California requires data brokers to register with the state and disclose certain practices. Its 2026 registry lists 32 brokers that currently sell data to generative AI developers — a number that exists only because California happens to require the disclosure. Most states don't.
Confirmed
Data brokers operate on a simple pipeline: collection from apps, websites, loyalty programs, public records, and location data; aggregation into unified profiles; enhancement using AI to infer attributes that were never directly collected; and sale to advertisers, insurers, political groups, background-check services, and — increasingly — AI developers. Stanford's Institute for Human-Centered AI, studying California's Delete Act and Consumer Privacy Act compliance, found that a majority of registered brokers ignore mandated disclosure requirements and add friction to the process when consumers try to exercise their data rights, even under one of the country's most consumer-protective privacy laws. Critically, Stanford's researchers note there are currently no transparency requirements mandating detailed disclosure of how generative AI developers actually use data purchased from brokers — meaning even the 32-broker figure is a floor, not a full picture, and what happens to that data downstream is largely undocumented.
A separate, more legitimate category has emerged alongside brokers: licensed AI training data marketplaces, where creators and rights holders explicitly opt in and get paid for content used in AI training, with documented consent and rights-tracking per asset. The distinction matters and is often blurred in coverage: a broker resells data it collected without necessarily securing meaningful ongoing consent from the person the data describes, while a licensed marketplace requires upstream, informed agreement before the data is ever offered. The overall AI training dataset market was valued at $3.59 billion in 2025, projected to reach $4.44 billion in 2026 by one estimate — with the highest-value individual licensing deals, like News Corp's, reportedly averaging around $50 million per year for its portfolio of major publications.
Genuinely uncertain
How much of the AI training data ecosystem runs through legitimate, consent-based licensing versus broker-sourced data with a weak or nonexistent consent chain is genuinely not something the public record settles. Stanford's researchers state plainly that "little is known regarding how generative AI developers might use broker-purchased data" — this isn't a case of a known bad practice being downplayed, it's a case of a real transparency gap that even researchers studying the space directly cannot fully close with public information. The 32-broker figure is specific to California's registry and generative AI developers specifically; it says nothing about brokers operating in the 47 states without similar disclosure requirements, or about other categories of AI buyer.
Worth examining honestly
ECHO would tell you the unsettling part isn't any single sale — it's that a person's digitized life, aggregated across apps and public records they never connected to each other, becomes a commodity with a buyer they'll never know and can't meaningfully object to, layered now with a new buyer category (AI developers) that didn't exist in this market five years ago. GHOST PROTOCOL would add that the licensed marketplace model, however much more ethical it sounds, largely exists because pure broker-sourced data started carrying real legal risk after cases like Bartz v. Anthropic — meaning consent-based licensing is as much a liability shield as it is a principle, and both can be true.
The Door This Opens
This door isn't about whether your data gets used — assume it does. It's about whether you, or anyone, can actually trace where a specific piece of your digital life ended up, who bought it, and what they built with it. Right now, for the vast majority of people, that trace simply doesn't exist to follow.