The Problem No One Quantifies

Privacy advocates talk constantly about the data broker industry. Lawmakers invoke the 4,000-broker figure in congressional testimony. Security researchers point to breach after breach. But a deceptively simple question remains underexplored: how exposed is the average person, right now, across the data broker ecosystem?

We decided to find out. Over a 90-day period in early 2026, we analyzed anonymized scan results from 500 GhostMyData users who completed full privacy scans across our coverage of 1,500+ data broker sites. The users were geographically distributed across 42 US states, ranged in age from 19 to 78, and included a mix of privacy-conscious early adopters and users who had never attempted any kind of data removal before.

This is what we found.

Methodology

Every GhostMyData privacy scan searches for a user's personal information across 1,500+ data broker sites in multiple tiers: SERP-based people-search discovery, direct scraping of broker databases, API queries against commercial data aggregators, and CCPA right-to-know inquiries to enterprise brokers. For this study, we aggregated the results of completed scans and anonymized all personally identifiable information before analysis.

Key parameters:

Sample size: 500 completed scans
Geographic coverage: 42 US states represented
Age range: 19 to 78 years old
Scan depth: Full multi-tier scan (SERP + scrape + API + CCPA)
Time period: January through March 2026
Exclusions: We excluded users who had previously run data removal services, to capture a "baseline" exposure level

All percentages and averages are rounded. Individual broker names are generalized into categories to prevent this report from functioning as a reconnaissance guide.

Finding 1: The Average Person Appears on 72 Data Broker Sites

The median number of data broker exposures per person was 72. The mean was 78, pulled upward by a subset of heavily exposed individuals (more on that below).

Distribution breakdown:

Exposure Count

Percentage of Users

0-20 exposures	3%
21-40 exposures	8%
41-60 exposures	22%
61-80 exposures	31%
81-100 exposures	21%
101-150 exposures	11%
150+ exposures	4%

The 3% of users with fewer than 20 exposures were disproportionately young (under 25), had recently moved to the US, or had uncommon names. At the other extreme, the 4% with 150+ exposures tended to be homeowners over 45 in states with liberal public records policies.

This means that even the most private-seeming person in our sample had their information on at least a handful of broker sites. There is no such thing as zero exposure in 2026 America.

Finding 2: Your Name and Address Are Everywhere

We categorized the types of personal data found across all exposures. Some data types were nearly universal:

Data Type

Found In (% of exposures)

Full name	98%
Current or past address	94%
Phone number	87%
Email address	71%
Age or date of birth	82%
Relatives and associates	76%
Previous addresses (2+)	69%
Estimated income range	41%
Property ownership records	38%
Court or criminal records	23%
Political affiliation or voter data	19%
Social media profiles	34%

The finding that 94% of exposures included address data was expected — public records (property deeds, voter registration, court filings) are the primary fuel for people-search brokers. More concerning was the 76% rate for relatives and associates. Data brokers routinely link family members together, which means one family member's exposure creates a map to the others.

Finding 3: People-Search Sites Dominate, But Enterprise Brokers Matter More

We categorized broker exposures by type:

People-search sites (Spokeo, BeenVerified, Whitepages, and similar): 58% of all exposures
Public records aggregators: 17% of all exposures
Enterprise data brokers (Acxiom, Epsilon, Oracle Data Cloud, LexisNexis consumer products): 12% of all exposures
Marketing data brokers: 8% of all exposures
Niche or specialty brokers (dating-related, healthcare adjacent, location data): 5% of all exposures

People-search sites account for the majority of exposures simply because there are so many of them and they make data freely (or cheaply) accessible. But enterprise data brokers, while representing only 12% of exposures by count, hold far richer and more detailed data profiles — including purchasing behavior, estimated net worth, credit indicators, and behavioral segments.

The practical implication: removing yourself from people-search sites addresses the most visible exposures. But the enterprise brokers are where sophisticated threat actors — and data-driven marketing — build their profiles.

Finding 4: Geography Is a Privacy Factor

Exposure levels varied meaningfully by state. We grouped states into tiers based on median exposure counts:

Highest exposure states (median 85+ exposures):

Florida, Texas, California, Georgia, Ohio, North Carolina

Moderate exposure states (median 65-84 exposures):

New York, Pennsylvania, Illinois, Michigan, Virginia, Arizona, Colorado, Washington

Lower exposure states (median under 65 exposures):

Vermont, New Hampshire, Maine, Wyoming, Montana, Alaska

The pattern largely correlates with two factors: state public records accessibility (Florida and Texas have extremely permissive public records regimes) and population density (more records mean more broker interest in aggregating them). Vermont residents in our sample had a median of 51 exposures — still significant, but 40% lower than the Florida median of 91.

States that have enacted comprehensive privacy laws (California, Colorado, Virginia, Connecticut) did not show dramatically lower exposure counts. Privacy laws create opt-out rights, but they do not prevent initial data collection and publication. The data is exposed first, and the law provides a mechanism to request removal after the fact.

Finding 5: Age Strongly Correlates with Exposure

This was one of the clearest signals in the data:

Age Group

Median Exposures

18-24	34
25-34	58
35-44	76
45-54	89
55-64	94
65+	91

Exposure increases steadily with age through the 55-64 bracket, then levels off slightly. The explanation is straightforward: more years alive means more addresses, more public records (property purchases, court filings, voter registrations, marriage records), more phone numbers, and more online accounts feeding data into the broker ecosystem.

The slight decline after 65 likely reflects a generational gap in online account creation — people over 65 tend to have fewer social media accounts and email addresses feeding commercial brokers, even though their public records exposure is extensive.

For younger users, the relatively lower baseline should not be comforting. A 22-year-old with 34 exposures today will accumulate more with every apartment lease, every job change, every voter registration update, and every new online account. Without active management, the trajectory is only upward.

Finding 6: Homeowners Are 40% More Exposed Than Renters

Users who owned property had a median of 88 exposures, compared to 63 for renters. Property deeds are among the most extensively aggregated public records in the US, and they link your full name to a specific address with near-perfect accuracy.

Homeownership also correlated strongly with having relatives listed in exposures (84% of homeowners vs. 64% of renters). Property records often surface family trusts, co-owners, and deed transfer histories that reveal family connections.

Finding 7: Previous Removal Attempts Show a 60% Re-Listing Rate

Among users who self-reported having previously submitted manual opt-out requests to at least one broker (approximately 15% of our sample), we found that 60% still had active listings on the brokers they claimed to have opted out of. This aligns with the known data broker practice of re-listing individuals when new data is ingested from upstream sources.

Manual opt-out is a point-in-time action. Continuous monitoring is the only reliable approach.

What These Numbers Mean for You

If you have never checked your exposure across data broker sites, the statistical likelihood is that your personal information — name, address, phone, relatives, and likely much more — is available on 60 to 90 data broker sites right now.

This exposure is not theoretical. It enables:

Robocall and spam targeting: Your phone number is sold as a marketing lead
Phishing personalization: Attackers reference your address, employer, or family members to make scam emails convincing
Identity theft groundwork: Aggregated broker data provides the building blocks for opening fraudulent accounts
Physical safety risks: Current address data is available to anyone willing to search for it
Background check contamination: Inaccurate or outdated broker data can affect housing applications, employment screening, and insurance underwriting

The average American would need to submit individual opt-out requests to 72 separate companies to address their exposure — and then monitor all of them for re-listing.

Automate Your Privacy with GhostMyData

This study reinforces what we built GhostMyData to solve. Manually opting out of 72+ brokers is not realistic for most people, and doing it once is not sufficient when 60% of listings reappear.

GhostMyData scans 1,500+ data broker sites, submits removal requests using the strongest privacy law applicable to your state, and continuously monitors for re-listings. Our platform handles the people-search sites that are most visible, the enterprise brokers that hold the deepest profiles, and everything in between.

Start your free privacy scan to see your actual exposure count — and let us bring it down.

Frequently Asked Questions

How accurate are these numbers?

Our scan methodology uses multiple detection tiers (SERP analysis, direct site scraping, API queries, and CCPA inquiries) to minimize false negatives. However, no scan can cover every data broker in existence — the industry includes over 4,000 entities by some estimates. Our coverage of 1,500+ brokers represents the most impactful and widely used sources, but actual total exposure may be higher.

Does this study include social media data?

Partially. Our scans detect when social media profiles are indexed or aggregated by data broker sites (34% of exposures). We do not scan social media platforms directly — this study measures the data broker ecosystem specifically.

Are children included in this data?

No. All users in the sample were 18 or older. Children under 18 have a meaningfully different exposure profile due to COPPA protections and the absence of public records like property deeds and voter registration.

How does this compare to other countries?

This study is US-specific. The data broker ecosystem in the US is uniquely large due to the combination of extensive public records, no federal privacy law, and a mature commercial data industry. European residents face a meaningfully different exposure landscape due to GDPR, though cross-border data flows mean the distinction is narrowing.

What can I do right now to reduce my exposure?

Run a free scan at GhostMyData to see your personal exposure count. From there, you can initiate automated removals across all the brokers where you appear. The scan takes about two minutes and requires no credit card.

How Exposed Are You? We Scanned 500 Americans and Here's What We Found