GAO Reports on Federal Agency Purchases of Commercial Data Broker Data (Post-2010)

SUMMARY

This dossier investigates the extent of Government Accountability Office (GAO) reporting since 2010 specifically on federal agency procurement of data from commercial data brokers. While the GAO has released numerous reports and testimonies concerning data brokers, consumer privacy, and federal agency data protection practices more broadly, the initial investigation focuses on identifying reports directly addressing federal agency *purchases* of commercial data.

Existing information indicates that the GAO has a long-standing interest in consumer data privacy and the operations of data brokers. A 2013 GAO report concluded there is no comprehensive privacy law governing consumer data collection and sale by private sector companies, noting the limited scope of existing laws regarding marketing purposes (Source 1). Earlier, a 2008 GAO testimony recommended that agencies specify their use of data from information resellers and proposed a Federal Agency Data Protection Act (Source 6). As of December 2022, only 41% of the GAO's privacy recommendations since 2010 have been implemented by federal agencies (Source 7). The core question is whether the GAO has specifically audited or reported on the financial transactions and procurement practices of federal agencies buying data from these brokers post-2010.

CLAIMS

1. VERIFIEDCONF 1.00

   The GAO released a report in September 2013 concluding there is no comprehensive privacy law governing consumer data collection and sale by private sector companies.

   — attributed to: U.S. Senate Commerce Committee Report (citing GAO)

   • https://www.commerce.senate.gov/wp-content/uploads/media/doc/12.18.13%20Senate%20Commerce%20Committee%20Report%20on%20Data%20Broker%20Industry.pdf
2. VERIFIEDCONF 1.00

   A 2013 GAO report found that existing privacy laws have 'limited scope' regarding the collection, use, and sale of consumer data for marketing purposes.

   — attributed to: U.S. Senate Commerce Committee Report (citing GAO)

   • https://www.commerce.senate.gov/wp-content/uploads/media/doc/12.18.13%20Senate%20Commerce%20Committee%20Report%20on%20Data%20Broker%20Industry.pdf
3. VERIFIEDCONF 1.00

   A 2013 GAO report stated consumers have no federal statutory right to know what information data brokers have compiled about them under current law.

   — attributed to: U.S. Senate Commerce Committee Report (citing GAO)

   • https://www.commerce.senate.gov/wp-content/uploads/media/doc/12.18.13%20Senate%20Commerce%20Committee%20Report%20on%20Data%20Broker%20Industry.pdf
4. VERIFIEDCONF 1.00

   The GAO has made specific recommendations for modifying federal law related to protecting consumer data held by private companies.

   — attributed to: U.S. Government Publishing Office (GPO)

   • https://www.govinfo.gov/content/pkg/CHRG-116shrg39485/html/CHRG-116shrg39485.htm
5. CORROBORATEDCONF 0.90

   As of December 2022, federal agencies have implemented approximately 41% of the GAO's recommendations related to the protection and security of sensitive data issued since 2010.

   — attributed to: Nextgov

   • https://www.nextgov.com/cybersecurity/2023/02/almost-60-gaos-privacy-recommendations-2010-are-unresolved/383005/
6. VERIFIEDCONF 1.00

   A 2008 GAO testimony recommended that federal agencies conduct privacy impact assessments for their uses of commercial data and promulgate regulations concerning the use of commercial data brokers.

   — attributed to: GAO Testimony (GAO-08-543T)

   • https://www.gao.gov/assets/gao-08-543t.pdf
   • https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-08-543T/html/GAOREPORTS-GAO-08-543T.htm
7. VERIFIEDCONF 1.00

   OMB has not implemented the GAO's recommendation to clarify guidance on federal agencies' use of commercial data.

   — attributed to: GAO Testimony (GAO-08-543T)

   • https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-08-543T/html/GAOREPORTS-GAO-08-543T.htm

TIMELINE

• 2007-12-18Federal Agency Data Protection Act introduced, proposing requirements for agencies using commercial data. [src]
• 2008GAO issues testimony (GAO-08-543T) recommending agencies specify their use of data from information resellers and conduct Privacy Impact Assessments for commercial data use. [src]
• 2013-09GAO releases a report concluding no comprehensive privacy law governs consumer data collection and sale by private sector companies, with existing laws having 'limited scope'. [src]
• 2014-10-10U.S. GAO issues a report on requiring information. [src]
• 2022-12Watchdog report indicates federal agencies have implemented only 41% of GAO's privacy recommendations since 2010. [src]

ENTITIES

• ORG Government Accountability Office (GAO) — Federal watchdog agency; report author
• ORG Commercial Data Brokers — Private sector entities collecting and selling consumer data
• ORG Federal Agencies — Purchasers and users of commercial data
• ORG U.S. Senate Commerce Committee — Congressional committee referencing GAO report
• ORG Office of Management and Budget (OMB) — Federal agency responsible for guidance on data use
• EVENT Federal Agency Data Protection Act — Proposed legislation

OPEN QUESTIONS — PENDING LEADS

• Identify specific GAO reports published since 2010 that explicitly detail federal agency procurement contracts or expenditures for data acquired from commercial data brokers.
• Has the GAO issued any recommendations specifically on the legality or oversight of federal agencies acquiring commercial data without warrants since 2010?
• What specific legislative proposals, if any, have emerged from GAO findings since 2010 regarding federal agency data broker purchases?
• Are there any GAO audit reports that quantitatively assess the volume or value of data purchased by federal agencies from data brokers post-2010?
• Have any federal agencies responded publicly to GAO findings regarding their specific data procurement practices from commercial brokers since 2010?

EVIDENCE — CAPTURED SOURCES

1. [WEB] https://www.gao.gov/assets/gao-08-543t.pdf [archived]

   identifiable form from a data broker.” We believe that such a · requirement is consistent with the recommendations contained in · our report, particularly given the debate concerning whether or not · agencies “systematically incorporate” information or are “merely · pinging or qu…

2. [WEB] https://policyreview.info/articles/analysis/untamed-and-discreet-role-data-brokers-surveillance-capitalism-transnational-and [archived]

   4 Aug 2022 · Government Accountability Office (GAO), and the Senate, have released reports and held hearings on the practices and operations of data brokers

3. [WEB] https://www.govinfo.gov/content/pkg/CHRG-116shrg39485/html/CHRG-116shrg39485.htm

   GAO has made a number of specific recommendations for modifying Federal law that relate to protecting consumer data held by private companies.

4. [WEB] https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-08-543T/html/GAOREPORTS-GAO-08-543T.htm

   In addition, the Department of ... to specify their use of data from information resellers. OMB, however, has not implemented GAO�s recommendation to clarify guidance on use of commercial data. The Federal Agency Data Protection Act was introduced on December 18, 2007. The legisl…

5. [WEB] https://www.nextgov.com/cybersecurity/2023/02/almost-60-gaos-privacy-recommendations-2010-are-unresolved/383005/ [archived]

   A watchdog report found that federal agencies have only implemented approximately 41% of recommendations related to the protection and security of sensitive data as of December 2022.

6. [WEB] https://www.priv.gc.ca/en/opc-actions-and-decisions/research/explore-privacy-research/2014/db_201409/?wbdisable=true

   10 Oct 2014 · The following year, the United States Government Accountability Office (U.S. GAO) issued a report that noted: “Requiring information ...

7. [REDDIT] https://www.reddit.com/r/IAmA/comments/eq0w5o/i_am_a_former_auditor_with_the_us_government/ [archived]

   Yeah, it speaks volumes that GAO has international fellows from other countries come to the agency each year to learn more about government auditing. As long as GAO is in existence, there will be some accountability, and in general, while I saw a lot of inefficiencies, corruption…

8. [REDDIT] https://www.reddit.com/r/LessCredibleDefence/comments/1jhlgys/a_long_shot_prediction_about_ngad_faxx_ngas_and/

   22 Mar 2025 · A big gripe that Kendall and others had with NGAD was that 200 airframes are just not a lot to work with, even if the aircraft is very capable.

9. [REDDIT] https://www.reddit.com/r/changemyview/comments/iq41dt/cmv_donald_trump_has_not_made_a_single_lasting/ [archived]

   10 Sept 2020 · The Tax Cuts and Jobs Act signed into law by Trump doubled the maximum amount of the child tax credit available to parents and lifted the income ...

10. [REDDIT] https://www.reddit.com/r/govcon/comments/14zisf5/how_often_does_protesting_a_contract_award/ [archived]

    Even if the protest is sustained, the agency usually is just required to go back and re-evaluate something. Most of these roads lead right back to the same company getting the award again. So the "homerun" scenario, where the protester ends up with the contract is pretty rare in …

11. [REDDIT] https://www.reddit.com/r/AskTechnology/comments/1sxjjmj/what_are_data_brokers_and_how_do_they_collect/
12. [REDDIT] https://www.reddit.com/r/todayilearned/comments/2qslea/til_90_of_college_students_from_china_in_the_us/

    30 Dec 2014 · I live in China. Last year there was an uproar in one place when the examiners tried to make it impossible for the students to cheat.

13. [REDDIT] https://www.reddit.com/r/residentevil/comments/128sob2/so_turns_out_people_have_been_harassing_lily_gao/ [archived]

    So turns out people have been harassing Lily Gao (Ada's RE4R VA) she had to turn her IG comments off. First, Hannah John-Karmen, then Avan Jogia, and now this. Since when did harassment=criticism? As the RE community, we need to do better. General

14. [WEB] https://www.commerce.senate.gov/wp-content/uploads/media/doc/12.18.13%20Senate%20Commerce%20Committee%20Report%20on%20Data%20Broker%20Industry.pdf [archived]

    sponse, in September 2013, GAO released a report concluding that there is no one · comprehensive privacy law governing information collection and sale of consumer data by · private sector companies14 and that further, existing privacy laws have “limited scope” regarding · the col…

15. [WEB] https://www.govinfo.gov/app/collection/GAOREPORTS [archived]

    All published reports, testimonies, correspondence, and special publications are included. Products that are restricted or classified are not included. GAO Comptroller General Decisions contains decisions and opinions issued by the Comptroller General in areas of Federal law such…

16. [REDDIT] https://www.reddit.com/r/fednews/comments/1kmn577/cfpb_quietly_kills_rule_to_shield_americans_from/ [archived]

    In its notice, CFBP’s acting director, Russel Vought, wrote that he was withdrawing the proposal “in light of updates to Bureau policies,” and that it did not align with the agency’s “current interpretation of the FCRA,” which he added CFBP is “in the process of revising.” · Read…

CROSS-REFERENCE

• → SUPPORTS Government Purchase of Commercial Location Data: Warrantless Surveillance Via Data Broker Loophole — The GAO's general findings on federal agency data use and lack of comprehensive privacy laws provide context for the specific issue of government warrantless purchases of commercial location data.
• ← SHARES-ACTOR Federal Courts: Agency Guidelines as Binding Law vs. Discretionary Policy — Both reference Federal Agencies