Data Broker Crackdown Casts a Shadow Over Ad Tech

A tightening regulatory noose around data brokers is sending ripples through the ad-tech industry, as lawmakers and regulators move to restrict how sensitive consumer information can be collected, traded and used for targeted advertising.

In Washington, several federal efforts have converged on the same problem, third party data flows that allow brokers to sell detailed profiles, location histories and behavioral data to advertisers and other buyers with limited oversight. Recent work on measures like the Protecting Americans’ Data from Foreign Adversaries Act, which targets transfers of sensitive data to entities linked to countries such as China and Russia, underlines how national security and privacy concerns are now driving policy.

At the state level, California continues to act as a bellwether.

A 2025 bill known as SB 361 amends the state’s Civil Code to impose stricter registration and disclosure obligations on data brokers under the CCPA and CPRA, including requirements to spell out exactly what types of sensitive information they collect, from government IDs and biometric data to login credentials and sexual orientation.

Non compliance can attract administrative fines, raising the cost of doing business for firms whose entire model depends on acquiring and reselling granular personal data at scale.

High profile incidents have given these legislative efforts real urgency.

A widely covered case involving a violent attack on Minnesota public officials renewed calls for stronger controls on “people search” and data broker sites after investigators found the suspect had compiled a list of targets and referenced multiple services that aggregate and resell personal information.

Lawmakers have pointed to that incident as evidence that allowing lightly regulated data markets can have real world safety consequences, not just abstract privacy risks.

For ad-tech companies, the message is straightforward but uncomfortable, a business model that relies heavily on opaque third party data is becoming steadily less tenable. Stricter rules on data brokers raise compliance costs, constrain what can legally be sold or accessed, and accelerate the shift toward first party data, contextual ads and privacy preserving techniques. While large platforms with rich in house data may adapt, smaller intermediaries and niche data vendors could see margins compress or demand dry up.

Markets are already discounting some of this risk into ad tech valuations.

As the regulatory framework hardens, investors will likely favor companies that can prove they can thrive with less invasive data practices, rather than those clinging to the old, high surveillance model.