The FTC and Data Brokers in 2026

Updated November 7, 2026

The Federal Trade Commission is the main federal agency watching data brokers. In 2026 it warned brokers about selling Americans' sensitive data to foreign adversaries, moved to ban one broker from selling location data, and kept enforcing the Fair Credit Reporting Act. Here is what happened and what it means for you.

Warning letters about foreign adversaries (February 2026)

On February 9, 2026, the FTC sent letters to 13 data brokers about the Protecting Americans' Data from Foreign Adversaries Act of 2024. The law bars data brokers from selling or giving access to Americans' sensitive data to China, Russia, Iran, North Korea or companies they control.

Covered data includes health, financial, genetic, biometric and precise location information, login credentials, and government ID numbers like Social Security, passport and driver's license numbers. The FTC also made clear that information showing whether someone serves in the military is covered.

Location data: the Kochava settlement (May 2026)

In May 2026, the FTC reached a proposed settlement with data broker Kochava and its subsidiary. It would bar them from selling Americans' location data without consent. The FTC alleged the data could reveal visits to sensitive places, including:

• Reproductive health and mental health clinics
• Addiction recovery centers
• Houses of worship
• Domestic violence and homeless shelters

It follows 2024 FTC orders against InMarket, X-Mode Social (now Outlogic), Gravy Analytics and Mobilewalla over sensitive location data.

FCRA enforcement against screening companies

When a data company's reports are used for housing, jobs or credit, the Fair Credit Reporting Act applies. In July 2026, tenant screening company RentGrow agreed to a $2.25 million penalty over duplicate eviction and criminal records and ignored disputes. See our guides on tenant screening errors and data brokers and the FCRA.

What you can do

1. Limit location sharing. On your phone, set apps to share location only while in use, and turn off or reset your advertising ID.
2. Opt out of people-search sites. Our removal guide covers the process. Texans can also use the Texas data broker registry.
3. Use your state privacy rights. Many states let you demand deletion. Californians can use the free DROP tool.
4. Report problems. Report scams or bad business practices at ReportFraud.ftc.gov.

Keep reading