Digital Footprint Statistics (2026)

How many people are online, how much of their lives sits on platforms, and how often that data gets exposed. Every figure comes from a regulator, a statistics agency or an original study.

By Siddharth ShankarUpdated October 12, 202642 statistics · 12 sourcesCite this page

Key takeaways

• The audience is almost everyone. DataReportal counts 6.04 billion internet users (73.2% of the world population) in October 2025, and Pew finds 96% of US adults online.
• The footprint is spread across many services. In the US, 84% of adults use YouTube and 71% use Facebook (Pew, 2025). UK adults spend an average of 4 hours 30 minutes a day online (Ofcom).
• Exposure is measured in billions of records. Have I Been Pwned lists 1,043 breaches and 17.8 billion breached accounts (HIBP). Accounts are not people, because one person can appear many times.
• The US recorded 3,322 data compromises in 2025, the highest annual count the Identity Theft Resource Center has reported (ITRC).
• Breach experience is common in surveys: 56% of UK adults say they have experienced a data breach (ICO), 43% of Canadians say they have been impacted by a privacy breach (OPC) and 38% of Australians were told in the past 12 months that their data was in one (OAIC). The questions differ, so the figures are not directly comparable.

How many people are online

A digital footprint starts with being online, so the first question is how many people are. The global figures below come from DataReportal, which compiles data from platform advertising tools, telecom operators and national surveys. The national figures come from surveys run by Pew Research Center in the US and by Ofcom in the UK.

DataReportal says part of the 294 million increase in internet users reflects revised figures for India, so the year-on-year change overstates real growth. Social media “user identities” are accounts that platforms report, and they do not equal unique people.

Where the footprint lives: platforms

Each platform a person uses holds a different slice of their data. The Pew figures below show how widely US adults use the main services, based on a 2025 survey of 5,022 adults. The Ofcom figures show monthly reach for the biggest services among UK online adults.

Reach and use are different measures: Ofcom reports monthly reach among UK online adults, while Pew reports the share of US adults who say they use a platform. The two sets are shown together for context and are not directly comparable.

How often the footprint is exposed

The sources below measure exposure in different ways: records in breached databases, breaches reported by organizations, and what people tell survey interviewers. Treat them as three views of the same problem rather than one number.

The BJS figure comes from the most recent Identity Theft Supplement it has published, covering 2021. Survey wording differs by country: the ICO asks whether people have experienced a breach in the past 12 months or before, the Australian question asks whether people were told in the last 12 months, and the Canadian question asks whether people have been impacted. Do not rank countries using these percentages.

The ITRC series shows why raw notice counts need care. The number of victim notices fell from about 1.37 billion in 2024 to about 279 million in 2025, while the number of reported compromises rose to a record. A drop in notices reflects which breaches happened to be large in each year; it does not mean fewer people are exposed overall, and it does not show that fewer organizations were breached.

What the numbers mean for an ordinary person

These statistics describe populations, not any one person. They show that exposure is common and that many breach notices leave out basic facts: in 70% of 2025 US breach notices the cause of the incident was not stated (ITRC). Our guides on the digital footprint basics and on how to check your own footprint turn these points into steps.

Methodology and limitations

Every figure on this page comes from the organization that published it, such as a regulator, a government agency or the original report. We read the source page or document directly, and we record the period each figure covers. When a number could not be confirmed against a primary source, we left it out. Rows marked “Our calculation” are simple arithmetic on published figures, and the inputs are named in the same row.

• DataReportal compiles third-party data, including modelled estimates, and revises prior-year figures. Its totals are best read as estimates.
• Pew and Ofcom survey different populations and define use differently, so US and UK platform shares are shown separately.
• Have I Been Pwned counts accounts in the breaches it has loaded. It does not hold every breach, and one person can appear in many records.
• The BJS identity theft figures cover 2021, which the agency lists as the latest year of data available from its Identity Theft Supplement.

Counts of reports, complaints and notifications measure what was reported or notified, not everything that happened. Currency symbols follow the source. Where an agency does not name its currency, we show the symbol the source uses (for example, C$ for Canada and A$ for Australia are our labels). Figures from different countries use different definitions and should not be added together. Spot an error? Tell us and include the source link; we correct verified errors and note the date at the top of the page.