The global data broker market reached $278.0 billion in 2024 and is projected to surpass $307.3 billion in 2026, scaling toward $512.5 billion by 2033 (Grand View Research, Data Broker Market Size Report 2025). Across this shadow economy, commercial aggregator Acxiom maintains detailed profiles on 2.5 billion consumers with up to 11,000 attributes per person, while Experian manages 245 million U.S. credit-active consumer records with 1.3 billion monthly updates. In response to rampant monetization, California’s Privacy Protection Agency mandated over 600 registered data brokers connect to its Delete Request and Opt-Out Platform (DROP) by August 2026, even as Consumer Reports testing found private removal services eliminated only 35% of personal data listings. The figures below come from primary regulatory filings with the California Privacy Protection Agency (CPPA), enforcement orders from the Federal Trade Commission (FTC), corporate disclosures from Experian and Acxiom, investigative studies from Duke University and Consumer Reports Innovation Lab, and market sizing from Grand View Research.
TL;DR
- Global data broker market size projected at $307.3 billion in 2026, up from $278.0 billion in 2024 (Grand View Research).
- Industry projected to scale to $512.5 billion by 2033 at a 7.3% CAGR (Grand View Research).
- Over 4,000 to 5,000 data brokers operate worldwide across marketing, financial, and people-search sectors (Grand View Research).
- California CPPA registry lists 600+ registered data brokers required to connect to the centralized DROP deletion portal (California Privacy Protection Agency).
- Data brokers face $200 per day fines per consumer for failing to process DROP deletion requests after August 1, 2026 (California Privacy Protection Agency).
- Acxiom maintains dossiers on 2.5 billion consumers globally, cataloging up to 11,000 data points per person (Corporate Disclosures / LiveRamp).
- Experian manages 245 million credit-active U.S. consumer files and over 4 billion device records, processing 1.3 billion updates monthly (Experian Annual Disclosures).
- Commercial data removal services succeed in deleting only 35% of personal data listings across 13 major broker sites (Consumer Reports Innovation Lab).
- FTC issued orders barring Kochava, InMarket Media, and X-Mode from selling precise geolocation data without explicit consent (Federal Trade Commission).
- The FTC warned 13 data brokers under the Protecting Americans’ Data from Foreign Adversaries Act against transferring sensitive data abroad (Federal Trade Commission).
- Researchers bought identifiable personal dossiers on U.S. military service members for as little as $0.12 per record (Duke University Sanford School of Public Policy).
- Data brokers actively market lists of patients diagnosed with depression and anxiety gathered from health apps outside HIPAA (Duke University Sanford School of Public Policy).
- 82% of all consumer privacy requests are data deletion demands, yet 69% of tracking cookies persist post-opt-out (DataGrail).
1. Global Market Size and Commercial Valuation
Monetizing consumer profiles has evolved from a targeted marketing niche into a cornerstone of the global digital economy. The commercial data broker industry reached $278.0 billion in 2024 and is projected to expand to $307.3 billion in 2026, maintaining a steady 7.3% compound annual growth rate toward $512.5 billion by 2033 (Grand View Research). This sustained momentum reflects growing enterprise reliance on third-party enrichment, customer identity resolution, and real-time behavioral scoring. While specialized data marketplace platforms represent a smaller segment at $1.5 billion in 2024, their projected 25.2% annual growth underscores a shift toward automated programmatic data feeds.
| Metric | Value | Source |
|---|---|---|
| Global data broker market size, 2024 | $278.0 billion | Grand View Research |
| Projected global market size, 2026 | $307.3 billion | Grand View Research |
| Projected global market size, 2033 | $512.5 billion | Grand View Research |
| Data broker market CAGR (2025-2033) | 7.3% | Grand View Research |
| Data marketplace platform market, 2024 | $1.5 billion | Grand View Research |
| Projected data marketplace market, 2030 | $5.7 billion (25.2% CAGR) | Grand View Research |
North America accounts for the largest regional revenue share at over 40%, driven by heavy advertising technology spend and the absence of a comprehensive federal privacy statute. Source: Grand View Research.
2. Scale of Consumer Profiling and Corporate Dossiers
The depth of commercial surveillance extends far beyond simple demographic tables into multi-layered behavioral files. Industry giant Acxiom manages files covering 2.5 billion consumers globally, assembling up to 11,000 distinct data attributes per person encompassing financial habits, retail transactions, and digital engagements (Acxiom Corporate Disclosures). Financial credit bureaus match this scale in transactional granularity: Experian tracks 245 million credit-active Americans with 1.3 billion monthly record updates. When paired with 4 billion device identifiers and 700 million vehicle records, these aggregations form persistent shadow identities that track consumers across hardware and physical environments.
| Metric | Value | Source |
|---|---|---|
| Acxiom global consumer records managed | 2.5 billion people | Acxiom / LiveRamp Disclosures |
| Data attributes tracked per individual (Acxiom) | Up to 11,000 points | Acxiom Corporate Disclosures |
| Experian U.S. credit-active consumer files | 245 million records | Experian Annual Disclosures |
| Monthly data updates processed (Experian) | 1.3 billion updates | Experian Annual Disclosures |
| Consumer credit tradelines tracked (Experian) | ~4 billion tradelines | Experian Annual Disclosures |
| Clustered device records maintained (Experian) | Over 4 billion records | Experian Annual Disclosures |
These massive identity clusters frequently operate without the subject’s direct knowledge or verifiable consent. Source: Experian Annual Disclosures.
3. State Registry Mandates and the California DROP System
State lawmakers have responded to unregulated aggregation by creating mandatory public registries and centralized deletion portals. Under the California Delete Act (SB 362), the California Privacy Protection Agency (CPPA) launched the Delete Request and Opt-Out Platform (DROP) on January 1, 2026, establishing a single mechanism for consumers to wipe their files across all registered entities. More than 600 data brokers are registered in California, each paying an annual $6,000 registration fee to fund enforcement. Beginning August 1, 2026, brokers must query DROP every 45 days and scrub matching records or face statutory fines of $200 per consumer per day. Understanding this shift connects closely to broader digital privacy statistics for 2026 and regulatory pressure seen in GDPR enforcement statistics.
| Metric | Value | Source |
|---|---|---|
| California CPPA registered data brokers | 600+ brokers | California Privacy Protection Agency |
| Annual California data broker registration fee | $6,000 per broker | California Privacy Protection Agency |
| Daily fine for non-compliance with DROP deletion | $200 per consumer/day | California Privacy Protection Agency |
| Mandatory DROP processing interval for brokers | Every 45 days | California Privacy Protection Agency |
| Vermont Secretary of State registered data brokers | 283 brokers | Vermont Secretary of State |
| Texas data broker threshold for mandatory filing | 50,000 individuals | Texas Secretary of State |
While California and Vermont maintain public rosters, compliance remains uneven across states lacking dedicated enforcement task forces. Sources: California Privacy Protection Agency; Vermont Secretary of State.
4. Sensitive Data Sales, Geolocation, and FTC Enforcement
Regulatory tolerance for unrestrained location harvesting collapsed as federal enforcers established that raw coordinates reveal intimate personal activities. In May 2026, the Federal Trade Commission entered a proposed settlement with location broker Kochava, prohibiting the transfer of sensitive geolocation coordinates tracking medical centers, places of worship, and shelters without affirmative express consent. This followed 2024 orders against InMarket Media and X-Mode Social (Outlogic), as well as crackdowns on Gravy Analytics and Mobilewalla. The FTC emphasized that selling timestamped coordinates exposes citizens to stalking, harassment, and profiling, echoing trends tracked in identity theft statistics for 2026.
| Metric | Value | Source |
|---|---|---|
| FTC enforcement actions against location brokers | 5 major actions | Federal Trade Commission |
| InMarket Media device reach restricted by FTC | ~100 million devices | Federal Trade Commission |
| PADFAA compliance warning letters issued (Feb 2026) | 13 data brokers | Federal Trade Commission |
| Sensitive locations protected under FTC orders | Clinics, worship, shelters | Federal Trade Commission |
| Typical mobile app SDK location tracking rate | Real-time continuous | Federal Trade Commission |
| Location coordinate precision in broker feeds | Sub-15 meter accuracy | Federal Trade Commission |
The FTC established algorithmic disgorgement as a standard remedy, requiring offending brokers to delete both harvested location logs and predictive models trained on them. Source: Federal Trade Commission.
5. National Security, Vulnerable Populations, and Shadow Health Records
Commercial data markets frequently handle records that threaten military personnel safety and individual dignity. Research from Duke University’s Sanford School of Public Policy demonstrated that data brokers sold individually identified records of active-duty military personnel, veterans, and military families for as little as $0.12 per record. The dossiers included residential addresses, credit risk scores, and religious preferences. In an adjacent study, Duke researchers uncovered brokers actively marketing contact lists of individuals diagnosed with major depressive disorders and anxiety disorders harvested from wellness applications exempt from HIPAA privacy rules. These unregulated data streams bypass website protections discussed in cookie consent banner statistics for 2026.
| Metric | Value | Source |
|---|---|---|
| Minimum cost per military personnel data record | $0.12 per record | Duke University Sanford School |
| Military records available in single broker purchases | Thousands of personnel | Duke University Sanford School |
| Identifying data fields included in military feeds | Address, finances, religion | Duke University Sanford School |
| Mental health diagnosis categories marketed | Depression, anxiety, bipolar | Duke University Sanford School |
| Wellness app compliance with HIPAA standards | 0% (unregulated apps) | Duke University Sanford School |
| Foreign entity access to domestic commercial data | Unrestricted pre-PADFAA | Duke University Sanford School |
These vulnerabilities spurred congressional passage of the Protecting Americans’ Data from Foreign Adversaries Act to curb overseas intelligence exploitation. Source: Duke University Sanford Cyber Policy Program.
6. Opt-Out Friction and the Inefficacy of Data Removal
Exercising privacy rights through commercial channels remains an inefficient and frustrating endeavor for consumers. An investigative evaluation by Consumer Reports Innovation Lab revealed that automated data removal services succeeded in eliminating only 35% of personal data instances across 13 major people-search data broker sites after four months of monitoring. Brokers frequently countered deletion demands with artificial friction, demanding government photo IDs or quietly re-populating removed records within weeks. Privacy platform DataGrail reports that deletion requests represent 82% of all consumer privacy requests, yet 69% of commercial websites continue deploying tracking cookies after users signal opt-out preferences.
| Metric | Value | Source |
|---|---|---|
| Personal data removed by paid services after 4 months | ~35% of listings | Consumer Reports Innovation Lab |
| People-search data broker sites tested | 13 major platforms | Consumer Reports Innovation Lab |
| Commercial data removal tools evaluated | 7 commercial tools | Consumer Reports Innovation Lab |
| Share of privacy requests seeking data deletion | 82% of all requests | DataGrail 2025 Privacy Trends |
| Annual privacy request volume increase | +43% year-over-year | DataGrail 2025 Privacy Trends |
| Businesses tracking consumers after opt-out signal | 69% of companies | DataGrail 2025 Privacy Trends |
Consumers attempting manual opt-outs face an average of 15 to 30 minutes of administrative friction per broker platform. Sources: Consumer Reports; DataGrail Privacy Trends.
Summary: Data Broker Industry by the Numbers
| Metric | Value | Source |
|---|---|---|
| Global data broker market, 2024 | $278.0 billion | Grand View Research |
| Projected global market size, 2026 | $307.3 billion | Grand View Research |
| Projected global market size, 2033 | $512.5 billion | Grand View Research |
| Industry compound annual growth rate (2025-2033) | 7.3% | Grand View Research |
| Estimated data brokers operating globally | 4,000-5,000 companies | Grand View Research |
| Acxiom global consumer records managed | 2.5 billion people | Acxiom / LiveRamp Disclosures |
| Maximum data points tracked per individual (Acxiom) | Up to 11,000 points | Acxiom Corporate Disclosures |
| Experian U.S. credit-active consumer files | 245 million records | Experian Annual Disclosures |
| Monthly consumer record updates (Experian) | 1.3 billion updates | Experian Annual Disclosures |
| California CPPA registered data brokers | 600+ brokers | California Privacy Protection Agency |
| Annual California data broker registration fee | $6,000 per broker | California Privacy Protection Agency |
| Daily fine for failure to process DROP deletion | $200 per consumer/day | California Privacy Protection Agency |
| Vermont Secretary of State registered data brokers | 283 brokers | Vermont Secretary of State |
| FTC enforcement actions against location brokers | 5 major actions | Federal Trade Commission |
| PADFAA compliance warning letters issued (Feb 2026) | 13 data brokers | Federal Trade Commission |
| Military personnel data purchase price | $0.12 per record | Duke University Sanford School |
| Removal service success rate after 4 months | ~35% of listings | Consumer Reports Innovation Lab |
| Share of privacy requests seeking record deletion | 82% of requests | DataGrail 2025 Privacy Trends |
Methodology and Sources
Data was gathered by analyzing primary regulatory registries, federal enforcement decrees, corporate financial filings, and independent privacy research studies published through mid-2026, cross-referencing market valuations across research firms and verifying public enforcement dockets.
- Grand View Research — Data Broker Market Size, Share & Trends Analysis Report, 2025 (link)
- California Privacy Protection Agency — Data Broker Registry and Delete Request and Opt-Out Platform (DROP), 2026 (link)
- Vermont Secretary of State — Data Broker Registry Annual Reports, 2026 (link)
- Federal Trade Commission — Enforcement Actions on Commercial Surveillance and Geolocation Data Brokers, 2026 (link)
- Duke University Sanford School of Public Policy — Cyber Policy Program Reports on Military and Health Data Sales, 2023-2026 (link)
- Consumer Reports Innovation Lab — Evaluating Personal Data Removal Services and Permission Slip Study, 2024-2026 (link)
- Experian plc — Annual Report and Investor Financial Disclosures, 2025-2026 (link)
- DataGrail — Data Privacy Trends Report, 2025 (link)
Data watch: Several regulatory benchmarks and datasets cited in this report operate on rolling compliance timelines. California’s CPPA DROP mandatory processing obligation took effect on August 1, 2026, with the first quarterly enforcement metrics expected in late 2026. The FTC’s implementation of the Protecting Americans’ Data from Foreign Adversaries Act (PADFAA) continues with active warning letters. Consumer Reports and DataGrail update their deletion benchmark studies annually.
Last updated: August 22, 2026. We review and update this page quarterly as new regulatory filings and market datasets emerge.