Economics of Data Broker Opt-Out Friction

A motivated person trying to remove themselves from the data broker ecosystem will, on a typical attempt, encounter dead URLs, moved opt-out pages, and forms that fail to submit. The standard interpretation — that data brokers are operationally sloppy, that their compliance teams are under-resourced, that broken links are an accident of organic web rot — does not survive contact with the numbers.

The friction is not incidental. It is doing economic work.

This piece walks the unit economics of the data broker subscription business, traces what each opted-out record actually costs the broker, and shows why an industry whose entire revenue model depends on database completeness has no commercial incentive to make opt-outs convert. The numbers anchor to public SEC filings, broker self-reported database claims, and standard UX research on user behaviour at failure points. Sources at the end.

The conclusion that emerges is uncomfortable but defensible. Broken opt-out links protect millions in subscription revenue annually. The opt-out failure rate is not a bug. It is closer to a feature.

The user numbers: what happens when opt-outs break

The most-cited UX statistic on broken links is this: 60% of users who hit a broken link exit the site immediately. Mobile users are harsher: 60% leave within 10 seconds. The figure is consistent across UX research aggregated in 2025 reviews of the field. For e-commerce checkout flows the rate is worse: 70% of users abandon a purchase if they encounter a broken checkout link.

Multi-step processes degrade further. The Baymard Institute and HubSpot, tracking 4.2 million form submissions across 18 industries, place the average web form abandonment rate at 67.9%. B2C lead-capture forms abandon at 72.3%. A Nielsen Norman Group field study of 2,200 participants across 11 countries found that 69.8% of users exit at step one of a multi-step form.

Broker opt-out flows are multi-step forms that exhibit every documented abandonment driver simultaneously. They are long, with eight to fifteen fields typical. They use unfamiliar legal terminology, which Baymard's research identifies as 22% of self-reported abandonment reasons. They require government ID upload, the "trust concerns about data use" category at 19%. They demand exact matching on prior addresses and phone numbers, which triggers the validation-error category at 14%. They route through verification emails sent to addresses people may no longer access.

The baseline expected completion rate for a fully working multi-step broker opt-out — every URL live, every form responsive, every confirmation email delivered — is approximately 30%. That is the optimistic case.

The actual rate is lower, because of a mechanism that operates entirely outside the broker's own infrastructure.

URL turnover, and what it lets the broker measure

Brokers periodically reorganise their privacy pages. The opt-out URL path moves. The broker's own site is fine; the new URL works perfectly for anyone landing on it directly. But every external reference to the old URL becomes a broken link. The third-party privacy guides, the consumer-protection sites, the maintained opt-out lists like our own: all of these point at URLs the broker has retired. A user clicking through from any external resource lands on a 404 on the broker's domain, or is redirected to the broker's homepage with no breadcrumb back to the opt-out flow.

This is not URL rot in the casual sense. It is URL turnover, and it has an analytical consequence. Users who would otherwise have arrived at the opt-out form directly are forced to navigate the broker's own site to find the relocated form. That navigation generates measurement.

Every click on a footer link, every drop-off from a privacy index page, every abandoned form field becomes input to the broker's conversion-rate analytics, with the optimisation target inverted. The infrastructure for maximising conversion on a checkout funnel is the same infrastructure for minimising conversion on an opt-out funnel. Heatmap tools, session replays, multivariate testing of footer placement, dropdown depth, link wording, form-field ordering: the standard toolkit of any marketing organisation. The broker has it. The broker uses it. The optimisation target is set on minimum.

Stack the 60% broken-external-link exit rate on top of the 67.9% multi-step form abandonment baseline for the users who persist past the 404. A user clicking through from an external opt-out guide to a relocated broker URL has roughly a 13% chance of completing the opt-out flow. The 60% who never make it past the broken link are the population the broker's funnel never has to defeat, because they were defeated by URL turnover before the funnel reached them.

These are user-side numbers. They describe motivated people trying and failing. The supply-side numbers — what each abandoned opt-out is worth — explain why this matters to the broker.

What a record is worth

The cleanest public-company anchor in the data broker space is ZoomInfo. Their 2024 annual revenue was $1.214 billion against a 2023 milestone of 235 million global B2B contacts. Recent marketing claims push toward 321 to 500 million, but those include cumulative records that brokers do not remove from headline figures: stale entries, people who changed jobs, deceased contacts, opted-out records carried as suppression entries. Take 235 million as conservative.

$1.214 billion divided by 235 million contacts equals approximately $5.17 in annual subscription revenue per held contact record. Every contact that stays in the database for another year is worth roughly five dollars to ZoomInfo, in aggregate, across the subscription base.

This number is generated by the buyer-side subscriptions that pay for access. The published prices, where available:

Cognism's pricing is quote-based, with no public list. Vendr benchmarking and procurement-side reviews put the platform fee at $15,000 to $25,000 before per-seat costs, with the Platinum (Grow) tier at approximately $1,500 per user per year and the Diamond (Elevate) tier at approximately $2,500 per user per year. "Unlimited" access carries a fair-use cap of approximately 2,000 records per user per month, with a credit system for bulk export and API calls. Standard discounts run 28% to 52% off list. Hidden costs include onboarding fees, intent-data add-ons at $1,600 to $6,000 per year for 8 to 15 topic feeds, auto-renewal clauses, and 10% to 15% annual price increases at renewal.

ZoomInfo enterprise contracts run $30,000 to $75,000 per year typical, custom-priced. 6sense and Demandbase, both at the account-based marketing intent-data tier, run $50,000 to $150,000 per year for custom enterprise contracts.

These are the prices paid by B2B sales teams, marketing operations, and revenue-intelligence functions at mid-market and enterprise firms. The brokers selling them are not selling leads. They are selling subscription access to a maintained database. Database completeness is the moat.

The math runs the other direction at the consumer side. Experian's ConsumerView covers 300 million individuals and 126 million households in the United States. Experian's FY2024 total revenue was $7.097 billion; Marketing Services as a sub-segment is analyst-estimated at $1.5 to $2 billion. Per individual: approximately $5 to $7 per year, similar to the B2B contact grade. Acxiom's InfoBase, now part of LiveRamp, covers approximately 260 million individuals across 162 million US households with 1,500 attributes per record. Equifax's Work Number holds over 700 million employment records on the workforce side.

The identity-resolution grade is different again. LiveRamp's AbiliTec system contains over 4.5 billion name and postal records, 1.1 billion email addresses, 600 million phone numbers, and 14 billion devices, per LiveRamp's public technical documentation and a BusinessWire announcement at the time of their connected-TV identity launch. LiveRamp's FY2024 revenue was $660 million. Against 14 billion devices, that is approximately 5 cents per device per year. Against 4.5 billion name records, approximately 15 cents per name per year.

A motivated person opting out across the broker ecosystem hits all three grades simultaneously. B2B contact brokers at roughly $5 per record. Consumer marketing brokers at roughly $5 to $7 per individual. Identity-resolution brokers at $0.05 to $0.15 per identifier. The per-attempt revenue value differs by 30x depending on which kind of broker the user is trying to escape.

Three broker grades

A short taxonomy, because the economic claim only works if the reader knows which broker is which.

B2B contact databases (ZoomInfo, Cognism, Apollo.io, Lusha) sell records of business contacts: name, title, company, email, phone, sometimes mobile. Customers are sales and marketing teams using contact lists for outbound prospecting. Revenue per held record: approximately $5 per year. Total addressable subscription market: tens of thousands of paying organisations globally, each at $15,000 to $150,000+ annually.

Consumer marketing databases (Experian Marketing Services, Acxiom InfoBase, LexisNexis Risk Solutions consumer arm) sell records of individual consumers: name, address, demographic attributes, purchase indicators, mortgage status, credit-relevant data points. Customers are marketers, insurance underwriters, financial services, government agencies. Revenue per held individual: approximately $5 to $7 per year. Database scale: 200 to 300 million individuals per major broker at US scope; pan-EU and global brokers operate at lower individual coverage but higher per-record value due to regulatory complexity.

Identity resolution graphs (LiveRamp AbiliTec, RampID) sell the mapping between identifiers. A given person owns a phone, an email, a postal address, multiple devices, multiple cookies. The graph maps these together so that an ad placed against one identifier can be measured against another. Customers are ad-tech platforms, programmatic exchanges, broadcasters. Revenue per identifier: $0.05 to $0.15 per year, but at 14 billion devices the aggregate is the asset.

The economic implication of the three-grade structure is that opt-outs are not equivalent across grades. Opting out at a B2B broker like Cognism removes one record worth approximately $5 per year. Opting out at LiveRamp severs identifier links across many devices and addresses for the same person, but each link was worth pennies individually. The B2B broker has more dollar-per-record incentive to keep the opt-out from completing. The identity-resolution broker has volume-per-record incentive to keep the opt-out from completing.

Both have an incentive. The grade only changes the per-attempt economic value of friction.

The math chain

A worked example, defensible to the order of magnitude.

Take 100,000 motivated users attempting to opt out across 50 major data brokers each. That is 5 million opt-out attempts, distributed across a broker stack that includes both B2B and consumer grades.

Apply a 25% external-link breakage rate. This is the order of magnitude observed in our own quarterly audits of the broker URLs we maintain. Broker reorganisation, not broker negligence, is the operative mechanism. We track 220 broker URLs across our EU and US opt-out lists. The May 2026 audit cycle fixed 55 broken external destinations across our content, including these lists. The rate at any given snapshot sits in the 15% to 25% range across the maintained set. The same rate applies, on average, to any third-party guide that has not been audited recently.

That is approximately 1.25 million broken external-link encounters distributed across 100,000 users. The 60% immediate-exit rate on broken external links accounts for approximately 750,000 abandoned opt-out attempts at the broken-link stage. The remaining 500,000 attempts proceed to the broker's homepage to hunt for the relocated form, where the multi-step form abandonment rate culls roughly another 340,000. The two stages together account for approximately 1.09 million failed opt-outs out of 1.25 million attempts touched by URL turnover. The records stay in the broker's active database.

To stay conservative, the dollar math below counts only the broken-link-stage abandonment (750,000 records retained). The actual revenue protected is likely larger, because users forced through the broker's homepage funnel are operating under additional friction the baseline form abandonment number does not account for.

Apply a blended per-record revenue value of $3 per year. The blend reflects a mix of B2B contact grade ($5), consumer marketing grade ($5 to $7), and identity-resolution grade ($0.05 to $0.15 per identifier). $3 is conservative.

The math: 750,000 records retained, multiplied by $3 per record per year, equals approximately $2.25 million per year of subscription revenue protected by URL turnover alone, across a single 100,000-user cohort.

Compounded across the typical five-year subscription tenure for the underlying customer contracts: approximately $11.25 million of revenue defended per cohort.

The numbers are sensitive to the inputs. A 40% breakage rate, plausible in some broker categories with high URL churn, doubles the friction value. A blended per-record figure of $5, the upper end of the B2B grade, raises the total by 67%. A two-year compounding window, a more conservative subscription assumption, lowers it.

The precise number is not the point. The point is that the number is several orders of magnitude larger than zero. It is the size of an annual revenue line item, defended by a structural mechanism that requires no active engineering. URLs turn over. External references break. Users leave. Records remain monetisable.

A broker that announced opt-out URL changes through standard channels — issuing redirects from old paths to the new opt-out form, updating sitemap entries, notifying known third-party privacy guides — would, mechanically, lower the friction yield. Most brokers do not. The infrastructure to do so exists at every organisation with a competent web team, which is all of them. The infrastructure to measure where users abandon the funnel also exists at every organisation with a competent marketing team, which is also all of them. The choice of which infrastructure to invest in surfaces the actual priority.

Implications

The standard reading of broker opt-out failure is incompetence. The economic reading is intent — not deliberate engineering, necessarily, but a stable equilibrium where no one inside the broker organisation has a measurable incentive to push the opt-out completion rate higher.

Three implications follow.

First, regulatory remedies that focus on the broker's stated policy — does the privacy notice include an opt-out mechanism, are the rights enumerated, is the response window stated — miss the operational mechanism that defeats the policy in practice. A broker can be fully compliant with the letter of "publish the opt-out URL" while running adversarial URL turnover that defeats every external reference to that URL. The California Delete Act and its DROP registry, effective January 2026, attempts to address exactly this by routing opt-outs through a central registry that bypasses the broker's own funnel entirely. Brokers begin accessing the DROP system on 1 August 2026 and must pull deletion requests at least every 45 days. The mechanism is correct. The coverage is California-only.

Second, the EU's Article 17 GDPR right to erasure is enforced complaint-by-complaint. A single supervisory authority complaint following a failed broker erasure can land within weeks for individual remedy. The Dutch Autoriteit Persoonsgegevens fined Clearview AI €30.5 million in May 2024. The French CNIL imposed €20 million on the same company in October 2022. Individual rights are intact. Scaling them requires either dedicated practitioner work or a regulatory shift, which the European Data Protection Board's 2026-2027 work programme contemplates but has not yet codified. For the supplier-side reconnaissance dimension of broker enforcement, our prior piece on right-of-access reconnaissance and the Article 15 gap maps the underlying mechanic.

Third, the economic-incentive analysis identifies who should be expected to fund the fix. The brokers will not, because URL turnover is revenue-protective. The buyers — the firms purchasing broker subscriptions for marketing, KYC, identity verification, and risk decisioning — might, but only if regulators or procurement standards make broker opt-out completion rates a contractual term. The FTC's May 2026 settlement with Kochava, banning the sale of sensitive location data without affirmative consent, is the regulatory direction this is moving. The shift from "policy exists" to "policy converts" is the audit question.

For the individual reader hitting a 404 on a broker's opt-out URL, the rational response is not to navigate the broker's own site looking for the new URL. That is the funnel the broker has measured and tuned to demotivate completion. The rational response is to document the failure with timestamp and the URL that was published, lodge a supervisory authority complaint where jurisdiction allows, and treat the URL turnover itself as evidence of a systemic mechanism rather than a one-time accident. For the practitioner-level walkthrough of where DIY removal hits its limits, our prior piece on automated data broker removal limits is the companion to this analysis.

The link is broken because the broker has every commercial incentive to let it stay broken, and no regulatory requirement to maintain redirects from old opt-out paths to new ones. The asymmetry is the point.