A data broker is a company that collects personal information about people it has no direct relationship with, then sells or licenses that information to others. The missing relationship is the whole definition. A retailer that profiles its own shoppers is not a broker; a firm that buys those profiles, joins them to twenty other files and resells the result is. Brokers exist because advertisers want to address people by attributes no single publisher can observe, and the records behind those attributes sit scattered across public registers, purchase histories, app software development kits and other brokers.

The label is contested by most of the companies it fits. Firms in the trade prefer audience data provider, identity resolution vendor or data collaboration platform. Statutes use the older word, and it increasingly carries a registration number.

How brokered data reaches an impression

The business begins with acquisition. Sources include electoral and property registers, court filings, warranty cards and surveys, loyalty schemes, mobile applications carrying a monetisation SDK, and other brokers. That last channel is not marginal. The Federal Trade Commission's May 2014 study of nine brokers found that seven supplied data to one another.

Raw records are then resolved to an advertising identifier. Offline attributes attach to a name and postal address, which is useless to a bidder, so the file is matched to a hashed email, a mobile advertising ID, a connected TV identifier or an IP-derived household. The output is a segment: a labelled bucket such as in-market for a saloon, a household income band, or a store visitor within 30 days.

Distribution runs through demand-side platform marketplaces, data management platforms and curation layers on the sell side. Inside the auction the mechanics are specified. OpenRTB carries third-party attributes in the user.data array, an array of Data objects. Each Data object holds an id and name identifying the provider plus an array of Segment objects, and each segment is a key-value triple of id, name and value. The specification requires exchanges to publish provider identifiers and segment names to bidders in advance, since neither string means anything on its own.

Pricing was historically a CPM adder negotiated deal by deal and quoted separately from media, an opacity that suppressed demand. The Trade Desk launched Audience Unlimited on 29 September 2025, replacing per-segment quotes with 3.3% and 4.4% of impression cost in Control Mode and bundling data access at no incremental cost in Performance Mode. According to the company, advertisers who bought third-party data before the change spent close to 20% of media cost on it. Chief executive Jeff Green blamed cost complexity rather than the data itself when Acxiom geo-based segments went live in the UK and Germany in June 2026.

Origin and evolution

The trade predates the internet by three decades. Charles Ward founded Demographics, Inc. in Conway, Arkansas in 1969 to build political mailing lists for the Democratic Party. The company moved into commercial direct mail in 1975 and was renamed Acxiom Corporation in 1988. The Fair Credit Reporting Act of 1970 drew the line the industry has lived on since: files used for credit, insurance and employment decisions became regulated consumer reports, marketing files did not.

Digital brokerage arrived with the data management platform. Datalogix was founded in 2002 and BlueKai in 2008; Oracle bought both in 2014, forming what became Oracle Advertising. Acxiom acquired LiveRamp in 2014, sold its marketing services division to Interpublic Group in 2018 and took the acquisition's name.

The 2014 FTC report gave the sector its first public measurement. One broker held about 3,000 data segments for nearly every United States consumer; another database contained 1.4 billion consumer transactions and more than 700 billion aggregated data elements. The Commission asked Congress for legislation. Congress did not act; Vermont did. Act 171 of 2018 became law on 22 May 2018 and took effect on 1 January 2019, creating the country's first mandatory data broker registry, at a 100 dollar filing fee and a 50 dollar daily penalty capped at 10,000 dollars a year.

European law moved the other way, regulating the data rather than the registrant. Oracle stopped selling third-party data targeting in Europe across BlueKai, Crosswise and Datalogix after class actions in the United Kingdom and the Netherlands alleged breaches of the General Data Protection Regulation. It then wound up the advertising business on 30 September 2024, terminating its data provider relationships, and settled a United States privacy class action for 115 million dollars.

Registries, deletion and enforcement

California turned the registry into an operating obligation. The Delete Act, Senate Bill 362, was signed in October 2023 and produced the Delete Request and Opt-Out Platform, which went live at midnight on 1 January 2026. Residents submit one verified request that reaches every registered broker. By the agency board meeting of 27 February 2026 it held 242,000 sign-ups, 1.2 million identifiers and more than 575 registered brokers. The identifier mix matters: 99% of requests carried a postcode and 94% a phone number, but only 10% a mobile advertising ID and 3% a connected TV ID, the two that govern programmatic targeting. Since 1 August 2026 brokers have had to check the platform at least every 45 days and process what they find, at 200 dollars per day per unprocessed request.

Senate Bill 361, signed on 8 October 2025, doubled the daily fine from 100 to 200 dollars and added disclosure of whether a broker sold data to foreign adversary governments, to law enforcement outside a court order, or to developers of generative artificial intelligence systems. Independent audits begin in 2028. Vermont's Act 138 of 16 June 2026 added comparable categories and raised its fee, defining precise geolocation as a radius of 1,850 feet.

Enforcement has concentrated on location. The FTC barred InMarket Media from selling precise location data in January 2024 and closed its four-year case against Kochava in May 2026 with an order requiring supplier consent verification, quarterly testing of a sensitive location programme and deletion on a fixed schedule. California's first Delete Act action, announced on 30 December 2025, fined a Texas company 45,000 dollars over unregistered lists that classified more than 435,000 people by Alzheimer's disease.

Federal policy has moved in two directions at once. The Justice Department's rule at 28 CFR Part 202, implementing Executive Order 14117, took effect on 8 April 2025 and treats data brokerage to six countries of concern as a national security matter, with enforcement from 8 July 2025 and no consent exemption. The Consumer Financial Protection Bureau proposed on 13 December 2024 to treat many brokers as consumer reporting agencies under the FCRA, then withdrew it on 15 May 2025. The SECURE Data Act introduced in April 2026 would pre-empt state law and build a federal registry, defining a broker by a threshold of 50% of annual gross revenue from selling data about non-customers.

Where the model is contested

Accuracy is the first dispute. An Adstra study published in July 2026 found IP-based connected TV targeting failing three times in four, with chief data officer Andy Johnson arguing that vendors compete on match rate and scale rather than accuracy, because nobody pays them for correctness.

Consent provenance is the second. A broker rarely collects from the individual, so the lawfulness of its file rests on disclosures made by an app or publisher several transfers upstream, which the buyer cannot inspect. That is the theory behind the Kochava order and the Commission's December 2024 concurrence in two location matters.

Onward use is the third. Location brokerage has supplied government agencies, and Homeland Security Investigations approached ad tech firms and data providers about commercial surveillance tools. Texas sued Netflix in May 2026alleging undisclosed sharing with Experian and Acxiom among others.

Definitional arbitrage is the fourth. A revenue percentage test excludes a firm earning most of its money from software while brokering on the side, which describes much of the identity layer.

Disambiguation

A data management platform stores and segments data for activation but does not necessarily sell anyone else's records. It is infrastructure rather than inventory, though many brokers run one.

An onboarder or identity resolution vendor matches records between parties without selling attributes of its own. LiveRamp's pseudonymous RampID is the widely deployed example, and neutrality was its selling point until Publicis agreed to buy the company for 2.5 billion dollars.

A consumer reporting agency is a broker whose output is used for credit, insurance, employment or housing decisions, and is regulated under the FCRA. The distinction is legal rather than technical, which the withdrawn CFPB proposal tried to change.

A curator packages third-party segments onto publisher supply on the sell side, reselling access to inventory shaped by data rather than the data itself.

Recent developments

Consolidation keeps pulling brokered data inside agency holding companies. LiveRamp shareholders rejected the merger pay proposal on 17 August 2026 by 44.3 million votes to 7.3 million without blocking the deal, and Acxiom now sits inside Omnicom as the identity layer of the Omni platform.

Distribution is also opening to software agents. On 2 September 2026 the German provider OS Data Solutions replaced its third-party data management platform with its own OSDX stack and shipped a Model Context Protocol server exposing its segments to agents, a first for a data supplier rather than a buying platform. European enforcement runs in parallel: Italy's Garante fined Lusha 2 million euros in July 2026 and ordered erasure of Italian contact data, from a company registered as a broker in California and in Israel.

Timeline

  • 1969: Charles Ward founds Demographics, Inc. in Conway, Arkansas
  • 1970: The Fair Credit Reporting Act separates regulated consumer reports from marketing files
  • 1988: The company is renamed Acxiom Corporation
  • 2002: Datalogix founded
  • 2008: BlueKai founded
  • 27 May 2014: The FTC publishes its study of nine data brokers
  • 2014: Oracle acquires BlueKai and Datalogix; Acxiom acquires LiveRamp
  • 22 May 2018: Vermont Act 171 becomes law, the first data broker registry in the United States
  • October 2018: Acxiom sells its marketing services division to Interpublic Group
  • 1 January 2019: Vermont registration takes effect
  • October 2023: California enacts the Delete Act, Senate Bill 362
  • January 2024: The FTC bars InMarket Media from selling precise location data
  • 30 September 2024: Oracle Advertising reaches end of life
  • 13 December 2024: The CFPB proposes bringing data brokers under the FCRA
  • 8 April 2025: The Justice Department rule at 28 CFR Part 202 takes effect
  • 15 May 2025: The CFPB withdraws its data broker proposal
  • 8 July 2025: Justice Department enforcement of the bulk data rule begins
  • 29 September 2025: The Trade Desk announces Audience Unlimited
  • 8 October 2025: California Senate Bill 361 doubles Delete Act fines and expands disclosures
  • 1 January 2026: The Delete Request and Opt-Out Platform opens to California residents
  • April 2026: The SECURE Data Act is introduced in the House
  • May 2026: The FTC closes its Kochava case
  • 16 June 2026: Vermont Act 138 expands data broker registration requirements
  • 1 August 2026: California brokers must begin processing deletion requests every 45 days

Summary

Who. Firms whose product is personal information about people they do not serve, from long-established list compilers such as Acxiom and Experian to location specialists and identity vendors, together with the regulators now registering them: CalPrivacy, the Vermont Secretary of State, the Federal Trade Commission and the Justice Department.

What. The collection of personal records from public, commercial and app sources, their resolution to advertising identifiers, and their sale as segments to advertisers, platforms, risk services and governments.

When. Continuously since 1969 as a mailing list trade, since around 2008 as programmatic infrastructure, and under registration requirements since 1 January 2019 in Vermont and 1 January 2026 in California for centralised deletion.

Where. In the user.data and segment objects of an OpenRTB bid request, in demand-side platform data marketplaces, and in state registries that now publish who is selling what.

Why. Advertisers pay for attributes no publisher can observe alone, and were spending close to 20% of media cost on them before pricing was restructured. That demand funds a supply chain whose consent provenance, accuracy and onward use are all contested.