Data Broker & Privacy Statistics (2026)

Identity-theft reports the FTC received in 2024, a 9.5% increase over the 1,036,855 reports in 2023.

Consumers reported losing more than $12.5 billion to fraud in 2024, a 25% increase over the prior year, according to the FTC.

Share of fraud reporters who said they lost money in 2024, up from 27% in 2023. This is a reported-loss rate among people who reported fraud, not the share of all consumers.

Traditional US identity-fraud losses in 2025, according to the Javelin Strategy 2026 Identity Fraud Study.

Number of account takeover victims in the US in 2025, representing an 18% increase year-over-year, per Javelin's 2026 Study.

Total losses reported to the FBI's Internet Crime Complaint Center (IC3) in 2025 across 1,008,597 complaints, a 26% year-over-year increase and a new record, beating the prior high of $16.6 billion set in 2024.

Adjusted losses tied to 22,364 complaints containing a reference to artificial intelligence in 2025 exceeded $893 million, according to the FBI IC3.

Losses reported by victims over age 60 in 2025, up 59% from 2024; complaints in this age group rose 37%, per the FBI IC3.

Share of surveyed U.S. adults who said they had submitted a robocall complaint to a state attorney general, the FTC, or the Do Not Call Registry in the prior 12 months, according to TNS survey data.

Share of U.S. residents age 16 or older who experienced identity theft during the prior 12 months in 2021, according to the Bureau of Justice Statistics; this is not a lifetime estimate.

Estimated global data-broker market size of $315.66 billion in 2026, growing from $294.27 billion in 2025 to $448.32 billion by 2031 at a 7.27% CAGR.

California residents may use DROP to submit one deletion request to all active data brokers within the platform’s current scope; the active list and eligibility can change, so check the live CPPA guidance.

Texas requires data brokers to register with the Secretary of State under Business & Commerce Code Chapter 510; the filing officer states that registration does not imply approval or endorsement.

Oregon publishes a data broker registry under its state registration requirements; the current list and qualifying exemptions should be checked before relying on a count.

Mandatory processing start date under the California Delete Act (SB 362): data brokers must access DROP at least once every 45 days and process deletion requests within the required timelines.

California's DROP (Delete Request and Opt-out Platform) lets residents send a single deletion request to all active data brokers, unless the consumer narrows the request; brokers are legally required to access DROP at least once every 45 days.

Annual registration fee for a data broker completing California registration in 2026, plus an associated third-party electronic-payment processing fee.

Estimated number of data-broker companies operating worldwide, far more than any single state registry captures.

Connecticut’s data privacy law generally requires a covered controller to respond to a consumer request within 45 days, subject to an allowed extension and scope rules; this is not a universal deadline for every state.

Vermont statutory requirement mandating annual registration and privacy disclosures for commercial data brokers operating in the state.

Texas Secretary of State filing and renewal fee for a data-broker registration under Business & Commerce Code Chapter 510.

Data compromises in the US in 2024, as reported retrospectively in the Identity Theft Resource Center’s 2025 Annual Data Breach Report.

Record number of data compromises in the US in 2025, marking an all-time high, according to the Identity Theft Resource Center.

Publicly reported data-breach notifications compiled in the Privacy Rights Clearinghouse chronology since 2005; the database uses government-source notifications and notes that reporting and duplication practices vary.

Global average cost of a data breach in IBM’s 2026 study, based on breaches experienced by 602 organizations from March 2025 through February 2026; the figure was 12% higher than the prior year and a record high in the report series.

People whose data was exposed in Equifax’s 2017 breach; the FTC says the global settlement included up to $425 million to help affected people. This credit-bureau settlement is not evidence of a data-broker count.

Estimated dark-web price range for a U.S. Social Security Number in DeepStrike’s August 2025 pricing snapshot.

Estimated dark-web price range for a scanned U.S. driver’s license in DeepStrike’s August 2025 pricing snapshot.

Estimated dark-web price range for an online bank login, highly dependent on account balance, in DeepStrike’s August 2025 pricing snapshot.

Estimated dark-web price range for a U.S. Fullz package containing a name, Social Security Number, and date of birth in DeepStrike’s August 2025 pricing snapshot.

Share of the 543 California-registered brokers that did not respond to the UC Irvine study’s defined verifiable consumer request; the study described this as apparent noncompliance, not a court or regulator finding.

Among respondents in the UC Irvine study’s defined sample, the share reported as replying within 45 days; this study result is not a universal broker-performance rate.

Number of European data protection authorities that participated in the EDPB’s 2025 coordinated enforcement action on the GDPR right to erasure; the action included fact-finding and formal investigations rather than a universal compliance rate.

California’s general response period for a covered, verifiable consumer request is 45 days, subject to permitted extensions, exceptions, and request-specific scope.

Weighted share of California data brokers estimated by the study to have at least one interface feature that increased submission friction; the estimate was based on a stratified audit of 250 brokers and weighted to 522 registered brokers.

Weighted share of California data brokers that the study classified as engaging in at least one behavior it considered a CCPA violation; this is an academic audit classification, not a regulator or court finding.

Share of registered California data brokers that the study classified as fully complying with all six CCPA transparency reporting criteria it evaluated.

FTC-finalized order requiring Avast to pay $16.5 million, expected to provide redress to consumers, and banning it from selling, disclosing, or licensing web-browsing data for advertising purposes.

Daily statutory non-compliance penalty under California Civil Code § 1798.99.82 for failure to delete information as required by the Delete Act, plus agency investigative and administrative costs.

Total GDPR fines tracked by the GDPR Enforcement Tracker across 3,215 publicly known EU/EEA enforcement actions; the tracker includes UK GDPR fines and excludes non-GDPR fines.

The FTC described the Gravy Analytics/Venntel action as its fifth action challenging the unfair handling of consumers’ sensitive location data; the release also names prior actions against Kochava, X-Mode, InMarket, and Mobilewalla.

The FTC announced a proposed order and settlement concerning Kochava on May 4, 2026. The proposal would restrict selling, sharing, or disclosing sensitive location data without affirmative express consent; the FTC case record should be checked before describing the matter as final.

Civil penalties of up to $53,088 per violation that the FTC warned data brokers may face in an enforcement action for violating PADFAA’s restrictions on providing sensitive data to foreign adversaries.

CCPA settlement California AG reached with DoorDash in 2024 for selling customer data via a marketing cooperative without required opt-out disclosures.

California's first public CCPA enforcement penalty against Sephora in 2022 for selling personal information and ignoring Global Privacy Control signals.

Maximum GDPR fine: the greater of €20 million or 4% of global annual turnover under Article 83.

Share of U.S. adults who say they have little to no control over the personal data companies collect about them.

Share of U.S. adults who feel very or somewhat concerned about how companies use the data they collect.

Share of surveyed consumers classified by Cisco as “Privacy Actives,” a segment defined by privacy concern, willingness to act, and actions such as switching companies or providers over data practices.

Share of surveyed consumers who said they would not purchase from an organization they do not trust with their data.

Total fines issued by France's CNIL in 2025; its annual summary reports 83 sanctions totaling €486,839,500 and cites €325M and €150M penalties against two major players.

SCHUFA says it has creditworthiness information on 69.1 million natural persons and 6.6 million companies in Germany; its current business page does not state a total record count.

192.com states that its database contains more than 700 million residential and business records across the UK; this is a provider claim, not an independent census or measure of current matching coverage.

Notifiable data breaches reported in Australia in 2025; OAIC says this was an 8% increase over 2024 and the highest annual total since the scheme began.

Fine levied by the UK ICO against TikTok in 2023 for breaches involving children's personal data, including failing to use that data lawfully.

Maximum civil penalty for a body corporate for a serious interference with privacy under Australia's Privacy Act 1988: the greatest of AUD $50 million, three times the benefit obtained, or 30% of adjusted turnover during the breach turnover period.

Number of US states with comprehensive consumer data privacy laws enacted as of mid-2026 (Vermont 23rd state in June 2026).

Maximum PECR penalty for certain direct-marketing or spam-related infringements under the Data (Use and Access) Act 2025: £17.5 million or 4% of worldwide turnover for an undertaking, whichever is higher; the cap depends on the specific infringement.

Reported fraud losses in Canada in 2025; the Canadian Anti-Fraud Centre says more than 112,000 reports were received and reported losses exceeded CA$704 million.

Average cost of a data breach for Canadian organizations in IBM's 2026 report, a record high since the study began.

Maximum administrative fine per infraction under Article 52 of Brazil's LGPD (Lei Geral de Proteção de Dados), capped at 2% of annual revenue in Brazil.

Maximum penalty listed in the Schedule to India's Digital Personal Data Protection Act, 2023 for breach of a data fiduciary's duty to take reasonable security safeguards to prevent personal-data breaches; commencement of the Act is phased, so this does not claim the provision is currently in force or has been imposed.

Cumulative GDPR fines issued by Ireland's Data Protection Commission since May 2018, as reported in its 2025 annual report.

Maximum personal criminal penalty under Article 60 of Switzerland's revised Federal Act on Data Protection for specified intentional violations by responsible individuals; this is not a corporate administrative fine.

Lista Robinson is a consumer advertising-exclusion service provided by Adigital; its privacy policy says citizens can express a desire not to receive commercial communications through specified channels, subject to the service rules. A current participant count is not claimed here.

Italy's Registro Pubblico delle Opposizioni lets consumers register fixed and mobile numbers, and certain postal addresses, to oppose telemarketing; prior consent is generally annulled subject to later consent and continuing-contract exceptions. A current membership count is not claimed here.