Loading story…
A U.S. congressional investigation by the Joint Economic Committee’s Democratic minority estimated that identity theft tied to breaches at four major data brokers has cost American consumers roughly $20 billion, and highlighted how some brokers obscured legally required “opt-out” pages (including use of no-index tactics that made deletion/opt-out pages harder to find). The report, prompted by investigative reporting, said several large brokers subsequently engaged with congressional staff and changed practices to make it easier for consumers to control the collection and sale of their personal data.
California regulators separately escalated enforcement of opt-out requirements under state privacy law, with the California Privacy Protection Agency (CPPA) fining PlayOn Sports $1.1 million over allegations that its GoFan ticketing platform used tracking technologies for targeted advertising without providing a compliant, easy-to-use opt-out mechanism. The CPPA said users—including large numbers of high school students—were effectively forced to “agree” to tracking to access paid tickets and services, and that directing users to industry opt-out programs (e.g., Network Advertising Initiative / Digital Advertising Alliance) did not satisfy California’s requirement that companies provide their own opt-out tool and clear disclosures.
See the reporting duties and controls this puts on the clock.
9 events from the most recent confirmed update back to the earliest known activity.
California Privacy Protection Agency Executive Director Tom Kemp discussed the state's new Delete Request and Opt-out Platform (DROP), a tool intended to help California residents exercise privacy rights with data brokers. The discussion also emphasized California's broader enforcement and regulatory approach to data-broker oversight.
The Joint Economic Committee’s Democratic minority released an investigation estimating that major data-broker breaches over the last decade caused more than $20 billion in consumer identity-theft losses. The report also called for easier opt-out mechanisms and stronger oversight of the data-broker industry.
The California Privacy Protection Agency fined PlayOn Sports $1.1 million for allegedly failing to provide a legally compliant opt-out from tracking technologies and for improperly steering users to third-party opt-out tools. The agency also ordered the company to change its privacy disclosures, opt-out practices, and conduct risk assessments.
After the reporting on hidden opt-out pages, Sen. Maggie Hassan contacted several data brokers about their practices. Most later engaged with congressional staff and changed their sites to make privacy and opt-out pages more visible, while Findem reportedly did not.
The Markup and CalMatters, in collaboration with WIRED, reported that some data brokers used no-index tags to keep legally required California opt-out pages from appearing in search engines, making them harder to find.
A 2025 TransUnion breach was cited by the Joint Economic Committee’s Democratic minority as one of the recent major data-broker breaches linked to consumer identity-theft losses.
A 2023 breach involving National Public was included among the major data-broker breaches used by congressional investigators to estimate consumer losses from identity theft.
The Exactis breach was identified in the congressional investigation as another major data-broker incident that helped drive large-scale consumer identity-theft harms over the last decade.
Equifax suffered a major data breach that was later cited by a congressional investigation as one of four large data-broker-related incidents contributing to identity-theft losses exceeding $20 billion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
lawfaremedia.org
Open sourcedatabreaches.net
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
California’s **Privacy Protection Agency (CalPrivacy)** announced a settlement action against Texas-based **Rickenbacher Data (doing business as DataMasters)**, fining the company and **banning it from selling Californians’ personal information** as part of a broader enforcement crackdown on data brokers. The action was brought by the agency’s enforcement division and its **Data Broker Enforcement Strike Force**, following CalPrivacy’s stated intent to increase investigations into data broker privacy violations. Regulators said DataMasters traded in data tied to **sensitive health conditions**—including lists associated with **Alzheimer’s disease, drug addiction, and bladder incontinence**—and also bought and sold lists segmented by demographics and inferred attributes such as **“Seniors,” “Hispanic,” political affiliation, grocery purchases, banking activity, and health-related purchases** for targeted advertising. CalPrivacy stated the company conducted these activities in **2024 without registering with the California Data Broker Registry**, a requirement under California’s data broker rules.
Jun 29, 2026
Multiple legal actions highlighted ongoing **privacy and data-protection risk** across healthcare and consumer platforms. Epic Systems sued health information exchange implementer **Health Gorilla** and several provider organizations, alleging improper access to roughly **300,000 patients’ records** and claiming some participants abused interoperability frameworks (including **Carequality** and **TEFCA**) to obtain and monetize sensitive health data without appropriate consent or authorization. Separately, pharmacy services provider **PharMerica** agreed to a **$5.2 million** class-action settlement tied to a **2023** hacking incident attributed to the **Money Message** ransomware group, which claimed exfiltration of **4.7 TB** and later leaked data affecting **5.8 million** people (including SSNs and medication/insurance details), alongside commitments to invest further in security. Outside healthcare, California’s Attorney General opened a probe into **xAI** after **Grok** was used to generate and post non-consensual sexualized deepfakes, while Google agreed to pay **$8.25 million** to settle claims that its **AdMob SDK** collected data from children’s devices in “Designed for Families” apps in alleged violation of **COPPA**; a separate YouTube children’s-data settlement was also noted. A HIPAA Privacy Rule update was also reported as moving closer to finalization following an HHS OCR tribal consultation notice, but it is a regulatory development rather than a specific incident.
Jun 29, 2026
Disney agreed to pay **$2.75 million** to settle allegations by the California Attorney General that it violated the **California Consumer Privacy Act (CCPA)** by making it difficult for consumers to opt out of the sale/sharing of their personal data. California alleged Disney’s opt-out mechanisms contained gaps that prevented users—including those logged into their accounts—from fully stopping data sharing across Disney’s services, devices, and platforms, and that data continued to be shared with **third-party ad-tech companies** whose code was embedded in Disney websites and apps. The settlement (pending court approval) requires Disney to implement a more comprehensive privacy program and provide California officials a **compliance update within 60 days** describing changes made to align with CCPA requirements. State officials characterized the penalty as the **largest fine to date under the CCPA**; Disney did not admit liability as part of the agreement and said it continues to invest in privacy protections across its streaming services.
Jun 29, 2026