What New Data Broker Laws Mean for Your Privacy

Your personal information is traded in a market most people never see. Data brokers collect details from apps, loyalty programs, public records, online purchases and mobile advertising, then combine them into profiles used for marketing, risk scoring and identity verification.

New state laws in the United States are beginning to challenge that system. They give residents stronger rights to learn what brokers hold, request deletion and restrict the sale of sensitive information. For Australians, the changes matter because digital services, advertising networks and data companies rarely operate within one country.

The rules also offer a useful warning closer to home. A shopper in Sydney, a commuter in Melbourne or a frequent traveller between Brisbane and the Gold Coast can generate thousands of location and behavioural signals without actively sharing a social media post. Understanding how the system works makes privacy choices more practical.

Why Data Brokers Matter

Data brokers gather information from many sources and connect records that appear unrelated. A supermarket purchase, property listing, online search and smartphone location ping may be combined into an inferred profile showing household income, health interests, shopping habits or likely political preferences.

That profile can be sold to advertisers, financial firms, insurers, recruiters and other businesses. Some uses are ordinary, such as receiving promotions for nearby restaurants. Others can affect access to offers, prices or services without the individual knowing that a hidden score influenced the decision.

What New State Rules Are Doing

California has taken a prominent role with the Delete Act, which creates a central mechanism for residents to request deletion from registered data brokers. The system is designed to reduce the burden of contacting companies individually, although implementation, identity checks and exemptions will shape how effective it becomes.

Other states, including Oregon, Texas and Vermont, have adopted or considered measures addressing data brokers, consumer access and the sale of sensitive information. These laws vary widely, but the direction is consistent: brokers face more registration, disclosure, security and deletion obligations than they did a few years ago.

The Privacy Rights Behind The Headlines

Residents covered by state privacy laws may receive rights to access personal data, correct inaccurate records, opt out of targeted advertising and stop certain sales or profiling. Some laws provide extra protection for precise geolocation, health information, biometric identifiers and details about children.

The rights are rarely automatic. A person may need to submit a request through a broker’s portal, verify their identity and repeat the process when information is repopulated. Companies can also rely on exceptions for fraud prevention, legal compliance, security or information that has been de-identified.

Why Australians Should Pay Attention

Australian consumers may not qualify for every American state remedy, yet their data can still move through the same global advertising ecosystem. The Privacy Act and Australian Privacy Principles provide important safeguards, while proposed reforms and regulatory enforcement continue to influence how businesses handle consent, security and sensitive information.

The local market has its own familiar collection points: Flybuys and supermarket rewards, mobile apps, toll-road accounts, e-commerce checkouts and property websites. A person using services across Sydney, Perth or Adelaide can encounter companies headquartered overseas and governed by several overlapping privacy regimes.

Location Data Reveals More Than A Postcode

Precise location information can expose routines, workplaces, medical visits, religious attendance and relationships. Even a time zone or recurring travel pattern can become useful when combined with other records. An app does not need to publish a map of your home for a broker to infer where you live.

Changes in clocks and time settings also create technical signals that help services estimate location and behaviour; the wider daylight-saving debate shows how strongly time zones remain tied to daily routines and regional identity. Australians in New South Wales, Victoria and South Australia already navigate seasonal clock changes differently from Queensland and Western Australia.

Where The New Laws Fall Short

A deletion request may remove a broker’s copy while leaving the original information with an app, retailer, government agency or public website. Data can also reappear when a company collects a fresh record or obtains it from another supplier.

Enforcement is another concern. Regulators must identify shadow companies, examine complex supply chains and ensure that “anonymous” datasets cannot easily be linked back to individuals. A law can create a right on paper while leaving consumers with a time-consuming process and limited visibility into who received their information.

Practical Privacy Steps For Everyday Use

Australians can reduce exposure even while lawmakers refine the rules. The most useful actions focus on limiting collection at the source, checking account settings and making formal requests when a company provides that option.

• Turn off unnecessary location access, Bluetooth scanning and background activity on your phone.
• Use separate email addresses for shopping, newsletters, loyalty programs and important accounts.
• Review supermarket, travel, fitness and finance apps before accepting optional personalisation.
• Read privacy dashboards for major platforms and disable targeted advertising where available.
• Request access or deletion from companies that hold your information, keeping copies of submissions.
• Avoid posting public details about home addresses, children’s schools, travel dates and daily routines.
• Use strong, unique passwords and multi-factor authentication to reduce account takeover risk.

What To Watch In The Next Phase

The biggest change may be the emergence of standardised opt-out systems. If states create reliable, interoperable tools, people could exercise privacy rights across many brokers instead of managing dozens of separate requests. Businesses will then need clearer data inventories and stronger controls over vendors.

Australia may also see pressure for more consistent national rules, especially as artificial intelligence increases demand for large datasets. Consumers should expect privacy notices to become more detailed, while regulators and advocacy groups push for meaningful consent rather than long legal documents that few people read.

Check the privacy controls on your most-used apps and loyalty accounts today, remove permissions that serve no clear purpose, and keep records of deletion or access requests. Small changes across everyday services can limit the profile available to data brokers while stronger laws continue to develop.