The state of enforcement: Part III — Data brokers and sensitive data
State privacy regulators are increasingly targeting data brokers and sensitive-data practices, making registration, transparency and consent key enforcement priorities.
Contributors:
David Botero
Former Westin Fellow
IAPP
Editor's note
This is the third article in a three-part series that focuses on U.S. enforcement trends during 2025 and early 2026. The first article explored regulators' growing focus on consumer privacy rights, including enforcement actions against opt-out processes that rely on friction, misrepresentation, or delays in fulfilling consumer requests. The second article explored the uptick in children's privacy enforcement, focusing on parental consent, company knowledge of minors, and protective safeguards.
An increasing number of U.S. state laws require certain entities to register as data brokers, which has led to increased enforcement activity. Regulators in states such as California and Oregon have been particularly active while others, like Connecticut which recently passed its own data broker law, are expected to follow.
Across the set of recent complaints, enforcers have clarified how different business practices may result in a business acting like a data broker and how some of those practices can result in additional risks to privacy. Another issue that has seen increased enforcement across several states is the handling of sensitive data with Texas and Utah enforcing their laws.
Failure to register as a data broker
Data brokers have been of special interest to some authorities. The Oregon attorney general's report noted that 62 of the 214 complaints its office received under the Oregon Consumer Privacy Act were focused on data brokers. The report emphasizes that the amount of personal data that "people search" websites collect are of interest to the attorney general’s office, as their bulk collection of personal data to compile profiles carries high risk of inaccuracy.
In California, the Delete Act has already prompted investigative sweeps and several enforcement actions against data brokers. CalPrivacy, as the main enforcer in these cases, has required several companies to register as data brokers under the law.
The Delete Act requires that any business that meets the definition of a data broker must register with the agency on or before 31 Jan. of each applicable year.
As a result of the recent enforcement sweep, CalPrivacy has reached settlements with several companies including Key Marketing Advantage, Jerico Pictures and S&P Global Inc., signaling increased scrutiny of registration compliance.
Business practices by data brokers
Contributors:
David Botero
Former Westin Fellow
IAPP