{"id":8684,"date":"2026-09-08T11:06:06","date_gmt":"2026-09-08T11:06:06","guid":{"rendered":"https:\/\/nextcitydigest.com\/?p=8684"},"modified":"2026-09-08T11:06:06","modified_gmt":"2026-09-08T11:06:06","slug":"californias-new-privacy-system-depends-on-data-brokers-with-a-poor-record-of-following-the-law-stanford-research","status":"publish","type":"post","link":"https:\/\/nextcitydigest.com\/?p=8684","title":{"rendered":"California\u2019s new privacy system depends on data brokers with a poor record of following the law: Stanford research"},"content":{"rendered":"
\n
\n

California\u2019s new, first-of-its-kind \u201cDROP\u201d program enabling residents to have personal information deleted by data brokers depends on companies that have frequently failed to follow privacy law already on the books, new research from Stanford University suggests.<\/p>\n

Read more Rubin: Trump has started a dumb trade war with Canada that threatens US jobs and security<\/a><\/p>\n

More than 600 companies have registered with the state as data brokers under California\u2019s first-of-its-kind 2023 Delete Act. Under that law, California\u2019s privacy regulator CalPrivacy created the DROP platform, a one-stop shop for Californians to have much of their personal data purged by companies that collect and sell everything from real-time locations to information related to reproductive health and gender identity. As of last week, about 520,000 California residents had signed up.<\/p>\n

However, Stanford researchers reported in a new paper that fewer than 1 in 10 of the data brokers who have registered for the DROP program had complied fully with transparency requirements of the California Consumer Privacy Act of 2018, that requires them to respond to data-deletion requests by individual consumers and remove information. Large numbers of data brokers threw up friction and \u201cdark patterns\u201d that made it harder for consumers to get their information removed, the researchers said.<\/p>\n

On transparency, the researchers analyzed the websites and privacy policies of the 522 data brokers registered at the time, to determine their compliance between June and September 2025 with the requirement to report the number of data-deletion requests they had received, and to post a privacy policy. Separately, the researchers analyzed a random sample of 250 of the brokers\u2019 online-request processes, identifying friction and dark-pattern design features, including 21% of brokers making consumers solve CAPTCHA puzzles, and 43% forcing people to resubmit the same form multiple times or submit multiple forms collecting the same information.<\/p>\n

\u201cClearly there have been companies not taking this seriously,\u201d said report co-author Jennifer King, privacy and data policy fellow at the Stanford University Institute for Human-Centered Artificial Intelligence. King said she thinks many companies she and her colleagues found noncompliant with the privacy law believe state privacy regulators are too overwhelmed by the amount of data collection they\u2019re charged with policing, or that the regulators don\u2019t understand the industry well enough to enforce privacy laws effectively.<\/p>\n

\u201cThe Stanford report was excellent,\u201d said CalPrivacy Executive Director Tom Kemp, in revealing many data brokers\u2019 failure to follow the privacy act.<\/p>\n

Kemp emphasized the actions his agency had taken under that law against noncompliant companies and said Cal Privacy will continue with enforcement and auditing. He also pointed to the work CalPrivacy is doing to make sure data brokers register for the DROP program.<\/p>\n

So far, the agency has fined more than a dozen data brokers for failing to register under the Delete Act, with penalties of $200 per day mostly totaling $30,000 to $60,000, Kemp said. He believes those sanctions have rippled through the data broker industry, driving up registrations.<\/p>\n

\n<\/div>\n

But the Stanford finding of widespread noncompliance with privacy law \u201cis really concerning,\u201d and shows the need for stronger enforcement, said Lena Cohen, a staff technologist and privacy expert at the Electronic Frontier Foundation, a San Francisco-based civil liberties nonprofit.<\/p>\n

\u201cIf there are weak enforcement mechanisms, companies can sort of factor the low risk of enforcement into the cost of doing business, and keep violating our privacy,\u201d Cohen said. \u201cUnless companies face serious consequences for violating our rights, they\u2019re unlikely to put privacy ahead of profits.\u201d<\/p>\n

Walnut Creek auto-industry marketing and consumer-data company AutoWeb was one of a handful of Bay Area data brokers named in the Stanford report as having transparency issues. The company\u2019s parent firm One Planet Group, also of Walnut Creek, told this news organization that at the time of the research, AutoWeb had \u201can established privacy-request process\u201d using a third-party compliance-management platform.<\/p>\n

One Planet said it confirmed that AutoWeb\u2019s privacy policy directed consumers to annual deletion-request numbers, but that it had not been able to determine whether the link to its metrics was working during the research period.<\/p>\n

\n<\/div>\n

\u201cAutoWeb treats privacy compliance as an ongoing operational responsibility,\u201d One Planet said in a statement. \u201cWe regularly review our processes, monitor regulatory developments, participate in industry and regulatory discussions, and update our practices as requirements evolve.\u201d<\/p>\n

Of the more than 600 data brokers currently in CalPrivacy\u2019s registry, 115 sell people\u2019s precise locations. More than 40 sell identity data that can include Social Security numbers. Almost 70 sell information on people\u2019s gender identity. Eight sell data related to reproductive health, and six sell information on union membership.<\/p>\n

Data can be harvested from consumers when they use online apps \u2014 many of which track locations \u2014 use loyalty cards, browse the internet, marry, or engage in a multitude of other activities that leave a public record or digital trail.<\/p>\n

Read more Horoscopes September 8, 2026: David Arquette, don\u2019t neglect your needs<\/a><\/p>\n

Data brokers build dossiers \u2014 increasingly supercharged by artificial intelligence \u2014 to draw inferences about a person\u2019s interests, family, politics, lifestyle, finances, sexual orientation and health. They sell those dossiers to advertisers and marketers,\u00a0governments, landlords, employers, and in some cases, Kemp has said, anyone willing to pay, including scammers, spammers, fraudsters and identity thieves.<\/p>\n

Kemp has cited reports of federal immigration-enforcement agencies buying data including location information from brokers, and women being tracked going to reproductive health clinics. People have been rejected for rental units based on data from brokers, Kemp said.<\/p>\n

Before the DROP platform was released, Californians seeking to limit the sale of their personal information faced the laborious task of making hundreds of individual requests to data brokers. Now, using DROP should compress that process into the few minutes it takes to sign up for the platform, Stanford\u2019s King said.<\/p>\n

And with California\u2019s privacy agency having spun up an enforcement \u201cstrike force\u201d and taken aim at data broker malfeasance, there will be more scrutiny \u2014 and heavy penalties \u2014 for companies defying the law, Kemp said.<\/p>\n

The DROP platform launched Jan. 1. Data brokers are required to start processing deletion requests by mid-September, and have until November to report to CalPrivacy and individual DROP participants what data they have purged.<\/p>\n

Even before the deadlines, about a quarter of the registered brokers have reported back, Kemp said, adding that the average DROP participant has had data deleted by 50 brokers. People who signed onto DROP before Aug. 1 should be seeing deletion results, Kemp said.<\/p>\n

In November, CalPrivacy announced the creation of the Data Broker Enforcement Strike Force, intended to police the data broker industry\u2019s compliance with the Delete Act and state consumer privacy act. The latest state budget provided funding the agency is using to add several members to the strike force, Kemp said.<\/p>\n

The $200-per-day fine for noncompliance with DROP could lead to penalties of millions of dollars per day, Kemp said, providing as a hypothetical example a company failing to delete 200,000 DROP users\u2019 data getting hit with a penalty of $40 million per day.<\/p>\n

\u201cExposure to potential enforcement action is increasing now that data brokers have started processing requests through DROP,\u201d Kemp said.<\/p>\n

Cohen described CalPrivacy as \u201cone of the strongest privacy-enforcement agencies in the country\u201d that does \u201cexcellent enforcement work.\u201d But, she argued, \u201cno government agency can match the scale of privacy violations that are happening online today.\u201d<\/p>\n

Neither the privacy act nor the Delete Act allow for a key solution to the enforcement problem: the right for individuals and groups to sue companies on their own over data illegally collected or sold, Cohen said.<\/p>\n

\u201cAs good as any enforcement agency is, we need to empower people to hold companies accountable when they violate your rights,\u201d she said.<\/p>\n

Stanford\u2019s King said she\u2019ll be watching closely as DROP\u2019s effects come into focus.<\/p>\n

Read more Asking Eric: He asked me to move in with him but not my dog<\/a><\/p>\n

\u201cI hope that we really see change,\u201d she said.<\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Stanford researchers found widespread privacy-law compliance failures among data brokers now required to delete Californians\u2019 personal information.<\/p>\n","protected":false},"author":1,"featured_media":8683,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-8684","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"yoast_head":"\nCalifornia\u2019s new privacy system depends on data brokers with a poor record of following the law: Stanford research - Next City Digest<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nextcitydigest.com\/?p=8684\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"California\u2019s new privacy system depends on data brokers with a poor record of following the law: Stanford research - Next City Digest\" \/>\n<meta property=\"og:description\" content=\"Stanford researchers found widespread privacy-law compliance failures among data brokers now required to delete Californians\u2019 personal information.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nextcitydigest.com\/?p=8684\" \/>\n<meta property=\"og:site_name\" content=\"Next City Digest\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-08T11:06:06+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/nextcitydigest.com\\\/?p=8684#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nextcitydigest.com\\\/?p=8684\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/nextcitydigest.com\\\/#\\\/schema\\\/person\\\/13065d40d633843429ac57d4e5c06f9b\"},\"headline\":\"California\u2019s new privacy system depends on data brokers with a poor record of following the law: Stanford research\",\"datePublished\":\"2026-09-08T11:06:06+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/nextcitydigest.com\\\/?p=8684\"},\"wordCount\":1319,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/nextcitydigest.com\\\/?p=8684#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nextcitydigest.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/fd2e2cd91519e48af5c82352e6f1ec2d.webp\",\"articleSection\":[\"News\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/nextcitydigest.com\\\/?p=8684#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/nextcitydigest.com\\\/?p=8684\",\"url\":\"https:\\\/\\\/nextcitydigest.com\\\/?p=8684\",\"name\":\"California\u2019s new privacy system depends on data brokers with a poor record of following the law: Stanford research - Next City Digest\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nextcitydigest.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/nextcitydigest.com\\\/?p=8684#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/nextcitydigest.com\\\/?p=8684#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nextcitydigest.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/fd2e2cd91519e48af5c82352e6f1ec2d.webp\",\"datePublished\":\"2026-09-08T11:06:06+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/nextcitydigest.com\\\/#\\\/schema\\\/person\\\/13065d40d633843429ac57d4e5c06f9b\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/nextcitydigest.com\\\/?p=8684#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/nextcitydigest.com\\\/?p=8684\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/nextcitydigest.com\\\/?p=8684#primaryimage\",\"url\":\"https:\\\/\\\/nextcitydigest.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/fd2e2cd91519e48af5c82352e6f1ec2d.webp\",\"contentUrl\":\"https:\\\/\\\/nextcitydigest.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/fd2e2cd91519e48af5c82352e6f1ec2d.webp\",\"width\":1023,\"height\":682},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/nextcitydigest.com\\\/?p=8684#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/nextcitydigest.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"California\u2019s new privacy system depends on data brokers with a poor record of following the law: Stanford research\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/nextcitydigest.com\\\/#website\",\"url\":\"https:\\\/\\\/nextcitydigest.com\\\/\",\"name\":\"Next City Digest\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/nextcitydigest.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/nextcitydigest.com\\\/#\\\/schema\\\/person\\\/13065d40d633843429ac57d4e5c06f9b\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"http:\\\/\\\/nextcitydigest.com\"],\"url\":\"https:\\\/\\\/nextcitydigest.com\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"California\u2019s new privacy system depends on data brokers with a poor record of following the law: Stanford research - Next City Digest","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nextcitydigest.com\/?p=8684","og_locale":"en_US","og_type":"article","og_title":"California\u2019s new privacy system depends on data brokers with a poor record of following the law: Stanford research - Next City Digest","og_description":"Stanford researchers found widespread privacy-law compliance failures among data brokers now required to delete Californians\u2019 personal information.","og_url":"https:\/\/nextcitydigest.com\/?p=8684","og_site_name":"Next City Digest","article_published_time":"2026-09-08T11:06:06+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nextcitydigest.com\/?p=8684#article","isPartOf":{"@id":"https:\/\/nextcitydigest.com\/?p=8684"},"author":{"name":"admin","@id":"https:\/\/nextcitydigest.com\/#\/schema\/person\/13065d40d633843429ac57d4e5c06f9b"},"headline":"California\u2019s new privacy system depends on data brokers with a poor record of following the law: Stanford research","datePublished":"2026-09-08T11:06:06+00:00","mainEntityOfPage":{"@id":"https:\/\/nextcitydigest.com\/?p=8684"},"wordCount":1319,"commentCount":0,"image":{"@id":"https:\/\/nextcitydigest.com\/?p=8684#primaryimage"},"thumbnailUrl":"https:\/\/nextcitydigest.com\/wp-content\/uploads\/2026\/09\/fd2e2cd91519e48af5c82352e6f1ec2d.webp","articleSection":["News"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/nextcitydigest.com\/?p=8684#respond"]}]},{"@type":"WebPage","@id":"https:\/\/nextcitydigest.com\/?p=8684","url":"https:\/\/nextcitydigest.com\/?p=8684","name":"California\u2019s new privacy system depends on data brokers with a poor record of following the law: Stanford research - Next City Digest","isPartOf":{"@id":"https:\/\/nextcitydigest.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/nextcitydigest.com\/?p=8684#primaryimage"},"image":{"@id":"https:\/\/nextcitydigest.com\/?p=8684#primaryimage"},"thumbnailUrl":"https:\/\/nextcitydigest.com\/wp-content\/uploads\/2026\/09\/fd2e2cd91519e48af5c82352e6f1ec2d.webp","datePublished":"2026-09-08T11:06:06+00:00","author":{"@id":"https:\/\/nextcitydigest.com\/#\/schema\/person\/13065d40d633843429ac57d4e5c06f9b"},"breadcrumb":{"@id":"https:\/\/nextcitydigest.com\/?p=8684#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nextcitydigest.com\/?p=8684"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/nextcitydigest.com\/?p=8684#primaryimage","url":"https:\/\/nextcitydigest.com\/wp-content\/uploads\/2026\/09\/fd2e2cd91519e48af5c82352e6f1ec2d.webp","contentUrl":"https:\/\/nextcitydigest.com\/wp-content\/uploads\/2026\/09\/fd2e2cd91519e48af5c82352e6f1ec2d.webp","width":1023,"height":682},{"@type":"BreadcrumbList","@id":"https:\/\/nextcitydigest.com\/?p=8684#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nextcitydigest.com\/"},{"@type":"ListItem","position":2,"name":"California\u2019s new privacy system depends on data brokers with a poor record of following the law: Stanford research"}]},{"@type":"WebSite","@id":"https:\/\/nextcitydigest.com\/#website","url":"https:\/\/nextcitydigest.com\/","name":"Next City Digest","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nextcitydigest.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/nextcitydigest.com\/#\/schema\/person\/13065d40d633843429ac57d4e5c06f9b","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g","caption":"admin"},"sameAs":["http:\/\/nextcitydigest.com"],"url":"https:\/\/nextcitydigest.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/nextcitydigest.com\/index.php?rest_route=\/wp\/v2\/posts\/8684","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nextcitydigest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nextcitydigest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nextcitydigest.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nextcitydigest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8684"}],"version-history":[{"count":0,"href":"https:\/\/nextcitydigest.com\/index.php?rest_route=\/wp\/v2\/posts\/8684\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nextcitydigest.com\/index.php?rest_route=\/wp\/v2\/media\/8683"}],"wp:attachment":[{"href":"https:\/\/nextcitydigest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8684"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nextcitydigest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8684"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nextcitydigest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8684"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}