Lawfare: Closing the Front Door: The Case for DOJ’s Bulk Data Security Program

“Two and a half years later, what the Duke team demonstrated in a controlled study is now a matter of public record. In March 2026, the Electronic Privacy Information Center flagged 33 data brokers that, in disclosures filed with the State of California for 2025 under the state’s Delete Act, reported selling data to, or sharing it with, “foreign actors”—defined by California law as governments or principal-place-of-business entities tied to China, Russia, Iran, or North Korea. The disclosures were not the product of a sting or a leak. They were self-reported, on an annual form, to a state agency.”

Read more here.