Why nobody can name them, on purpose

Data brokers operate business-to-business — they collect data from public records, other companies, apps, and loyalty programs, then sell profiles to marketers, insurers, landlords, employers, and (per reporting this desk has already covered) law enforcement. Because their actual customers are other businesses, not consumers, there's no reason for them to build a recognizable brand the way a retailer or a streaming service does. Most people never interact with one directly in a way they'd notice.

That's compounded by structure, not just business logic. The FTC's own 2014 report on the industry — built on a review of nine major brokers — found that data typically passes through multiple brokers reselling to each other in layers before it reaches a final buyer, which is why the FTC's own conclusion, in its own words, is that it is "virtually impossible" for a consumer to determine how a specific data broker obtained their information. And separate research has found most Americans already assume common data-broker practices are illegal, which means a lot of people never think to go looking for a name in the first place — they assume there's already a law stopping this.

Yes, you can actually name them

Two states require it by law, and both publish the results.

Vermont was first. In 2018, it became the first state to require data brokers to register annually and publicly, for a $100 fee, specifically so residents could see who was operating. As of the current registration cycle, 283 companies are on Vermont's public list — viewable by anyone, not just Vermont residents.

California's registry is bigger, and it's downloadable. Under the Delete Act, any business meeting the legal definition of data broker must register annually with the California Privacy Protection Agency between January 1 and 31, disclosing what categories of data it collects — and, as of 2026, whether that includes minors' data, precise geolocation, biometric data, reproductive health information, or citizenship status — and who it sells or shares that data to, including whether that's a foreign actor, the federal government, state governments, law enforcement, or an AI developer. The full dataset is a free CSV download, no login required, at cppa.ca.gov/data_broker_registry.

Names you'll actually recognize once you look: Experian and Equifax — companies most people know only as credit bureaus — both also run marketing/data-broker businesses well beyond your credit file (Equifax markets more than 800 audience segments; Experian's ConsumerView database covers over 300 million people). LexisNexis Risk Solutions, Acxiom, Epsilon, CoreLogic, TransUnion, Dun & Bradstreet, BeenVerified, and Intelius are all established, currently-operating, large-scale players, independently documented across multiple industry trackers. One name worth a specific correction rather than inclusion: Oracle — separately notable in this beat as the biggest data-broker-industry lobbying spender, per an earlier piece from this desk, a legal activity that doesn't by itself establish improper influence — shut down its own third-party data-broker business, Oracle Data Cloud, in June 2024. It's not a currently operating broker, even though the parent company remains active in adjacent advertising and lobbying.

One thing worth being precise about: the live 2026 registry page on CPPA's own site currently shows zero brokers registered, timestamped July 29, 2026 — which doesn't match California's own separate DROP tool, which states it already reaches "over 600 registered data brokers." Both of those are real numbers pulled directly from CPPA's own pages this pass. Most likely explanation is a publishing lag between the 2026 cycle's summary table and DROP's underlying data, not that 600 companies vanished — but that's not confirmed, so treat it as an open discrepancy, not a resolved one. What is confirmed: the "0 registered" count appears to be a display bug on that one summary table specifically, not a broken dataset — the page's own "Download Registration Information" button, sitting directly below the "0," produces a populated 2026 CSV with 300-plus real broker names on it, Experian, Equifax, Acxiom, Epsilon, BeenVerified, and TransUnion entities among them. The download works right now; only the on-page count next to it appears to be wrong.

California has also already begun enforcing the registration requirement this year: on August 11, 2026, CalPrivacy fined LocateSmarter, LLC $116,490 for operating as a data broker without registering — its first-ever enforcement action under the Delete Act. Two days later, it fined a second unregistered broker, Cybba, Inc., $52,400, for the same violation.

What can I do

If you're a California resident, this is the rare privacy story with an actual one-click answer: go to privacy.ca.gov/drop, verify your residency, and submit one request that reaches every data broker registered in the state — over 600 of them as of this writing. You don't need to find each company individually. Data brokers are required to check DROP at least every 45 days and begin processing deletion requests; DROP itself says it can take up to 90 days before you see a status update, and by CPPA's own timeline, all of them should have completed their first full cycle by November 2026.

If you're not a California resident, you still have two real options. First: Vermont's registry is public to anyone, not just Vermont residents — you can look up a specific company's registration even if you'll have to contact it directly rather than use a one-click tool. Second: several of the named companies above — Experian, Equifax, LexisNexis, Acxiom — accept individual opt-out or deletion requests through their own privacy pages, the same mechanism this desk has covered for other companies; it's slower and has to be repeated company by company, but it's real.

What this piece is not saying

This isn't claiming California's or Vermont's registry captures every data broker operating in the U.S. — both are legally scoped to companies meeting each state's own specific definition, and a company that only handles data in ways that fall outside that definition wouldn't appear even if it functions like a data broker in practice. It isn't asserting the "0 registered" figure on CPPA's live 2026 table means California's registry has collapsed or that the 600+ brokers DROP references no longer exist — this pass found a real discrepancy between two of CPPA's own pages and is reporting it as observed, not resolving it with a guess. And it isn't claiming opting out through DROP or any individual company removes you from data collection generally — DROP requests actual deletion of the data a broker already holds on you, not just a future-sale stop, but real exemptions apply: public-record data, data already governed by HIPAA, FCRA, or GLBA, and anything you gave the broker directly rather than data they bought about you can fall outside what gets deleted. And it doesn't reach brokers who aren't registered at all. And naming these companies isn't an accusation — registering as a data broker is a legal requirement for any business that meets the definition, not a violation of it. Nothing in this piece alleges any of the named companies broke a law or misused data.

Why this is a BL:UF story

Every piece this desk has run on data brokers has been about a system with no name attached — a "safety" pretext, a policy clause, a market nobody can see into. This is the one piece of that system with an actual, public, checkable answer: two states require these companies to say who they are, in writing, once a year, and California built a tool that lets you act on the whole list at once. That's rare enough in this beat to be the headline on its own.

The Receipts