WHO’S WATCHING YOU: CORPORATE SURVEILLANCE ANALYSIS 2026
Investigation Date: July 2026
Focus: Corporate Data Sales, Broker Registries, Surveillance Legislation
Evidence File Number: #2026-05
THE CLAIM
Privacy advocates allege that major corporations collect, aggregate, and sell personal data to third parties including data brokers, advertising networks, government agencies, and political organizations — often without meaningful consent and in ways that enable comprehensive individual tracking across digital services.
This investigation examines:
Current U.S. surveillance-related legislation (2024-2026 session)
Major data broker company filings and disclosures
FTC enforcement actions regarding privacy violations
Congressional testimony on data industry practices
LEGISLATIVE LANDSCAPE: WHAT THE LAW SAYS
Federal Bills Under Consideration
American Data Privacy and Protection Act (ADPPA)
Bill Number: H.R. 7851 (117th Congress, reintroduced 2024)
Status: Passed House Energy & Commerce Committee markup (2022); stalled in Senate
Key Provisions:
Prohibits targeted advertising to minors
Requires affirmative opt-in consent for sensitive data
Creates private right of action for consumers
Establishes Federal Trade Commission enforcement authority
Congressional Hearing Notes (July 2025): During Subcommittee on Consumer Protection hearing, Committee Chair stated:
“The ADPPA remains the most viable framework for federal privacy regulation. We continue to seek bipartisan compromise.”
Source: House Energy & Commerce Committee — Consumer Protection Subcommittee Transcripts
State-Level Actions (2024-2026)
State Bill Status Effective Date
California CPRA Amendments Enacted Jan 1, 2024
Virginia CDPA Enacted Jan 1, 2023
Colorado CPA Enacted July 1, 2023
Connecticut CTCPA Enacted July 1, 2023
Texas TDPSA Enacted July 1, 2024
Oregon OCPA Enacted July 1, 2024
Florida FDCPA Enacted July 1, 2024
Tennessee TIPA Enacted July 1, 2024
Indiana CDPA Enacted July 1, 2024
Source: National Conference of State Legislatures — State Privacy Laws Tracker
Federal Preemption Debate
A major sticking point in federal legislation is whether state laws would be preempted by federal law. Industry groups (Internet Association, Chamber of Commerce) lobby for broad preemption; consumer advocates oppose preemption that weakens California’s CCPA baseline.
Source: Electronic Frontier Foundation — Federal Privacy Legislation Tracker
DATA BROKER INDUSTRY ANALYSIS
What Data Brokers Do
Data brokers compile information from multiple sources (public records, purchase histories, online activity, app usage) and sell aggregated profiles. They operate largely outside direct consumer relationships.
Primary Broker Categories:
Category Function Examples
Marketing Data Brokers Build consumer profiles for advertisers Acxiom, Experian, Oracle Data Cloud
Risk/Fraud Brokers Identity verification for financial services Equifax, TransUnion
People Search Brokers Public record aggregation Whitepages, BeenVerified, Spokeo
Location Data Brokers GPS tracking sales PlaceIQ, Foursquare, Nearbuy
Source: Federal Trade Commission — Data Broker Report 2023
FTC Enforcement Actions (2023-2026)
Equifax Data Breach Settlement
Violation: Failed to secure 147 million consumer records
Penalty: $700 million (largest FTC privacy settlement in history)
Finding: Company knew about vulnerabilities for months before disclosure
Consent Decree Requirements: Comprehensive security program audit for 20 years
Source: FTC — Equifax Case Documents
Clearview AI Settlement
Violation: Scraped facial recognition images from social media without consent
Penalty: $10 million + prohibition on commercial facial recognition sales
Finding: Biometric data collection violated Illinois BIPA and FTC deception standards
Impact: Forced exit from U.S. commercial facial recognition market
Source: FTC — Clearview AI Cease and Desist Order
Facebook/Meta Privacy Settlement
Violation: Deceived users about ability to control data sharing
Penalty: $5 billion (2019 settlement, ongoing compliance through 2026)
Finding: Privacy settings manipulated to maximize data collection
Compliance: Regular third-party audits required through 2040
Source: FTC — Facebook Consent Decree
CONGRESSIONAL TESTIMONY HIGHLIGHTS
Senator Ron Wyden (Oregon) — Senate Intelligence Committee (March 2025)
During testimony on surveillance capitalism:
“The data broker industry operates like a shadow government. They know where you shop, who you associate with, what health conditions you research, what political campaigns you follow. And they sell it to anyone willing to pay — including foreign adversaries.”
Source: Senate Intelligence Committee — Markup Session Transcripts
Senator Mark Warner (Virginia) — Commerce Committee Hearing (June 2025)
On location data trafficking:
“Location data brokers are selling real-time tracking information on Americans to anyone with a credit card. There’s virtually no oversight. We’ve seen this data purchased by bounty hunters, stalkers, and unauthorized government entities.”
Source: Commerce Committee — Location Data Privacy Hearing
House Subcommittee on Antitrust (September 2025)
Major tech companies testified about data collection practices:
Google CEO Sundar Pichai: “We offer transparency tools and user controls.”
Amazon Representative: “Data collection improves customer experience and product recommendations.”
Meta Representative: “Users understand how data is used based on our terms of service.”
Critics noted testimony avoided admitting to data broker sales relationships.
Source: House Judiciary Committee — Big Tech Hearings Archive
DATA BROKER REGISTRY DISCLOSURES
California Data Broker Registration
Under CCPA amendments, California requires data brokers to register annually. As of January 2026:
Total Registered Brokers: 1,247 entities
Top 20 Hold: Estimated 68% of industry revenue
Common Violations: Failure to honor opt-out requests, inadequate deletion processes
Source: California Department of Justice — Data Broker Registry
Industry Self-Regulation Initiatives
Digital Advertising Alliance (DAA) Opt-Out Program:
Voluntary cross-industry opt-out system
Participation rates vary by company (45-92%)
Limited enforcement mechanisms
Does not cover all data collection types (e.g., app data, IoT devices)
Source: DAA — Annual Compliance Report 2025
CORPORATE FILINGS ANALYSIS
SEC Filings on Privacy Risk Disclosure
Public companies must disclose material risks in SEC filings (10-K, 10-Q). Privacy and data breaches are increasingly listed as risk factors.
Sample Disclosures from Major Tech Companies (FY 2025 10-K Filings):
Apple Inc.:
“Data breaches or unauthorized access to personal information could harm our reputation and result in legal proceedings and regulatory actions.”
Amazon.com Inc.:
“We face risks related to data privacy and security laws, which are evolving globally and may impose significant compliance costs.”
Microsoft Corporation:
“Failure to comply with data protection regulations could result in substantial fines, litigation costs, and reputational damage.”
Google (Alphabet Inc.):
“Increasing regulatory scrutiny of our data practices could materially impact our business model and profitability.”
Source: SEC EDGAR Database — Company Filings
Analysis: All major tech companies list privacy compliance as material risk — indicating potential liability exposure in billions of dollars if regulations tighten.
POLITICAL SPENDING ON PRIVACY LEGISLATION
Lobbying Expenditures (2024-2026)
According to OpenSecrets lobbying database:
Organization 2024 Lobbying Spend 2025 Lobbying Spend Primary Focus
Google (Alphabet) $8.9M $9.4M Privacy preemption, antitrust
Meta $19.8M $18.2M Data regulation, content moderation
Amazon $16.2M $17.1M Privacy compliance, labor laws
Microsoft $21.8M $22.4M Data sovereignty, cloud regulation
Apple $4.7M $5.1M Privacy as competitive feature
Data Broker Council $2.3M $2.8M Preempting state laws
Source: OpenSecrets — Lobbying Database
Trend Analysis: Tech companies spend heavily to shape privacy legislation. Common goals include:
Federal preemption of stricter state laws
Favorable consent thresholds (implied vs. affirmative)
Reduced enforcement authority
Consumer advocacy groups spent approximately $8M collectively — roughly 1/8th of industry spending.
Source: Center for Responsive Politics — Advocacy Spending
DOCUMENT TIMELINE
Date Event Source Type Verification Status
2022 ADPPA passes House Committee Legislative transcript 
Enacted in committee
Enacted in committee2023 Multiple state laws enacted State statutes In effect
In effect2023 Clearview AI FTC settlement FTC consent decree Enforced
Enforced2025 Senate Intelligence testimony Congressional record Published transcript
Published transcript2025 1,247 California broker registrations State registry Public database
Public database2026 Current legislative status Congressional tracker Ongoing stalemate
Ongoing stalemateUNANSWERED QUESTIONS
Question Status Barrier to Answer
Total value of U.S. data broker market Partially Known Industry estimates vary (tens of billions); companies don’t disclose separately
Foreign government purchases of U.S. citizen data Undisclosed National security classification limits release
Effectiveness of DAA opt-out program Limited Study Industry self-reporting; independent audits rare
Full scope of law enforcement access to data brokers Partially Classified Many acquisitions exempt from public disclosure
SOURCES CONSULTED
Document Type Repository Status
- Federal Legislative Text Congress.gov Reviewed
- State Privacy Statutes State legislature archives Reviewed
- FTC Consent Decrees FTC Legal Archive Reviewed
- Congressional Testimony Senate/House Committee Records Reviewed
- SEC 10-K Filings SEC EDGAR Database Reviewed
- Lobbying Disclosure Reports OpenSecrets Reviewed
- Data Broker Registrations California DOJ Reviewed
VERDICT: DOCUMENT-BASED ASSESSMENT
Category Finding
Legislative Activity 
Active debate; no federal law passed yet
Active debate; no federal law passed yetEnforcement Actions Significant penalties levied against major companies
Significant penalties levied against major companiesIndustry Transparency 
Minimal voluntary disclosure beyond required filings
Minimal voluntary disclosure beyond required filingsConsumer Protections 
Patchwork — varies significantly by state
Patchwork — varies significantly by stateOversight Capacity FTC understaffed relative to industry scale
FTC understaffed relative to industry scaleOverall Assessment High Risk Environment — Protections Inadequate
High Risk Environment — Protections InadequateDISCLAIMER
This content was created with the assistance of artificial intelligence tools for document organization. All claims were reviewed and verified by human researchers. The content is for educational and informational purposes only. We do not guarantee the accuracy or completeness of any information presented.
Files Don’t Lie disclaims any liability for damages or losses resulting from reliance on this information. Always consult primary sources for policy and legislative research.
