Data Broker and People-Search Statistics (2026)

How many data brokers are registered, how many people have asked to be deleted, how well opt-outs work and what regulators have done, using regulator releases and independent testing.

By Siddharth ShankarUpdated October 12, 202628 statistics · 10 sourcesCite this page

Key takeaways

• California’s Delete Request and Opt-out Platform (DROP) passed 300,000 sign-ups within about five months of its January 1, 2026 launch (CalPrivacy).
• The registered broker list keeps growing: 459 in June 2025, more than 575 in February 2026 and 581 in June 2026 (IAPP; CalPrivacy). CalPrivacy’s DROP page now says “over 600”.
• Enforcement has started. CalPrivacy’s announced actions include a $45,000 fine (January 2026) and a $116,490 fine (August 2026), both against data brokers.
• Removal is slow and uneven. In a four-month Consumer Reports test, the best-scoring service with published results removed 68% of profiles and the lowest removed 4%, and no participant was fully cleared (Consumer Reports).
• Public attitudes line up with the regulation: 73% of US adults say they have little or no control over data companies collect (Pew).

California DROP: sign-ups and brokers

California’s DROP lets residents send one deletion request to over 600 registered data brokers (CalPrivacy). CalPrivacy, the state privacy agency, runs the system, called DROP. Brokers must register each year and, from August 1, 2026, must check DROP at least every 45 days to process requests.

The registry figures are snapshots from different publications, so they are not a single time series. The IAPP article reports 242,000 “DROP requests” and CalPrivacy’s later release reports 300,000 “sign-ups”; we show each in the source’s own words.

Enforcement

The August 2026 decision was described by law firm Orrick as the first CCPA decision against a data broker and the first under both the CCPA and the Delete Act. It alleged that the broker missed the January 31, 2025 registration deadline and required consumers to give a mailing address and part of a Social Security number to opt out. At the federal level, the FTC finalized an order on January 14, 2025 that bans Gravy Analytics and Venntel from selling sensitive location data except for limited national security and law enforcement purposes (FTC).

Do opt-outs work? The Consumer Reports test

Consumer Reports ran the most detailed independent test we found. It tracked 32 volunteers over four months across 13 people-search sites and 7 paid removal services priced from $19.99 to $249 a year. Its results are from 2024, so services may have changed, but the gap between manual and paid removal is the headline.

Consumer Reports found CheckPeople, PublicDataUSA and Intelius hardest to remove from, and PeopleFinders, ClustrMaps and ThatsThem the most compliant. If you are weighing a service, our guides on whether removal services are worth it and how to opt out yourself go into the trade-offs.

Large data broker and background-check leaks

Have I Been Pwned lists two large breaches at data aggregators.

HIBP describes National Public Data as a background check service and flags the breach as unverified. It describes DemandScience’s data as mostly business contact information from public sources.

What the public says

Methodology and limitations

Every figure on this page comes from the organization that published it, such as a regulator, a government agency or the original report. We read the source page or document directly, and we record the period each figure covers. When a number could not be confirmed against a primary source, we left it out. Rows marked “Our calculation” are simple arithmetic on published figures, and the inputs are named in the same row.

• DROP participation counts are published by the agency and the press at different dates and with different labels, so they are shown as separate snapshots.
• The Consumer Reports test is from 2024, covered 32 volunteers and does not represent every service or site. We have not seen a comparable independent test with newer results.
• We did not find an authoritative count of people-search sites or of the share of adults listed on them, so we do not give one.
• HIBP counts email addresses in a breach, which are not unique people.

Counts of reports, complaints and notifications measure what was reported or notified, not everything that happened. Currency symbols follow the source. Where an agency does not name its currency, we show the symbol the source uses (for example, C$ for Canada and A$ for Australia are our labels). Figures from different countries use different definitions and should not be added together. Spot an error? Tell us and include the source link; we correct verified errors and note the date at the top of the page.