Data Brokers Laws

Data brokers are companies that buy and sell consumer data. Many have amassed enormous archives of data, and some have created specific “profiles” of each individual consumer that include their likes, dislikes, political and sexual orientation, and other personal information. This personal information becomes dark data, where consumers don’t know exactly where it exists or what will be done with it.

In the United States, there are general privacy protections that may curb the worst abuses of data brokers, but there are few laws that directly regulate the buying and selling of consumer information.

Vermont Data Broker Law

Vermont became the first state to pass a law explicitly regulating data brokers. The law defines a “data broker” as a business that “knowingly collects and sells” to other companies “the brokered personal information of a consumer with whom the business does not have a direct relationship.” In essence, the law does not consider a company to be a data broker if it is only selling its own customers’ information to third parties — although doing so may violate other laws. If Facebook, for example, sold its users information to the Chinese government, Facebook wouldn’t be considered a “data broker” in that context because it is selling the information of users with whom it has a direct relationship. The data broker law, instead, applies to companies like Acxiom that acquire consumer information, collect it, and sell it to others — without ever interacting directly with the consumers.

Types of Personal Information Protected by the VT Data Broker Law

The Vermont data broker statute covers the following categories of “brokered information”:

1. name,
2. address,
3. date of birth,
4. place of birth,
5. mother’s maiden name,
6. unique biometric data, such as fingerprints or retina scans,
7. name or address of family members,
8. Social Security number or other government-issued identification number,
9. any other information that, alone or in combination with other brokered information, would allow a reasonable person to identify the consumer.

List of Data Brokers

Some of the most prominent data brokers are: Acxiom, Corelogic, Datalogix, eBureau, ID Analytics, Intelius, PeekYou, Rapleaf, and Recorded Future.

We successfully resolved a lawsuit against Vizio that alleged the television-maker had sold customers’ viewing information to data brokers.