FTC Issues PADFAA Warning to Data Brokers

The FTC recently issued a formal reminder to 13 data brokers concerning their obligations under the Protecting Americans’ Data from Foreign Adversaries Act of 2024 (PADFAA).  PADFAA strictly prohibits the sale, disclosure, or transfer of personally identifiable sensitive data to defined “foreign adversaries”—specifically China, Russia, North Korea, and Iran—or any entity under their control.  PADFAA’s definition of “sensitive data” includes not only Social Security, passport and driver’s license numbers, but also sexual behavior information, geolocation, biometric data, and account/device log-in credentials.

The FTC’s warning specifically highlighted the “offering of solutions” involving the military status of individuals, noting that information regarding members of the Armed Forces is subject to heightened scrutiny under PADFAA.

FTC’s notice confirmed that PADFAA violations can result in enforcement actions and civil penalties of up to $53,088 per violation.