81% of American adults are concerned about how companies use the data collected about them, and 73% feel they have little or no control over it (Pew Research Center, How Americans View Data Privacy 2023 — still the most recent national benchmark). The systems behind that anxiety kept expanding in 2025: the Identity Theft Resource Center logged a record 3,322 U.S. data compromises (ITRC, 2025 Annual Data Breach Report), European regulators notched roughly 1.15 billion euros in GDPR fines (CMS, GDPR Enforcement Tracker Report 2025), and Texas alone extracted a 1.375 billion dollar privacy settlement from Google over voiceprints and facial geometry collected without consent (Texas Attorney General, May 2025). Meanwhile the machinery of collection scaled up — up to 5,000 data brokers now trade personal records and Clearview AI’s face database passed 50 billion images. This analysis consolidates data from Pew Research Center, Cisco, the Identity Theft Resource Center, the CMS GDPR Enforcement Tracker, DLA Piper, DataGrail, and 15 other primary sources into one reference set, with every figure traced to its original report.
TL;DR
- 81% of Americans are concerned about corporate data use; 71% about government use (Pew Research Center, 2023).
- 3,322 U.S. data compromises in 2025 — an all-time record, up 79% over five years, and 70% of notices never disclosed the cause (ITRC, 2025 Annual Data Breach Report).
- Personal data breach notifications across Europe hit 443 per day, up 22% year over year (DLA Piper, GDPR Fines and Data Breach Survey January 2026).
- Roughly 1.15 billion euros in GDPR fines in 2025; about 6.11 billion euros cumulative since 2018 (CMS, GDPR Enforcement Tracker Report 2025).
- 20 U.S. states had comprehensive privacy laws in effect entering 2026, expanding toward 24 by mid-year (MultiState, 2026).
- Texas won a 1.375 billion dollar settlement from Google over voiceprints and facial geometry captured without consent (Texas Attorney General, May 2025).
- 62% of U.S. adults live in a household with a smart speaker, up from 36% in 2020 (ElectroIQ / Statista, 2025).
- Up to 5,000 data brokers operate globally; California’s DROP platform covers 600+ registered in-state (Grand View Research, 2025; California Privacy Protection Agency, 2026).
- Data-deletion requests make up 82% of all consumer privacy requests, and total request volume rose 43% year over year (DataGrail, 2025 Data Privacy Trends Report).
- About 23% of internet users worldwide use a VPN; U.S. usage fell to 32% from 46% in 2023 (Security.org, 2025 VPN Consumer Report).
- 96% of organizations say the returns on privacy investment outweigh the costs (Cisco, 2025 Data Privacy Benchmark Study).
1. How Consumers Feel About Digital Privacy
Concern is close to universal, but it travels with resignation — most people report they cannot control collection and do not fully understand it. The one group that acts on the worry is younger: 49% of consumers aged 25 to 34 have switched companies or providers over their data practices, versus just 18% of those 75 and over (Cisco, 2025 Data Privacy Benchmark Study). Awareness is also finally a majority: 2025 was the first year most global consumers said they knew their country had a privacy law. The flagship U.S. attitude data below is from Pew’s 2023 study, its most recent national read on the subject.
| Metric | Value | Source |
|---|---|---|
| Concerned about how companies use their data | 81% of U.S. adults | Pew Research Center, 2023 |
| Concerned about government data use | 71% | Pew Research Center, 2023 |
| Feel little or no control over company data collection | 73% | Pew Research Center, 2023 |
| Want more privacy regulation than exists today | 72% | Pew Research Center, 2023 |
| Consumers 25-34 who switched providers over data practices | 49% (vs 18% of 75+) | Cisco, 2025 Data Privacy Benchmark Study |
| Global consumers aware of their country’s privacy law | 53% (first-ever majority) | Cisco, 2025 Data Privacy Benchmark Study |
| Aware-of-law consumers who feel able to protect their data | 81% (vs 44% of unaware) | Cisco, 2025 Data Privacy Benchmark Study |
Sources: Pew Research Center, How Americans View Data Privacy; Cisco, 2025 Data Privacy Benchmark Study. The Pew figures are the most recent available national benchmark (Pew Research Center, 2023).
2. Data Breaches and Personal Data Exposure
The count of incidents keeps climbing while the story gets harder to read. 2025 set a record for the number of compromises, yet victim notices fell sharply — not because exposure shrank, but because 2025 lacked the single billion-record mega-breaches that inflated 2024. The transparency signal is the worrying one: 70% of 2025 breach notices did not explain how the breach happened (ITRC, 2025 Annual Data Breach Report), leaving affected consumers unable to judge their own risk. Anyone tracing the downstream harm should read this alongside identity theft statistics for 2026.
| Metric | Value | Source |
|---|---|---|
| U.S. data compromises, 2025 | 3,322 (record; +5% vs 2024’s 3,152) | ITRC, 2025 Annual Data Breach Report |
| Five-year change in annual compromises | +79% | ITRC, 2025 Annual Data Breach Report |
| Victim notices, 2025 | 278.8 million (down from 1.37 billion in 2024) | ITRC, 2025 Annual Data Breach Report |
| Breach notices that omitted the cause | 70% | ITRC, 2025 Annual Data Breach Report |
| Largest single 2025 incident (PowerSchool) | 71.9 million victim notices | ITRC, 2025 Annual Data Breach Report |
| Personal data breach notifications in Europe | 443 per day (+22% YoY) | DLA Piper, GDPR Survey January 2026 |
Context: the drop in victim notices is a composition effect, not a safety gain — the 2024 total was inflated by billion-record incidents that did not recur in 2025. Sources: ITRC 2025 Annual Data Breach Report; DLA Piper GDPR Fines and Data Breach Survey.
3. Privacy Regulation and Enforcement
Enforcement is globalizing while the United States fragments. Europe’s cumulative GDPR penalties keep compounding and the annual total held near record levels, concentrated in a handful of Big Tech cases. Insufficient legal basis for processing accounted for 90% of the 2025 GDPR fine value — about 1.03 billion euros (Surfshark, GDPR Fines 2025). In the U.S., a growing patchwork of state laws now does the work no federal statute does; see AI regulation statistics for 2026 for the adjacent governance wave.
| Metric | Value | Source |
|---|---|---|
| GDPR fines issued in 2025 | ~1.15 billion euros across 330+ fines | CMS / Surfshark, GDPR Enforcement Tracker 2025 |
| Cumulative GDPR fines since 2018 | ~6.11 billion euros | CMS, GDPR Enforcement Tracker Report 2025 |
| Largest 2025 GDPR fine (TikTok) | 530 million euros | CMS, GDPR Enforcement Tracker Report 2025 |
| Share of 2025 fine value from insufficient legal basis | 90% (~1.03 billion euros) | Surfshark, GDPR Fines 2025 |
| Most active authority by fine count (Spain, cumulative) | 1,048 fines | CMS, GDPR Enforcement Tracker Report 2025 |
| U.S. states with comprehensive privacy laws entering 2026 | 20 (expanding toward 24) | MultiState, 2026 |
| FTC COPPA penalty vs Genshin Impact’s developer | $20 million | FTC / Future of Privacy Forum, 2025 |
Divergence note: cumulative GDPR totals vary by tracker — CMS reports roughly 6.11 billion euros, while some analyses citing broader datasets put the figure near 7.1 billion euros. Sources: CMS GDPR Enforcement Tracker Report; MultiState, State Privacy Laws in Effect 2026.
4. Voice, Biometric, and Smart-Device Privacy
Biometric identifiers carry the highest stakes, and the enforcement numbers show it — the single largest state privacy recovery on record turned on voiceprints and facial geometry. Texas secured a 1.375 billion dollar settlement from Google over biometric identifiers including voiceprints and facial geometry captured without clear consent (Texas Attorney General, May 2025), dwarfing the previous high of 93 million dollars for a single state. The device layer is moving the opposite way: in March 2025 Amazon removed the on-device Do Not Send Voice Recordings option on Echo hardware, sending audio to its cloud (Washington Post, 2025). Consumers, surveys repeatedly show, prefer local processing — consent-based tools that run voice capture on-device sit on the other side of that trade-off. For the authentication angle, see voice biometrics statistics for 2026.
| Metric | Value | Source |
|---|---|---|
| Texas settlement with Google over voiceprints and facial geometry | $1.375 billion | Texas Attorney General, May 2025 |
| Clearview AI biometric settlement (23% equity stake) | ~$51.75 million | Regulatory Oversight / Troutman, 2025 |
| New BIPA class actions filed in 2025 | ~100-150 (down from 300+ per year) | Privacy World / National Law Review, 2025 |
| U.S. adults living in a smart-speaker household | 62% (up from 36% in 2020) | ElectroIQ / Statista, 2025 |
| Alexa requests reviewed by human annotators | Less than 1% | Amazon, 2025 |
| Clearview AI facial-image database | 50+ billion images | Biometric Update, 2024 |
| Americans with faces stored in a facial-recognition database | ~117 million (about half of adults) | U.S. GAO, 2021 (most recent available) |
| Projected U.S. voice-assistant users, 2026 | 157.1 million | Business of Apps / Statista, 2025 |
Outlier: BIPA filings roughly halved in 2025 after a 2024 amendment limited plaintiffs to a single recovery per person for repeated uses of the same biometric. Sources: Texas Attorney General, $1.375B Google settlement; Washington Post, Alexa voice recordings change.
5. Tracking, Cookies, and the Data-Broker Economy
Collection is now an industry with its own market cap, and consumer opt-outs are surging faster than firms honor them. 69% of businesses continued to deploy tracking cookies after users set opt-out preferences (DataGrail, 2025 Data Privacy Trends Report), a consent-violation rate that helps explain why deletion requests dominate the queue. Platform-level friction bites hardest: Apple’s App Tracking Transparency prompt cut the share of trackable U.S. iOS users from 72.6% to 17.9%.
| Metric | Value | Source |
|---|---|---|
| Data brokers operating globally (estimate) | Up to 5,000 | Grand View Research, 2025 |
| Global data broker market value, 2025 | ~$290-342 billion (estimates vary) | Grand View Research / Fortune Business Insights, 2025 |
| Brokers covered by California’s DROP deletion platform | 600+ registered in-state | California Privacy Protection Agency, 2026 |
| Year-over-year increase in consumer data-subject requests | +43% | DataGrail, 2025 Data Privacy Trends Report |
| Share of privacy requests that are deletion requests | 82% | DataGrail, 2025 Data Privacy Trends Report |
| Businesses still tracking users after opt-out | 69% | DataGrail, 2025 Data Privacy Trends Report |
| Apple App Tracking Transparency opt-in rate | ~35% | Business of Apps, 2025 |
| U.S. iOS users trackable after ATT | 17.9% (from 72.6% pre-ATT) | AppleMagazine, 2025 |
Divergence note: data broker market sizing is not standardized — 2025 estimates range from roughly 290 billion to 342 billion dollars across research firms, reflecting different definitions of what counts as brokered data. Sources: DataGrail 2025 Data Privacy Trends Report; California Privacy Protection Agency, Data Broker Registry and DROP.
6. Consumer Defenses and the Privacy-Tech Market
Protective tooling has gone mainstream and then plateaued, while the compliance market it feeds keeps growing on regulatory pressure. VPN adoption has settled into a mature band, and U.S. usage actually retreated from its 2023 peak. On the business side the ROI case is now settled: 96% of organizations report that the returns on privacy investment outweigh the costs (Cisco, 2025 Data Privacy Benchmark Study). For the broader threat backdrop driving that spend, see cybersecurity statistics for 2026.
| Metric | Value | Source |
|---|---|---|
| Internet users worldwide using a VPN | ~23% (1.7-1.8 billion people) | Security.org, 2025 VPN Consumer Report |
| U.S. VPN usage | 32% (down from 46% in 2023) | Security.org, 2025 VPN Consumer Report |
| Non-essential cookie rejection rate (compliant banners) | ~60% of visits | etracker, 2025 Cookie Consent Benchmarks |
| Annual DSR compliance cost per 5M website visitors | $1.26 million (+43% vs 2023) | DataGrail, 2025 Data Privacy Trends Report |
| Privacy management software market, 2025 to 2026 | $5.07B to $6.24B | Mordor Intelligence, 2025 |
| Organizations saying privacy ROI outweighs cost | 96% | Cisco, 2025 Data Privacy Benchmark Study |
| Privacy professionals who took on AI-governance duties | 68% | IAPP, Salary and Jobs Report 2025-26 |
Context: privacy management software estimates diverge widely by scope — Mordor Intelligence models the 2025 market near 5.07 billion dollars, while broader data-privacy software definitions run several billion higher. Sources: Security.org, 2025 VPN Consumer Report; Mordor Intelligence, Privacy Management Software Market.
Summary: Digital Privacy by the Numbers
| Metric | Value | Source |
|---|---|---|
| Americans concerned about corporate data use | 81% | Pew Research Center, 2023 |
| Consumers 25-34 who switched providers over data practices | 49% | Cisco, 2025 Data Privacy Benchmark Study |
| Global consumers aware of their country’s privacy law | 53% | Cisco, 2025 Data Privacy Benchmark Study |
| U.S. data compromises, 2025 | 3,322 (record) | ITRC, 2025 Annual Data Breach Report |
| Five-year rise in annual U.S. compromises | +79% | ITRC, 2025 Annual Data Breach Report |
| Europe data breach notifications per day | 443 (+22% YoY) | DLA Piper, GDPR Survey January 2026 |
| GDPR fines issued in 2025 | ~1.15 billion euros | CMS, GDPR Enforcement Tracker Report 2025 |
| Cumulative GDPR fines since 2018 | ~6.11 billion euros | CMS, GDPR Enforcement Tracker Report 2025 |
| U.S. states with comprehensive privacy laws entering 2026 | 20 (expanding toward 24) | MultiState, 2026 |
| Texas settlement with Google over voiceprints and facial geometry | $1.375 billion | Texas Attorney General, May 2025 |
| U.S. adults in a smart-speaker household | 62% | ElectroIQ / Statista, 2025 |
| Clearview AI facial-image database | 50+ billion images | Biometric Update, 2024 |
| Data brokers operating globally | Up to 5,000 | Grand View Research, 2025 |
| Consumer privacy requests that are deletions | 82% | DataGrail, 2025 Data Privacy Trends Report |
| Businesses still tracking users after opt-out | 69% | DataGrail, 2025 Data Privacy Trends Report |
| Internet users worldwide using a VPN | ~23% | Security.org, 2025 VPN Consumer Report |
| Organizations saying privacy ROI outweighs cost | 96% | Cisco, 2025 Data Privacy Benchmark Study |
Methodology and Sources
Data was gathered by aggregating primary reports, regulator and government disclosures, court and enforcement records, and named industry trackers published mainly in 2025 and the first half of 2026, cross-referencing market and adoption figures across two or more sources and flagging divergences where they exist.
- Pew Research Center — How Americans View Data Privacy, 2023 (link) — most recent national U.S. benchmark
- Cisco — 2025 Data Privacy Benchmark Study, 2025 (link)
- Identity Theft Resource Center — 2025 Annual Data Breach Report, 2026 (link)
- DLA Piper — GDPR Fines and Data Breach Survey, January 2026 (link)
- CMS — GDPR Enforcement Tracker Report, 2025 (link)
- Surfshark Research — GDPR Fines 2025, 2026
- MultiState — State Privacy Laws in Effect 2026, 2026 (link)
- Business Software Alliance and Byte Back — U.S. State Privacy Law Landscape, 2026
- Federal Trade Commission and Future of Privacy Forum — U.S. Privacy Enforcement in 2025, 2026
- Texas Attorney General — Google $1.375 Billion Data Privacy Settlement, May 2025 (link)
- Privacy World and National Law Review — 2025 Year in Review: Biometric Privacy Litigation, 2025
- Regulatory Oversight / Troutman — Clearview AI Settlement Analysis, 2025
- Washington Post — Amazon Alexa Voice Recordings Change, 2025 (link)
- ElectroIQ and Statista — Smart Speaker and Voice Assistant Statistics, 2025
- Business of Apps and AppleMagazine — App Tracking Transparency Opt-In Rates, 2025 (link)
- U.S. Government Accountability Office — Facial Recognition Technology, 2021 (most recent available)
- Biometric Update — Clearview AI Database Coverage, 2024
- DataGrail — 2025 Data Privacy Trends Report, 2025 (link)
- California Privacy Protection Agency — Data Broker Registry and DROP, 2026 (link)
- Grand View Research and Fortune Business Insights — Data Broker Market, 2025
- etracker — Cookie Consent Benchmarks, 2025 (link)
- Security.org — 2025 VPN Consumer Report, 2025 (link)
- Mordor Intelligence — Privacy Management Software Market, 2025 (link)
- IAPP — Salary and Jobs Report 2025-26 and Organizational Digital Governance Report 2025
Data watch: several cited sources publish on an annual cycle and will refresh soon — Pew Research Center is overdue for a new national privacy read after its 2023 edition; the ITRC 2026 Annual Data Breach Report is due in January 2027; DLA Piper’s next GDPR Fines and Data Breach Survey lands in January 2027; Cisco’s 2026 Data and Privacy Benchmark Study and the CMS GDPR Enforcement Tracker Report both update annually; and DataGrail’s next Data Privacy Trends Report is expected mid-2026.
Last updated: July 10, 2026. We review and update this page quarterly as new data is published.