PADFAA: the data-broker rule that isn't a deletion right

2026-11-10Editorial review: reviewed

A federal law makes it unlawful for data brokers to transfer personally identifiable sensitive data of U.S. individuals to foreign adversaries — but it offers consumers no personal deletion mechanism. It is a national-security restriction, and it is worth reading precisely.

Sensitive personal informationData brokersEnforcementLocation tracking

The Protecting Americans’ Data from Foreign Adversaries Act (PADFAA), codified at 15 U.S.C. § 9901, is one of the clearest examples of a law that is frequently paraphrased into something it is not.

What it actually prohibits. It is unlawful for a data broker to sell, license, rent, trade, transfer, release, disclose, provide access to, or otherwise make available personally identifiable sensitive data of a U.S. individual to (1) a foreign adversary country or (2) an entity controlled by a foreign adversary.

How it is enforced. A violation is treated as a violation of a rule defining an unfair or deceptive act or practice under the FTC Act. The FTC enforces it with the same powers it has under that Act.

Why the definitions matter. The statute’s reach depends on precise definitions. “Sensitive data” is an enumerated list that includes government identifiers, health information, financial account data, biometric and genetic data, precise geolocation information, private communications and more. “Precise geolocation information” is defined by reference to street-level accuracy or a range of 1,850 feet or less. “Data broker” is defined with several exclusions, including news publishing and service-provider activity.

What it is not. PADFAA is not a consumer-initiated deletion right. It does not give you a way to demand that a broker delete your data, and it does not require notification to you. It constrains who a broker may send certain data to.

Why include it. Because “there’s a federal law about data brokers” is technically true and materially misleading. Precision here is the point of this library: a national-security transfer prohibition and a state deletion right are different instruments with different remedies.

← All news & research