Data Brokers Post-FTC Consent Orders: Procurement Diligence in 2026

The 2024 wave of FTC enforcement against data brokers was the largest structural event in commercial data since Apple ATT. X-Mode/Outlogic, InMarket Media, Gravy Analytics/Venntel, and Mobilewalla converged on one message: sensitive-category location data, weak consent chains, and unclear downstream use are unfair practices under Section 5. Procurement diligence in 2026 has a new floor, not optional privacy theater. Pair with geo-panel audit 2026, FTC location enforcement, and sourcing methodology.

Healthcare, financial services, and retail media buyers face heightened scrutiny when precise geolocation feeds activation or credit-adjacent decisions. Document which FTC actions you reviewed in diligence memos with order dates and remedy summaries: examiners ask for primary sources, not vendor summaries.

What the Consent Orders Require

Orders specify injunctive language on sensitive categories, SDK disclosure, affirmative consent for advertising use of precise location, deletion of non-consented historical data, and downstream sharing restrictions. Map each clause to supplier pipeline architecture before legal closes the file. Orders are engineering requirements, not footnotes.

Sensitive-Category Scrubbing Verification

Buyers should verify exclusion lists, scrubbing methodology, false-negative testing, and update cadence when categories expand. Ask for sample queries demonstrating health-facility, reproductive-health, religious-site, and shelter exclusions on production logic, not marketing PDFs. See sensitive location checklist.

Consent Chain and Deletion SLAs

Require panel-level consent scope, purpose limitation, consumer opt-out handling, and deletion propagation SLAs with subprocessors. Consent artifacts should survive audit. SDK disclosures, partner agreements, and CMP integrations documented. Subprocessor change notice must match contract objection windows.

Where Residual Exposure Lives in 2026

Residual risk sits in downstream activation beyond contracted purpose, re-identification from small cohorts, stale historical tranches not deleted, and brokers rebranding post-order without operational change; a rebranded entity's California registration status is checkable against the California Privacy Protection Agency data broker registry. State broker registration laws and state data broker registration diligence add parallel obligations, alongside the comprehensive state privacy statutes listed in the IAPP state privacy legislation tracker.

Flow-Down: Your Vendor’s Obligations Have to Reach Their Suppliers

The most common gap in post-order diligence is a vendor that has genuinely cleaned up its own house while still buying from suppliers operating on the old assumptions. Restrictions that stop at the first tier accomplish very little, because sensitive-category exposure usually originates further upstream, in the panel or app relationship where consent was first collected. Ask to see the actual contractual language pushing each obligation down the chain, not a statement that suppliers are required to comply.

Three clauses do most of the work: a flow-down requiring suppliers to accept equivalent restrictions, an audit or evidence right the vendor can genuinely exercise against those suppliers, and a termination path if a supplier refuses. Where a vendor cannot show all three, treat the upstream tiers as unverified. That is not automatically disqualifying, but it belongs in your risk register with a named owner rather than in a footnote nobody reads at renewal.

The Evidence Pack to Request Before Signing

Questionnaires produce answers. Evidence packs produce artifacts, and artifacts are what survive a later inquiry. Ask for documented lineage covering each feed you are licensing, the current sensitive-category exclusion list with the date it was last reviewed, a written description of the consent mechanism at the point of collection, deletion and suppression SLAs with measured performance rather than targets, and the sub-processor list with jurisdictions.

• Lineage per feed, not per company. A vendor can be scrupulous on one product and opaque on another, and you are buying a specific one.
• An exclusion list carrying a review date. An undated list says nothing about whether it reflects the current enforcement landscape.
• Measured deletion performance, not the contractual maximum. Ask for last quarter’s actual distribution, including the tail.
• Sub-processors with jurisdictions, because a transfer question you never asked becomes your problem rather than theirs.

What an Indemnity Actually Covers

Buyers routinely treat an indemnity as though it retires the risk. It does not. An indemnity is a promise to cover certain losses, made by a counterparty that must still be solvent when the loss arrives. It is usually capped at a multiple of fees paid, frequently carves out regulatory penalties, and is typically silent on the cost that actually hurts, which is unwinding a model or a campaign built on data you can no longer use.

Read the cap, the carve-outs, and the survival period together rather than separately, and compare the cap against your realistic remediation cost rather than against the contract value. Then ask the question the document cannot answer: if this feed had to be switched off tomorrow, what stops working, and how long would replacing it take? A vendor whose data is deeply wired into scoring or routing carries concentration risk no indemnity clause addresses. Pair this with the RFP scorecard so the answer gets scored rather than assumed.

Re-Diligence on a Schedule, Not on an Incident

Diligence performed once at signature describes a company that no longer exists by the second renewal. Supplier mixes change, panels are added and dropped, and the enforcement landscape moves underneath both parties. Put re-diligence on a calendar with a defined scope, lighter than the original review but genuinely re-run: confirm the exclusion list has been reviewed since last time, confirm the sub-processor list has not quietly grown, and re-request measured deletion performance.

Set a materiality trigger alongside the calendar so meaningful changes do not wait for the annual slot. A new sub-processor in a new jurisdiction, an acquisition, or a change to the consent mechanism should each pull the review forward. The cost of doing this is a few hours a year. The cost of discovering a supplier change through an incident is the whole engagement.

RFP Matrix Additions for 2026

Add FTC-aligned rows: consent artifact samples, sensitive-category list, deletion SLA, subprocessor notice, audit rights, and order-compliance attestation. Pair with RFP scoring matrix and geo-panel audit. Federal buyers mirror the same packet for federal intelligence engagements.

Annual re-diligence beats one-time checkbox exercises: broker pipelines, SDK partners, and exclusion lists change faster than three-year contracts.