Data Brokers List 2026: 728 Registered Companies, but Only 260 Sign Up in All Three Open State Registries

This data brokers list merges every state registry that publishes its full roster: California (603 brokers), Texas (438) and Oregon (386). After matching legal names, 728 distinct companies are registered, but only 260 appear in all three. In California, 19% say they collect precise geolocation and 3% collect minors’ data.

We downloaded the three registries in October 2026, normalized company names so that “Acme Data, LLC” and “ACME DATA INC.” count once, and cross-referenced them. Vermont, the fourth state with a data broker registry, puts its search behind a CAPTCHA and its bulk file behind an account login, so it is not in the counts. That changes in 2027: Vermont’s Act 138, signed June 16, 2026, requires the Secretary of State to publish a downloadable spreadsheet of registered brokers once its main provisions take effect on January 1, 2027. The comparison table below covers what each of the four states requires.

Who registers where

Distinct companies after name normalization. California: 2026 registry (brokers that operated in 2025). Texas: all registrations listed on the Secretary of State registry. Oregon: active registrations. Circle sizes are not to scale.

197 companies are registered only in California, the largest single block. California also charges by far the highest fee: $6,000 in 2026, against $600 in Oregon, $300 in Texas and $100 in Vermont (rising to $900 in 2027 under Act 138). 439 companies (60%) are on at least two registries.

Registration in one state and not another is not by itself a violation, since each law applies to brokers handling that state’s residents. Still, 125 companies on the Texas or Oregon registry are missing from California’s 2026 list, and 91 of them do not appear in any California registry back to 2020 (matching on normalized name). California’s registry also shows how international the trade is: 39 of its 603 registrants list a primary address outside the United States.

The data brokers list: search all 728

Click a blue header to sort. Geolocation is the California 2026 registry answer. Minors is Yes if the broker answered yes in California (collects minors’ personal information) or Texas (processes data of a known child). Deletion requests are the number received in calendar 2024, as reported in the broker’s 2026 California registration. The full dataset, with websites, privacy-rights links and Oregon opt-out links, is in the download below.

What California’s registrants admit to collecting

California asks each broker yes-or-no questions about sensitive data and about who it sold or shared data with in the past year. Of the 603 brokers on the 2026 registry, 211 (35%) answered yes to at least one sensitive-data question, and 127 (21.1%) collect precise geolocation or minors’ data. 95 (16%) said they sold or shared data with a government, law enforcement, a foreign actor or a GenAI developer.

Source: California Data Broker Registry 2026 (CalPrivacy), last updated July 29, 2026. Self-reported answers; 603 brokers.

Three questions (minors, precise geolocation, reproductive health care data) have been asked since 2024, so they can be compared year to year:

Each registry year reflects the prior year’s operations. The 2026 form added the other sensitive-data and recipient questions, which appear in the Delete Act text effective January 1, 2026.

The geolocation count rose from 88 to 115 brokers in one year, faster than the registry grew. The minors’ data count fell from 32 in 2024 to 18 in 2026.

What Oregon’s registrants collect

Oregon asks a different set of questions: which identifying fields a broker collects, and whether it sells or licenses each one. Two answers matter for security teams. 17 of 391 Oregon registrants say they collect a person’s mother’s maiden name, and 16 of those sell or license it. 32 collect a Social Security number or other government ID (18 sell or license it), and 184 collect date of birth. Our MFA statistics show how few online services support phishing-resistant sign-in, which does not depend on such answers.

Source: Oregon DCBS, Division of Financial Regulation, “Data Broker Data Collected” report, 391 registrations. Percentages are of all Oregon registrants.

Texas: children’s data and breaches

Of the three open registries, only Texas publishes a count of security breaches, and it also asks whether a broker processes data of a known child. 7 of 453 Texas registrations (1.5%) say they process data of a known child. 6 registrations report one or more security breaches: Sojern Inc. (2), Anchor Computer Inc. (1), LexisNexis Risk Solutions FL Inc. (1), Merkle Inc (1), Trans Union LLC (1), Unacast, Inc. (1). 338 (75%) say they run a purchaser credentialing process, while 115 answered no. Our analysis of breach notification timing shows how long companies take to report breaches to a state.

Registrations per year

*2026 is partial for Texas and Oregon (through mid-October); California’s 2026 registration window closed January 31. California 2020 to 2023: first “Date Added” in the Department of Justice era registry. California 2024 to 2026: names not seen in any earlier California list. Texas and Oregon counts include only companies still listed, so earlier years are understated. Oregon’s 1 December 2023 registration is counted in 2024.

California’s registry has held between 543 and 603 brokers a year since 2024 (543, 543, 603), but the list turns over. Between the 2025 and 2026 registries, 86 names dropped off and 149 were added, 128 of them new to any California list since 2020. Texas registration numbers carry the year: the highest are 20240271, 20250220 and 20260185, which implies at least 676 numbers issued since 2024, against 453 registrations listed today. Our cybersecurity statistics hub collects the other breach, regulation and disclosure data we track.

Deletion requests and California’s DROP

California brokers must report how many privacy requests they handled. In their 2026 registrations, covering calendar 2024, the 603 brokers reported 58,031,327 deletion requests. They said they complied in whole with 98.2%, in part with 0.4%, and denied 890,712 (1.5%); these self-reported outcomes add up to 0.1% more than the requests received. 163 brokers reported zero. The demand is concentrated: Cuebiq Group, LLC, which told California it collects precise geolocation, reported 26,285,436 requests, 45% of the total, and the top ten account for 75%. Among brokers that received any, the typical reported median response time was 5 days.

Source: California Data Broker Registry 2026, request metrics columns (labelled “in 2024”). Under Civil Code 1798.99.85, metrics are compiled by July 1 for the previous calendar year. Opt-out of sale requests (98,815,966) and requests to know (4,311,895) are reported separately.

Those numbers predate the Delete Request and Opt-out Platform (DROP), which replaces one-by-one requests for California residents:

• January 1, 2026. California residents can submit a single deletion request through DROP that goes to every registered broker.
• January 31, 2026. Annual registration deadline; the fee was $6,000.
• August 1, 2026. Brokers must begin processing DROP requests and must access the platform at least once every 45 days.
• After processing. Brokers have up to 90 days to report each request’s status and must re-check for new matching data at least every 45 days. Failing to delete as required costs $200 per day per deletion request.

How the four state registries compare

Fees and questions from each state’s statute or registry page: California Civil Code 1798.99.82 and CalPrivacy; Texas Business and Commerce Code chapter 510 and the Secretary of State; Oregon DCBS; 9 V.S.A. section 2446 and Vermont Act 138 of 2026.

Frequently asked questions

Who are the data brokers?

The three state registries that publish full lists (California, Texas and Oregon) name 728 distinct companies after we matched legal names. California lists 603, Texas 438 and Oregon 386. 260 appear in all three, among them Experian Information Solutions, Equifax Information Services, Trans Union, LexisNexis Risk Solutions, Acxiom, Epsilon and Spokeo.

What are the top 10 data brokers?

There is no official ranking. One measurable proxy is consumer demand: in 2026 California registrations, Cuebiq Group, LLC reported the most deletion requests for 2024 (26,285,436), followed by Azira, LLC (5,042,679) and Uplead LLC (4,063,777). The ten largest received 75% of all 58,031,327 deletion requests reported.

Who is the biggest data broker?

By deletion requests reported to California, Cuebiq Group, LLC: 26,285,436 requests in 2024, 45% of the 58,031,327 reported by all 603 registered brokers. Registries do not publish revenue or record counts, so size by those measures cannot be read from them.

How do I remove my phone number from data broker lists?

California residents can file one request through CalPrivacy’s DROP platform, which data brokers had to start processing on August 1, 2026, and then re-check at least every 45 days. Elsewhere, opt out broker by broker: Oregon’s registry publishes opt-out methods for all 391 of its registrants, and 333 of them accept requests made by an authorized agent.

Do data brokers have to register in California?

Yes. A business that operated as a data broker in the prior year must register with CalPrivacy between January 1 and 31. The 2026 fee was $6,000, and failing to register costs $200 a day. 603 brokers registered in 2026, up from 543 in 2025.

Can data brokers sell your SSN?

Some say they collect it. In California’s 2026 registry, 42 of 603 brokers (7%) said they collect government ID numbers such as SSNs. In Oregon, 32 of 391 said they collect SSN or government ID, and 18 said they sell or license it.

Methodology

References

1. CalPrivacy, California Data Broker Registry (2026, 2025, 2024 and 2020 to 2023 CSV downloads). Accessed October 2026.
2. CalPrivacy, How DROP works. Accessed October 2026.
3. CalPrivacy, DROP for data brokers (registration fee, processing schedule, penalties). Accessed October 2026.
4. California Civil Code 1798.99.80 to 1798.99.89, Delete Act text effective January 1, 2026. Accessed October 2026.
5. Texas Secretary of State, Data Broker Registry. Accessed October 2026.
6. Texas Secretary of State, Data Brokers (registration and $300 fee). Accessed October 2026.
7. Oregon DCBS, Division of Financial Regulation, Data Broker search and downloads. Accessed October 2026.
8. Oregon DFR, Data broker registry (registration and $600 fee). Accessed October 2026.
9. 9 V.S.A. section 2446, Vermont data broker annual registration. Accessed October 2026.
10. Vermont Act 138 of 2026 (H.211), an act relating to data brokers and personal information, as enacted. Accessed October 2026.
11. Vermont Secretary of State, Data Broker Search. Accessed October 2026.