DID YOU KNOW…?
The data broker business, which buys and sells data about people like you (and about companies too), moves between about 298 and 434 billion dollars a year.
That is what two market research firms estimate for 2025. It almost always happens without the person knowing: what you pay with your data shows up on no invoice.
Sources: SNS Insider (298.3 billion in 2025) and Knowledge Sourcing Intelligence (433.9 billion in 2025). The figures vary a lot depending on who measures and what they count; that is why we give both.
THE BUSINESS OF YOUR DATA
You hand over your data for free and they sell it
You open a newspaper. Before it finishes loading, your machine has asked for twenty or thirty addresses that do not belong to the newspaper: companies that buy and sell the ad slot you are about to see, and that need to know who you are in order to auction it. You do not choose them, nobody introduces them, and you could almost certainly not name one. This page names them.
How it works, in four steps
- You open a site. The site has advertising slots it sells to the highest bidder.
- The auction takes milliseconds, and to bid you need to know who the ad is for: where you are, what you looked at before, which device you are on.
- For that, several companies have to agree that “you” are the same person who was on another site yesterday. That is called matching identifiers, and some names say so out loud:
user-sync,sync,prebid. - None of this is charged to you. You pay for it with the data.
FROM “ACCEPT” TO MONEY
The journey of your data, step by step
This is what happens, in order, from the moment you press “Accept” on a cookie notice until someone makes money from it. The names are examples of companies that do each step.
You press “Accept”
The notice stores your answer and passes it to the website’s list of “partners”. In the system most used in Europe, IAB Europe’s, more than a thousand companies are registered (source).
Who does it: Didomi, OneTrust, Cookiebot
The site calls its partners
Before the page finishes loading, each partner sets or reads a tag in your browser with a number that is yours alone: a cookie or an identifier.
Who does it: Google, Meta, Criteo, TikTok
They recognise you on other sites
Companies swap their numbers to know you are the same person on the newspaper, the shop and the blog. If you ever gave your email somewhere, they turn it into a code (a “hash”) to link it with what is known about you offline.
Who does it: LiveRamp, ID5, Tapad (Experian)
They put you in boxes
From what you look at they sort you into groups that are bought and sold: “interested in trainers”, “looking for a flat”, “travelling soon”. Data brokers buy, mix and resell those groups; in California alone 603 are registered by law (public registry).
Who does it: Epsilon, Acxiom, Experian
They auction you in milliseconds
Every time you open a page with ads, a “bid request” with what is known about you (the site, your device, your area, your identifiers, your boxes) goes out to many companies at once. A study by the Irish Council for Civil Liberties estimated in 2022 that this exposes what a person does 376 times a day in Europe and 747 in the US: 178 trillion times a year across both (ICCL).
Who does it: Sell the slot: Magnite, PubMatic, Index Exchange · Bid: The Trade Desk, Google
One wins and shows you its ad
All of it happens before the page finishes loading. The companies that lost the auction received your data anyway.
Who does it: The advertiser who paid most
The money is shared out
The advertiser pays and every middleman keeps a share. A study by the British advertisers’ association (ISBA) with PwC found in 2020 that only 51% of what the advertiser paid reached the site showing the ad, and 15% could not be attributed to anyone (ISBA).
Who does it: All of the above
An example: Ana and a pair of trainers
Ana, in Bogotá, looks at a pair of trainers in an online shop and presses “Accept”. The shop’s pixels tell its partners which model she looked at. That night Ana opens a newspaper: in milliseconds the newspaper auctions the ad slot, a retargeting company recognises her identifier, outbids the others because it knows she looked at those trainers, and Ana sees them again. That is exactly what Criteo describes in its privacy policy (Criteo). The shop pays the retargeting company, which pays the auction, which pays the newspaper. Ana gets nothing, and the companies that lost the bid already know she read that newspaper that night.
Why they earn so much
Because the data is asked of you for free, it can be used and sold many times, and every step takes its cut. That is how Alphabet, Google’s owner, took in 402,836 million dollars in 2025, mostly from advertising (Alphabet’s results), and Meta 200,966 million (Meta’s results).
What you can do
Press “Reject” when the site lets you; cut the connections to these companies with the ZERO browser, which also tells you who each one is and which country it is from; and ask them to delete your data through the privacy page linked from each company’s profile.
Who they are
Each card says what the company does, where it is and, where one exists, the penalty a regulator or a court has imposed, with a link to the file. What could not be checked is not here.
Criteo
| Headquarters | Paris · France |
|---|---|
| What it sells | Retargeting: it shows you again, on another site, the product you looked at before. |
| Reaches your machine as | criteo.com, criteo.net |
| In our measurements | It appears in this project’s measurements: 18 queries on a test PC in 24 hours. |
The French authority found that Criteo could not show that the users of its partners had given consent before their data was collected and used for advertising. The Conseil d’État dismissed Criteo’s appeal on 4 March 2026 and upheld the fine in full.
CNIL · deliberation SAN-2023-009, 15 Jun 2023 · upheld by the Conseil d’État, 4 Mar 2026 ↗LiveRamp
| Headquarters | San Francisco · United States |
|---|---|
| What it sells | Identity. Its ATS product turns a signed-in person into an identifier of its own, the “RampID”, used to recognise the same person across different sites without cookies. |
| Reaches your machine as | privacymanager.io, rlcdn.com, pippio.com |
| In our measurements | It appears in this project’s measurements: ats-wrapper.privacymanager.io, on a test PC. |
In its own words: “ATS allows publishers to resolve consented user data with a RampID in real time.” — LiveRamp documentation ↗
No penalties known to us in the sources consulted. That says nothing for or against: it says we have not found any.
Kochava
| Headquarters | Sandpoint, Idaho · United States |
|---|---|
| What it sells | Ad attribution and mobile location data. |
| Reaches your machine as | kochava.com |
The FTC and Kochava agreed an order barring it from selling sensitive location data without express consent. The FTC’s complaint held that it sold the precise location of hundreds of millions of phones, enough to follow a person to clinics, places of worship or shelters. The order was filed with the Idaho court on 4 May 2026 and has the force of law once the judge signs it.
FTC · 4 MAY 2026 ↗Verve Group
| Headquarters | Stockholm · Sweden |
|---|---|
| What it sells | Video and mobile advertising: it auctions, in milliseconds, the ad slot you are about to see. Smaato and the former LKQD are part of the group. |
| Reaches your machine as | lkqd.net, smaato.net |
| In our measurements | It is the most requested unclassified name on a whole test PC: 380 queries to cs.lkqd.net in 24 hours. |
No penalties known to us in the sources consulted. That says nothing for or against: it says we have not found any.
RTB House
| Headquarters | Warsaw · Poland |
|---|---|
| What it sells | Machine-learning retargeting: it shows you again what you looked at. |
| Reaches your machine as | creativecdn.com |
| In our measurements | It appears in this project’s measurements. |
In its own words: “We operate under the creativecdn.com domain while providing our services.” — RTB House privacy policy ↗
No penalties known to us in the sources consulted. That says nothing for or against: it says we have not found any.
FreeWheel
| Headquarters | New York · a Comcast company · United States |
|---|---|
| What it sells | Television and video advertising. The name it reaches machines by, user-sync.fwmrm.net, says what it does: matching a person’s identifier between different companies. |
| Reaches your machine as | fwmrm.net |
| In our measurements | It appears in this project’s measurements. |
No penalties known to us in the sources consulted. That says nothing for or against: it says we have not found any.
Didomi
| Headquarters | Paris · France |
|---|---|
| What it sells | The cookie window. It collects your consent answer and stores it for the site you are visiting. |
| Reaches your machine as | privacy-center.org |
| In our measurements | It appears in this project’s measurements. |
No penalties known to us in the sources consulted. That says nothing for or against: it says we have not found any.
OneTag
| Headquarters | London · Companies House 09905190 · United Kingdom |
|---|---|
| What it sells | Ad auction: it connects whoever sells the slot with whoever buys it. |
| Reaches your machine as | onetag-sys.com |
| In our measurements | It appears in this project’s measurements. |
No penalties known to us in the sources consulted. That says nothing for or against: it says we have not found any.
The ones that register as data brokers
There is one list we do not make: the companies make it themselves, by law. In California, a data broker is a business that collects and sells to third parties the personal information of people it has no direct relationship with (Civil Code 1798.99.80), and since 2024 every one of them has to register in the public registry of the California Privacy Protection Agency. When they register they tick, themselves, what they collect (precise location, data of minors, biometrics) and whom they sold or shared data with in the past year: foreign actors, the federal government, the police without a court order, developers of generative AI. On 8 October 2026 there were 603 registrants.
Using that registry, on an ordinary PC and over eight days, we counted 1,569 queries to 32 of these companies: Comscore, Taboola, Criteo, Disqus, Magnite, Index Exchange, HubSpot, PubMatic, OpenX and others. A company being on the registry is a public fact, not a verdict of ours.
What this page does NOT say
- It does not say these companies do anything illegal. What they do is published on their own sites and rests on a consent most people accept without reading. The only thing this page asserts about anyone's legality is what a regulator or a court has already ruled, and where that happened it is on their card, with the date and a link to the file. Nothing else.
- It does not say what data of yours each one holds. Only each company knows that: you can ask it through its privacy page.
- It does not say a penalty from years ago still describes the company today. The date is next to it so the two are read together.
- If you are one of these companies and a figure is wrong, write to hola@guardianagroup.com and it is corrected with its date, as everywhere else on this site.
And what GUARDIANA has to do with it
GUARDIANA does not promise to take you out of this business. It does something more concrete: in the ZERO browser it shows you which company is behind each connection, which country it is from and what it is for, and you decide what gets cut.