Cybersecurity Policy Report, Hundreds of Data Brokers Missing From State Registries, Privacy Advocates Find, (Jun 26, 2025)
Hundreds of data brokers that registered in one of four U.S. states with data broker registration laws did not register with the other states, suggesting possible violations of the states’ laws, according to the Electronic Frontier Foundation and Privacy Rights Clearinghouse.
“In recent years, California, Texas, Oregon, and Vermont have passed data broker registration laws that require brokers to identify themselves to state regulators and the public,” the groups noted in a news release.
“Companies that registered in one state but did not register in another include: 291 companies that did not register in California, 524 in Texas, 475 in Oregon, and 309 in Vermont. These numbers come from data analyzed from early April 2025,” they said.
The groups wrote letters to privacy enforcement officials in the four states to alert them to the discrepancy. “Our comprehensive analysis has uncovered a troubling pattern, identifying 291 data brokers that apparently have either not registered or re-registered with the California Privacy Protection Agency’s (CPPA) registry despite having registered in other states,” they said in their letter to California Attorney General Rob Bonta (D.) and Michael Macko, the CPPA’s deputy director–enforcement.
“The attached report identifies self-identified data brokers that are operating in other jurisdictions—as evidenced by their registration in states like Vermont, Texas, and Oregon—or that have previously registered in California, yet did not appear on the California’s CPPA registry at the time of data collection,” they said.
EFF and Privacy Rights Clearinghouse acknowledged, however, that their analysis didn’t necessarily indicate violations of state laws.
“More investigation by the state is needed since data broker requirements vary from state to state. But these findings could indicate a systematic failure of compliance in California, potentially undermining the transparency goals at the heart of the state’s privacy framework,” they told the California officials.
In addition, their analysis “does not capture data brokers that completely disregard state laws by failing to register in any state,” they said. “While harder to find, shady data brokers who have failed to register anywhere should remain a primary enforcement target.”
“States should investigate compliance with data broker registration requirements, enforce their laws, and plug any loopholes,” according to the groups’ news release. “Ultimately, consumers deserve protections regardless of where they reside, and Congress should also work to pass baseline federal data broker legislation that minimizes collection and includes strict use and disclosure limits, transparency obligations, and consumer rights.”
News: StateLegislation DataPrivacy