Data Brokers in 2026: What 625 Companies Told California

How many data brokers are there?

Nobody knows the full number. Four states make data brokers register (California, Vermont, Texas and Oregon), and their registries are the best count there is.

California: 625 brokers in 2026, up 15% from 543 in both 2024 and 2025, according to the California Privacy Protection Agency (CalPrivacy). About 130 of them were not on the 2025 list. A business must register by January 31 if it acted as a data broker in the year before, so the 2026 list describes 2025.

Oregon: 395 brokers on the state’s Division of Financial Regulation list, downloaded November 8, 2026. Oregon’s list doesn’t say which registrations have lapsed. We found 350 of them in California’s registry too.

Vermont and Texas: both registry sites could not be reached when we checked on November 8, 2026, so they are left out of this edition.

Registration is patchy. In April 2025, Privacy Rights Clearinghouse and the EFF found 291 brokers that had registered in another state but not in California, and 524 missing from Texas’s list.

Most registered brokers are American: 583 of the 625 give a US address. California hosts the most (128), ahead of New York (87), Florida (49), Texas (33), Illinois (32) and Massachusetts (31). The other 42 are based abroad, most often in the UK (12) and Canada (10).

What data brokers collect

The registry asks ten yes-or-no questions about sensitive data, seven of them new this year. The most common yes is precise geolocation: 116 brokers collect it, nearly one in five. A precise location history shows where you sleep, work, pray and see a doctor, so it’s the data point that turns a marketing profile into a map of your life.

Location collection dipped and came back. In 2024, 104 of 543 brokers said they collected precise geolocation; in 2025 it was 88 of 543; in 2026, 116 of 625. Brokers collecting minors’ data went the other way, from 32 in 2024 to 18.

A few names stand out on lists where you might not expect them. Marriott International, General Motors and Cox Automotive all told California they collect citizenship or immigration data. Clearview AI, which built its business on scraped face photos, is one of 12 brokers collecting biometrics. Eight collect reproductive health care data, among them HealthWise Data, Epsilon and Choreograph.

A yes says nothing about scale. The registry can’t tell you whether a broker holds one record or a hundred million, only that the category is there.

Who data brokers sell to

Five questions are new in 2026, added by California’s SB 361 (statute text): whether the broker sold or shared consumers’ data in the past year with the federal government, other state governments, law enforcement (except when a subpoena or court order required it), a developer of generative AI, or a “foreign actor”.

The federal government and other states are the most common buyers, at 56 brokers each. Twenty-eight brokers sold or shared with all three government groups.

Location data and the government. Fourteen brokers collect precise geolocation and sold or shared data with the federal government. They include Venntel, Veraset, Unacast, Fog Data Science, Babel Street, Pen-Link and LexisNexis Risk Solutions. Eight of the 14 also supplied law enforcement without a subpoena or court order. That matters because buying data is one way agencies can get location histories without the warrant the Supreme Court requires when they ask a phone company for them (Carpenter v. United States, 2018).

Venntel is a familiar name. In January 2025 the FTC barred it and its parent Gravy Analytics from selling sensitive location data, “except in limited circumstances involving national security or law enforcement”. In its 2026 registration, Venntel says it sold or shared data with the federal government in the past year.

AI developers. Thirty-two brokers sold or shared data with a developer of a generative AI system. Most are business-data firms (Crunchbase, PitchBook, Dun & Bradstreet, Moody’s), but the list also includes units of all three credit bureaus (Experian Marketing Solutions, Equifax Information Services, TransUnion Risk and Alternative Data Solutions) and the health data company Komodo Health.

Foreign actors. Twenty-six brokers answered yes, including HubSpot, Moody’s and Epsilon. The law’s definition is narrow: the government of, or a company based in, North Korea, China, Russia or Iran. A yes is therefore either a striking admission or a wrong answer. CalPrivacy has already fined two brokers, Clarivate and DR/Decision Resources, $10,800 each for wrongly answering yes. Their entries have been corrected; the 26 yes answers above are the registry as it stands.

Two states, two answers

Oregon asks some of the same questions, so we compared the 350 brokers registered in both states. We kept only Oregon filings updated in 2025 or 2026 and checked every pair by hand.

Twenty-two companies gave the two states conflicting answers about whether they collect government ID numbers, such as Social Security numbers, or biometrics.

There are innocent explanations. The questions are not worded the same way, the filings cover slightly different periods, and a company can change what it collects. But the answers can’t both be right, and California treats a wrong registration as a registration that wasn’t filed: its September 2026 enforcement advisory warns that incorrect information costs $200 for every day it stays in the registry.

What happens when you ask a broker to delete your data

Brokers must report how many privacy requests they received and how they handled them. The latest figures in the registry cover 2024, the year before DROP.

Deletion requests: 58.0 million. Brokers say they complied in full with 56,977,552 and in part with 230,346, and denied 890,655 (1.5%). Requests to opt out of the sale or sharing of data were even more common, at 98.8 million, of which 1.7 million were denied.

The total is lopsided. One location data company, Cuebiq, received 26.3 million deletion requests, 45% of all of them. The ten busiest brokers account for 75%. At the other end, 180 brokers reported no deletion requests at all.

Most brokers say they answer fast: among those that received deletion requests, the middle broker’s median response time was 5.5 days. Eight brokers took longer on average than the 45 days the CCPA allows before an extension. The slowest, TrueData Solutions, averaged 167 days.

A denial isn’t automatically a violation. Brokers may refuse when they can’t verify who is asking, when the person doesn’t live in California, or when a legal exemption applies. Brokers must publish the reasons for their denials on their own websites; the registry only has the totals. Still, a handful of brokers refused almost everyone.

DROP: one request to every broker

Since January 1, 2026, Californians can send a single deletion request to every registered broker through DROP, the Delete Request and Opt-out Platform. More than 300,000 people had signed up by June 2, and more than 500,000 by August 25.

Since August 1, 2026, brokers must check DROP at least every 45 days and delete matching records. CalPrivacy says brokers have already reported deleting “tens of millions of records”. The first full figures, DROP requests included, are due on brokers’ websites by July 1, 2027. From 2028, brokers will also need an independent audit every three years.

Enforcement has been steady, if small. CalPrivacy’s board has issued 17 Delete Act decisions since November 2024, with fines totalling $731,090 (one case also covered CCPA violations).

Most fines are for registering late, at $200 a day. 2026 also brought fines for wrong answers in the registration itself (Clarivate, DR/Decision Resources and WINR Data) and the first case under both the Delete Act and the CCPA (LocateSmarter, $116,490). At $200 a day, a broker that registers a full year late owes $73,000. For a company selling profiles of millions of people, that is a cost of doing business, not a deterrent; the deletion duty is what bites.

If you live in California, DROP is the fastest way to reach every registered broker at once. Everyone else still has to opt out broker by broker; our data broker removal guide walks through the largest ones.

Methodology, sources and how to cite this page

Sources. California’s data broker registry files for 2024, 2025 and 2026 (CalPrivacy, downloaded November 8, 2026; the 2026 file was last updated October 30, 2026). Oregon’s data broker registry files (Division of Financial Regulation, downloaded November 8, 2026). CalPrivacy board decisions and press releases. The Delete Act as in force on January 1, 2026 (Cal. Civ. Code §§ 1798.99.80–1798.99.89).

Self-reported data. Every yes, no and request count is the broker’s own answer. We did not correct answers we thought were wrong; the foreign-actor question in particular may include mistakes (chapter 3).

Request figures cover calendar year 2024. Under Civ. Code § 1798.99.85, brokers compile the previous year’s figures by July 1 and report them in the next registration.

California vs. Oregon. We matched brokers by name, trade name or website, then checked each conflicting pair by hand. We dropped matches where only a shared website linked a subsidiary to its parent, and Oregon entries last updated in 2024.

Download: our dataset (CSV) with all 625 California brokers, their answers to the 15 yes-or-no questions, their 2024 request figures and whether they appear on Oregon’s list. Free to use with credit to PrivacyAffairs.