32 data brokers told California they shared or sold consumers' data to generative AI developers in the past year

32 of the 603 data brokers in California's 2026 registry answered Yes when asked whether they "shared or sold consumers’ data to a developer of a GenAI system or model in the past year". Names on the list include Equifax Information Services LLC, Experian Marketing Solutions, LLC, TransUnion Risk and Alternative Data Solutions, Inc., Dun and Bradstreet Inc., Moody's Corporation and West Publishing Corp. We counted the answers on October 11, 2026 in CalPrivacy's registry file, last updated July 29, 2026. All 32 are in the table below.

Figures above were counted from CalPrivacy's registry file (registry.csv, last updated July 29, 2026) on 2026-10-11. See sources.

The question, word for word

The registry file records the answer in column Z, headed "Data broker shared or sold consumers’ data to a developer of a GenAI system or model in the past year". The requirement is in Civil Code section 1798.99.82(b)(2)(S), which lists among the information a registering broker must provide: "Whether the data broker has shared or sold consumers’ data to a developer of a GenAI system or model in the past year."

The same section defines the terms. A developer is "a business, person, partnership, corporation, or other entity that designs, codes, produces, or substantially modifies a GenAI system." A GenAI system is "an artificial intelligence that can generate derived synthetic content, including text, images, video, and audio, that emulates the structure and characteristics of the system’s training data."

The question was added by SB 361, passed in 2025. CalPrivacy's page for data brokers says: "SB 361 also requires data brokers to disclose some information about their selling and/or sharing practices, such as whether they’ve shared data with foreign actors, law enforcement, or developers of generative AI systems." The statute text CalPrivacy posts is labeled effective January 1, 2026, "SB 361 update". The 2025 registry file has no such question, so the 2026 file is the first with these answers. According to the registry page, the brokers in it "operated as data brokers in 2025."

The 32 brokers, A to Z

How the 32 answered the other questions

Of the 32, 11 also answered Yes for the federal government, 13 for other state governments, 10 for law enforcement and 7 for a foreign actor. 17 answered No to all four of those questions.

On data collection, 6 said they collect gender identity and gender expression data, 5 personal information of minors, 4 government-issued ID numbers, 3 account logins or account numbers with security codes, 2 biometric data, 1 citizenship data, 1 sexual orientation status and 1 precise geolocation (iSpot.tv, Inc.). None said it collects union membership status or reproductive health care data.

30 of the 32 list a U.S. address; Eyeota Pte Ltd lists Singapore and Similarweb Ltd. lists Israel. Two said they or a subsidiary are regulated by the Fair Credit Reporting Act, two by the Gramm-Leach-Bliley Act and four by the HIPAA privacy, security and breach-notification rules.

The count was 31 in an Internet Archive copy of the file captured on July 17, 2026. Of the 22 brokers added between that copy and the July 29 file, one, Sprout Social, Inc., answered Yes, and no broker already in the file changed its answer.

What a Yes does not tell you

• Who the developer was. The file records only Yes or No for this question. No column names recipients.
• What data, how much, or for what use. Nothing in the file says what kind of data went to a GenAI developer, how many people it covered, or whether it was used to train a model.
• Exactly when. The question covers "the past year". The registration was filed in January 2026 and covers the broker's 2025 activity.
• Whether the answer is right. Answers are self-reported. In Enforcement Advisory 2026-01, issued September 3, 2026, CalPrivacy's enforcement staff describe a hypothetical startup "designing the fastest chatbot on the market" that buys data from a broker, and include whether that startup counts as a GenAI developer among the questions the advisory poses for the broker filling in its registration. The advisory says incorrect registration information can bring a $200 fine for each day it appears in the registry. How other answers in the 2026 registry were later corrected is covered in our page on the 2026 registry.

What we could not confirm

• Which AI developers received data from any of the 32. The registry does not say, and we found no other CalPrivacy record that does.
• The on-screen wording of the registration form, which sits inside DROP's accounts for data brokers and is not public. The wording quoted here comes from the statute and the file's column header.
• The text of SB 361 as passed. We did not read the Legislature's site; the statute text quoted here is the version CalPrivacy posts with the label "SB 361 update".
• Whether any of the 32 answered differently when the 2026 registry was first posted in March 2026. We found no archived copy of the March file; the July 17, 2026 copy is the earliest version we compared.

Sources

• 2026 registry file, registry.csv (last updated July 29, 2026) - CalPrivacy, downloaded and counted 2026-10-11
• California Data Broker Registry page - CalPrivacy (cppa.ca.gov), read 2026-10-11
• 2025 registry file - CalPrivacy, downloaded 2026-10-11
• Copy of registry.csv captured July 17, 2026 - Internet Archive, read 2026-10-11
• Delete Act, Civil Code sections 1798.99.80-1798.99.89, effective January 1, 2026 (SB 361 update) - CalPrivacy PDF, read 2026-10-11
• Information for Data Brokers (SB 361 disclosures) - CalPrivacy (cppa.ca.gov), read 2026-10-11
• Enforcement Advisory No. 2026-01, Accuracy of Data Broker Registration Information, September 3, 2026 - CalPrivacy PDF, read 2026-10-11

Source links are not affiliate links. This page is general information, not legal advice; how these rules apply depends on the facts and the state.