PADFAA Data Broker Screening 2026

PADFAA) (Protecting Americans' Data from Foreign Adversaries Act, enacted 2024) defines data brokers as entities that sell, license, or otherwise transfer data of US individuals they did not collect directly from those individuals. It prohibits making personally identifiable sensitive data available to foreign adversary countries — China, Russia, Iran, North Korea, Venezuela, and entities they control — or to entities subject to their jurisdiction. For commercial brokers, PADFAA is a transfer gate: know the buyer's ultimate parent, hosting geography, and subprocessor tree before shipping identity, mobility, email, or clickstream products. Pair with DOJ bulk sensitive data rule and federal procurement when defense-adjacent buyers appear.

Key Takeaways

  • PADFAA targets US individual sensitive data sold by brokers — not pure B2B firmographics without person-level fields.
  • Screen ultimate beneficial owner, cloud region, and subprocessor access — contractual reps alone are insufficient.
  • Precise geolocation, biometrics, financial and health fields, government IDs, and private communications are in scope.
  • Geo-block adversary-country IP, corporate, and platform access to sensitive SKUs on delivery systems.
  • Retain audit artifacts: questionnaires, denylists, and annual re-attestation after M&A or cloud moves.

Who Counts as a Data Broker Under PADFAA

PADFAA's broker definition covers entities that obtain data of US individuals and sell, license, rent, trade, or transfer it to another entity. Direct collectors can be brokers when they resell third-party enrichment. Platforms that only provide infrastructure may still face downstream pressure when their customers are brokers. GSDSI buyers should ask vendors whether they self-classify as brokers under PADFAA and how they implement transfer prohibitions in master agreements. The FTC's data broker rulemaking and state DELETE regimes overlap — use /trust/data-broker-registrations as a diligence index.

If your organization buys brokered sensitive data, you inherit supply-chain questions: did the upstream broker screen your corporate family and hosting? Enterprise procurement should push screening upstream, not only at the final license signature.

State DELETE and broker-registration laws do not replace PADFAA — they overlap. A vendor registered in California still must block adversary-country transfers of PADFAA-sensitive fields. Index registrations at /trust/data-broker-registrations and require written PADFAA programs in the same security packet.

What Counts as Sensitive Under PADFAA

Sensitive categories include precise geolocation, government identifiers, financial account and payment data, private communications content, biometric and genetic data, personal health information, and persistent online activity that reveals details of an individual's life. Coarse ZIP-level mobility may still be sensitive when combined with timestamps, MAIDs, or household graphs. Read alongside FTC sensitive location thresholds and sensitive location checklist. POI geofencing programs should confirm whether visit-level feeds include coordinates precise enough to trigger PADFAA-sensitive treatment.

Screening Workflow Vendors Should Operate

  1. Buyer diligence questionnaire — ownership chart, headquarters, primary cloud regions, subprocessors with data access, and any adversary-country nexus.
  2. Technical controls — IP allowlists, geo-fencing on APIs and object storage, separate buckets for export-controlled or federal buyers.
  3. Contractual prohibitions — no transfer, access, or sublicense to covered countries or covered persons; audit and breach notification.
  4. Annual re-attestation — repeat screening after M&A, rebrand, or migration to new cloud regions.
  5. Evidence retention — store approvals in /trust/security-program packets for enterprise review.

Federal and critical-infrastructure buyers increasingly paste PADFAA-style language into commercial MSAs even when the deal is not a government contract. Align answers with security overview and privacy center disclosures.

Data management platforms and clean rooms are not automatic safe harbors: if a buyer in a covered country can query sensitive fields through a shared clean room, treat it as a transfer. Map query interfaces, export buttons, and support engineer VPN access in the same diligence pass as SFTP credentials.

Buyer Diligence When Licensing Brokered Feeds

Ask vendors for: (1) written PADFAA compliance policy, (2) sample transfer denial log (redacted), (3) list of countries and entities blocked, (4) subprocessors with access to sensitive SKUs, and (5) how Octopus or SFTP endpoints enforce geography. Buyers activating audience targeting in multinational agencies should map which legal entity receives the feed — a US subsidiary licensing data that flows to an adversary-country parent is the scenario PADFAA targets.

Cross-border transfers for EU or UK programs still require GDPR tools; PADFAA is an additional US export-style gate for sensitive US person data. Document both in RFP scorecard governance rows.

Procurement should add a PADFAA attestation line item beside FCRA and HIPAA-adjacent questions: "List all countries where employees or contractors can access sensitive fields" and "Confirm no adversary-country parent owns >X% of buyer." Vendors answering "US only" without subprocessor detail should receive follow-up questionnaires, not automatic approval.

Enforcement Posture and Deal Risk

PADFAA does not create a private right of action — enforcement is federal. That does not make it optional: enterprise security teams treat violations as deal-stopper risk, and federal agencies mirror restrictions in supply-chain rules. The DOJ NPRM on bulk sensitive personal data adds volume thresholds and countries of concern framing that complements PADFAA. Vendors licensing mobility at scale should read geo-panel audit before promising unrestricted global access.

Insurance and financial buyers licensing insurance leads or mortgage refi panels should verify whether PADFAA-sensitive fields are segmented in separate SKUs with stronger transfer controls than marketing files. Ad-tech buyers combining clickstream with maid feed need subprocessors lists that include demand-side platforms in adversary-adjacent jurisdictions — screening is a graph problem, not a checkbox on the MSA cover page.

Document denials: when legal rejects a deal because ultimate parent maps to a covered country, retain the questionnaire and denial rationale (redacted) for auditor replay. Positive approvals should name the approving counsel or compliance officer and expire annually.

University and nonprofit buyers are not automatically low risk — research collaborations with adversary-country institutions can taint transfers. Screen grant-funded projects and visiting scholars with the same ownership questionnaire used for commercial agencies.

Maintain a denied-parties list synchronized with adversary-country entity updates — screening once at onboarding is insufficient when buyers restructure quarterly. Train customer success teams to escalate when prospects request access from VPNs geolocated to adversary countries — technical signals should trigger legal review even before contract signature. Align the list with DOJ bulk data covered-person screening to avoid maintaining two incompatible deny matrices.

Buyers building location, foot-traffic, or geofence programs can scope POI data with polygon coverage, brand hierarchy, and daily refresh before production licensing.

Frequently Asked Questions

Is there a private right of action under PADFAA?
No — federal enforcement applies. Enterprise buyers still treat PADFAA breaches as termination-level contract events and audit failures.
Does PADFAA apply to pure B2B firmographic data?
PADFAA targets US individuals. Pure firmographic tables without person-level identifiers may fall outside, but mixed files (email, MAID, phone, precise location) need legal review — do not assume "B2B" is an automatic safe harbor.
How does PADFAA interact with the DOJ bulk data rule?
Both restrict sensitive US person data flows to adversary countries; DOJ adds volume thresholds for categories like geolocation. Operate one screening program that satisfies both — see DOJ bulk data guide.
Should platforms geo-block Octopus and API access?
Yes, when sensitive SKUs could be accessed from adversary-controlled entities. Combine technical blocks with contractual transfer prohibitions and logging.
Where do GSDSI buyers document transfer approval?
During pilot process and security review — attach vendor PADFAA questionnaires to the same packet as sourcing methodology and product specs for maid feed or global mobility.