What the investigation found
A February 2026 report from the U.S. Senate Joint Economic Committee examined the practices of registered data brokers (companies that collect and sell personal information, often without most people ever knowing it’s happening). The investigation followed an earlier news report finding that more than 30 data brokers had used code to tell search engines like Google and Bing to exclude their opt-out pages from search results, making the one page a consumer would need to find nearly invisible by design.
Regulators elsewhere have been tracking related harms. In one of the most significant recent enforcement actions, the FTC took action against a location-data company for collecting and selling billions of precise location points harvested from smartphone apps, data specific enough to show individual visits to medical facilities, religious institutions, domestic violence shelters, and military installations.
Why “just opt out” has been harder than it sounds
Most registered brokers technically offer an opt-out right on paper. The core problem is exercising it: finding a deliberately obscured page, then repeating the process across each broker individually, since data brokers don't share a single opt-out system by default. And because brokers continuously re-collect data from public records and other sources, a one-time opt-out doesn't necessarily stay effective indefinitely.
The practical takeaway
Some regions now offer a real fix for the scale problem: as of January 2026, California residents can use a single state-run platform to submit one opt-out request that covers all California-registered data brokers at once, rather than tackling each one separately. Other states are watching this model closely. Outside of that, the realistic approach is targeting the handful of data brokers with the widest reach and the most sensitive data first (people-search sites that surface your address and phone number publicly) rather than attempting to chase down every company at once, which isn’t a realistic goal for most people’s time.
Opting out reduces exposure going forward. It doesn’t erase data that’s already been sold, resold, or copied into other systems before the opt-out took effect. Treat it as damage reduction, not a full data-privacy reset.
Reference
U.S. Congress Joint Economic Committee (Minority), “Opt-Out Obstacles: Concerning Practices by Registered Data Brokers and the Multi-Billion-Dollar Cost of Breaches” (February 27, 2026). https://www.jec.senate.gov/public/_cache/files/7f821956-d826-4241-8196-be987cc1f06c/2026-02-27-jec-data-brokers-report-final.pdf
Top comments (0)