Data Brokers

Data brokers collect and sell personal information about you without your knowledge or consent. We're here to help you understand who they are, what they do, and what you can do about it.

Blue background with a light blue hand icon and white outlines globe icon a test vessel icon and a magnifying glass with an eye inside

What are Data Brokers?

Data brokers are companies that collect, aggregate, and sell personal information about people they have no direct relationship with. You've probably never heard of most of them, but they've heard of you. They compile data from public records, social media, purchase histories, loyalty programs, app usage, location tracking, and other brokers. The result is detailed profiles on hundreds of millions of Americans—often containing thousands of data points per person.

This information gets sold for marketing, targeted advertising, background checks, risk assessment, fraud detection, and purposes most consumers would never anticipate. Data broker profiles have been used to target vulnerable populations with predatory ads, to screen job applicants and tenants, and to identify individuals for government surveillance. Some brokers have been caught selling data on military personnel and protestors to foreign adversaries.

Data brokers are a central focus of our work at Privacy Rights Clearinghouse and we've advocated for data broker regulations for decades. They sit at the intersection of nearly every privacy issue we care about. Understanding who they are is the first step. Taking back control of your data is the next.

Screenshot of our dashboard visualizing the unified data broker registry gathered during April 2025 and unified by Privacy Rights Clearinghouse and the Electronic Frontier Foundation

Our 2025 Data Broker Research

In 2025, we built a unified database of 750+ data brokers by collecting and cross-referencing registration data from all five state registries. In the process, we identified hundreds of companies that registered in one state but failed to register in others.

We sent letters to enforcement agencies in each state. CalPrivacy has since fined multiple unregistered brokers and ordered others to shut down.

Read the full report and explore the unified data broker registry

Taking Control: Deleting Your Data from Brokers

Removing your personal information from data brokers is a daunting challenge. There are hundreds of registered data brokers across the various registries, and while our database somewhat simplifies the task by directly linking to the privacy policies of nearly every broker listed -- this is still a Herculean task.

California residents now have a better option. On January 1, 2026, the California Privacy Protection Agency (CalPrivacy) launched the Delete Request and Opt-Out Platform (DROP)—a first-of-its-kind public service that allows you to submit a single deletion request to every registered data broker in California, completely free of charge. This is the result of California's groundbreaking DELETE Act, which Privacy Rights Clearinghouse proudly co-sponsored in 2023.

If you are a California resident, we strongly encourage you to sign up for DROP today. CalPrivacy met its statutory deadline and completed a complex regulatory process—including extensive public engagement and comment periods—to deliver this platform on schedule. It's an impressive accomplishment for consumer privacy.

One important note: While DROP is now accepting registrations, data brokers are not required to begin processing deletion requests until August 1, 2026. After that date, data brokers must access DROP every 45 days to process all pending deletion requests. This means if you sign up now, your information will be queued and ready for deletion once the obligation kicks in.

For those outside California, or for anyone who prefers to take matters into their own hands, you may still approach each broker individually:

Visit each data broker's privacy policy directly (available through the "more information" links above)
Submit a formal deletion request through the process they provide—usually found under sections like "Delete Your Information," "Privacy Requests," or "Consumer Privacy Rights"
Verify your identity, which may require providing additional personal information
Wait for a response, generally within 45 days, though brokers may request extensions or deny requests for certain reasons allowed by law

You may also consider using an authorized agent service to help you submit opt-out requests if DROP is unavailable in your state.

Find Out More About the California Delete Act

and sign up for DROP with CalPrivacy

DROP: Frequently Asked Questions

You verify California residency through the state's identity gateway, then submit identifying information: name, address, email, phone number, date of birth, and optionally your mobile advertising ID.

DROP immediately hashes this information. Hashing is a one-way cryptographic transformation that converts your data into a fixed string of characters. The same input always produces the same hash, but you can't reverse a hash to get the original data back.

Starting August 2026, data brokers must log into DROP every 45 days and download lists of hashed identifiers. They take the data in their own systems, apply the same formatting and hashing process, and compare results. A matching hash means they have your data and must delete it.

The key innovation is standardization. CalPrivacy's regulations require data brokers to format fields in specific ways before hashing (dates as eight-digit strings, phone numbers as the last 10 digits without dashes, etc.). This eliminates the excuse data brokers have used for years to dodge deletion requests: "the information you submitted doesn't match our records." Now everyone uses the same format.

This standardization will also make third-party deletion services more effective, since the same matching problems have plagued them too.

Your information is hashed the moment you submit it. CalPrivacy never stores or shares your actual name, address, or other details with data brokers. Brokers only receive lists of hashed values.

Brokers can't reverse these hashes to learn anything new about you. They can only check whether hashes of records they already have match hashes in the DROP list. If they have your info, they find a match and delete it. If they don't have your info, the hash is meaningless to them.

DROP doesn't give data brokers anything they don't already have. It just tells them to delete what they've got.

Deletion services are private companies with no enforcement power. If a data broker ignores them, their only recourse is to try again. DROP is operated by a state regulatory agency that can investigate violations and impose fines of $200 per consumer per day for failures to delete.

Beyond enforcement, deletion services are fundamentally limited by the legal tools available to them. They're acting as authorized agents exercising CCPA-style privacy rights on your behalf, and those rights weren't designed with data brokers in mind.

For starters, the CCPA's right to delete only covers information collected from you. Data brokers collect information about you from other sources, which has let them argue the deletion right doesn't apply. The process is also slow: CCPA gives businesses up to 45 days to respond, extendable to 90. Multiply that by hundreds of brokers and you're looking at a years-long game of whack-a-mole. And once you've deleted, there's nothing stopping brokers from collecting your information again the next day. Traditional deletion requests are one-time actions.

The Delete Act addresses all of this. It requires standardized data formatting (eliminating the "no matching record" excuse), mandates ongoing deletion every 45 days (not one-time), and backs the whole thing with penalties steep enough to matter.

Two things.

First, once you submit a DROP request, brokers must keep your hashed identifiers on a suppression list. Every 45 days, they check newly collected data against this list. If they've re-acquired your information, they delete it again. This isn't a one-time thing.

Second, the Delete Act prohibits brokers from selling or sharing new personal information about consumers who've submitted deletion requests.

CalPrivacy. They launched a Data Broker Enforcement Strike Force in late 2025 and have been actively going after brokers that failed to register. Background Alert was told to shut down through 2028 or pay $50,000. Accurate Append paid $55,400. ROR Partners paid $56,600 for building profiles on 262 million Americans without bothering to register. Datamasters paid $45,000 and was ordered to stop selling Californians' data altogether.

Those are all registration violations, which carry fines of $200/day. Deletion violations are different. The Delete Act sets fines at $200 per consumer per day for each failure to delete. Not per violation, not per complaint—per consumer, per day. California has about 39.5 million residents. If even a fraction of them sign up for DROP, the numbers add up fast. A broker that ignores a million deletion requests is looking at $200 million in potential fines, and that resets every 45-day cycle. Unlike the CCPA, where enforcement is discretionary and penalties are capped, the Delete Act creates liability that makes ignoring deletion requests genuinely risky. It's arguably the strongest privacy enforcement mechanism in the country, and CalPrivacy has already shown it's willing to use it.

Investigations aren't the only accountability mechanism.

Starting January 2028, data brokers must undergo independent third-party audits every three years. Audit reports must be kept for six years and produced to CalPrivacy within five business days on request. Starting 2029, brokers must publicly disclose whether they've been audited.

Brokers also already have to report deletion request metrics (how many received, processed, denied) in their annual registration and privacy policies. Researchers and advocacy organizations can track compliance patterns across the industry using this data.

Your mobile advertising ID (MAID) is a unique identifier assigned to your phone that advertisers and data brokers use to track you across apps. On iPhones it's called IDFA; on Android it's GAID or AAID. Every time you use an app that displays ads or collects analytics, that app can read your MAID and share it with third parties. Over time, data brokers build detailed profiles tied to your MAID: which apps you use, where you go, what you buy, what you search for.

Many data brokers have extensive records tied to your MAID without ever knowing your name, email, or phone number. They've been tracking your device for years but can't necessarily connect that activity to your real-world identity. If you only submit traditional identifiers to DROP, those records won't match. Your MAID fills that gap.

On Android, go to Settings > Privacy > Ads (or Settings > Google > Ads on some devices). Samsung uses Settings > Security and Privacy > More Privacy Settings > Ads. Your advertising ID will be listed there. If you can't find it, search "ads" or "advertising" in Settings.

On iOS it's harder. Apple doesn't display your IDFA anywhere in Settings. You'll need a third-party app to retrieve it. And if you have "Allow Apps to Request to Track" turned off (Settings > Privacy & Security > Tracking), your device may not have an active IDFA at all.

CalPrivacy has published a guide specifically for DROP users: Understanding Mobile Advertising IDs and DROP.

Unfortunately, no. DROP is limited to verified California residents under state law.

Vermont, Texas, and Oregon have data broker registration requirements, but none have a centralized deletion mechanism like DROP. California is the only state where you can submit a single request that reaches every registered data broker. The other registries are useful for transparency, and you can see which companies have registered as data brokers, but they don't give consumers the same tools to act on that information.

Data brokers are a national problem. The same companies collecting and selling Californians' data are doing the same thing to everyone else. California has historically set the template on privacy (the CCPA influenced state privacy laws across the country), and we expect other states to look at the Delete Act as a model. Several states are already considering similar legislation.

If you want DROP-like protections where you live, tell your state legislators. Point them to California's Delete Act. The infrastructure now exists to show it can be done.

Frequently Asked Questions

Data brokers gather your information from numerous sources, creating detailed profiles that can include thousands of data points per individual. Common sources include social media activity, public records such as property and court filings, browsing history captured through website cookies, loyalty and reward programs, mobile app interactions, surveys, and offline transactions such as retail purchases or magazine subscriptions. They also frequently purchase or exchange data with other companies, allowing them to build comprehensive profiles that include your demographic details, interests, financial status, medical history, purchasing habits, and even inferred characteristics like political affiliations and lifestyle preferences.

Data brokers affect your privacy in many ways, from routine identity verification and risk assessments to more troubling impacts like targeted marketing that exploits vulnerabilities or sensitive situations. While data broker information can serve legitimate purposes, such as verifying identities for security or financial transactions, it also poses significant risks. Data brokers often compile sensitive consumer profiles—like "economically anxious elders" or "frequent purchasers of pregnancy kits"—potentially exposing individuals to unwanted attention or discrimination. The industry’s widespread sale of personal data can also amplify privacy harms following data breaches by re-identifying anonymized datasets. Concerns have even extended to national security, with reports of brokers selling information about veterans and protestors to foreign adversaries, prompting recognition by agencies like the Office of the Director of National Intelligence that this industry can threaten civil liberties and consumer privacy alike.

It's not always easy to tell! You can verify if a company is a registered data broker by checking data broker registries in California, Texas, Oregon, or Vermont—or use our database above that consolidates these registries into one location. Unfortunately, there are many non-registered data brokers, and many businesses are less-than clear about their data collection practices that might qualify them as data brokers. This list is a great place to start.

If you're a California resident, the easiest option is now the Delete Request and Opt-Out Platform (DROP), which launched January 1, 2026 under California's Delete Act. DROP lets you submit a single deletion request that reaches every registered data broker in California, free of charge. Data brokers must begin processing these requests starting August 1, 2026, and continue deleting every 45 days on an ongoing basis.

For non-Californians, or if you prefer to handle requests directly, you (or an authorized agent) must individually submit deletion requests through each broker's privacy policy or consumer request forms. You'll typically need to verify your identity, and brokers can delay responses, deny your request based on certain exemptions, or extend response timelines. Under California's CCPA, brokers have 45 days to respond but can request extensions.

You can directly contact data brokers and submit a "right to know" or access request if you live in a state that provides such privacy rights (currently, no federal right exists). Use our database to find registered brokers and access their privacy policies, which typically detail how you can request your data. Keep in mind, in the United States, businesses do not need your consent to collect or sell your information—they are legally allowed to sell and share your data unless you affirmatively opt-out (where state laws permit). This lack of consent requirements is one reason data brokers are so widespread in the U.S.

The California DELETE Act (2023) requires registered data brokers to honor automated consumer requests for data deletion at no cost. As of January 1, 2026, Californians can submit these requests simultaneously to every registered data broker through the Delete Request and Opt-Out Platform (DROP). Data brokers must begin processing requests starting August 1, 2026, and must continue deleting consumer data every 45 days thereafter. Privacy Rights Clearinghouse co-sponsored this legislation, leading a coalition of advocates to establish this first-of-its-kind consumer right.

Your data rights vary depending on your state's laws. Comprehensive privacy laws in states such as California, Colorado, Connecticut, Utah, and Virginia typically provide rights to access, correct, delete, and opt out of the sale or sharing of your personal data. Additionally, the Fair Credit Reporting Act and Gramm-Leach-Bliley Act regulate certain aspects of data collection and sale, especially in credit and financial contexts. California's DELETE Act specifically targets data brokers, and as of 2026, California residents can use DROP to request deletion from all registered brokers through a single request.

This is a difficult question to answer, with a sliding target that changes every day and for every individual. You can minimize data broker collection by opting out of tracking cookies, using ad blockers, enabling privacy settings on your devices, and employing browser privacy signals like the Global Privacy Control (GPC). Additionally, consider authorized agent services that help automate opt-out requests.