Texas hits data brokers for not registering, underscoring a larger privacy problem

Data broker registries are now operative in four states but many do not register, a fact which makes it difficult for authorities to track their business practices and alert consumers to their operations.

Texas sent violation notices last Monday warning six businesses that they must register with the state or face fines of at least $100 a day spent unregistered, Recorded Future News learned through public records requests. 

The six companies put on notice are LoopMe Limited, Fifty Technology, Affinity Solutions, ZenLeads Inc., Spectrum Mailing Lists and HubSpot Inc.

California also has recently begun picking up the pace in its data broker registration enforcement. The state attorney general’s office fined facial recognition technology firm Clearview AI $68,800 for failing to register in 2022, but did not issue any other such penalties. 

The California Privacy Protection Agency (CPPA), which took over enforcement of data broker registration on January 1, fined two data brokers — UpLead LLC and Growbots, Inc. — about $35,000 each last month for failing to register.

Those fines followed the office’s announcement of an investigative sweep to check compliance on Oct. 30. 

The California Delete Act mandates penalties of $200 per day for data brokers failing to register by the state’s annual deadline. 

Experts say that data brokers' failures to register is a serious problem and that the wildly different total number of brokers registered in the four states requiring it proves that many brokers don’t come forward as required by law.

Last month the California advocacy group Privacy Rights Clearinghouse completed a centralized analysis showing the disparity in registrations across the four states which require them. Most data brokers operate nationally, but the registration numbers for California, Oregon, Texas and Vermont range widely.

In California, 519 brokers are currently registered while in Oregon the number is 206, in Texas 217 and in Vermont 467.

In the new year, Privacy Rights Clearinghouse plans to share its research showing which data brokers are registered in each state with state enforcement authorities to fuel a broader crackdown, Emory Roane, associate director of policy there, said via email.

“All it takes is one look at the brokers that are registered already to realize that most people have no idea these data brokers even exist, much less which ones are buying and selling their personal information,” Roane said via email. “For the many brokers we know aren't registered, consumers simply have no way to find these businesses to try to exercise their privacy rights.”