Research Report
Data Broker Industry Report 2026: How Big Is the Industry Selling Your Data?
The data broker industry is one of the least visible sectors in the global economy, and one of the most financially significant. It operates largely in the background, aggregating personal information about billions of people and selling it to businesses, advertisers, insurers, employers, and increasingly, individuals. This report compiles publicly available industry data, regulatory filings, and market research to give you a clear picture of the industry in 2026.
Key Findings
$365B+
Estimated global data broker industry revenue (2024, Grand View Research)
4,000+
Registered data brokers operating in the United States
700+
Data brokers registered with California's CPPA registry alone
$0.0001
Estimated price per individual data record in bulk B2B sales
80%
Share of data broker revenue from business-to-business sales
100+ hrs
Average time needed to manually opt out of all major US data brokers
How Large Is the Data Broker Industry?
The global data broker market was estimated at $365.74 billion in 2024 (Grand View Research, 2024 Data Broker Market Report) and is projected to reach $545 billion by 2029, growing at a compound annual growth rate of approximately 8.3%. For context, this market size exceeds the entire GDP of countries like South Africa, Denmark, or Hong Kong.
The United States is the largest single market, estimated to account for approximately $200 billion of global revenue. The US market's size reflects both the scale of the American economy and the relative absence of comprehensive federal privacy regulation, which has allowed the industry to grow without the legal friction present in the European Union.
The industry is broadly divided into four major revenue categories:
- Marketing and advertising data — the largest segment; includes consumer demographics, behavioral data, and purchase history sold to advertisers
- Financial risk data — credit-related data, income estimates, and fraud-detection data sold to banks, insurers, and lenders
- Healthcare data — prescription history, diagnosis codes, and health behavior data; the fastest-growing and highest-margin segment
- People-search data — consumer-facing products allowing individuals to look up background information on others; the most visible segment to ordinary consumers
Who Are the Major Players?
The data broker industry is not monolithic. It spans from Fortune 500 companies with billions in annual revenue to small specialty brokers selling niche datasets to specific industries. The industry breaks down across three tiers:
Tier 1 — The Giants (Primarily B2B)
These companies primarily sell to businesses: banks, insurers, employers, government agencies, and marketers. Most consumers have never heard of them, even though these companies hold more data about individual Americans than most people's own banks do.
- Acxiom (now LiveRamp) — claims data on 2.5 billion consumers globally; primary revenue from marketing data
- LexisNexis (RELX Group) — largest provider of legal, financial, and risk data; annual revenue exceeding $3B from data products
- Equifax, Experian, TransUnion — the three credit bureaus are technically data brokers holding SSNs, credit histories, and financial data on virtually every US adult
- Oracle Data Cloud — operates one of the largest third-party data marketplaces; acquired Datalogix, BlueKai, and others
- Epsilon — loyalty program data and consumer identity; acquired by Publicis in 2019 for $4.4B
- CoreLogic — property data on 99% of US residential properties; revenue ~$1.7B annually
- Verisk — insurance industry data and analytics; annual revenue ~$3B
Tier 2 — Consumer-Facing People-Search Sites
These companies sell directly to individuals: neighbors, employers, landlords, stalkers, and curious members of the public. They are the most visible face of the data broker industry to ordinary consumers and the most directly harmful to personal privacy.
- Spokeo
- Whitepages
- BeenVerified
- TruthFinder
- Intelius
- Radaris
- MyLife
- Instant Checkmate
- PeopleFinders
- FastPeopleSearch
- TruePeopleSearch
- PeopleLooker
Tier 3 — Specialty Data Brokers
These companies focus on specific data verticals. They are less well-known but often deal in the most sensitive categories: medical data brokers like IQVIA (IMS Health) sell prescription records to pharmaceutical companies; insurance data aggregators like ISO ClaimSearch sell claims history to underwriters; employment data companies sell salary benchmarks and work history verification.
What Data Is Being Sold
Not all personal data is equal in the marketplace. Here is a breakdown of the major data categories, who buys them, approximate price ranges, and the level of existing regulation:
| Data Type | Primary Buyers | Price Range | Regulation |
|---|---|---|---|
| Contact data name, address, phone, email | Marketers, political campaigns, nonprofits | $0.0001–$0.01 per record | Low (CAN-SPAM, state laws) |
| Behavioral data browsing, app usage, purchase history | Advertisers, retail analytics, media companies | $0.10–$2.00 per profile | Medium (state privacy laws) |
| Financial data income estimates, credit behavior, assets | Banks, insurers, lenders, wealth managers | $1–$15 per record | Medium-High (FCRA, GLBA) |
| Health data prescriptions, diagnoses, fitness data | Pharma companies, insurers, employers | $50–$250+ per record | Variable (HIPAA gap for non-providers) |
| Location data real-time mobility, visit patterns | Retailers, hedge funds, governments, insurers | $0.50–$10 per device/day | Low-Medium (growing FTC scrutiny) |
The health data segment deserves special attention. Unlike HIPAA-covered entities (hospitals, physicians, health insurers), data brokers that derive health insights from non-clinical sources, prescription drug purchase records sold by pharmacies, fitness tracker data, app usage patterns suggesting conditions, often fall outside HIPAA's coverage entirely. This gap has allowed a significant market in health-derived data to grow with minimal oversight.
How Data Brokers Get Your Data
Understanding where data brokers acquire their raw material is important context for understanding why the problem is so difficult to solve at the individual level. The data comes from multiple sources, many of which individuals have little or no ability to control:
Public Records
County deed recorders, court systems, DMV records (via DPPA resellers), voter registration rolls, business license filings, and property assessments. These are legally public and difficult for individuals to suppress.
Purchase Transaction Data
Loyalty card programs, store receipts collected by payment processors, point-of-sale systems, and retail data consortiums. When you use a grocery loyalty card, that purchase data is typically sold to data brokers.
Online Behavioral Data
Third-party cookies, web tracking pixels, mobile SDK data harvested from apps, and direct scraping of public social media profiles and forums. This segment is declining as browsers eliminate third-party cookies, but mobile data collection is growing to compensate.
Inter-Broker Data Sales
Data brokers buy from each other. This creates a situation where opting out of one broker doesn't prevent others from receiving that data. It may have already been sold multiple times before the opt-out request is processed.
Direct Consumer Submissions
Surveys, sweepstakes entries, warranty registrations, and other voluntary data submissions where fine-print disclosures permit data resale. Also includes data submitted to websites that share with data broker affiliates.
Regulatory Landscape
The regulatory environment governing data brokers is fragmented: strong in the EU, patchwork in the US, and largely absent in most of the rest of the world.
European Union — GDPR (2018)
The General Data Protection Regulation is the strongest data privacy framework globally. It provides EU residents with the right to access, correct, and delete personal data held by any organization. Fines can reach 4% of global annual revenue or €20 million, whichever is greater. Major tech companies have paid billions in GDPR fines. Data brokers operating in the EU must provide detailed legal bases for processing and must honor deletion requests within 30 days.
California — CCPA/CPRA + California Delete Act (2023)
California has the most comprehensive US state framework. The California Consumer Privacy Act (2020) and California Privacy Rights Act (2023) give California residents the right to know, delete, correct, and opt out of the sale of their personal data. The California Delete Act (SB 362, effective 2026) requires all registered data brokers to honor deletion requests through a single centralized portal — a significant step toward making removal practical. The California Privacy Protection Agency (CPPA) maintains the official registry of registered brokers, currently listing 700+ companies.
As of February 2026, the following US states have enacted comprehensive privacy laws that provide consumers with deletion rights applicable to data brokers:
| State | Law | Effective Date |
|---|---|---|
| California | CCPA / CPRA | Jan 1, 2023 |
| Virginia | VCDPA | Jan 1, 2023 |
| Colorado | CPA | Jul 1, 2023 |
| Connecticut | CTDPA | Jul 1, 2023 |
| Utah | UCPA | Dec 31, 2023 |
| Iowa | ICDPA | Jan 1, 2025 |
| Indiana | INCDPA | Jan 1, 2026 |
| Tennessee | TIPA | Jul 1, 2025 |
| Montana | MCDPA | Oct 1, 2024 |
| Texas | TDPSA | Jul 1, 2024 |
| Oregon | OCPA | Jul 1, 2024 |
| Delaware | DPDPA | Jan 1, 2025 |
Notably absent from this list: no comprehensive federal privacy law exists in the United States as of 2026. The American Data Privacy and Protection Act (ADPPA) passed the House Energy and Commerce Committee in 2022 but has stalled in Congress. Industry lobbying has played a significant role in that outcome.
The Data Broker Lobbying Machine
The data broker industry has spent aggressively to prevent privacy legislation at the federal level. Research from the Electronic Privacy Information Center (EPIC) estimates that data brokers and their proxies spent an estimated $143 million lobbying against privacy legislation between 2019 and 2023. The primary industry lobbying arm is the Consumer Data Industry Association (CDIA), which represents the major credit bureaus and data companies.
Individual company lobbying disclosures (required under the Lobbying Disclosure Act) show that Experian, Equifax, TransUnion, LexisNexis, and the Direct Marketing Association (now the Data & Marketing Association) have each spent tens of millions opposing federal privacy bills, mandatory opt-out registries, and restrictions on data sales.
Despite this spending, the industry has lost significant ground at the state level. California, Texas, Virginia, Colorado, and a dozen other states have passed laws that materially constrain data broker operations. Lobbying resources are more diluted at the state level, and consumer advocacy has managed to push legislation through anyway.
The Growth of the Removal Industry
The same forces driving awareness of the data broker problem, high-profile breaches, doxxing incidents, state privacy laws, are also driving growth in the counter-industry: data removal services. The market for personal data removal and privacy management services is estimated to reach $1.4 billion by 2028, up from approximately $450 million in 2023 (PrivacyTech Market Report, 2024).
Three factors are driving that growth:
- Increasing consumer awareness. High-profile breach disclosures — the National Public Data breach affecting 2.9 billion records, Change Healthcare exposing 100M+ patients — have created broad awareness that personal data circulates far beyond what people consent to.
- New state laws strengthening deletion rights. California's Delete Act, which mandates a centralized opt-out portal for California residents, is expected to be modeled by other states. As deletion rights become more legally robust, services that automate the exercise of those rights become more valuable.
- The perpetual nature of the problem. Data broker sites re-populate removed profiles from new public records on a continuous basis. This creates recurring demand — individuals who remove their data once find it has reappeared within months, making ongoing subscription-based removal services the only practical solution.
What This Means for You
These numbers aren't abstract. The average American adult appears in hundreds of individual data broker databases, with profiles that include their current and past addresses, phone numbers, email addresses, relatives' names, employment history, property ownership, estimated income, political affiliation, and in many cases, their Social Security Number.
This data is being sold to marketers, used by insurance underwriters to price your policies, accessed by employers conducting background checks, and purchased by stalkers, scammers, and identity thieves. A $4 background check on any people-search site can reveal more about you than most people would voluntarily share with anyone but close family.
The scale of the industry means there is no single action that fully addresses the problem. Regulatory compliance remains incomplete: state laws cover residents but not the data itself, which crosses state lines freely. The only way to meaningfully reduce your data broker exposure is systematic removal across all major broker sites, with continuous monitoring and re-removal as data reappears, which is what automated removal services provide. Start with a background check opt-out guide to understand the process, or see GhostVault's pricing for automated removal.