A landmark class-action lawsuit filed against a major data broker has resulted in a $340 million settlement and a court order requiring the company to delete billions of records containing personal information collected without consumer consent. The case, filed in the Northern District of California, could reshape how the data brokerage industry operates in the United States.
The Case Against DataStream Analytics
DataStream Analytics, one of the largest data brokers in the United States, was accused of collecting and selling personal information on more than 200 million Americans without obtaining meaningful consent. The company aggregated data from mobile apps, public records, social media profiles, and purchase histories to build detailed consumer profiles that it sold to advertisers, insurers, and other businesses.
The lawsuit alleged that DataStream’s data collection practices violated the California Consumer Privacy Act (CCPA), Illinois Biometric Information Privacy Act (BIPA), and common law privacy protections in multiple states. Plaintiffs argued that the company’s terms of service, which purportedly authorized data collection, were buried in fine print that no reasonable consumer would read or understand.
The Settlement Terms
Under the settlement, DataStream must pay $340 million to the plaintiff class, delete all personal data collected without verifiable consent, and implement a comprehensive consent management platform that provides clear, conspicuous disclosure before collecting any personal information. The company is also required to submit to independent audits of its data practices for the next five years.
Implications for the Data Broker Industry
The settlement sends a powerful signal to the broader data brokerage industry, which has long operated in a regulatory gray area. While companies like DataStream have argued that their practices comply with existing privacy laws, this case establishes a precedent that passive consent through terms of service may not satisfy legal requirements for data collection.
“This settlement fundamentally changes the calculus for data brokers,” said privacy attorney Julie Brill, a former FTC commissioner. “Companies can no longer assume that burying consent provisions in lengthy privacy policies provides adequate legal cover.”
Consumer Impact
Individual class members are expected to receive payments ranging from $50 to $500 depending on the extent of data collected about them. More significantly, the deletion order will remove personal profiles that have been used for targeted advertising, insurance risk scoring, and employment screening.
Political Momentum
The settlement has given new momentum to federal privacy legislation. The American Data Privacy and Protection Act, which has stalled in Congress for several sessions, has attracted new co-sponsors in the wake of the ruling. The bill would establish federal standards for data collection and give consumers the right to access, correct, and delete their personal information held by data brokers.
Privacy advocates have also called for the creation of a national data broker registry that would require all companies engaged in the sale of personal information to register with the FTC and disclose their data sources, collection methods, and business customers.
As consumers become increasingly aware of how their personal data is collected and monetized, legal and regulatory pressure on the data brokerage industry is likely to intensify. The DataStream settlement may prove to be just the beginning of a broader reckoning.
