License: CC BY 4.0
California’s registered data brokers logged 58,031,327 deletion requests in 2024, and Axis Intelligence Research finds that one company, Cuebiq Group, received 45.3% of them. Since January 2026, the state’s DROP platform has signed up more than 560,000 Californians and pushed reported profile deletions toward 100 million.
Quick Answer
There are 603 data brokers in California’s 2026 registry, and more than 660 are wired into the state’s Delete Request and Opt-out Platform (DROP) as of October 12, 2026. In calendar 2024, registered brokers received 194.9 million privacy-rights requests, including 58.0 million deletion requests, and denied 1.53% of deletions. Axis Intelligence Research estimates DROP has already produced 1.47× to 1.75× the deletions brokers fulfilled in all of 2024.
Key Findings
- Axis Intelligence Research finds that Cuebiq Group received 26,285,436 of the 58,031,327 deletion requests filed with California-registered data brokers in 2024, a 45.3% share (2026 CalPrivacy registry).
- Axis Intelligence Research estimates that California’s DROP platform reported 1.47× to 1.75× as many profile deletions by October 12, 2026 as brokers fulfilled through individual requests in all of 2024 (DROP Leverage Multiple, DLM™).
- Axis Intelligence Research finds that 68 of 603 registered data brokers (11.3%) score 3 or higher on the Sensitive Disclosure Index (SDX™), yet those brokers received only 2.2% of 2024 deletion requests.
- Deletion requests to registered brokers rose 6.8× between 2023 and 2024, while opt-out requests fell 21.6%, according to an Axis Intelligence Research analysis of the 2025 and 2026 CalPrivacy registries.
- 115 California-registered data brokers disclosed collecting precise geolocation in the 2026 registry, up 30.7% from 88 a year earlier (CalPrivacy).
How Many Data Brokers Are There in 2026?
The only hard count of data brokers in the United States comes from state registries, where companies self-identify and pay to register. California’s is the largest and the only one that publishes structured disclosures and request metrics. The 2026 California Data Broker Registry lists 603 businesses that operated as data brokers in 2025, up 11.0% from 543 in the 2025 registry.
That figure moves during the year. Brokers that start trading in Californians’ data after the January registration window still have to join DROP, which is why CalPrivacy counted 654 brokers in the system on August 25, 2026, and over 660 on October 12, 2026.
Data broker registrations by state
| Registry | Registered brokers | Annual fee | As of | Source |
|---|---|---|---|---|
| California (2026 registry) | 603 | $6,000 | Brokers active in 2025 | CalPrivacy |
| California (DROP system) | 660+ | — | Oct 12, 2026 | CalPrivacy |
| Texas | 452 registrations | $300 | Oct 16, 2026 | Texas Secretary of State |
| Oregon | Not published as a count | $600 | Oct 16, 2026 | Oregon DFR |
| Vermont | Not published as a count | — | Oct 16, 2026 | Vermont Secretary of State |
CalPrivacy describes California as one of four states, with Oregon, Texas and Vermont, that require data broker registration. The Texas data broker registry displayed 452 registrations on October 16, 2026, under a $300 filing fee. Oregon’s Division of Financial Regulation charges $600, and Vermont registers brokers under 9 V.S.A. chapter 62; neither publishes a running total.
Where data brokers are headquartered
Of the 603 brokers in the 2026 California registry, 564 list a US headquarters and 39 are based abroad, led by the United Kingdom (12) and Canada (10). Axis Intelligence Research normalized the free-text state field to postal codes to produce the first state-level headquarters breakdown of the registry.
| HQ state | Registered brokers | 2024 deletion requests received | Source |
|---|---|---|---|
| California | 126 | 13,883,292 | CalPrivacy registry; Axis calculation |
| New York | 84 | 28,440,141 | CalPrivacy registry; Axis calculation |
| Florida | 48 | 2,161,156 | CalPrivacy registry; Axis calculation |
| Texas | 32 | — | CalPrivacy registry; Axis calculation |
| Illinois | 32 | — | CalPrivacy registry; Axis calculation |
| Massachusetts | 29 | 2,522,748 | CalPrivacy registry; Axis calculation |
New York-headquartered brokers received 49.0% of all 2024 deletion requests, against 23.9% for California-headquartered brokers, even though California hosts more brokers. The gap comes almost entirely from one New York company, covered in the next section.
Marcus Chen, Cybersecurity & Privacy: Six hundred registrants sounds like an industry census. It isn’t. It’s a count of companies that decided California’s definition applies to them and paid $6,000 to say so. CalPrivacy has spent two years fining brokers that skipped that step, and its 2026-01 enforcement advisory exists because some of the ones that did register filled in the form wrong. Treat 603 as a floor with good paperwork, not a ceiling.
How Many People Ask Data Brokers to Delete Their Data?
Every broker in California’s registry must report how many privacy-rights requests it received and how it handled them. Summed across all 603 registrants, the 2026 registry shows 194,943,316 requests in calendar 2024, up 30.6% from 149,237,732 in 2023.
Data broker privacy requests by type, 2023 vs 2024
| Request type | 2023 | 2024 | Source |
|---|---|---|---|
| Delete | 8,514,612 | 58,031,327 | CalPrivacy registries 2025 and 2026 |
| Opt out of sale or sharing | 126,036,970 | 98,815,966 | CalPrivacy registries 2025 and 2026 |
| Limit use of sensitive data | — | 30,951,795 | CalPrivacy registry 2026 |
| Know what is collected | — | 4,311,895 | CalPrivacy registry 2026 |
| Know what is sold or shared | — | 2,832,333 | CalPrivacy registry 2026 |
| All requests | 149,237,732 | 194,943,316 | Axis calculation |
Opt-outs remain the largest category at 50.7% of 2024 requests, but deletion is the fastest-growing: 29.8% of the 2024 total, and a 6.8× jump from 2023 (58,031,327 ÷ 8,514,612). Opt-out requests fell 21.6% over the same year.
One broker received 45% of all deletion requests (RCR™)
Axis Intelligence Research built the Request Concentration Ratio (RCR™) to show how unevenly consumer effort lands across the industry. RCR is the share of all deletion requests received by the top n brokers in a registry year.
RCR = deletion requests received by the top n brokers ÷ deletion requests received by all registered brokers
| Measure | 2024 value | Inputs | Source |
|---|---|---|---|
| RCR top-1 | 45.3% | 26,285,436 ÷ 58,031,327 | Axis calculation, CalPrivacy 2026 registry |
| RCR top-5 | 67.4% | 39,107,725 ÷ 58,031,327 | Axis calculation |
| RCR top-10 | 75.5% | 43,786,096 ÷ 58,031,327 | Axis calculation |
| RCR top-1 (2023) | 18.7% | 1,590,436 ÷ 8,514,612 (Sabio, Inc.) | Axis calculation, CalPrivacy 2025 registry |
The top recipient in 2024, location-data company Cuebiq Group, reported 26,285,436 deletion requests, up from 647 in 2023. Its registry comment explains part of the jump: Cuebiq says it treats opt-out and limit requests as deletions because it primarily holds mobile ad IDs and geolocation. The next four were Azira (5,042,679), UpLead (4,063,777), PeopleWhiz (2,569,965) and Fifty Technology (1,145,868).
Strip Cuebiq out and deletion requests still grew 3.7× year over year. At the other end, 164 registered brokers (27.2%) reported zero deletion requests in 2024, and 142 reported zero requests of any kind.
Marcus Chen: The 6.8× headline is real, and it is also mostly one company’s accounting choice. Cuebiq’s opt-out and deletion counts are nearly identical because it collapses one into the other. The number to watch is the 3.7× underneath it, and the 142 brokers that say nobody asked them anything all year. For a company that sells location trails, silence from consumers usually means consumers don’t know its name.
How Often Do Data Brokers Deny Deletion Requests?
Registered brokers denied 890,712 deletion requests in 2024, a denial rate of 1.53%, up from 1.01% (85,586 denials) in 2023. Opt-out denials ran slightly higher at 1.73% (1,712,354 of 98,815,966).
The aggregate rate hides how concentrated refusals are. The five brokers with the most denials account for 68.2% of the 2024 total.
Brokers with the most denied deletion requests, 2024
| Broker | Deletion requests received | Denied | Denial share | Source |
|---|---|---|---|---|
| VisitIQ LLC | 363,368 | 272,025 | 74.9% | CalPrivacy registry (self-reported) |
| Zeta Global | 137,625 | 110,100 | 80.0% | CalPrivacy registry (self-reported) |
| HealthWise Data | 98,275 | 88,648 | 90.2% | CalPrivacy registry (self-reported) |
| Cuebiq Group, LLC | 26,285,436 | 74,372 | 0.3% | CalPrivacy registry (self-reported) |
| 33 Mile Radius LLC | 62,584 | 62,190 | 99.4% | CalPrivacy registry (self-reported) |
Axis Intelligence Research counts 33 brokers that denied 90% or more of the deletion requests they received in 2024; 13 of them handled at least 1,000 requests.
“Denied” does not always mean refused. Zeta Global’s registry comment says many 2024 requests were “apparently bogus” and failed email verification. Live Data Technologies, which denied 45,853 of 45,865 requests, explains that records “could not be located with provided information.” For a consumer, the outcome is the same either way: the request did not produce a confirmed deletion.
How long do data brokers take to respond?
Across the 439 brokers that reported at least one deletion request, the median of their self-reported median response times was 5 days. Eight brokers reported a median above 45 days.
The registry also carries a self-reporting inconsistency worth knowing before you cite it: for 2024, brokers’ “complied in whole,” “complied in part” and “denied” figures add up to 62,670 more outcomes than requests received.
Marcus Chen: A 1.5% denial rate reads as cooperative until you notice that two-thirds of the refusals come from five companies, and that a verification step designed to stop fraud is also the step that stops real people. When a broker can’t match you, it hasn’t deleted you. It has told you it can’t find the record it may still be selling.
Is California’s DROP Platform Actually Deleting Data?
DROP opened to consumers on January 1, 2026, and brokers had to start processing its requests on August 1, 2026, checking the platform at least every 45 days. One sign-up reaches every registered broker.
DROP sign-ups and deletions, 2026
| Date | Californians registered | Deletion metric | Source |
|---|---|---|---|
| Aug 13, 2026 | 475,000+ | — | Office of the Governor |
| Aug 25, 2026 | 500,000+ | ~25% of 654 brokers had reported processing; typical user deleted by 40+ brokers | CalPrivacy |
| Early Oct 2026 | 550,000+ | 70% of users deleted by 100+ brokers in first three months | CalPrivacy DROP FAQ |
| Oct 12, 2026 | 560,000+ | Profiles reported deleted approaching 100 million; 99.9% of users deleted by at least one broker; typical user deleted by 150+ brokers | CalPrivacy |
Registrations grew at least 12.0% between August 25 and October 12. Over the same seven weeks, the typical user’s count of deleting brokers went from over 40 to over 150.
DROP Leverage Multiple (DLM™)
To measure what centralization changed, Axis Intelligence Research created the DROP Leverage Multiple (DLM™): DROP deletions reported to date divided by the deletion requests brokers fulfilled, in whole or in part, through individual channels during the most recent full registry year.
DLM = DROP profiles reported deleted ÷ 2024 deletion requests complied with in whole or in part
- Denominator: 56,972,890 complied in whole + 230,395 in part = 57,203,285 (2026 CalPrivacy registry).
- Ceiling: approaching 100,000,000 reported deletions ÷ 57,203,285 = 1.75×.
- Typical-user estimate: 560,000 users × 150 brokers = 84,000,000 ÷ 57,203,285 = 1.47×.
In roughly ten weeks of mandatory processing, DROP produced between 1.47× and 1.75× the deletions that the entire registered industry fulfilled through individual requests in all of 2024. The two counts are not identical units: a registry “request” is one consumer contacting one broker, while a DROP “profile deleted” is one broker deleting one consumer. Both measure consumer-broker pairs, which is why the ratio holds as an order-of-magnitude comparison and not as a precise conversion.
The DROP FAQ sets the boundaries: deletion can take up to 90 days, brokers may keep data a consumer gave them directly or data that is publicly available, and the obligation is ongoing as brokers acquire new data. DROP verifies California residency before sending a request.
Marcus Chen: The pre-DROP system put the work on the person with the least information: you had to know a broker existed before you could ask it to forget you. DROP flips that. Remember the SDX finding below: the brokers disclosing the most sensitive activity drew 2.2% of 2024’s deletion requests. A blanket request reaches them whether you’ve heard of them or not, which is the entire point.
What Sensitive Data Do Data Brokers Collect and Sell?
Since the 2026 registration cycle, brokers must answer ten yes/no questions about sensitive data they collect and five about who received consumers’ data in the past year. Definitions are set in the Delete Act; “foreign actor,” for example, means a government or company tied to a foreign adversary country under 10 U.S.C. § 4872, as spelled out in the registry’s key terms.
Sensitive data collected by registered data brokers, 2026 registry
| Disclosure | Brokers answering “Yes” | Source |
|---|---|---|
| Precise geolocation | 115 | CalPrivacy registry |
| Gender identity data | 69 | CalPrivacy registry |
| Government-issued ID numbers | 42 | CalPrivacy registry |
| Personal information of minors | 18 | CalPrivacy registry |
| Sexual orientation | 18 | CalPrivacy registry |
| Account logins or numbers with security codes | 13 | CalPrivacy registry |
| Citizenship or immigration status | 12 | CalPrivacy registry |
| Biometric data | 12 | CalPrivacy registry |
| Reproductive health care data | 8 | CalPrivacy registry |
| Union membership | 6 | CalPrivacy registry |
Who buys data from data brokers?
| Recipient (past year) | Brokers answering “Yes” | Source |
|---|---|---|
| Federal government | 55 | CalPrivacy registry |
| Other state governments | 54 | CalPrivacy registry |
| Developer of a GenAI system or model | 32 | CalPrivacy registry |
| Law enforcement (outside subpoena or court order) | 28 | CalPrivacy registry |
| Foreign actor (China, Russia, Iran, North Korea-linked) | 26 | CalPrivacy registry |
In total, 95 brokers disclosed at least one of these five recipient types. Axis Intelligence Research cross-tabulated the answers: 7 brokers that collect minors’ data also sold or shared data with the federal government.
At the federal level, the FTC sent 13 warning letters on February 9, 2026, reminding data brokers that the Protecting Americans’ Data from Foreign Adversaries Act bars transfers of sensitive data to foreign adversaries, with civil penalties of up to $53,088 per violation. CalPrivacy has already fined two affiliated brokers, Clarivate Analytics and D/R Decision Resources, $10,800 each for registering with an incorrect description of their foreign-actor sharing.
Sensitive Disclosure Index (SDX™)
The Sensitive Disclosure Index (SDX™) scores every registered broker on the breadth of what it discloses to California. It is a disclosure measure, not a misconduct finding: a high score means a broker told regulators it touches more sensitive categories or recipients.
SDX = number of “Yes” answers across the 10 sensitive-collection questions and the 5 sensitive-recipient questions (equal weight, range 0–15)
| SDX score | Brokers | Source |
|---|---|---|
| 0 | 351 | Axis calculation, CalPrivacy 2026 registry |
| 1 | 139 | Axis calculation |
| 2 | 45 | Axis calculation |
| 3 | 30 | Axis calculation |
| 4 | 17 | Axis calculation |
| 5 | 9 | Axis calculation |
| 6 | 8 | Axis calculation |
| 7 | 4 | Axis calculation |
The industry mean is 0.84. More than half of registrants (58.2%) score zero, and no broker scores above 7. The four brokers at the top, each with an SDX of 7, are Crunchbase, Equifax Information Services, Equifax Workforce Solutions and SpyCloud. Two Equifax affiliates sit in that top tier, alongside two TransUnion entities at 6, because identity verification and credit-adjacent products touch government IDs, credentials and government buyers by design.
The finding that matters for consumers: the 68 brokers with an SDX of 3 or more (11.3% of registrants) received just 2.2% of all 2024 deletion requests. Individual requests flowed to the companies people had heard of, not to the companies disclosing the most sensitive activity.
Marcus Chen: Equal weighting is deliberate. The moment you decide biometrics outrank reproductive health data, you’ve built an opinion and called it an index. SDX counts what each company told the state, so anyone can rerun it from the CSV. If you want a weighted version for your own risk model, the 15 flags are in the dataset.
Which Data Brokers Sell Precise Location Data?
Precise geolocation, defined in California law as data locating a device within a 1,850-foot radius, is the most common sensitive category in the registry. 115 brokers (19.1% of registrants) disclosed collecting it in the 2026 registry, up from 88 in the 2025 registry and 104 in the 2024 registry.
| Registry year | Brokers collecting precise geolocation | Source |
|---|---|---|
| 2024 registry | 104 | CalPrivacy |
| 2025 registry | 88 | CalPrivacy |
| 2026 registry | 115 | CalPrivacy |
Among the 115, Axis Intelligence Research finds 17 that also sold or shared data with the federal government, state governments or law enforcement, and 5 that disclosed sharing with a foreign actor.
The scale of a single location broker can be large. In December 2024, the FTC said Gravy Analytics and Venntel claimed to process more than 17 billion signals from around a billion mobile devices daily; the FTC’s proposed order would bar them from selling sensitive location data outside limited national-security and law-enforcement uses.
Marcus Chen: A 1,850-foot circle is enough to separate a clinic from the coffee shop next door. The 30.7% rise from 88 to 115 may reflect better disclosure as much as more collection, since the 2026 form asked sharper questions. Either way, it’s the first year the registry gives a credible count, and the count went up.
How Much Are Data Brokers Fined?
CalPrivacy’s board decisions page lists 17 Delete Act decisions against data brokers between November 2024 and August 27, 2026. Eight of them, dated December 30, 2025 onward, carry published amounts.
CalPrivacy data broker enforcement decisions with published amounts
| Broker | Decision date | Amount | Violation | Source |
|---|---|---|---|---|
| LocateSmarter, LLC | Aug 10, 2026 | $116,490 | Late registration; required partial SSNs for opt-outs (CCPA and Delete Act) | CalPrivacy |
| S&P Global, Inc. | Dec 30, 2025 | $62,600 | Failure to register | CalPrivacy |
| Cybba, Inc. | Aug 10, 2026 | $52,400 | Failure to register by 2025 deadline | CalPrivacy |
| Rickenbacher Data (Datamasters) | Dec 30, 2025 | $45,000 | Failure to register | CalPrivacy |
| SalesIntel Research, Inc. | Aug 27, 2026 | $36,400 | Late registration | CalPrivacy |
| WINR Data Pty Ltd | Jun 24, 2026 | $12,200 | Incorrect registration information | CalPrivacy |
| Clarivate Analytics (US), LLC | Jun 24, 2026 | $10,800 | Incorrect foreign-actor disclosure | CalPrivacy |
| D/R Decision Resources, LLC | Jun 24, 2026 | $10,800 | Incorrect foreign-actor disclosure | CalPrivacy |
| Total (8 decisions) | $346,690 | Axis calculation |
The eight amounts total $346,690, equal to 9.6% of the $3,618,000 that 603 registrants paid at the $6,000 fee (Axis calculation). Registration fines so far are small. Deletion fines are not.
What a DROP violation could cost
The Delete Act sets a fine of $200 per consumer per day for failure to delete. Axis Intelligence Research calculates the statutory ceiling for a single broker that matched and ignored every DROP user for one day:
$200 × 560,000 registered DROP users = $112,000,000 per day
That ceiling assumes the broker holds records on every user; real exposure scales with match rate. It still explains why registration-era fines in the five figures are a poor guide to what processing-era enforcement will look like.
Marcus Chen: So far CalPrivacy has mostly fined companies for paperwork: not registering, registering late, describing their foreign sharing wrong. Those are easy cases. The harder ones start now, because DROP gives the agency a ledger of who received each deletion instruction and when. Audits begin January 1, 2028, and the per-consumer, per-day math doesn’t need a large broker to get large.
Methodology
Collection. Axis Intelligence Research downloaded the 2024, 2025 and 2026 California Data Broker Registry CSV files directly from CalPrivacy on October 16, 2026 (registry2024.csv, registry2025.csv, registry.csv). We counted non-empty data rows as registrants, summed each consumer-request column across all brokers, and tallied Yes/No answers for each disclosure question. Free-text headquarters states were normalized to USPS codes. DROP, enforcement and fee figures were taken from CalPrivacy press releases, the DROP FAQ and board decision pages; federal figures from FTC press releases; Texas, Oregon and Vermont figures from each state’s registry page. Every number in this article appears as a row in the dataset with its source URL and retrieval date.
Reference years. The 2026 registry covers brokers operating in 2025 and reports request metrics for calendar 2024. The 2025 registry’s request columns are labeled 2023. We report each figure under the year its column header states.
Axis metrics and formulas.
- RCR™ (Request Concentration Ratio) = deletion requests received by the top n brokers ÷ all deletion requests received in the registry year.
- DLM™ (DROP Leverage Multiple) = DROP profiles reported deleted ÷ deletion requests complied with in whole or in part in the latest full registry year. Ceiling uses CalPrivacy’s “approaching 100 million”; the typical-user estimate uses 560,000 users × 150 brokers.
- SDX™ (Sensitive Disclosure Index) = count of “Yes” answers to the 15 sensitive-collection and sensitive-recipient questions in the 2026 registry, equal weight, range 0–15.
- Statutory exposure ceiling = $200 × DROP registered users.
Verification. All derived figures were computed twice in Python, once in floating point and once with exact rational arithmetic (fractions.Fraction), and matched. Every external link was opened on October 16, 2026.
Scope. Registry data is self-reported by brokers, and CalPrivacy has fined companies for inaccurate entries. Brokers that never registered are not counted. DROP figures are CalPrivacy-reported lower bounds or approximations (“more than,” “approaching”), and DLM inherits that precision. “Denied” deletion requests include unverifiable and unmatched requests, not only refusals. Industry revenue estimates from market-research firms were excluded because their methods are not published.
About This Dataset
File: data-broker-statistics.csv ·
Rows: 207 · Coverage: California registry years 2024–2026, request metrics for calendar 2023–2024, DROP results through October 12, 2026, CalPrivacy enforcement through August 27, 2026, plus Texas, Oregon, Vermont and FTC reference points.
Columns: metric_id, metric, value, unit, as_of_date, geography, segment, source_org, source_document, source_url, retrieved_date, is_primary, axis_calculated, method_note, license.
License: CC BY 4.0. Reuse freely with attribution to Axis Intelligence Research and a link to this page.
How to Cite This Data
APA: Axis Intelligence Research, & Chen, M. (2026, October 16). Data broker statistics 2026: 603 registered brokers, 58 million deletion requests and what DROP changed. Axis Intelligence. https://axis-intelligence.com/data-broker-statistics/
MLA: Axis Intelligence Research, and Marcus Chen. “Data Broker Statistics 2026: 603 Registered Brokers, 58 Million Deletion Requests and What DROP Changed.” Axis Intelligence, 16 Oct. 2026, axis-intelligence.com/data-broker-statistics/.
Chicago: Axis Intelligence Research, and Marcus Chen. “Data Broker Statistics 2026: 603 Registered Brokers, 58 Million Deletion Requests and What DROP Changed.” Axis Intelligence, October 16, 2026. https://axis-intelligence.com/data-broker-statistics/.
Related Axis Intelligence Research
Data brokers sit upstream of most consumer fraud. See our identity theft statistics for loss-per-victim data, the online scam statistics for global targeting rates, and SIM swap statistics for the account-takeover path that phone numbers and dates of birth enable. For breach exposure, see data breach statistics and healthcare data breach statistics. The broader picture lives on our cybersecurity statistics hub.
FAQ
How many data brokers are there in the United States?
No federal count exists. California’s 2026 registry lists 603 data brokers, and more than 660 were in its DROP system by October 12, 2026. Texas listed 452 registrations on October 16, 2026. Unregistered brokers are not captured in any official total.
Does California’s DROP actually remove my information?
CalPrivacy reported on October 12, 2026 that 99.9% of DROP users had been deleted by at least one broker and the typical user by more than 150 brokers. Deletion can take up to 90 days, and brokers may keep publicly available data or data you gave them directly.
Can I use DROP if I don’t live in California?
No. DROP verifies California residency before sending a deletion request to brokers. CalPrivacy describes DROP as the first platform of its kind, so residents of other states still have to contact brokers one by one or use the opt-out pages listed in each broker’s registration.
Which data broker received the most deletion requests?
Cuebiq Group received 26,285,436 deletion requests in 2024, 45.3% of the 58,031,327 total reported by California-registered brokers. Cuebiq says it treats opt-out and limit requests as deletions, which inflates its count relative to other brokers.
Do data brokers sell Americans’ data to China, Russia or Iran?
In the 2026 California registry, 26 data brokers disclosed selling or sharing consumers’ data with a “foreign actor,” meaning an entity tied to China, Russia, Iran or North Korea. Federal law (PADFAA) bars transfers of sensitive data to those countries, with FTC penalties up to $53,088 per violation.
How many data brokers sell precise location data?
115 brokers disclosed collecting precise geolocation in the 2026 California registry, up from 88 a year earlier. Seventeen of them also sold or shared data with federal or state governments or law enforcement.
What is the fine for a data broker that ignores DROP?
The Delete Act sets $200 per consumer per day for failure to delete. Axis Intelligence Research calculates a ceiling of $112 million per day for a broker matching all 560,000 registered DROP users. Published registration fines have ranged from $10,800 to $116,490.
Are credit bureaus considered data brokers?
Some of their affiliates are. Equifax Information Services, Equifax Workforce Solutions and two TransUnion entities are registered California data brokers. Overall, 17 registrants report FCRA regulation, and 53 report coverage under at least one of FCRA, GLBA, HIPAA, CMIA or IIPPA, laws the registry asks brokers to disclose because they govern part of the data those companies hold.
Why do data brokers deny deletion requests?
Brokers denied 1.53% of deletion requests in 2024. Their own registry comments cite unverified emails, suspected bogus submissions and records that “could not be located.” Five brokers account for 68.2% of all denials.