About half of California's registered data brokers report fewer than 100 deletion requests a year

California's data broker registry lists 603 companies. For 2024 they reported 58.0 million deletion requests in total, but the numbers are lopsided: one company accounts for 45% of them, 164 brokers (27%) reported zero, and about half reported fewer than 100. Brokers say they complied in whole with 98.2% of requests and took a median of 5 days to respond. Eight brokers reported a median response time above 45 days.

Every figure below comes from one file: the registry CSV that the California Privacy Protection Agency (CalPrivacy, formerly CPPA) publishes, downloaded on 2026-10-06. The numbers are what brokers typed into their own registration forms. Nobody audits them. Read them as "what brokers disclosed", not as measured fact.

What brokers must report and why the numbers are self-reported

California's registry page describes the process like this: "Any business that meets the definition of 'data broker' must register with CalPrivacy annually between January 1-31 to report on its activities from the previous calendar year." The agency then "publishes the information submitted during the registration process in the California Data Broker Registry after the registration period ends." (CalPrivacy registry page)

The request metrics come from the Delete Act. Section 1798.99.85(a) of the statute text says the business shall "compile the number of requests ... that the data broker received, complied with in whole or in part, and denied during the previous calendar year" and "compile the median and the mean number of days within which the data broker substantively responded to requests." Section 1798.99.82(b)(2) lists what goes into the registration: the broker's name and websites, those metrics, and "whether the data broker collects the personal information of minors," "consumers' precise geolocation," and "consumers' reproductive health care data." (statute text, CPPA PDF)

The CSV carries 77 columns. The metric columns are labeled "in 2024", so the figures cover calendar year 2024. The agency checks whether brokers register at all: its October 30, 2024 announcement describes "a public investigative sweep of data broker registration compliance under the Delete Act" with a penalty of "$200 per day." (CPPA announcement, 2024-10-30) We found no statement that it verifies the request counts themselves.

How many requests brokers receive

The 603 brokers reported 58,031,327 deletion requests for 2024. That total is almost meaningless on its own, because it is dominated by a handful of companies.

Broker (as listed in the registry)	Deletion requests received	Complied in whole	Denied	Median days
Cuebiq Group, LLC	26,285,436	26,211,064	74,372	4
Azira, LLC	5,042,679	5,042,679	0	1
Uplead LLC	4,063,777	4,063,777	0	15
Peoplewhiz, Inc	2,569,965	2,569,965	0	0
Fifty Technology Ltd	1,145,868	1,145,868	0	1
Focus USA, Inc.	965,924	965,924	0	1
Fourleaf LLC	953,753	953,753	0	1
Cybba Inc.	933,375	933,258	117	16
Semcasting, Inc.	932,924	889,839	43,085	3
Share Local Media, Inc.	892,395	890,540	1,855	1

Cuebiq Group, LLC alone reported 26.3 million requests, 45.3% of everything in the file. The top 10 together account for 75.5%. The registry does not say where requests come from, so we cannot tell what drives volumes of this size.

The typical broker looks very different. The median broker reported 107 deletion requests for the whole year. 296 brokers, 49.1%, reported fewer than 100. 415 brokers, 68.8%, reported fewer than 1,000. Only 188 brokers reported 1,000 or more, and only 5 reported a million or more.

Opt-out requests are a separate column and larger: 98.8 million in total, again with Cuebiq Group, LLC reporting the most (26.6%). The split between "delete" and "opt out" is not consistent across brokers. Spokeo, Inc. reported 8 deletion requests and 3,795,579 opt-out requests according to its registry entry. A site that files almost everything under opt-out looks like it receives no deletion requests at all.

How often they comply

Aggregated, brokers reported complying in whole with 56,972,890 deletion requests (98.2%) and denying 890,712 (1.5%). Without Cuebiq Group, LLC the rates are 96.9% complied and 2.6% denied. Another 230,395 requests were reported as "complied in part" by 41 brokers; that column is not in our extract and we took it from the full CSV.

Per broker, the picture is more mixed. We looked at the 307 brokers that reported at least 100 deletion requests, so that a rate means something. The median broker in that group reported complying in whole with 100% of requests, and 171 of them (55.7%) reported complying with every single request. But 64 brokers reported denying more than 10% of requests, 40 reported denying more than half, and 6 reported denying every request they received. Two more, Live Data Technologies, Inc. and Online Advertising Network sp. z o.o., reported denying all but 12 and all but 2 requests, so their rate rounds to 100% in the table below.

Broker (as listed in the registry)	Deletion requests received	Denied	Denial rate	Median days
Live Data Technologies, Inc.	45,865	45,853	100.0%	172
Online Advertising Network sp. z o.o.	6,879	6,877	100.0%	48
Keyword Connects LLC	5,201	5,201	100.0%	20
Effyis, Inc.	1,609	1,609	100.0%	1
VRTCAL Markets Inc.	812	812	100.0%	1
ONAUDIENCE LTD	340	340	100.0%	48
MedPro Systems, LLC	178	178	100.0%	45
AWL Holdings, LLC	139	139	100.0%	1
DTN, LLC	6,218	6,202	99.7%	12
33 Mile Radius LLC	62,584	62,190	99.4%	12

A high denial rate is not by itself a sign of wrongdoing. The statute text lists reasons a request may be denied, among them that "the request was not verifiable" or "called for information exempt from deletion" (section 1798.99.85(b)). The CSV has no column for those reasons, so we cannot say why these brokers denied what they denied. We can only say what they disclosed.

Some entries do not add up. Salutary Data LLC., Modigie Inc and R.L. Polk & Co. reported more requests complied with plus denied than received. Seven brokers reported deletion requests but zero complied and zero denied, among them SpyCloud Inc. (2,611 requests) and SBFE, LLC (1,641). These look like form-filling errors. They also show how little checking the file gets before publication.

How long they take

Brokers report a median number of days to respond. Across the 439 brokers that reported at least one deletion request, the median of those medians is 5 days. 59.0% reported a median of 7 days or less, 78.4% reported 15 days or less, and 98.2% reported 45 days or less. The mean-days column in the full CSV tells the same story: the median broker reported a mean of 7 days.

Eight brokers reported a median above 45 days: Live Data Technologies, Inc. (172 days), TrueData Solutions, Inc. (129), Modigie Inc (80), Zeta Global (62), and Online Advertising Network sp. z o.o., Qualfon, Crunchbase, Inc. and ONAUDIENCE LTD (48 each). Seven of them had at least 100 requests. Zeta Global reported the largest volume of the group: 137,625 requests, 110,100 of them denied. Another 28 brokers reported a median between 31 and 45 days.

Twelve brokers reported deletion requests but a median of 0 days. That can mean same-day responses or an empty field. The file does not distinguish.

Who reports nothing

164 brokers, 27.2% of the registry, reported zero deletion requests for 2024. 142 of them (23.5%) reported zero in every metric column: no deletion requests, no opt-outs, nothing complied with or denied, zero days.

A zero is ambiguous. In the full CSV only one broker left the deletion-requests cell blank; everyone else typed a number. So a zero can mean "we received none", "we do not count them", or "we did not fill this in". The registry does not say which.

The flags are more complete. 18 brokers (3.0%) disclosed that they collect personal information of minors, 115 (19.1%) that they collect precise geolocation, and 8 (1.3%) that they collect reproductive health care data. 32 disclosed that they shared or sold consumer data to a developer of a generative AI system in the past year, and 55 that they did so with the federal government.

What this means if you send a request

If you write to a broker yourself, the registry suggests what to expect, with all the caveats above.

• Most brokers report answering within about two weeks. The typical broker reported a median of 5 days, and three quarters reported 15 days or less. If you hear nothing after a month, you are in the slow tail. Follow up in writing.
• A denial is possible, and you may not be told why. 40 of the 307 brokers with meaningful volume reported denying more than half of their requests. Ask for the reason in writing.
• Keep records. Save the date, the address you used, the confirmation email and any reply. Brokers report their own numbers; your records are the only independent evidence of your request.
• Expect to repeat. A broker that reports fewer than 100 requests a year has little practice with them. Check the listing again after a few months.
• From August 2026, California residents have a second route. CalPrivacy's page for brokers says: "Starting August 1, 2026, data brokers must begin processing DROP requests at least once every 45 days" and that they must "report the status of each request in DROP within 45 days." (CalPrivacy, DROP for data brokers) By June 2, 2026 the agency counted "more than 300,000 Californians signing up for the free tool." (CalPrivacy press release) How DROP works: our guide to the Delete Act and DROP.

Per-broker opt-out steps are in our data broker directory.

Method and limits

• Source file. registry.csv from the CalPrivacy registry page, retrieved 2026-10-06, 603 rows. Re-downloaded 2026-10-09 to cross-check: same names, same values.
• Columns used. Requests to delete: total received, complied in whole, denied, median days to respond in 2024. Requests to opt out of sale or sharing: total received. Complied in part, mean days and the data-collection flags come from the full CSV. There is no column for requests to correct and no registration-year column.
• Rules. "Reporting brokers" means deletion requests received above 0. Per-broker rates use only brokers with at least 100 deletion requests. "Over 45 days" means a reported median of 46 or more. We quote medians rather than means because one broker holds 45% of the total.
• Limits. Self-reported, unaudited. Metrics cover calendar year 2024 as labeled in the file. Zero and blank cannot be told apart. Three entries report more outcomes than requests and were left as reported. The registry page currently says the listed businesses "operated as data brokers in 2025" and the June 2026 press release says "the Data Broker Registry now includes 581 registered data brokers"; our file has 603 rows. We did not reconcile the difference.
• No categories. We did not sort brokers into people-search, marketing or B2B. A keyword rule on names and websites produced too many false positives to publish.
• Verification. Every number was computed by a script, never by hand. The script and all intermediate figures are in one analysis file. Journalists and researchers can request it through the contact on our methodology page.

FAQ

How many data brokers are registered in California? The registry file we downloaded on 2026-10-06 lists 603 brokers. CalPrivacy's press release of June 2, 2026 cited 581 registered data brokers, so the number moves during the year.

Do data brokers deny deletion requests? Rarely in total: brokers reported denying 1.5% of 58 million deletion requests for 2024. But among 307 brokers with at least 100 requests, 40 reported denying more than half of them, and 6 reported denying every request they received.

How long does a data broker take to answer a deletion request? The typical broker reported a median of 5 days. 59% of brokers with requests reported a median of 7 days or less, and 8 brokers reported a median above 45 days.