The Legal Loophole That Lets Data Brokers Sell Your Information

Why There’s No Single Law Banning This

The US has no comprehensive federal privacy law. What it has instead is a patchwork of sector-specific rules, each covering a narrow slice of how information gets used:

• The Fair Credit Reporting Act, for credit and employment decisions
• The Gramm-Leach-Bliley Act, for financial institutions
• HIPAA, for healthcare providers
• COPPA, for children’s data

A company that simply collects public and semi-public information and resells it, without touching any of those specific sectors, generally falls into the space between them. That gap is the entire reason data brokers can operate as a business model in the first place.

Federal law does occasionally step in directly, but narrowly — the 2026 TAKE IT DOWN Act, for example, forces platforms to remove non-consensual intimate images within 48 hours of a valid report.

There’s no equivalent blanket takedown duty for a broker profile, which is exactly why the patchwork above is what you’re actually working with. See our guide to that federal takedown law for how narrowly it’s scoped.

The Publicly Available Information Loophole

Even states with comprehensive privacy laws build in an exception that matters more than most people realize. California’s Consumer Privacy Act, for example, fully exempts information that qualifies as “publicly available” — government records, voter registration data, and other information lawfully made accessible to the public.

That exemption is what lets a broker scrape property records, court filings, and voter rolls without running into the same restrictions that would apply to, say, your browsing history or purchase data. The information isn’t protected because it was never treated as private to begin with, regardless of how uncomfortable it feels to see it aggregated in one place.

This is the same exemption that lets a classic people-search aggregator like Radaris compile property records, court filings, and voter rolls into a public profile without needing anyone’s consent.

The FCRA Line: Why Some Background Check Sites Are Regulated and Others Aren’t

Not every company that compiles information about people is regulated the same way, and the dividing line isn’t what a company calls itself. The FTC’s own guidance is direct on this: a company is a “consumer reporting agency” under the Fair Credit Reporting Act if its reports are used, or are expected to be used, for decisions about employment, credit, or housing — regardless of whether the company labels itself that way.

This is why a genuine employment background-check service has real compliance obligations, while a people-search site that simply displays the same categories of information, without being built for those specific eligibility decisions, formally sits outside FCRA’s reach. Sites like CyberBackgroundChecks and AdvancedBackgroundChecks are examples of that second category — they compile and display the same kinds of records without functioning as a consumer reporting agency under the FCRA definition.

Registries Are Not the Same as Deletion Rights

A handful of states now require data brokers to register — but registering and actually deleting your information are two very different obligations, and states have landed on very different versions of each.

Three states illustrate how different “registration” can look in practice:

• Vermont was first, in 2018: brokers must register annually with the Secretary of State, but the law creates a public list, not a deletion mechanism.
• Oregon’s registry has been active since January 2024, requiring a $600 fee and a short public “opt-out narrative,” again without a centralized way to request deletion.
• Texas required registration by March 2024 and imposes a general duty to maintain reasonable data “safeguards” — but, like Vermont and Oregon, gives consumers no single deletion request to file.

In practice, these registries solve a narrower problem than most people assume: they tell you who to contact, not how to make all of them stop at once.

California’s Delete Act Is Now Actually Live

California went further, and the timeline here matters. The state’s new deletion platform (DROP) opened for consumers on January 1, 2026, letting a resident submit one request instead of contacting dozens of brokers individually.

But the harder obligation — brokers being legally required to actually process those requests — only started on August 1, 2026, a deadline that passed just last month. Brokers must now check the DROP system at least every 45 days for new requests.

Connecticut passed a similar law, but its own deletion mechanism isn’t required to be operational until July 2028 — a reminder that “the state has a data broker law” and “the state has a working deletion system” are two different claims, even within states that look similar on paper.

Enforcement Is Thin, But It’s Starting

Registration requirements only matter if someone actually enforces them. In June 2024, Texas Attorney General Ken Paxton’s office sent notices to more than 100 companies for apparently failing to register by the state’s March 2024 deadline.

It’s a modest action in the scope of the industry, but it’s real evidence that these registry laws carry an actual penalty for non-compliance, not just a symbolic requirement nobody checks.

None of this adds up to a right to disappear entirely — even in states with the strongest rules, opting out of one broker doesn’t touch the dozens of others still holding a copy of the same information, and the ones you do clear can resurface later as brokers re-acquire and re-list the same underlying data (see our guide to why listings reappear). Our data broker removal service works through this site by site, including the FCRA-gray-area sites and classic people-search aggregators already mentioned above.

---

Because new listings keep appearing even after a successful removal, ongoing monitoring is usually the more realistic long-term answer than a one-time cleanup. Get a free assessment of what’s currently out there.