Data Broker Status

The cited state statutes generally define a "data broker" as a business that knowingly collects and sells the personal information of consumers with whom the business does not have a direct relationship. Each state’s definition differs in detail. Some statutes carve out the sale of public-records information, the sale of information about businesses (rather than consumers), and a number of other exceptions.

IDLeakCheck does not sell personal information to third parties as that term is defined under the California Consumer Privacy Act, the California Privacy Rights Act, or the cited state data-broker statutes. We do not provide bulk data feeds to advertising networks, data-aggregation marketplaces, or any other commercial buyer of personal information. The information made available through the Service is provided to authenticated users for individual look-up only and is subject to per-tier access restrictions, attestation requirements under DPPA and GLBA where applicable, and our FCRA Notice.

Because IDLeakCheck makes consumer personal information available to users with whom the underlying consumer may not have a direct relationship, our status under the various state data-broker definitions is jurisdiction-specific and currently under active legal review.

Registration: under evaluation. We are reviewing whether the Service meets the California data-broker definition under the DELETE Act and will register with the California Privacy Protection Agency (CPPA) if required. This page will be updated with our registration number and registration date if and when we register.

Registration: under evaluation. Same evaluation applies to Vermont (9 V.S.A. § 2446), Texas (Business & Commerce Code § 509), and Oregon (HB 2052). This page will be updated as registrations are filed.

Independent of whether IDLeakCheck is required to register as a data broker in any jurisdiction, we commit to the following:

• Honor deletion requests from any consumer through our Data Removal form, with a verifiable response within 45 days under California law.
• Honor the California DELETE Act’s central deletion mechanism once operational (currently scheduled for August 2026). We will accept deletion requests routed through the CPPA’s central system.
• Honor the Global Privacy Control (GPC) signal as a valid opt-out request under CCPA / CPRA and equivalent state laws.
• Maintain a public list of sub-processors at /legal/subprocessors, with 30-day advance notice of any addition or change.
• Maintain consumer notice obligations under the FCRA, DPPA, and GLBA as set out in our FCRA Notice, DPPA Notice, and Privacy Policy.

Questions about our data-broker status, registration, or DELETE Act compliance: legal@idleakcheck.com