Looking upstream: big tech and data brokers

Effecting meaningful change in data privacy requires looking upstream—targeting the sources that power the data ecosystem rather than individual companies at the point of collection. Two primary pathways exist: regulating big tech directly, which layers in competition law and antitrust complexity, or focusing on data brokers, who sit at the center of the marketing daisy chain supplying ad tech and consumer companies with data on virtually every American. Data brokers operate largely in obscurity, trading billions of records across a chain where even the parties involved often can't trace how data is moving between hands. The California Delete Act represents one of the most significant upstream interventions to date, creating a centralized consumer opt-out registry that triggers deletion requests across all registered data brokers simultaneously. The premise is top-down systemic change: if consumers can eliminate their data at the broker layer, the impact ripples through the entire ecosystem. Complementing this systemic lever is targeted enforcement—identifying the most egregious actors, such as non-HIPAA health entities mishandling sensitive data, and making high-profile examples to deter the broader market. Both approaches are necessary because no single tool is sufficient on its own. Changing big tech directly is a long-horizon effort requiring enormous resources and coordination, as the DOJ antitrust cases illustrate. Regulators and advocates need to fire on all cylinders simultaneously—pursuing upstream systemic reforms, targeted enforcement actions, and structural antitrust cases in parallel—using whichever lever generates results fastest in the near term while the longer-horizon work plays out. The framework that emerged from this conversation reflects a coordinated, multi-front strategy rather than a sequential one.

**Raashee:** So to effect change, you kinda have to go upstream. Right? You can go upstream in two different ways. Either you go up to big tech, which problems. Like, it's not just privacy. Then you have to layer in competition and anti antitrust and a lot of other conduct type things. But then the other is what is happening outside the big tech where they can inform change, and that's where data brokers come into play. Because if you think about a marketing ecosystem, a marketing daisy chain, if I am a consumer company, I am working with a dozen ad tech companies who are providing me services and products, and those are powered by data. And that data is being collect either collected by them or sourced by them through other means, and the other means are data brokers. And they are collecting data and selling data to each other or sharing data to each other. Nobody knows who's where how the data is exchanging hands. But when you when you hear about them, they have billions of records. They have data on every single American out there. So that's where I feel like this idea of going upstream so that there is a change that can take place from the top down with California Delete Act. I think I feel like that's the premise behind it is providing this registry for consumers that is a central place for opting out across all data brokers. So that's a that's a I think that's a important and a big undertaking, but I feel like the sentiment behind it is how do we inform change, how do we affect change that is larger and wider. **Jonathan:** Yeah. That's that's huge. Right? This idea that you just I mean, that's a big part of the ecosystem. Yeah. You know? So that's interesting when we see that California delete act, start to happen. And I'm sure that won't be the end of it. It's funny. I had heard it at at a different way or, like, a secondary way, I should say, second way, where it's you find the biggest offender, and you go after them and you make an example of them. You know? And so that's true as well. **Raashee:** I think I think you can have to take both approaches. Right? Just like we all in in the business world, we take a bottoms up and a top down approach to our planning, to our activities. So I think it's the same thing is how can you sort of attack **Jonathan:** Pretty powerful combination. On both sides. Yeah. Let me pick an industry, like, you know, for example, to to take it back to, like, one of the first, pieces of your framework. We're gonna look at non HIPAA regulated health entities or, you know, in the health ecosystem, but they're not, you know, regarded as as HIPAA compliant. And let's see what they're doing. And let's pick the most egregious examples and make an example of them or just someone we think we can make an example of. And then it's like, hey. Let's let's get into the ecosystem. And where are the big players? Where are the cogs? Happens to be data brokers in this particular business. Let's do that. And then finally, right, there might even be a third one, which is I know the the moats around big tech are huge, but, I mean, we're seeing it with the the DOJ actually. It's good. They're doing that as well. Like, it's just so many weapons at your disposal. **Raashee:** Yeah. I think the it comes back to which ones can get you results faster and you have to fire on all cylinders because a complex trying to change big tech is gonna take time, energy, army of people, a lot of like, it's not a it's a it's a giant ship that is slow moving. But then if you're trying to go after a consumer company and wanting to make an make an example, so that is so it it's really comes back to you have to approach it from both sides, from the top and the bottom. **Jonathan:** Rashi, I really appreciate this. I love that three point framework. It's it it really helps me kinda think about this. Hopefully, it helps everybody listening. I appreciate this. Thank you, and we'll kinda hear more from you. **Raashee:** Yeah. Thank you. This was fun. Thanks for having the conversation. **Jonathan:** Nice. Thanks, Rashi. Alright.