It’s no secret that businesses collect personal information as users scroll and click through websites and mobile apps. But a booming ecosystem of third-party data brokers that buy and sell massive amounts of customer data remains invisible to most consumers.

To make that ecosystem more transparent, California passed the first law regulating data broker practices: the 2023 Delete Act. Under the act, any business collecting data from at least 10 million California consumers must register with the state and give consumers the right to delete their data, correct personal information, and learn what personal information the business is selling.

The problem? Most data brokers are ignoring those rules.

Joint research from Stanford RegLab and Stanford HAI looked at compliance with California’s strict privacy laws and found that only 9% of these companies are fully complying with the law.

“This is a surprisingly low compliance rate,” says Stanford HAI Privacy and Data Policy Fellow Jennifer King. “It’s possible data brokers are still working out how to report on the required metrics, but they’ve been on notice for more than three years and this step is now mandatory.”

Allowing consumers to manage their own personal data matters for many reasons. When brokers sell your data, it can impact what ads you see, what pricing businesses offer you, and whether you get hired for a job or qualify for a loan. Inaccurate information spreads quickly through the ecosystem and persists long after it’s detected.

“Companies use personal data to create a 360-degree profile and make predictions about you, but often that data is incorrect,” King says. “People need to have some control over the entire coursing river of their data, especially as AI developers build more automated systems that are unsupervised by humans.”

Today, it’s unclear to what extent data brokers influence the development of AI because of a lack of transparency with how frontier models are built. However, the 2026 Data Broker Registry now requires brokers to disclose whether they have sold data to generative AI developers. So far, more than 30 companies have disclosed this information. “California has been a leader in mandating broker transparency on paper. In principle, that should allow us to better understand the role of data brokers in the AI ecosystem, but in practice, our research shows that disclosures are far from complete,” says RegLab Director Daniel E. Ho.

Strong on paper, weak in practice

By July 1, 2025, data brokers had to publicly report how many consumer requests they received in the past two years for the following categories:

• To delete one’s data
• To correct personal information
• To know what personal information is being collected by a business
• To know what personal information is being sold/shared by a business
• To request the business not sell or share your data
• To limit the use and disclosure of sensitive personal information

They also needed to share the mean and median number of days to fulfill each request type, and a breakdown of the number of requests they complied with and denied.

But when King, Ho, and coauthors Anna-Maria Gueorguieva, PhD candidate at the University of Washington and RegLab 2025 Summer Graduate Student Fellow, and Apoorva Panidapu, RegLab undergraduate research assistant, manually reviewed privacy policies for all 522 self-registered data brokers in 2025, they found only 9% fully complied by reporting on the full set of transparency requirements and 45% did not submit any rights request metrics at all to the California Privacy Protection Agency.

Moreover, the study found 64% of data brokers added friction to rights request processes, using confusing website designs, multiple forms, or excessive verification steps to make it more difficult for consumers to submit requests. Such “dark patterns” are expressly prohibited by the law.

The team identified several possible reasons for noncompliance: The system relies on data brokers to self-register, penalties are inconsistent, and the agency that enforces the rules is under-resourced.

A one-stop shop for dropping data

The Delete Act also authorized a new technical platform, the Delete Request and Opt-out Platform (DROP), that will allow California residents to submit data-deletion and opt-out-of-sale requests to all registered data brokers with a single request. Now live as of Aug. 1, every 45 days, data brokers must delete all personal information related to consumers who opt out, including behavioral, financial, health, location, and relationship data, as well as any inferences drawn about individuals from their data.

The platform holds promise, but its effectiveness will depend on how effectively consumer rights organizations publicize the new mechanism, King says.

Another phase of the legislation kicks in by 2028, when data brokers will have to undergo third-party audits every three years to assess their compliance with the Delete Act. King adds that this is when the stakes will go up.

“California is leading the way in consumer privacy laws, but our findings paint a troubling picture of how these protections have been implemented,” she says. “Without clear reporting requirements and consistent financial consequences, businesses simply won’t do it.”