Data Brokers
How Many Data Brokers Have Your Information?
The short version
There is no federal registry, so nobody can give you an exact number. The firmest floor comes from state registries: California listed more than 575 registered data brokers as of February 2026, up from 459 in June 2025. For an individual, the practical answer is dozens of consumer people-search sites plus an unknowable number of business-to-business brokers behind them. You cannot count them all, but you can find the ones publishing a profile of you - search your own name, check your state registry, and run a scan - and those are the ones you can actually remove yourself from.
The honest answer: nobody knows
If you have seen a confident figure for the total number of data brokers, treat it with suspicion. The United States has no federal registration requirement, no central list, and no agreed definition of where "data broker" ends and "marketing company" begins. Any single number is either an estimate or a count of one particular registry.
That is not a reason to shrug. It is a reason to use the counts that are real and verifiable, and then to focus on the subset that affects you directly. Both are achievable in an afternoon.
What the state registries actually show
Four states require data brokers to register: California, Vermont, Texas and Oregon. Their registries are the only hard numbers in this field, and California's is the largest.
Figures reported from the California Privacy Protection Agency's February 2026 board meeting put registered brokers at more than 575, up from 459 in June 2025. CalPrivacy Executive Director Tom Kemp described the scale plainly: "No other state or even past data broker registries here in California have as many registered data brokers." Failing to register carries a penalty of $200 per day.
| Registry | What it tells you |
|---|---|
| California (CPPA) | More than 575 registered brokers as of February 2026, up from 459 in June 2025. The largest US registry. |
| Vermont (Secretary of State) | Several hundred registered brokers; the oldest of the four registries. |
| Texas (Secretary of State) | A searchable register of brokers meeting the state's threshold. |
| Oregon (Dept. of Consumer and Business Services) | Registration required, with the added right to request the list of third parties that received your data. |
California figures: CPPA data presented at its February 2026 board meeting, as reported by the IAPP (linked in Sources). Vermont, Texas and Oregon operate registries under their own statutes; consult each registry directly for a current count, as the figures move with every annual filing window.
One caution if you go looking: the CPPA's live registry page currently renders a broker count of zero, which is a display artifact rather than a real figure. Use the reported numbers above rather than that page's counter.
Why the registries undercount
A registry counts companies that registered. That leaves out several categories, and the omissions are not small.
- Brokers that simply did not register. Registration duties are self-executing only in theory; regulators have to find non-filers, which is why California has run enforcement sweeps.
- Brokers outside those four states' definitions. Each statute sets its own thresholds and carve-outs, so a company can be a data broker in ordinary language and out of scope legally.
- Companies with a direct relationship with you. Most definitions exclude businesses you dealt with yourself, even when they sell or share what they collected.
- Data covered by other regimes. Credit reporting, financial and medical data sit under the FCRA, GLBA and HIPAA respectively, and those holders are typically excluded from broker registries.
- The same data under many brands. One operator can run a network of people-search sites, so a single registration can sit behind several consumer-facing sites.
How many have your data?
This is the more useful question, and it has a more useful answer. For a typical American adult with a rental or property history, a phone number and a voter registration, expect to be listed on dozens of consumer-facing people-search sites. Behind them sit business-to-business brokers you will never see, selling audience segments and identity graphs to advertisers and risk-scoring firms.
The consumer sites are the ones that matter for your day-to-day safety, because they are the ones a stranger can search. That is also where you have real leverage: each one is legally obliged to offer a free opt-out, and most take under ten minutes.
Three ways to find out which brokers list you
Work through these in order. The first two are free and take minutes; the third saves you doing twenty searches by hand.
- Search your own name. Put your full name in quotes with your city, then again with your state, in more than one search engine. The people-search sites that rank on the first two pages are your priority list, because they are what anyone looking for you will find.
- Check your state's registry. If you are in California, Vermont, Texas or Oregon, the registry tells you which companies have declared themselves brokers. Oregon goes furthest by letting you request the specific third parties that received your data.
- Run a scan. Our free exposure scan checks your email against known breach records, looks for public profiles tied to a username, and lists the major people-search sites likely to hold a record for a US adult, with a direct link to each opt-out guide. Nothing you scan is stored.
Be realistic about what any tool can promise here. No scanner can query every broker's private database, and anything claiming a precise count of "brokers holding your data" is estimating. What a scan genuinely does is turn a vague worry into a specific, ordered list of removals.
What each broker typically holds
The contents are more consistent than the number of companies. A standard people-search profile assembles your full name, age or date of birth, current and past addresses, phone numbers, email addresses, and a list of relatives and associates. Many add court and property records and links to social profiles.
None of it was hacked. It is public records, purchased commercial data and publicly visible web sources, joined together. The harm is in the joining: individually scattered documents that were technically public become one indexed dossier that takes a stranger ten seconds to pull up.
The counting trap, and what to do instead
It is tempting to try to enumerate every broker before acting. Do not. The list is unknowable, partly hidden and constantly changing, and the effort produces no protection, whereas a finite, ordered task list does.
A pragmatic sequence: clear the sites that rank for your name, then work down the opt-out guides by difficulty, then set a reminder to re-check in three months, because listings rebuild as brokers re-ingest public records. Our guide to removing yourself from data brokers covers the mechanics, and what people-search sites are explains where the data originates.
The one shortcut, if you live in California
California residents can skip the site-by-site grind for registered brokers. The state's DROP platform takes a single deletion request and applies it to every data broker registered with the CPPA - more than 575 companies - and it is free and legally binding rather than best-effort. More than 242,000 Californians had filed a request as of the February 2026 board meeting, about 18,000 of them within the platform's first 48 hours.
Consumers have been able to file since January 1, 2026, and registered brokers must begin processing those requests from August 1, 2026, checking the platform at least every 45 days thereafter. Our California DROP guide walks through filing, and the state-by-state guide covers what applies if you live elsewhere.
What a realistic goal looks like
You are not going to reach zero, and framing it that way guarantees disappointment. Brokers rebuild from public records that will keep existing, and some operate beyond the reach of any registry.
The achievable goal is to make yourself hard to look up casually. Clearing the sites that rank for your name moves you from "one free search" to "real effort", which deters almost everyone who might idly search for you. That is a genuine improvement in safety, and it does not require knowing the total number of data brokers in America.
Find out which ones list you
Run a free exposure scan to see which people-search sites are likely to hold a record for you, plus any breaches tied to your email - no account, nothing stored.
Frequently asked questions
How many data brokers are there?
Nobody knows the true total, because there is no federal registry. The best available floor comes from state registries: California listed more than 575 registered data brokers as of February 2026, up from 459 in June 2025, and Vermont's registry has listed several hundred. Those counts only include companies that registered in a state that requires it, so the real number is higher.
How many data brokers have my personal information?
For a typical US adult the realistic answer is dozens of consumer-facing people-search sites and an unknown number of business-to-business brokers behind them. You cannot get an exact figure, but you can find the ones that publish a profile of you, which are the ones you can actually do something about.
How do I find out which data brokers have my data?
Three practical steps. Search your own name plus your city in a search engine to see which people-search sites rank. Check your state's data broker registry if it has one, since California, Vermont, Texas and Oregon all publish lists. And run a scan that checks the major people-search sites and known breaches at once.
Is there a list of all data brokers?
There is no single complete list. The closest things are the state registries maintained by California, Vermont, Texas and Oregon, plus catalogues published by privacy organisations. Each is partial: registries only capture companies that comply with a registration duty, and no registry covers brokers operating outside those four states' rules.
Why are there so many data brokers?
Because assembling public records is cheap, legal in the United States, and profitable. Property deeds, voter files, court filings and licence records are available in bulk, and the same underlying data gets bought, enriched and resold repeatedly, so one record about you can end up on many sites under different brands.
Do I have to opt out of every data broker individually?
Almost always yes, because each company runs its own opt-out and there is no universal off switch. The one real exception is California's DROP platform, which sends a single binding deletion request to every data broker registered with the state.
Which data brokers should I remove myself from first?
Start with the consumer people-search sites that rank for your name, because those are what an ex, a stranger or a scammer will actually find. The free opt-outs on the biggest of them take five to ten minutes each, and clearing the ones that show up on the first page of results removes most of your practical exposure.
Does removing myself from one broker remove me from the others?
No. Each site keeps its own database and honours only its own opt-out, so removing yourself from one has no effect on the rest. Worse, several brokers share upstream data suppliers, so a site you cleared can be repopulated from the same source that feeds the sites you have not.
Sources: California Privacy Protection Agency figures presented at its February 2026 board meeting, as reported by the IAPP (registered broker counts, DROP request volumes, the $200-per-day registration penalty and the 45-day access requirement); the CPPA's data broker registry and DROP information for data brokers (January 1, 2026 consumer launch and August 1, 2026 broker processing date). Vermont, Texas and Oregon registry details reflect each state's own registration statute.