Data Brokerage & Sharing
Visitor data flowing to vendors on official data-broker registries, which triggers heightened state obligations and direct enforcement exposure.
Where sharing becomes a sale.
Sending visitor data to a company that buys and sells personal data can count as a sale under state privacy laws. That makes it mainly a regulatory-enforcement exposure.
Regulators treat brokers that trade location data as especially sensitive, so CyRisk flags those separately.
Data broker interaction
Example finding. Vendor names are withheld.
What CyRisk tracks.
Severity and placement are CyRisk defaults. Your team can elevate, downgrade or drop any risk to context-only, per account.
| RISK | DEFAULT SEVERITY | DEFAULT PLACEMENT |
|---|---|---|
| Data broker interaction | Critical | Critical to Bind |
The site is observed transmitting visitor data to a vendor listed on an official data-broker registry, such as California’s.
Audit vendor relationships against state data-broker registries. For each registered broker, disclose the relationship in the privacy policy, provide a working opt-out and honor deletion requests passed through to the broker.
Verified by rescan. The fix shows on the next scan.
Ready-to-use language.
“Which vendors on the site appear on state data-broker registries, and are opt-outs and deletions passed through?”
“Disclose each data-broker relationship and provide a working opt-out, verified by CyRisk rescan.”
Regulatory coverage terms. Read alongside the Do Not Sell/Share and GPC findings.
Keep exploring.
Laws this exposure can trigger
Related exposure families
What is a data-broker registry?
An official state list of companies that buy and sell personal data. California maintains one through its privacy regulator.
Why is this Critical to Bind by default?
Undisclosed broker flows create direct enforcement exposure. You can change the default per account.
What about location data brokers?
Regulators treat them as especially sensitive, so CyRisk flags them separately.
Follow the data downstream.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our disposition next to the call you made.
Severity and placement shown are CyRisk defaults and can be tuned per account. A detected exposure indicates a fact pattern common to privacy litigation, not a confirmed violation. Litigation theories explain why a finding is tracked; they are not legal advice.