Regulatory scrutiny of consumer data collection and opt-out compliance

A U.S. congressional investigation by the Joint Economic Committee’s Democratic minority estimated that identity theft tied to breaches at four major data brokers has cost American consumers roughly $20 billion, and highlighted how some brokers obscured legally required “opt-out” pages (including use of no-index tactics that made deletion/opt-out pages harder to find). The report, prompted by investigative reporting, said several large brokers subsequently engaged with congressional staff and changed practices to make it easier for consumers to control the collection and sale of their personal data.

California regulators separately escalated enforcement of opt-out requirements under state privacy law, with the California Privacy Protection Agency (CPPA) fining PlayOn Sports $1.1 million over allegations that its GoFan ticketing platform used tracking technologies for targeted advertising without providing a compliant, easy-to-use opt-out mechanism. The CPPA said users—including large numbers of high school students—were effectively forced to “agree” to tracking to access paid tickets and services, and that directing users to industry opt-out programs (e.g., Network Advertising Initiative / Digital Advertising Alliance) did not satisfy California’s requirement that companies provide their own opt-out tool and clear disclosures.