What Changed in 2026

Several jurisdictions tightened data broker registration. Public lists are longer, opt out portals are mandatory, and fines have teeth.

What the Rules Cover

• Brokers that self identify as such.

• Companies that resell consumer records as their primary business.

• Aggregators that monetize public records.

What They Miss

• Inferred datasets from behavior, not declared identity.

• Breach aggregators operating outside regulated jurisdictions.

• Scraped social graphs labeled as analytics.

Net Effect

For investigators this means cleaner sources up top and dirtier sources just below the surface. Both still work, neither is going away soon.