UC Irvine probe into state data brokers raises legal and privacy concerns

• UC Irvine research on companies collecting and selling personal information discovered violations of the California Consumer Privacy Act.
• Nearly half of the data brokerages investigated failed to respond to legitimate consumer requests.
• Study was funded by the National Science Foundation.

Irvine, Calif., July 22, 2025 — Computer scientists at the University of California, Irvine conducted a comprehensive investigation of all 543 state-registered data brokers – companies that accumulate, aggregate and sell personal information on millions of individuals, often without their knowledge or permission – and found a pattern of “rampant noncompliance” with a California law mandating that they respond in a timely manner to consumer inquiries.

Under the California Consumer Privacy Act, entities that transact in personal data must expeditiously provide individuals access to and/or deletion of their personal information when asked to do so. To test CCPA compliance, the UC Irvine investigators, funded by the National Science Foundation, ran a roughly seven-month analysis of data brokers from late 2024 to early 2025. They sent verifiable consumer requests to all the data brokers registered with the CCPA and received responses from only 57 percent, with 43 percent failing to reply, an apparent violation of the law, which was passed in 2018 and amended in 2020.

In response to the UC Irvine team’s inquiries, some data brokers asked for sensitive personal information – such as full name, address or Social Security number – to verify the requesting consumer’s identity. In a paper recently posted online, the five-member UC Irvine team opines that this requirement from data brokers is paradoxical since exercising one’s privacy rights under the CCPA potentially exposes the consumer to new privacy risks.

According to the study, data brokers operate largely in a surreptitious manner, systematically harvesting consumer information from public records, online activities, social media profiles and even their own competitors.

“Data brokers analyze this information to determine very personal and often sensitive details, such as purchasing behavior, financial status and health conditions. Then they monetize this information by selling it to other companies, individuals and governments,” said co-author Gene Tsudik, UC Irvine Distinguished Professor of computer science. “These sales often happen without the knowledge of those affected, and such transactions can open the door to malicious actors, giving them access to consumers’ personal information to mount identity theft, fraud or phishing activities.”

He added that the sensitivity and potentially damaging nature of the data involved necessitate stronger regulations. Laws similar to California’s have been enacted around the world, including in the European Union and Brazil.

The CCPA demands that, upon receiving a consumer’s request, a data broker must rapidly verify the consumer’s identity, confirm receipt of the request within 10 business days and answer it within 45 calendar days. The reply must contain either the collected personal information, a statement that the company possesses no such data or an explanation for the denial of the request.

According to the study’s lead author, Elina van Kempen, a UC Irvine Ph.D. candidate in computer science, the six key aspects of the verifiable consumer request process that her team examined were: 1) the consumer burden of composing VCRs, 2) the variability of identity verification, 3) the response time differences among brokers, 4) the content and quality of responses, 5) whether and what additional personal information was requested as part of the VCR process and 6) any other privacy issues.

“Composing and submitting verifiable consumer requests to data brokers is very burdensome, because there is no standardized process for doing so. Some data brokers require an email contact, while others ask the consumer to call them on the phone or complete an online form,” Van Kempen said. “Our team encountered multistep submission forms, broken links and live phone calls with clueless or poorly trained staff. Further, after all the maneuvering around these Kafkaesque processes, there is still only about a 50-50 chance that a consumer will receive a reply.”

Tsudik said the results gathered by the investigators reveal a broken system that fails to address the privacy needs of California consumers. “People are being forced to jump through hoops, surrender personal data, and are still often ignored. This undermines both trust in and the spirit of the law,” he said.

About UC Irvine’s Brilliant Future campaign: Publicly launched on Oct. 4, 2019, the Brilliant Future campaign aims to raise awareness and support for the university. By engaging 75,000 alumni and garnering $2 billion in philanthropic investment, UC Irvine seeks to reach new heights of excellence in student success, health and wellness, research and more. The Donald Bren School of Information & Computer Sciences plays a vital role in the success of the campaign. Learn more at https://brilliantfuture.uci.edu/donald-bren-school-of-ics.

About the University of California, Irvine: Founded in 1965, UC Irvine is a member of the prestigious Association of American Universities and is ranked among the nation’s top 10 public universities by U.S. News & World Report. The campus has produced five Nobel laureates and is known for its academic achievement, premier research, innovation and anteater mascot. Led by Chancellor Howard Gillman, UC Irvine has more than 36,000 students and offers 224 degree programs. It’s located in one of the world’s safest and most economically vibrant communities and is Orange County’s second-largest employer, contributing $7 billion annually to the local economy and $8 billion statewide. For more on UC Irvine, visit www.uci.edu.

Media access: Radio programs/stations may, for a fee, use an on-campus studio with a Comrex IP audio codec to interview UC Irvine faculty and experts, subject to availability and university approval. For more UC Irvine news, visit news.uci.edu. Additional resources for journalists may be found at https://news.uci.edu/media-resources.