Privacy experts say that US state laws requiring data brokers to register are not adequately enforced, letting large numbers of brokers operate under the radar
Suzanne Smalley / The Record : X: @suzannemsmalley X: Suzanne Smalley / @suzannemsmalley : Data broker registry laws have not been well enforced, leading many brokers to ignore them + raising questions about the efficacy of the just enacted CA Delete Act. One data broker erasure pro told me brokers sell cell phone numbers belonging to minors https://therecord.media/...
Context & Ripple Effects
State-level registration requirements were designed to make an opaque market legible: Vermont’s framework made it possible to identify 121 brokers operating in the US, while its early rollout also exposed how few firms were registering accurately.
The reported enforcement gap matters because a deletion regime can only reach companies regulators and consumers can identify. It puts the newly enacted California Delete Act’s practical coverage, rather than its stated mechanism, at issue.
First-order effects
- Unregistered brokers can avoid the disclosure and accountability obligations tied to state registries, leaving consumers with an incomplete view of who holds or sells their information.
- California’s new deletion system faces an immediate coverage problem: brokers outside the registry may not be reachable through a registry-based request process.
Second-order effects
- Compliant brokers may face higher reporting burdens than rivals that remain undisclosed, weakening the competitive neutrality of state-by-state transparency rules.
- Consumer erasure services and privacy advocates must rely more heavily on their own broker discovery efforts, reducing the usefulness of official registries as a complete directory.
Third-order effects
- If registry obligations are not paired with credible detection and enforcement, data-broker regulation risks becoming a partial compliance layer rather than a market-wide consent architecture.
- Persistent gaps could strengthen the case for a broader registry or centralized oversight, though the related coverage shows that registration mandates alone do not ensure comprehensive participation.
The trend: This is one data point in the shift from privacy rules written around disclosure and opt-out rights toward the harder task of making fragmented data markets observable and enforceable.