The CPPA makes every data broker operating in California register annually and file a sworn statement about what they collect and who they sell to. We pulled a small slice of NowSecure MARI and cross-referenced 6,612 mobile apps against that registry. MARI scans thousands of apps per day on an ongoing basis; this post is a sliver of that. Of the forty-one brokers we matched, twenty-four are actively running as SDKs; the rest appear as URL strings baked into binaries.
Every California-registered data broker, observed in our mobile sample or not. Search by name, DBA, or website. Filter by sensitive-data category or who a broker sold to in the past year. Click any row to see the full disclosure checklist and a link to the broker's consumer-rights portal.
This is research. Before the findings, the mechanics.
rlcdn.com).4 apps
iSpot.tv is one of the brokers in our matched set that self-disclosed selling consumer data to a developer of a GenAI system or model in the past year, consistent with their public Sage AI product line. All four of the apps in which we observed iSpot.tv endpoints are active integrations, not just URL references.
163 apps · 50 more referenced
Comscore self-discloses collecting personal information of minors. We observe their SDK (scorecardresearch.com) actively running in 163 apps, more than any other matched broker in the sample. 77% active-to-referenced ratio.
2 apps · all four disclosure flags
MaxMind is the only broker in our matched set that self-disclosed sales to all four of: foreign actors, federal government, law enforcement, and GenAI developers. Tiny mobile footprint in this sample, but the filing itself is the story.
31 apps
LiveRamp's mobile SDK surface (rlcdn.com and liadm.com, inherited from acquisitions) is actively running in 31 apps in the sample. LiveRamp self-discloses collection of government-issued identification numbers.
Every CPPA-registered broker we observed in the sample, sorted by evidence strength. Click any row to expand it and see the member filings, specific hostnames, and the full disclosure checklist from each broker's CPPA filing. Type to search by broker, app, or host.
Live endpoint contact, cross-validated by multiple signals (API call + captured traffic, or a pinned certificate). High confidence the broker's SDK is actually running.
The app contacted the broker's endpoint during analysis (API call or captured traffic), but we didn't see the cross-validating signals a "strong" rating needs. Real activity, thinner evidence.
The broker's domain appears as text in the app binary, but we never saw the app call it. Often a privacy-policy URL, deep-link target, or dormant SDK code that didn't fire during our run.
Some broker domains appear as text strings inside app binaries, typically in privacy policies, FCRA disclosure links, or deep links to a broker's consumer-rights portal. But we don't observe the apps actually connecting to them. That doesn't mean these brokers don't get data about you. It means they don't get it directly from these apps. They're downstream; they buy from the adtech vendors above.
The brokers below still file sworn statements with the CPPA about what they collect and who they sell to. Those filings are their own disclosures, not inferences from our data.
NowSecure continuously analyzes the binaries teams ship and the ones your users trust you with. If you want to know which data brokers are reachable from your mobile attack surface, we'll run the query.
Talk to NowSecure → Explore MARI