The emails arrive without warning. A move to a new city, the purchase of a car, a baby registry created at a store — and inboxes flood with offers from companies never contacted and newsletters never requested. Behind those messages is a sprawling industry many Americans never see: commercial data brokers.
That industry is drawing new attention from statehouses and federal regulators, who are advancing rules to define when the collection and sale of personal information crosses a legal line. The result is an incremental but significant test of how far the country is willing to go to treat personal data less like a commodity and more like something closer to a protected asset.
A fragmented map of state laws
Over the last decade, states have been the primary laboratories for regulating data brokers. A small but growing group now requires companies that trade in personal information to register, provide disclosures, or accept new limits.
Vermont was the first to create a data broker registry, setting up a list of entities that buy and sell personal data without a direct relationship to the individuals involved. California followed with its own registration requirement and broader privacy rules that give residents a right to know, access, and delete certain data — and to opt out of its sale.
More recently, other states have moved from broad consumer privacy acts into more specific rules for data brokers. Several legislatures are weighing bills that would expand definitions of “broker” to reach firms handling everything from location traces and ad-tech identifiers to voter profiles and credit header data.
The statutes vary on basic points: which businesses are covered, what counts as “selling” data, and how much detail must be disclosed when someone asks what has been collected about them. Some laws focus on transparency — compelling companies to register or publish information about their practices — while others create substantive rights, such as the ability to demand that data be deleted or not resold.
The patchwork is intentional, at least for now. Without a comprehensive federal privacy statute, state lawmakers are stepping into what they often describe as a regulatory vacuum. In doing so, they are setting up a national test of how far traditional concepts of consumer protection can reach into an economy built on information.
What data brokers actually do
The phrase “data broker” tends to evoke credit bureaus or consumer reporting agencies, which are already regulated under longstanding federal law. The modern industry is broader and less visible.
Many firms operating as brokers obtain data from a mix of public records, commercial partners, loyalty programs, mobile apps, and online tracking tools. They combine those sources to build profiles: estimated income, likely interests, inferred health conditions, political leanings, and more.
Those profiles are then used for targeted advertising, risk assessment, identity verification, and analytics. In many cases, brokers do not know the individuals they profile, and those individuals have no direct account to log into or dashboard to adjust.
For years, the legal framework assumed that so long as truly sensitive categories — such as medical records or children’s school files — were handled under sector-specific rules, the rest of this trading could proceed with minimal oversight. That assumption is now in question.
Regulators and advocates point to practices that, while technically lawful under older rules, raise new concerns: the sale of location data associated with visits to sensitive places, the use of inferred traits in insurance or housing decisions, and the combination of different datasets in ways that can reveal identities even when names are stripped out.
Federal regulators lean on old tools for a new problem
At the federal level, privacy law remains a patchwork of targeted statutes. But agencies are beginning to use general consumer protection authority to reach some corners of the data broker market.
The Federal Trade Commission, relying on its mandate to police “unfair or deceptive” acts, has brought cases against companies that misrepresented how they used location information or failed to limit access to sensitive data. In enforcement orders, the agency has increasingly insisted on data minimization — collecting and retaining only what is reasonably necessary — and on explicit limits for sensitive categories like precise geolocation.
Other federal agencies have used existing laws to constrain how data from brokers enters decision-making in credit, employment, housing, and government benefits. Guidance documents emphasize that if consumer information is used to determine eligibility or terms in these contexts, it may fall under legal regimes that demand accuracy, transparency, and a route to dispute errors.
Even so, those interventions tend to be case-by-case. Without a comprehensive statute, much turns on whether regulators can characterize a practice as harmful in traditional consumer-protection terms: financial loss, tangible risk, or clear deception.
The business of consent
Central to many of these debates is a familiar phrase in privacy policies: “with your consent.” Data brokers rarely collect information directly from individuals, but they often rely on consent language embedded in the websites, apps, and loyalty programs that sit closer to consumers.
A mobile app that requests location access may disclose, often deep in its terms, that information can be shared with “trusted partners.” An online purchase form may include a pre-checked box allowing marketing use by “affiliates.” In practice, those phrases can lead to the transfer of data into broker databases.
State privacy laws are starting to narrow the definition of consent, moving away from implied or bundled permission and toward more specific, opt-in agreements for sensitive categories. Some statutes require separate choices for selling data to third parties, especially when it relates to precise location, health, or information about children.
Critics of the current model argue that a notice-and-consent framework is ill-suited to a world of constant data flows. Few people read lengthy policies or track which firms later buy the data. They also point out that the burden falls on individuals to navigate a complex market, rather than on companies to limit collection.
Industry groups counter that data flows underpin services that consumers rely on, from fraud detection and credit access to free content and more relevant advertising. They warn that overly rigid rules could impose compliance costs that smaller firms struggle to meet and might entrench larger incumbents.
Health-adjacent data and the line between sectors
One of the most contested questions is how to treat data that sits near, but not squarely within, traditional health privacy protections.
Federal law imposes strict rules on hospitals, clinics, and insurers when handling patient records. But information about health-related web searches, purchases of over-the-counter products, or visits to clinics inferred from location data exists mostly outside that framework.
This gap became more visible as digital health tools proliferated. Fitness trackers, period-tracking apps, and symptom checkers typically operate outside hospital systems, even if their data relates to health. So do many of the ad-tech tools that measure visits to clinics or pharmacies.
Some state laws now single out health-adjacent data, limiting its sale or requiring explicit opt-in consent for its use in advertising. Others draw broader categories of “sensitive data” that sweep in any information about a physical or mental health condition, whether collected in a medical setting or not.
These efforts intersect with debates already under way in other corners of the health system. Earlier reporting on hospital consolidation, for example, has explored how market power and patient data can intersect in ways that reshape local care. For readers tracking that evolution, further reading on concentrated hospital markets offers one view of how information and scale interact when providers merge.
The larger question is whether the law will continue to treat most health-related signals as ordinary consumer data or move toward a more unified approach to medical privacy that follows the information wherever it goes.
Law enforcement and national security carve-outs
Any attempt to regulate data brokers confronts another complication: the demand for information by law enforcement and intelligence agencies.
In many cases, public reporting has described government entities purchasing access to commercially available data, including location information, rather than obtaining it through court orders. Supporters say this approach allows investigators to use tools widely available to the private sector. Critics argue it lets agencies sidestep constitutional protections that would otherwise apply.
Several state bills now under debate would tighten how government agencies can access brokered data about residents, requiring warrants or limiting use to specified purposes. Others leave the question largely untouched or carve out broad exceptions for security and policing.
How legislatures resolve those provisions may shape not only privacy expectations but also the business models of brokers that rely heavily on government contracts.
Individuals caught between rights and reality
On paper, new privacy statutes grant residents a swelling set of rights: to know what data companies hold, to correct errors, to delete information, and to opt out of certain kinds of sharing. In practice, exercising those rights against a diffuse web of data brokers can be difficult.
Some states have tried to streamline the process with universal opt-out mechanisms that allow individuals to signal their preferences through browser settings or centralized tools. Where those signals are recognized, companies must treat them as binding choices to limit data sale or targeted advertising.
Elsewhere, residents must visit individual broker websites, locate opt-out forms, and repeat the process across dozens of entities. For people who have moved frequently, changed names, or share a household, confirming that all relevant records have been covered becomes even more complex.
This friction is not accidental. Industry groups often warn that global opt-out systems can be overbroad, affecting services that individuals might not intend to restrict. Advocates counter that without frictionless tools, rights exist largely on paper.
The next moves
For now, the United States continues to regulate data brokers indirectly, through a mix of state experimentation and federal enforcement grounded in older statutes.
National privacy legislation is periodically introduced in Congress with varying degrees of bipartisan support. Most proposals would set baseline standards for data collection, use, and sharing, likely preempting at least some state rules. Whether any bill advances may hinge on disputes over enforcement — in particular, how much power to give federal agencies and whether to allow individuals to sue companies directly.
In the absence of a comprehensive law, more states are expected to pursue their own broker registries, opt-out mechanisms, and rules for sensitive data. Companies that trade in personal information are adjusting to that trajectory, debating whether to align practices with the strictest state standards or maintain separate systems.
For individuals, the policy shifts remain mostly invisible until a data breach notification arrives, an ad appears uncannily tailored, or a denied application hints at a profile built elsewhere. The legal architecture around those moments is changing, slowly, as lawmakers and regulators decide how far to go in treating personal data less as a byproduct of modern life and more as something the law must deliberately govern.
