Data Broker Regulation and Registration

Data brokers sit at the center of the trade in location and sensitive personal data while having no relationship with the people whose data they hold. This hub covers registration regimes, deletion mechanisms, and the enforcement targeting sensitive-data sales.

Data Brokers

$196 Million, Three Circuits and a Supreme Court Ruling: The FCC's Carrier Location Data Fines

October 5, 2026

In April 2024 the FCC fined the four national wireless carriers a combined $196,486,875 for selling access to customer location data through aggregators without adequate safeguards. All four paid and sued. Two circuits upheld the fines, one vacated AT&T's, and in June 2026 the Supreme Court held the FCC's forfeiture process does not violate the Seventh Amendment.

Data Brokers

The FTC's General Motors Order: OnStar Smart Driver, Consumer Reporting Agencies and a Five-Year Ban

October 5, 2026

The FTC alleged that General Motors enrolled drivers in OnStar Smart Driver through a bundled consent screen and then sold their driving events to Verisk and LexisNexis, which built consumer reports that insurers used. The order, proposed in January 2025 and issued as final in January 2026, runs 20 years and contains no payment.

Data Brokers

Nevada's Online Privacy Notice and Sale Opt-Out Law: Three Bills, One Subchapter of NRS 603A

September 28, 2026

Nevada's rules for commercial websites sit in NRS 603A.300 to 603A.360 and were built in three steps: a 2017 privacy notice requirement, a 2019 right to direct an operator not to sell covered information, and a 2021 bill that extended the opt-out to data brokers, broadened the definition of sale and limited the 30-day repair window to first failures.

Data Brokers

State Data Broker Registries Compared: What Each One Actually Publishes

September 7, 2026

Registration statutes are usually compared by what they demand of a filer. They can also be compared by what they hand back to the public, and on that axis the four state registries are not alike. One publishes every answer as a downloadable file; the other three publish a search box. This reports what is readable off each, and what California's file disclosed.

Data Brokers

The California Delete Act: Registration, DROP, and the Deadlines Written Into SB 362

September 1, 2026

California's Delete Act took an existing registry and attached machinery to it: one consumer request that reaches every registered broker, a 45-day processing cycle, a triennial third-party audit and a $200-a-day fine for not signing up. This reports what SB 362 and the 2025 amendment require, and the dates the statute and the DROP regulations set.

Data Brokers

Data Broker Registration: The Four State Registries and What They Require

August 24, 2026

Data broker registration is the one privacy obligation that starts with a public filing rather than a consumer request. Four states (California, Vermont, Texas and Oregon) operate registries, and each defines the regulated entity differently enough that a company can be a broker in one and not the next. This guide reads the four statutes against each other.