The Federal Trade Commission (FTC) sent warning letters to 13 data brokers reminding them of their obligations under the Protecting Americans’ Data from Foreign Adversaries Act (PADFAA). PADFAA prohibits data brokers from selling or providing sensitive personal data about Americans to foreign adversaries such as China, Russia, Iran, and North Korea. The letters warn that violations could result in civil penalties of up to $53,088 per violation and urge companies to review their business practices for compliance.
In-house legal teams should review all vendor and data processing agreements where the company acts as a data broker or shares data with third parties, particularly those involving international transfers. Specific clauses to scrutinize include data sharing/transfer provisions, definitions of sensitive data, compliance with laws, prohibited destination lists, and audit rights. Changes may be needed to explicitly incorporate PADFAA's prohibitions on selling or providing sensitive personal data to foreign adversaries (China, Russia, Iran, North Korea), update data classification schemas to match PADFAA's definition (including health, financial, biometric, geolocation, etc.), add representations and warranties regarding non-disclosure to adversarial nations, and implement enhanced monitoring and termination rights for potential violations.
Entity
Data Brokers
Industry
Data BrokerOfficial Press Release
https://www.ftc.gov/news-events/news/press-releases/2026/02/ftc-reminds-data-brokers-their-obligations-comply-padfaa
military padfaa warning letter template
https://www.ftc.gov/system/files/ftc_gov/pdf/military-padfaa-warning-letter-template.pdf
Federal Trade Commission Enforcement Page
https://www.ftc.gov/enforcement
CalPrivacy issued Enforcement Advisory No. 2025-01 to remind data brokers of their annual registration obligations under California's Delete Act, including disclosing all trade names and websites and registering independently rather than through a parent company. The advisory warns that failures to comply may result in administrative fines of $200 per day, plus fees and recovery costs. It also highlights the upcoming Delete Request and Opt-Out Platform (DROP) launching January 1, 2026.
The California Privacy Protection Agency (CalPrivacy) announced the creation of a Data Broker Enforcement Strike Force to investigate privacy violations by data brokers. The strike force will focus on compliance with the Delete Act's registration requirement and the CCPA, building on previous enforcement actions. This initiative aims to hold data brokers accountable and protect Californians' personal information.
The California Privacy Protection Agency (CalPrivacy) announced the creation of a Data Broker Enforcement Strike Force to investigate privacy violations by data brokers under the CCPA and Delete Act. The strike force will focus on compliance with registration requirements and other obligations, building on previous enforcement actions to increase accountability.
The FTC referred a complaint against REPS & Company Inc. and company executives, alleging they bypassed ticket-issuer security controls and purchasing limits to acquire millions of tickets for resale. The complaint was filed by the Department of Justice, and the case will be decided by the court; the press release does not report a penalty or other remedy imposed.
The FTC sued Digital Forensics Corporation LLC and affiliated defendants, alleging they misled sextortion victims with promises of investigative and monitoring services that often were not provided, and used fake positive reviews. A federal court granted the FTC’s request to temporarily halt the defendants’ activities; the complaint remains for the court to decide.
The FTC alleged that Greenway Auto Group advertised vehicle prices thousands of dollars below the amounts consumers actually paid and used mailers falsely suggesting recipients had won cash prizes. Greenway agreed to an order requiring transparent pricing and prohibiting deceptive prize mailers and other misrepresentations; the press release does not state a monetary penalty.