Transparency Without Teeth: An Empirical Understanding of Data Broker Regulation

It is no secret that data has taken over the modern economy, and it is unsurprising that governments have begun acting in response. Perceiving mismatched bargaining power between firms and consumers—and certain externalities resulting from the massive quantities of data being collected by firms about those consumers— many state legislatures have passed generally applicable data privacy statutes. These laws give consumers certain rights to control the data they distribute in everyday commerce. Such regulations follow an “interaction model,” whereby consumers can exercise their rights by interacting with data-possessing firms. But there is a key player that complicates this scheme: the data broker. Data brokers buy and sell data about consumers with whom they never interact. They can have just as much—or more—data about a consumer as a traditional firm, but that consumer has no way to know that they do. How, then, is a consumer meant to exercise their rights with this “interaction gap” between them? A handful of states have tried to soften the interaction gap by enacting data broker–specific legislation under the “transparency model.” These laws, among other things, require brokers to publicly disclose themselves in state registries. The theory is that consumers would exercise their rights against brokers if they simply knew of the brokers’ existence. California recently went further than the transparency model with the Delete Act, charting a new path for providing consumers data broker– specific privacy rights. Assembling brokers’ reported privacy request metrics, this Comment performs an empirical analysis of the transparency model’s efficacy. It argues that privacy request usage rates demonstrate that the model does not do enough to facilitate consumers in following through on their expected privacy preferences. Regulators, if seeking to actually impact broker practices, must follow in the footsteps of the Delete Act and move beyond the transparency model.