7 ms·

Data Brokers

195 points by troydavis 7y ago

thisisastopsign 7y ago
The full submission for [spydialer] says: ----------------------------- > How a consumer may opt out of sale or submit requests under the CCPA: > Go to spydialer.com, then click the link "Do Not Sell My Info". ----------------------------- Cool. Now compare that to another one listed [infocore]: ----------------------------- > How a consumer may opt out of sale or submit requests under the CCPA: > contact the company > How a protected individual can demand deletion of information posted online under Gov. Code sections 6208.1(b) or 6254.21(c)(1): > contact the company > Additional information about data collecting practices: > No information provided. ----------------------------- Ugh. Their contact page is intended for submitting requests to do business with them: https://infocore.com/about/contact-us/ https://infocore.com/about/contact-us/
- xendipity 7y ago
  >> Go to spydialer.com, then click the link "Do Not Sell My Info". > Cool. Now compare that to another one listed [infocore]: To opt-out of spydialer.com, you go to https://www.spydialer.com/Consumers/ https://www.spydialer.com/Consumers/, then you have to provide all of the information you think it has on you to verify your identity and selectively remove it from their services. I'm not really comfortable providing my full name, address (or addresses if you've lived in multiple places), and phone numbers to a Data Broker just to opt-out - that feels quite counter to the idea of them ideally not having my information in the first place. I feel like I need a global opt-out where a system or agent on my behalf can then handle this for me at each place where data can be collected.
  - giarc 7y ago
    Until that company then turns around and sells your data. Looking at you Unroll.me
  - dannyw 7y ago
    At the very least, when a company acquires my data through any mechanism, it should be forced to email me with a copy of all the data they have on me, and with a one click link to get them to delete the data and permanently opt out. Any company found in procession of personal data without the appropriate (delivered) email notifications being sent should be fined at minimum $1000 per individual, and criminal charges if intentional. This won't put anything like services you voluntarily sign up for out of business (as they send sign up confirmations anyway, or should).
    - rckoepke 7y ago
      This would severely backfire if the data broker thought someone else's email account was associated with your identity. Say: Danny W[ilkins] - Job Title - Salary - Job application records - Social media post history - Email 1: dannyw@gmail.com (correct) - Email 2: dannywilkins@EmployerLLC.com (correct) - Email 3: dannywinters@hotmail.com (not correct) I'd assume they'd send the email containing your salary and post history to the two valid emails as well as the one invalid email. That seems like a potential nightmare for you, for example records of job searches being sent to your employer email.
      - rolandog 7y ago
        Also, there's the situation of people who receive a lot of emails from services where the user mistyped their email, but the service doesn't validate the registered email. In my case, I always feel I'm fighting a losing battle against the horde of emails addressed to users of unknown services... There are a growing number of services that validate the email and include a "I didn't register at this service". This has me worried, because I can imagine so many scenarios where the metadata aggregators scrape and mis-classify by email: A teenage boy using a Snapchat-like service had created an account with my email and I had to manually delete it; some guy used my email to register his account at a MacDonald's franchise's ERP; I once received a booking confirmation from some large airline (and Google nicely reminded me that I had an upcoming flight); also, I was once wrongfully tagged by email in an unlisted web album of a party that had taken place in a French village by an older lady. I always try to reach out to notify the person... But sometimes it's hard to call a Peruvian bank to notify them that one of their account holders used my email to register his account, and they tell you they'll get around to notifying the user, but don't. Now; I could imagine several scenarios where things might get bumpy for me in the near future... Like in the event where someone tries to forecast criminal behavior; or what if a government thinks I should be paying taxes on some income that their metadata suggests I have (because, why else would you have emails in your inbox from that bank?).
m463 7y ago
Hopefully this is a non-controversial (register only) beginning to regulation.
rolltiide 7y ago
I approve of this outcome
hbcondo714 7y ago
> a “data broker” is in the business of aggregating and selling data about consumers with whom the business does not have a direct relationship I had to make a few clicks to find the definition, more details here (scroll down to section 1c): http://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201920200AB1202 http://leginfo.legislature.ca.gov/faces/billTextClient.xhtml...
- dialfordollars 7y ago
  Lot of companies still need to register. * LinkedIn - Sell your data via Sales Navigator * ZoomInfo - Scrape your email account and sell the data to other businesses - https://www.zoominfo.com/business/about-zoominfo/privacy-policy https://www.zoominfo.com/business/about-zoominfo/privacy-pol... * DiscoverOrg * Clearbit - Browser extension scrapes your emails for data and they sell it to others via their "free browser-based add-ons, extensions, or plug-ins" - https://clearbit.com/privacy https://clearbit.com/privacy * Hunter.io - Scrape people data from your browsing activities to resell. * Demandbase
  - parsimo2010 7y ago
    I don't know about the others, but I'm not sure LinkedIn qualifies. They have a direct relationship because people have profiles that they voluntarily created. It might be different if they were selling information from shadow profiles that they created from other people sharing their contact lists, but I don't think they are selling that.
  - binaryjay 7y ago
    LinkedIn is really Microsoft. No surprise there that they fully endorse the selling of their users data.
  - downandout 7y ago
    I’m not sure that any browser extension (Clearbit in your example) would have to register. It’s pretty clear that you have a “direct relationship” with them when you install their extension.
oferzelig 7y ago
Asking as a non-American. This is basically to prevent atrocities like Equifax, right?
- advisedwang 7y ago
  The law[1] specifically excludes " A consumer reporting agency to the extent that it is covered by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.)." [1] http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201920200AB1202 http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?...
  - oferzelig 7y ago
    So what pains does this legislation solve? To me it seemed outrageous that a company I had no dealings with, accumulated data on me without my consent, and above all - their data was breached. I thought that's what this legislation was trying to address.
    - olefoo 7y ago
      It provides a regulatory moat for experian, equifax and axciom. And it makes it sound like the legislature has done something useful.
    - SpicyLemonZest 7y ago
      It is. But as a credit bureau, Equifax was already subject to some data protection regulations from the federal government - that's a large part of why they could even get in trouble in the first place. Due to details of constitutional structure in the US, California's general data protection law can't legally be applied to companies that are already subject to a federal data protection law.
    - closeparen 7y ago
      Blacking out credit history would obliterate lending, which would in turn collapse asset prices and lead to a complete restructuring of entire industries and society itself. If that were on the table, you would’ve heard. This is primarily about the companies that buy your phone number from your gym membership or supermarket loyalty card and sell it to telemarketers. They won’t be missed.
ErikAugust 7y ago
I see six entries. Where's Google, Facebook, etc?
- ardy42 7y ago
  > I see six entries. Where's Google, Facebook, etc? The deadline for registration looks like it's January 31st, hopefully after that date California will start going after those who do not comply.
- advisedwang 7y ago
  Google and Facebook typically work by allowing advertisers to pick customer traits, and then Google/Facebook shows ads based on their knowledge of who fits those traits. It looks like the definition of sale[1] means companies must actually transfer the consumers info for them to count as a data broker. This means Google and Facebook likely don't have to register. Their lobbyists did their jobs, I suppose. [1] https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140 https://leginfo.legislature.ca.gov/faces/codes_displaySectio....
- dodobirdlord 7y ago
  Google and Facebook don't sell user data. It's much more profitable to keep it for themselves than to sell it to others.
  - lmkg 7y ago
    CCPA's definition of selling data is both expansive, and a little vague. Google Ads (formerly AdWords) now has an API so that customers can disable possibly-sales-like features on a per-use basis if someone clicks "Do not sell my information." So, while Google doesn't sell users information, they're only willing to go to bat and say "this is definitely not a Sale Of Information under CCPA" for a subset of the services they offer. https://privacy.google.com/businesses/rdp/ https://privacy.google.com/businesses/rdp/ Facebook I dunno. My sense is they have a larger appetite for testing the boundaries of the law.
    - 7y ago
gorbachev 7y ago
Not a single one of the big ones have registered. Acxiom, Experian, etc.
- jefftk 7y ago
  "(d) “Data broker” means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. “Data broker” does not include any of the following: (1) A consumer reporting agency to the extent that it is covered by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.)." http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201920200AB1202 http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?...
OrgNet 7y ago
They should add a column for cost per record /s
yalogin 7y ago
Is there a condensed version of the bill somewhere for lazy people like me? I am looking to know - - What the legal obligations of a data broker are. - What are the legal obligations of sites/services that use them on their pages and enable them to get user data
- waterheater 7y ago
  According to 1798.99.80(d), a data broker is defined as "a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship." The bill explicitly says the following entities are not considered data brokers: consumer reporting agencies, financial institutions, and insurance companies. (I'll note that this is a summary; the bill states more specifically those entities covered. However, the categories are generally correct.) So, to the questions. > What are the legal obligations of a data broker? According to 1798.99.82(b), the obligations are two: 1) The data broker must register with the Attorney General and pay the annual registration fee. 2) The data broker must provide the state with the name of the data broker; its primary physical, email, and internet website addresses; and any additional information or explanation the data broker chooses to provide concerning its data collection practices. > What are the legal obligations of sites/services that use them on their pages and enable them to get user data? The bill does not directly state any obligations. In my read, the key part of the definition of a data broker lies in the lack of a direct relationship to a consumer. A business can still sell customer information to a data broker, but I believe this would then fall under the purview of CCPA (which appears to be corroborated by the final line of this bill.) This bill seems targeted toward those who solely acquire information through other, indirect collection means. My read of this bill (I'm not a lawyer) tells me the state understands the present value of data brokers and doesn't want to eliminate the industry with crushing regulations. However, we know there's plenty of corruption, greed, and lack of ethics among data brokers. Requiring entities to publicly declare their brokering of data seems like a reasonable way for government to reduce these issues. Consider a restaurant which operates without a license. A license is good because the city knows of the existence of the restaurant. If the city was not aware of the existence of the restaurant, they could not, say, reliably send in health inspectors. Restaurant cleanliness is clearly a good thing since it reduces the potential for food-borne illnesses. I can envision similar analogous benefits from licensing data brokers. ---- Sources: http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201920200AB1202 http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?...
Klonoar 7y ago
Skimming the bill is frustrating (readability doesn't seem to be a strong suite with govt sites) and a question comes to mind: does this basically only apply to California businesses, or any entity who has consumer data on California residents, or...? I'm all for it, just wish that tidbit was more clear I guess. Or maybe I'm just not reading it correctly, who knows.
- downandout 7y ago
  California has no jurisdiction outside of California, period. If you are not based in California and do not deal with the data of Californians, then you are not subject to it. If either of these things are true though, you probably are subject to it. The problem of course is that you may not know that you are dealing with a Californian’s data. For example, you may have scraped an email address and have no idea who it belongs to. I suspect that for this reason, I got a bunch of emails from affiliate programs recently saying that they had to close because of this law. Example: “Unfortunately, the Yelp For Business Owners program is being paused immediately due to 2020 California Consumer Privacy Act (CCPA) concerns. As of the sending of this notification we have expired all affiliates, which will be effective 1/13/20. As you may be aware, the newly enacted California Consumer Privacy Act has placed new requirements on Yelp. While we evaluate the implications of these requirements, we are taking the step of temporarily pausing our affiliate program. Thank you for all of your hard work in 2019 and we?re looking forward to working more closely with all of you in 2020 once we work past this issue.”
santa_boy 7y ago
The real estate online industry is a significant data broker. Zillow, Realtor, Redfin, AirBnb etc have lead generation platforms that, I guess, fit into the definition of a data broker.
whtifbru 7y ago
What about businesses that aggregate api data, if you use 2-3 data brokers are you a data broker? Seems to me only the source should register but the i think theres a lack of definition there. So every user who uses a api with consumer demographics and sells data should register as a data broker?
- lmkg 7y ago
  Data brokers are middlemen. Not the source (no direct relationship to the data subject), and not the consumer (derive revenue from selling data). If the process of selling data involves a daisy-chain of three middlemen companies, they're all data brokers.
- mportela 7y ago
  If you collect data from third-party APIs and then re-sell them, you are a data broker. If you only use the data, then you aren't.
spacegod 7y ago
where's safeway?
ronzensci 7y ago
Wouldn't Google Search/Gmail/Twitter -- all need to register themselves as Data Brokers?
- giarc 7y ago
  See the response by hbcondo714 > a “data broker” is in the business of aggregating and selling data about consumers with whom the business does not have a direct relationship
  - ronzensci 7y ago
    Google is aggregating search queries. And they are selling my search query to the highest bidder with whom I'm not having a direct relationship. That sounds like a search broker to me.
    - lmkg 7y ago
      If you use Google to search (or use Chrome or gmail or...) then you have a direct relationship with Google, meaning Google is not a data broker.
      - ronzensci 7y ago
        "Existing law, the California Consumer Privacy Act of 2018, beginning January 1, 2020, among other things, grants a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of third parties with which the information is shared." The new law requires companies to tell us who are they sharing our personal information with. Applying common sense law -- this sounds like anyone who sells my personal information to a third party with whom I'm not having a direct relationship - that gets covered. The Ad I see on the top of my search query seems based on personal information that was sold to a third party.
all_blue_chucks 7y ago
This list seems like a good place for hackers to start. These brokers likely don't have the infosec teams that Google or Facebook have.
- mportela 7y ago
  That's why they should be tightly regulated and directly responsible for incidents involving data leaks à la Equifax
0x8BADF00D 7y ago
More useless regulation instead of trying to improve the state. No wonder people are leaving here in droves.
tritip 7y ago
It’s so depressing...I spend so much time opting out of unwanted services and data sharing but I feel like I’m losing this battle.
bookAlot 7y ago
Sounds like someone is drawing in honey pots and is asking them to melt in their mouth. Not in their hands!
mehrdadn 7y ago
> California law requires a data broker to register with the Attorney General [...] on or before January 31 following each year in which a business meets the definition of a data broker. Confused, so this means you won't know who is a data broker this year until next year?
alasdair_ 7y ago
One straightforward solution is to grant each individual copyright protection over all data that identifies them. Each person own their own data, and can sue to enforce those rights.
StarlaAtNight 7y ago
So there's only 6?
throwaway4392 7y ago
Err-- I have a successful business that falls under the "data broker" category and requires I register, but I won't. I won't because they don't tell you what the "fee" is until the Attorney General "reviews" the submission and then assigns a fee to you. Sounds like extortion to me. I am not going to give them all of the leverage and then accept whatever fee they want to levy on me. If they want me to register, have a fixed fee and be up front about it. I am willing to accept the penalty fee for not registering. At least I know what it is and it's well within the financial capability of my business, so who really cares. Selling people's data is fine as long as the state gets a cut I guess?
- silexia 7y ago
  Any business that sells people's data without their knowledge is unethical. You should consider an alternative direction for your life.
  - throwaway4392 7y ago
    Oh really? Yet you probably use Google, Facebook and a ton of other services that do far worse.

195 points by troydavis 7y ago

The full submission for [spydialer] says: ----------------------------- > How a consumer may opt out of sale or submit requests under the CCPA: > Go to spydialer.com, then click the link "Do Not Sell My Info". ----------------------------- Cool. Now compare that to another one listed [infocore]: ----------------------------- > How a consumer may opt out of sale or submit requests under the CCPA: > contact the company > How a protected individual can demand deletion of information posted online under Gov. Code sections 6208.1(b) or 6254.21(c)(1): > contact the company > Additional information about data collecting practices: > No information provided. ----------------------------- Ugh. Their contact page is intended for submitting requests to do business with them: https://infocore.com/about/contact-us/ https://infocore.com/about/contact-us/

xendipity 7y ago
>> Go to spydialer.com, then click the link "Do Not Sell My Info". > Cool. Now compare that to another one listed [infocore]: To opt-out of spydialer.com, you go to https://www.spydialer.com/Consumers/ https://www.spydialer.com/Consumers/, then you have to provide all of the information you think it has on you to verify your identity and selectively remove it from their services. I'm not really comfortable providing my full name, address (or addresses if you've lived in multiple places), and phone numbers to a Data Broker just to opt-out - that feels quite counter to the idea of them ideally not having my information in the first place. I feel like I need a global opt-out where a system or agent on my behalf can then handle this for me at each place where data can be collected.
- giarc 7y ago
  Until that company then turns around and sells your data. Looking at you Unroll.me
- dannyw 7y ago
  At the very least, when a company acquires my data through any mechanism, it should be forced to email me with a copy of all the data they have on me, and with a one click link to get them to delete the data and permanently opt out. Any company found in procession of personal data without the appropriate (delivered) email notifications being sent should be fined at minimum $1000 per individual, and criminal charges if intentional. This won't put anything like services you voluntarily sign up for out of business (as they send sign up confirmations anyway, or should).
  - rckoepke 7y ago
    This would severely backfire if the data broker thought someone else's email account was associated with your identity. Say: Danny W[ilkins] - Job Title - Salary - Job application records - Social media post history - Email 1: dannyw@gmail.com (correct) - Email 2: dannywilkins@EmployerLLC.com (correct) - Email 3: dannywinters@hotmail.com (not correct) I'd assume they'd send the email containing your salary and post history to the two valid emails as well as the one invalid email. That seems like a potential nightmare for you, for example records of job searches being sent to your employer email.
    - rolandog 7y ago
      Also, there's the situation of people who receive a lot of emails from services where the user mistyped their email, but the service doesn't validate the registered email. In my case, I always feel I'm fighting a losing battle against the horde of emails addressed to users of unknown services... There are a growing number of services that validate the email and include a "I didn't register at this service". This has me worried, because I can imagine so many scenarios where the metadata aggregators scrape and mis-classify by email: A teenage boy using a Snapchat-like service had created an account with my email and I had to manually delete it; some guy used my email to register his account at a MacDonald's franchise's ERP; I once received a booking confirmation from some large airline (and Google nicely reminded me that I had an upcoming flight); also, I was once wrongfully tagged by email in an unlisted web album of a party that had taken place in a French village by an older lady. I always try to reach out to notify the person... But sometimes it's hard to call a Peruvian bank to notify them that one of their account holders used my email to register his account, and they tell you they'll get around to notifying the user, but don't. Now; I could imagine several scenarios where things might get bumpy for me in the near future... Like in the event where someone tries to forecast criminal behavior; or what if a government thinks I should be paying taxes on some income that their metadata suggests I have (because, why else would you have emails in your inbox from that bank?).

m463 7y ago

Hopefully this is a non-controversial (register only) beginning to regulation.

rolltiide 7y ago

I approve of this outcome

hbcondo714 7y ago

> a “data broker” is in the business of aggregating and selling data about consumers with whom the business does not have a direct relationship I had to make a few clicks to find the definition, more details here (scroll down to section 1c): http://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201920200AB1202 http://leginfo.legislature.ca.gov/faces/billTextClient.xhtml...

dialfordollars 7y ago
Lot of companies still need to register. * LinkedIn - Sell your data via Sales Navigator * ZoomInfo - Scrape your email account and sell the data to other businesses - https://www.zoominfo.com/business/about-zoominfo/privacy-policy https://www.zoominfo.com/business/about-zoominfo/privacy-pol... * DiscoverOrg * Clearbit - Browser extension scrapes your emails for data and they sell it to others via their "free browser-based add-ons, extensions, or plug-ins" - https://clearbit.com/privacy https://clearbit.com/privacy * Hunter.io - Scrape people data from your browsing activities to resell. * Demandbase
- parsimo2010 7y ago
  I don't know about the others, but I'm not sure LinkedIn qualifies. They have a direct relationship because people have profiles that they voluntarily created. It might be different if they were selling information from shadow profiles that they created from other people sharing their contact lists, but I don't think they are selling that.
- binaryjay 7y ago
  LinkedIn is really Microsoft. No surprise there that they fully endorse the selling of their users data.
- downandout 7y ago
  I’m not sure that any browser extension (Clearbit in your example) would have to register. It’s pretty clear that you have a “direct relationship” with them when you install their extension.

oferzelig 7y ago

Asking as a non-American. This is basically to prevent atrocities like Equifax, right?

advisedwang 7y ago
The law[1] specifically excludes " A consumer reporting agency to the extent that it is covered by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.)." [1] http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201920200AB1202 http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?...
- oferzelig 7y ago
  So what pains does this legislation solve? To me it seemed outrageous that a company I had no dealings with, accumulated data on me without my consent, and above all - their data was breached. I thought that's what this legislation was trying to address.
  - olefoo 7y ago
    It provides a regulatory moat for experian, equifax and axciom. And it makes it sound like the legislature has done something useful.
  - SpicyLemonZest 7y ago
    It is. But as a credit bureau, Equifax was already subject to some data protection regulations from the federal government - that's a large part of why they could even get in trouble in the first place. Due to details of constitutional structure in the US, California's general data protection law can't legally be applied to companies that are already subject to a federal data protection law.
  - closeparen 7y ago
    Blacking out credit history would obliterate lending, which would in turn collapse asset prices and lead to a complete restructuring of entire industries and society itself. If that were on the table, you would’ve heard. This is primarily about the companies that buy your phone number from your gym membership or supermarket loyalty card and sell it to telemarketers. They won’t be missed.

ErikAugust 7y ago

I see six entries. Where's Google, Facebook, etc?

ardy42 7y ago
> I see six entries. Where's Google, Facebook, etc? The deadline for registration looks like it's January 31st, hopefully after that date California will start going after those who do not comply.
advisedwang 7y ago
Google and Facebook typically work by allowing advertisers to pick customer traits, and then Google/Facebook shows ads based on their knowledge of who fits those traits. It looks like the definition of sale[1] means companies must actually transfer the consumers info for them to count as a data broker. This means Google and Facebook likely don't have to register. Their lobbyists did their jobs, I suppose. [1] https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140 https://leginfo.legislature.ca.gov/faces/codes_displaySectio....
dodobirdlord 7y ago
Google and Facebook don't sell user data. It's much more profitable to keep it for themselves than to sell it to others.
- lmkg 7y ago
  CCPA's definition of selling data is both expansive, and a little vague. Google Ads (formerly AdWords) now has an API so that customers can disable possibly-sales-like features on a per-use basis if someone clicks "Do not sell my information." So, while Google doesn't sell users information, they're only willing to go to bat and say "this is definitely not a Sale Of Information under CCPA" for a subset of the services they offer. https://privacy.google.com/businesses/rdp/ https://privacy.google.com/businesses/rdp/ Facebook I dunno. My sense is they have a larger appetite for testing the boundaries of the law.
  - 7y ago

gorbachev 7y ago

Not a single one of the big ones have registered. Acxiom, Experian, etc.

jefftk 7y ago
"(d) “Data broker” means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. “Data broker” does not include any of the following: (1) A consumer reporting agency to the extent that it is covered by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.)." http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201920200AB1202 http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?...

OrgNet 7y ago

They should add a column for cost per record /s

yalogin 7y ago

Is there a condensed version of the bill somewhere for lazy people like me? I am looking to know - - What the legal obligations of a data broker are. - What are the legal obligations of sites/services that use them on their pages and enable them to get user data

waterheater 7y ago
According to 1798.99.80(d), a data broker is defined as "a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship." The bill explicitly says the following entities are not considered data brokers: consumer reporting agencies, financial institutions, and insurance companies. (I'll note that this is a summary; the bill states more specifically those entities covered. However, the categories are generally correct.) So, to the questions. > What are the legal obligations of a data broker? According to 1798.99.82(b), the obligations are two: 1) The data broker must register with the Attorney General and pay the annual registration fee. 2) The data broker must provide the state with the name of the data broker; its primary physical, email, and internet website addresses; and any additional information or explanation the data broker chooses to provide concerning its data collection practices. > What are the legal obligations of sites/services that use them on their pages and enable them to get user data? The bill does not directly state any obligations. In my read, the key part of the definition of a data broker lies in the lack of a direct relationship to a consumer. A business can still sell customer information to a data broker, but I believe this would then fall under the purview of CCPA (which appears to be corroborated by the final line of this bill.) This bill seems targeted toward those who solely acquire information through other, indirect collection means. My read of this bill (I'm not a lawyer) tells me the state understands the present value of data brokers and doesn't want to eliminate the industry with crushing regulations. However, we know there's plenty of corruption, greed, and lack of ethics among data brokers. Requiring entities to publicly declare their brokering of data seems like a reasonable way for government to reduce these issues. Consider a restaurant which operates without a license. A license is good because the city knows of the existence of the restaurant. If the city was not aware of the existence of the restaurant, they could not, say, reliably send in health inspectors. Restaurant cleanliness is clearly a good thing since it reduces the potential for food-borne illnesses. I can envision similar analogous benefits from licensing data brokers. ---- Sources: http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201920200AB1202 http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?...

Klonoar 7y ago

Skimming the bill is frustrating (readability doesn't seem to be a strong suite with govt sites) and a question comes to mind: does this basically only apply to California businesses, or any entity who has consumer data on California residents, or...? I'm all for it, just wish that tidbit was more clear I guess. Or maybe I'm just not reading it correctly, who knows.

downandout 7y ago
California has no jurisdiction outside of California, period. If you are not based in California and do not deal with the data of Californians, then you are not subject to it. If either of these things are true though, you probably are subject to it. The problem of course is that you may not know that you are dealing with a Californian’s data. For example, you may have scraped an email address and have no idea who it belongs to. I suspect that for this reason, I got a bunch of emails from affiliate programs recently saying that they had to close because of this law. Example: “Unfortunately, the Yelp For Business Owners program is being paused immediately due to 2020 California Consumer Privacy Act (CCPA) concerns. As of the sending of this notification we have expired all affiliates, which will be effective 1/13/20. As you may be aware, the newly enacted California Consumer Privacy Act has placed new requirements on Yelp. While we evaluate the implications of these requirements, we are taking the step of temporarily pausing our affiliate program. Thank you for all of your hard work in 2019 and we?re looking forward to working more closely with all of you in 2020 once we work past this issue.”

santa_boy 7y ago

The real estate online industry is a significant data broker. Zillow, Realtor, Redfin, AirBnb etc have lead generation platforms that, I guess, fit into the definition of a data broker.

whtifbru 7y ago

What about businesses that aggregate api data, if you use 2-3 data brokers are you a data broker? Seems to me only the source should register but the i think theres a lack of definition there. So every user who uses a api with consumer demographics and sells data should register as a data broker?

lmkg 7y ago
Data brokers are middlemen. Not the source (no direct relationship to the data subject), and not the consumer (derive revenue from selling data). If the process of selling data involves a daisy-chain of three middlemen companies, they're all data brokers.
mportela 7y ago
If you collect data from third-party APIs and then re-sell them, you are a data broker. If you only use the data, then you aren't.

spacegod 7y ago

where's safeway?

ronzensci 7y ago

Wouldn't Google Search/Gmail/Twitter -- all need to register themselves as Data Brokers?

giarc 7y ago
See the response by hbcondo714 > a “data broker” is in the business of aggregating and selling data about consumers with whom the business does not have a direct relationship
- ronzensci 7y ago
  Google is aggregating search queries. And they are selling my search query to the highest bidder with whom I'm not having a direct relationship. That sounds like a search broker to me.
  - lmkg 7y ago
    If you use Google to search (or use Chrome or gmail or...) then you have a direct relationship with Google, meaning Google is not a data broker.
    - ronzensci 7y ago
      "Existing law, the California Consumer Privacy Act of 2018, beginning January 1, 2020, among other things, grants a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of third parties with which the information is shared." The new law requires companies to tell us who are they sharing our personal information with. Applying common sense law -- this sounds like anyone who sells my personal information to a third party with whom I'm not having a direct relationship - that gets covered. The Ad I see on the top of my search query seems based on personal information that was sold to a third party.

all_blue_chucks 7y ago

This list seems like a good place for hackers to start. These brokers likely don't have the infosec teams that Google or Facebook have.

mportela 7y ago
That's why they should be tightly regulated and directly responsible for incidents involving data leaks à la Equifax

0x8BADF00D 7y ago

More useless regulation instead of trying to improve the state. No wonder people are leaving here in droves.

tritip 7y ago

It’s so depressing...I spend so much time opting out of unwanted services and data sharing but I feel like I’m losing this battle.

bookAlot 7y ago

Sounds like someone is drawing in honey pots and is asking them to melt in their mouth. Not in their hands!

mehrdadn 7y ago

> California law requires a data broker to register with the Attorney General [...] on or before January 31 following each year in which a business meets the definition of a data broker. Confused, so this means you won't know who is a data broker this year until next year?

alasdair_ 7y ago

One straightforward solution is to grant each individual copyright protection over all data that identifies them. Each person own their own data, and can sue to enforce those rights.

StarlaAtNight 7y ago

So there's only 6?

throwaway4392 7y ago

Err-- I have a successful business that falls under the "data broker" category and requires I register, but I won't. I won't because they don't tell you what the "fee" is until the Attorney General "reviews" the submission and then assigns a fee to you. Sounds like extortion to me. I am not going to give them all of the leverage and then accept whatever fee they want to levy on me. If they want me to register, have a fixed fee and be up front about it. I am willing to accept the penalty fee for not registering. At least I know what it is and it's well within the financial capability of my business, so who really cares. Selling people's data is fine as long as the state gets a cut I guess?

silexia 7y ago
Any business that sells people's data without their knowledge is unethical. You should consider an alternative direction for your life.
- throwaway4392 7y ago
  Oh really? Yet you probably use Google, Facebook and a ton of other services that do far worse.