Information newly made available under California law has shed light on data broker practices, including exactly what categories of information they trade in.<\/p>\n
Any business that meets the definition of data broker must register with the California Privacy Protection Agency (CPPA) annually. The CPPA defines data brokers as businesses that consumers don\u2019t directly interact with, but that buy and sell information about consumers from and to other businesses.<\/p>\n
Where there’s money to be made you\u2019ll find companies and individuals that will go to any length to get a piece of the action. At the moment there are around 480 data brokers registered with the CPPA. However, that might be just the tip of the iceberg, because there are a host of smaller players active that try to keep a low profile. There are 70 fewer data brokers listed than last year, but it is questionable whether they went out of business or just couldn\u2019t be bothered with all the regulations tied to being a listed data broker.<\/p>\n
The law requires registered data brokers<\/a> to disclose in which of the following categories they actively trade information in:<\/p>\n Four of these data brokers are active in all three of these categories: LexisNexis Risk Solutions, Harmon Research Group, Experian Marketing Solutions, and BDO USA, P.C., Global Corporate Intelligence group.<\/p>\n What is particularly disturbing is the traffic in the data of minors. Children require special privacy protection since they\u2019re more vulnerable and less aware of the potential risks associated with data processing.<\/p>\n When it comes to children\u2019s data, the CCPA requires businesses to obtain opt-in consent to sell the data of a person under the age of 16. Children between the ages of 13 and 16 can provide their own consent, but for children under the age of 13, businesses must obtain verifiable parental consent before collecting or selling their data.<\/p>\n Data brokers were under no obligation to disclose information about selling data belonging to minors until the Delete Act<\/a> was signed into law on October 10, 2023. The Delete Act is a Californian privacy law which provides consumers with the right to request the deletion of their personal information held by various data brokers subject to the law through a single request.<\/p>\n The next step forward would be if more states followed California\u2019s example. So far only four states\u2014California, Vermont, Oregon, and Texas\u2014have enacted data broker registration laws.<\/p>\n The Children\u2019s Online Privacy Protection Act (COPPA), which regulates children\u2019s privacy, does not currently prevent companies from selling data about children. An update for the bill<\/a> (COPPA 2.0), that would enhance the protection of minors, is held up in Congress.<\/p>\n In Texas, data brokers are governed by\u00a0Chapter 509 of the Business and Commerce Code<\/a> and this includes the specification that each data broker has a \u201cduty to protect personal data held by that data broker.\u201d This is important because, as we have seen<\/a>, breaches at these data brokers can be combined with others and result in a veritable treasure trove of personal data in the hands of cybercriminals.<\/p>\n If you want to find out how much of your data has been exposed online, you can try our\u00a0free Digital Footprint scan<\/a>. Fill in the email address you\u2019re curious about (it\u2019s best to submit the one you most frequently use) and we\u2019ll send you a free report.<\/p>\n\n
Check your digital footprint<\/h2>\n