Regulating Data Brokers in the Age of AI: A California Case Study is a policy brief published by Stanford HAI in collaboration with Stanford's Regulation, Evaluation, and Governance Lab (RegLab), by Anna-Maria Gueorguieva, Jennifer King, Apoorva Panidapu and Daniel E. Ho (Source: hai.stanford.edu). It condenses the authors' peer-reviewed paper, "Privacy Without Remedy: An Assessment of Data Broker Compliance with California Privacy Law," presented at the ACM Conference on Fairness, Accountability, and Transparency in June 2026 (Source: dl.acm.org).
The brief measures whether a strong state privacy law produces the disclosure it requires, and reports that it largely does not. Its connection to AI policy runs through one registry field: California began in 2026 requiring brokers to disclose whether they sell data to generative-AI developers, and 32 currently do.
The brief is a compliance audit, not a study of what AI developers do with brokered data. It states directly that "little is known regarding how generative AI developers might use broker-purchased data, and there are no transparency requirements that mandate any detailed disclosure."
What was measured
Data brokers are defined in the brief as third-party companies that collect and sell the data of consumers with whom they have no first-party relationship. Some offer more than 10,000 distinct data types, and sell inferences about future behaviour alongside observed behaviour.
Two California instruments create the obligations assessed. The California Consumer Privacy Act of 2018 requires brokers to let consumers delete, correct, and stop the sale of their data, to disclose what personal information is collected, sold or shared, and to limit use of sensitive personal information on request. The 2023 Delete Act requires brokers to publicly post the number of consumer requests they received in the prior calendar year, on a theory the brief describes as crowdsourcing compliance through direct public disclosure. Only four states regulate data brokers at all, and the brief states that no other researchers had studied compliance with either instrument.
The authors reviewed all 522 brokers registered with the California Privacy Protection Agency in 2025, visiting each broker's website manually to check for a posted privacy policy and for reported rights-request figures, both before and after the July 1, 2025 compliance deadline. They separately coded the request interfaces of a 250-broker subsample.
Findings
Disclosure. 45% of registered brokers reported no information at all about requests received. 9.2% were fully compliant, reporting across all four request types — deletion, opt-out, right to know what is collected or sold, and limiting the sharing of sensitive information. Among brokers that do report, fulfilment rates exceed 80% for most request types; the exception is "right to know," at 73%. The brief's reading is that some brokers comply with the requests themselves while a majority fail the disclosure obligation, leaving regulators and researchers unable to assess compliance systematically. It also reports that the majority of posted metrics were at best incomplete and in some cases likely incorrect when compared against the same brokers' submissions to the state registry.
Interface friction. In the 250-broker subsample, 43% did not support all six consumer rights requests, a direct CCPA violation. 22% required a CAPTCHA in the request process — in one case eight separate CAPTCHAs including math problems. The authors report that brokers with less interface friction received more consumer requests, and frame the design of these interfaces as material to whether an opt-out statute works at all: because the CCPA is opt-out rather than opt-in, the burden of exercising the right falls on the consumer navigating hundreds of non-standardised processes.
The AI link. The 2026 California registry newly requires brokers to indicate whether they sell data to generative-AI companies. 32 currently do.
Recommendations
The brief makes five, framed as applying beyond California:
- Require broker registration across states. The authors note their study was only possible because the California registry exists, and that the proposed federal SECURE Data Act (H.R. 8413) contains a comparable requirement.
- Adopt automated, scalable rights-request processes, including standardised templates and one-stop mechanisms. They cite California's DROP (Delete Request and Opt-out Platform), launched January 2026, which more than 300,000 Californians had used to request deletion and opt out across registered brokers.
- Standardise reporting in both human- and machine-readable formats, since obtaining the figures from individual privacy policies is unscalable.
- Include a private right of action. The brief argues public enforcement resources are constrained and have produced suboptimal transparency, and notes that no other state regulating data brokers provides one.
- Extend protections to AI contexts, on the ground that consumer privacy law must account for the interactions between AI developers and the third-party intermediaries that collect, infer, sell and circulate personal data.
Harms cited
The brief grounds its case in documented downstream harms rather than in privacy as an abstraction: broker data used in political violence, including the 2020 targeting of District Judge Esther Salas, whose son was fatally shot at their New Jersey home by a lawyer using publicly available data; broker data used to identify military personnel; and General Motors found in 2024 to be selling customers' driving data without explicit consent to brokers, who built auto-insurance risk-scoring products from it — discovered when owners saw rate increases, were dropped from policies, or could not obtain new coverage.
Provenance and limits
Published on Stanford HAI's own domain and linked as the full text from the brief's landing page. The brief carries no publication date in its text; coverage on August 25, 2026 dated the underlying work August 11 and referred to it by the ACM paper's title, Privacy Without Remedy, rather than the brief's own (Source: insideaipolicy.com).
The study covers one state's registered brokers, and the authors note that registration there is self-selected with limited monitoring and penalties, so unregistered brokers are outside the sample entirely. Compliance rates are measured from public postings and interface review, not from audit of internal records.
Relationships
- related: Stanford HAI — publisher, with Stanford RegLab.
- related: California CCPA/CPRA Regulations — Automated Decision-Making Technology (ADMT) — the CCPA is the instrument assessed.
- supports: AI and Privacy — measured evidence on the broker layer feeding AI training data.
- related: Three Privacy Problems AI Creates — the brokered-data path is a supply-side instance of the problems that page sets out.
- related: Web Scraping for AI Training — purchased broker data is the non-scraped route into a training corpus.