The Predictive Data Edition

Technology · Data

The Forecast That Paid For Itself

Prediction is a purchase like any other. The test is not whether the number turned out to be right — it is whether it changed a decision that had money attached.

Somewhere in most established businesses there is a spreadsheet that forecasts next year's revenue to the dollar, is admired briefly in January, and is never opened again. It is a common habit and a quietly expensive one — expensive not because the spreadsheet cost anything, but because the hours that built it were the same hours that could have produced a forecast somebody actually used. The useful question about any prediction is not how accurate it proved to be. It is narrower and more awkward: which decision did this change, and what was that decision worth? A forecast that pays for itself leaves a receipt. It delayed a hire who would otherwise have been laid off in May. It opened a line of credit two months before the money was needed rather than two weeks after. It killed a product before the tooling order went out.

Federal Reserve survey work suggests the decisions worth forecasting are mostly about timing rather than strategy. The 2026 Small Business Credit Survey, published on 3 March 2026 from 6,525 responses collected the previous autumn, found that 54 percent of small employer firms had difficulty paying operating expenses in the prior twelve months and 50 percent dealt with uneven cash flow. Seventy-seven percent reported challenges associated with rising costs. Those are calendar problems — money arriving after it was needed, not money that never existed. Two cautions belong with the figures: the survey is a convenience sample rather than a probability sample, and its authors warn that a 2025 questionnaire change makes the financial-challenge numbers not directly comparable with earlier rounds. Read as a snapshot rather than a trend, it still points somewhere specific.

It points at the thirteen-week cash forecast, which is the least glamorous instrument in the toolkit and the one most likely to earn its cost in the first month. The mechanism is unexciting. Every expected receipt and every committed payment is placed on the week it will actually clear, not the week it was invoiced. Payroll, rent, debt service and tax deposits go in as fixed. Collections go in on their historical lag rather than their stated terms. What emerges is not a prediction of the year. It is a map of the four or five weeks in the next quarter where the balance goes thin. Those weeks are where decisions live, and they are visible months before they arrive, which is the entire point.

• 79.6% Private-sector establishments that opened in the year to March 2015 and were still open one year later — source
• 50.2% Share of that same cohort still open after five years, in March 2020 — source
• 34.6% Share of that cohort still open after ten years, in March 2025 — source
• 6.0% Error in the Labor Department's own ten-year projection of 2024 industry employment — source

The case for modesty about longer forecasts is made most plainly by the institutions with the best data in the country. Every quarter the Federal Open Market Committee publishes its projections for growth, unemployment and inflation, and alongside them a table headed Average Historical Projection Error Ranges. In the release of 16 September 2026, the error range on real GDP growth was plus or minus 1.4 percentage points for the current year, widening to plus or minus 2.3 points by 2029. The unemployment range widened from half a point to 2.1 points. The Fed's own note explains that these bands are root mean squared errors drawn from projections made by private and government forecasters for 2006 through 2025, and that there is about a 70 percent probability that outcomes fall inside them.

±2.3 points The Federal Reserve's published error range on its own 2029 real GDP growth projection, at roughly 70 percent confidence — FOMC Summary of Economic Projections, 16 September 2026

The Federal Reserve Bank of Philadelphia keeps a sharper scorecard still. Its Survey of Professional Forecasters publishes error statistics for the consensus against a simple autoregressive benchmark — a statistical rule that looks only at the recent past. In the release dated 22 August 2025, covering 1985 through early 2023, the consensus beat the simple benchmark comfortably for the current quarter, with an error ratio of 0.45. Four quarters out, that ratio was 0.98. A year ahead, in other words, the assembled judgment of professional economists was essentially indistinguishable from a mechanical rule. The page carries its own caveat: updates were paused because of complications from the 2025 federal shutdown, so the figures are as of that August 2025 release.

A forecast is not a claim about the future. It is a device for deciding what to do before the future arrives — and it can be wrong and still be worth every hour it took.

The Bureau of Labor Statistics grades its own long-range work in public, which is rarer and more useful than it sounds. Its evaluation of the 2014 to 2024 industry employment projection, last updated on 10 April 2026, reports a projected figure of 149,132 thousand jobs against an actual 158,569 thousand — an absolute error of 6.0 percent. Put as a growth rate, the bureau projected compound annual growth of 0.6 percent over the decade and got 1.3 percent. It also notes, fairly, that its model beat a naive model for total nonfarm employment. Both facts belong together. Careful long-range forecasting adds something real, and it is still off by a margin no business should bet its solvency on.

The practical response is to forecast in brackets rather than points, and to attach each bracket to a threshold. A single revenue number invites argument about the number. Three scenarios with decision rules attached invite a different conversation: at what level of bookings does the second hire go ahead, at what level does it wait a quarter, at what level does the lease not get signed. The forecast stops being a prophecy and becomes a trigger list. This is the form in which a forecast most often pays, because the value is not in the estimate but in having settled the response in advance, at a calm moment, rather than in the week the number lands.

Survival data sets the stakes. The Bureau of Labor Statistics tracks private-sector establishments from the quarter they open. Of those that opened in the year ending March 2015, 79.6 percent were still trading a year later, 50.2 percent after five years and 34.6 percent after ten. Two qualifications matter. These are establishments, meaning physical locations, not firms. And that cohort's five-year anniversary fell in March 2020, so the pandemic sits inside the number. The broader shape has held across cohorts since the mid-1990s: roughly four in five survive the first year, about half reach five, about a third reach ten. The decade is not won by precision about revenue. It is won by not running out of cash in a particular fortnight.

Expectations across American business are currently flat rather than fearful, which is its own kind of planning information. In the Census Bureau's Business Trends and Outlook Survey cycle collected 5 to 18 October 2026, 21.6 percent of businesses expected demand for their goods or services to increase over the following six months, 18.2 percent expected a decrease, and 60.2 percent expected no change. The Small Business Credit Survey's revenue expectations index fell six points year over year, from 39 to 33, and its employment expectations index from 26 to 23 — both the lowest readings since the 2020 survey. A population that mostly expects no change is a population for which the main risk is not a downturn but a surprise.

The forecast that paid for itself is rarely the one that got the number right. More often it is the one that stopped something: an order, a lease, a hire, a product line that three scenarios all showed arriving after the cash did. Measured that way, the discipline is cheap and the sophistication is optional. The federal government's own forecasters publish their error bands precisely because the bands are the finding, and the most honest finding in the professional forecasting literature — that combinations of simple methods, rather than any single clever one, tend to hold up best — points the same direction. Forecast to narrow the range of things you might be wrong about. Then write down what you will do at each edge of it.

Technology · Data

Your Data Is Worth Less Than They Told You

Per record, the market price of personal information is measured in fractions of a cent. The value is in the relationship, the consent and the refining — and almost none of it is in the volume.

The phrase that launched a thousand budget requests is twenty years old and was never quite what people think. Data is the new oil appears in a November 2006 post on the American National Advertisers blog by Michael Palmer, who opens by quoting the marketer Clive Humby saying exactly that at a summit at the Kellogg School. Palmer then spends the rest of the piece explaining the part that gets dropped: crude oil is worth very little until it is broken down and refined, and so is data. The original URL is dead and the post survives in web archives. The slogan outlived the argument, and the argument was the useful half. Volume was never the asset. Refining was.

Anyone trying to price a database should start with the only number in this field that a company publishes about itself as revenue per human being. Meta Platforms reports average revenue per person: the revenue of its applications divided by the average number of people who use them daily. In its annual report for 2025, filed on 29 January 2026, the figure was 57 dollars and three cents for the entire year, worldwide, up 15 percent. For the quarter ending 30 September 2026 it was 17 dollars and 72 cents. That is what one of the most sophisticated advertising operations ever assembled, holding years of behavioural history on billions of people, extracts from a person in three months. It is a real number, filed under penalty of law, and it is not large.

$17.72 Meta's average revenue per daily active person worldwide, quarter ended 30 September 2026 — the company's own published figure — Meta Platforms Form 10-Q, filed 22 October 2026

Two cautions keep that figure honest. It is revenue per daily active person, not per American adult, and Meta no longer publishes a regional per-person figure at all — it retired the United States and Canada series after 2022, when the last quarterly reading was 58 dollars and 77 cents. Alphabet, the other giant of the business, publishes no per-user metric whatsoever. Its 2025 annual report shows 294.7 billion dollars of advertising revenue and 194.2 billion of total revenue from United States customers, with no user count to divide by. Every per-Google-user figure in circulation is therefore somebody's arithmetic, not a company disclosure. That absence is itself worth noticing: the firms in the best position to state what a person is worth decline to.

• $57.03 Meta's average revenue per person worldwide for the whole of 2025 — source
• $426m Combined 2012 revenue from data products of the nine data brokers the FTC studied — source
• 625 Data brokers on California's registry as of 30 October 2026 — source
• 762 Health data breaches of 500 or more people reported in two years and still under investigation — source

The best federal measurement of what brokered data actually earns remains the Federal Trade Commission's May 2014 report, built on compulsory orders to nine companies. The scale findings are the ones people quote: one broker's database held information on 1.4 billion consumer transactions and over 700 billion aggregated data elements; another covered a trillion dollars of consumer transactions; another added three billion new records a month; one held 3,000 data segments for nearly every American consumer. The revenue finding is the one people skip. Those products generated a combined total of approximately 426 million dollars in annual revenue in 2012 across all nine firms, split between marketing, risk mitigation and people search. Nine companies holding a near-complete census of American consumers were, together, a mid-sized business.

Nine data brokers holding a near-complete census of American consumers earned, between them, less in a year than a single regional hospital system. Scale is not the same thing as value.

More recent litigation gives a rough price per record. In the Commission's case against the location-data firm Kochava, filed in August 2022 in the District of Idaho, the original complaint alleged that the company typically charged a monthly subscription fee of thousands of dollars for access to its location data feed, and that a 25,000 dollar subscription had appeared on a public cloud marketplace. The second amended complaint of July 2024 alleged that customers pay a monthly subscription, often in the tens of thousands of dollars, and that a single day of the company's data sample contained over 327 million rows corresponding to more than 61.8 million unique mobile devices. Divide one by the other and the implied price per device is a small fraction of a cent. The arithmetic is illustrative rather than a quoted rate.

Credit data, the most regulated and arguably most valuable consumer data in the country, prices out at a similar order of magnitude. The Consumer Financial Protection Bureau's December 2012 study of the credit reporting system found that the three nationwide agencies each maintained files on over 200 million adults, received updates on over 1.3 billion trade lines in a typical month, and by 2011 generated United States revenues of about four billion dollars — a figure that includes monitoring subscriptions and analytics, not just reports. That is roughly twenty dollars per adult per year, by division, and the report is now old enough that it should be cited as a 2011 picture rather than a current one. Even so, the pattern holds: comprehensive national files, modest revenue per person.

Against those revenues sits a cost side that owners routinely forget to enter. Held data is a liability with a maintenance schedule. The Department of Health and Human Services maintains a public portal of health data breaches affecting 500 or more individuals; as of early November 2026 it listed 762 such incidents reported within the previous two years and still under investigation, with 7,309 more in the resolved archive. That portal publishes counts, not dollars. The widely quoted figure of 4.99 million dollars as the global average cost of a breach comes from IBM's 2026 report, which is produced by a company selling security services and built on self-reported survey data. It is a vendor number and should be read as one.

There is one more telling silence in the record. When the Commission issued orders in December 2020 to nine social media and streaming companies for the study published in September 2024 as A Look Behind the Screens, the order demanded, for each user attribute, the average value of the user to the company, including average revenue per user. The published report does not disclose any company's answer. What it does report is qualitative and damning in a different way: that data collection, minimisation and retention practices were woefully inadequate, that many companies lacked written retention or deletion policies, and that some services did not delete data in response to user requests but merely de-identified it. The per-person value exists inside these firms. It has never been made public.

California's registry gives a sense of how crowded the supply side is. The state's privacy agency published 625 registered data brokers as of 30 October 2026, up from 544 the previous year and 543 the year before. A market with hundreds of sellers offering overlapping inventories of the same population is not a market where any individual record commands a premium. That is the structural reason the per-record numbers are small, and it will not change. What does command a premium is the thing none of those 625 firms can sell: a direct relationship with a named person who agreed to hear from you, attached to a record of what they actually bought.

The practical conclusion is not that data is worthless. It is that the value lives almost entirely in refining and in permission, exactly as the 2006 argument said before the slogan ate it. A business that has fifteen years of its own transaction history, properly dated and lawfully collected, holds something no broker can supply and no competitor can buy. A business that has purchased three million rows holds a cost centre. The test is unglamorous and reliable: if a record cannot be traced to a consent, reached through a working channel, and connected to a decision someone will make this quarter, it is not an asset. Price it accordingly, and spend the budget on the file you already own.

Technology · Data

When a Model Is Really a Guess

Decades of open forecasting competitions have produced replicated findings about when complicated methods beat simple ones. The findings are less flattering to complexity than the sales material suggests — and more interesting.

Forecasting is unusual among applied disciplines in having run public, adversarial tournaments on itself for half a century. Beginning in the 1970s, the statistician Spyros Makridakis and colleagues assembled large collections of real time series, invited anyone to submit methods, held back the later observations, and published who was closest. The competitions are known by number. The third, published in 2000, used 3,003 series drawn from business, demography, finance and economics, with twenty-four entries. The fourth, published in the International Journal of Forecasting in 2020, used 100,000. This body of work is the closest thing the field has to a clinical trial record, and it is the right place for any business owner to start before buying a predictive model.

The conclusions that emerged from the earlier rounds have been restated so often they function as folklore, and they are worth stating precisely. In the form recorded in the journal's own history of these competitions, they are four: statistically sophisticated or complex methods do not typically produce more accurate forecasts than simpler ones; the ranking of methods varies according to which accuracy measure is used; the accuracy of a combination of methods outperforms, on average, the individual methods being combined; and the performance of a method depends on the length of the forecasting horizon. Three of those four are about humility. The third is the only one that tells you what to do.

• 3,003 Time series in the third forecasting competition, published 2000 — source
• 100,000 Real-life series in the fourth competition, with 61 methods evaluated — source
• 12 of 17 Of the most accurate methods in that competition, the number that were combinations — source
• 294 Published papers across 17 scientific fields found affected by data leakage — source

Here the honest account diverges from the folklore. Rob Hyndman, reviewing the history in the same journal in 2020, writes that although Makridakis and Hibon claimed the third competition upheld their earlier findings, the results did not in fact support the first of them — that simple methods outperform more complicated ones. The best two methods were not obviously simple, and classical ARIMA models did much better than in previous rounds. Hyndman adds something more uncomfortable still: although the data and the submitted forecasts are all public, the computed accuracy scores do not match those in the published paper, which he describes as part of a broader reproducibility problem in statistics and in forecasting in particular. The most-quoted result in the field is both contested and not reproducible from its own data.

Risk management of AI systems that are intended to augment or replace human activity, for example decision making, requires some form of baseline metrics for comparison.NIST AI Risk Management Framework 1.0, January 2023

The fourth competition is where the machine-learning question was put properly. Its published findings, as the organisers summarised them in 2018, run as follows. Out of the seventeen most accurate methods, twelve were combinations of mostly statistical approaches. The biggest surprise was a hybrid approach using both statistical and machine-learning features, whose average error was close to ten percent better than the combination benchmark. The second most accurate method combined seven statistical methods and one machine-learning method, with the averaging weights computed by a learning algorithm. And the finding the sales material never reproduces: the six pure machine-learning methods performed poorly, with none more accurate than the combination benchmark and only one more accurate than a naive benchmark.

That is not an argument that learning methods do not work. It is an argument that they work on some problems and not others, and that the problem type decides. The same authors, in an open-access paper in PLOS ONE in March 2018, compared popular machine-learning methods against eight traditional statistical ones on 1,045 monthly series and found the former dominated across both accuracy measures and all horizons examined, with considerably greater computational requirements. Two years later the fifth competition used 42,840 series of hierarchical unit sales from Walmart, requiring 30,490 point forecasts at the lowest level, and drew close to six thousand participants on a public platform. There the top of the leaderboard looked different: the teams that finished in the medal range published methods built on gradient-boosted trees blended with neural networks.

The pattern across the two is legible. Short, noisy, intermittent retail series with thousands of related products and rich covariates — promotions, prices, calendars, store hierarchies — are the conditions under which learning methods earn their complexity. Isolated series with a hundred observations and no side information are not. A business owner being sold a model can ask which of those two situations their data resembles, and the answer is usually knowable in a morning. The useful question is never whether machine learning works. It is whether this data has the shape that lets it work, and whether anyone has checked against the dull alternative.

The most instructive failure in the field remains Google Flu Trends, which estimated influenza prevalence from search queries. In Science in March 2014, Lazer, Kennedy, King and Vespignani reported that the system had been persistently overestimating prevalence, missed by a very large margin in the 2011 to 2012 season, and missed high for 100 out of 108 weeks beginning in August 2011. It had completely missed the non-seasonal 2009 H1N1 pandemic. The method had been to find the best matches among fifty million search terms to fit 1,152 data points. The authors' diagnosis is the sentence to remember: the initial version was part flu detector, part winter detector. And the baseline that beat it was not another model — even three-week-old data from the Centers for Disease Control did a better job of projecting current prevalence.

100 of 108 Consecutive weeks from August 2011 in which Google Flu Trends overestimated influenza prevalence — Lazer, Kennedy, King & Vespignani, Science, 14 March 2014

The same paper contains the constructive finding, which is the four-decade-old result about combination arriving again from a different direction: by combining the search-based estimate with lagged official data, and recalibrating as it went, the authors could substantially improve on either source alone. This is the single most reliable thing known about prediction. It is not that one method wins. It is that averaging several decent methods, including a stupid one, usually beats picking the best-looking one. The empirical demonstration goes back to Newbold and Granger in the 1970s and, as the journal's own history notes, to a similar result from Francis Galton in 1907. It is also the cheapest intervention available to anybody forecasting anything.

Overfitting is the mechanism by which a guess acquires the appearance of a model, and finance has quantified it brutally. In the Notices of the American Mathematical Society in May 2014, Bailey, Borwein, Lopez de Prado and Zhu showed that a researcher trying only ten alternative configurations of a strategy is expected to find one with an in-sample Sharpe ratio of 1.57 even when every strategy has a true out-of-sample Sharpe ratio of zero. With five years of data, they calculate, no more than forty-five independent configurations should be tried; with two years, seven. Their warning is about disclosure: because the number of trials is almost never reported, the magnitude of overfitting in published backtests is unknown. That suspicion is theirs, not a measured prevalence, and it should be read as such.

Leakage is overfitting's quieter cousin, and the most systematic survey of it should unsettle anyone buying predictive software. In Patterns in September 2023, Kapoor and Narayanan identified seventeen fields in which leakage has been found, collectively affecting 294 published papers and in some cases leading to wildly overoptimistic conclusions. They catalogue eight distinct types, from textbook errors to open research problems. Their own replication is the detail that lands: in civil war prediction, where complex methods were believed to vastly outperform traditional statistical models, correcting the errors left the complex models performing no better than decades-old logistic regression. The 294 is a count of papers found, not a prevalence rate — a floor, not a share.

The last trap is arithmetic rather than computational, and it has nothing to do with the model's quality. When the thing being predicted is rare, even an accurate test produces mostly false alarms. The United States Preventive Services Task Force's 2024 recommendation on breast cancer screening puts real numbers on it: collaborative modelling estimated that biennial screening from ages 40 to 74 would produce 1,376 false-positive results per 1,000 women screened over a lifetime, and that the ten-year cumulative probability of at least one false positive was 49.6 to 56.3 percent for annual screening depending on modality. These are modelled estimates from a registry, and the Task Force labels them so. The lesson transfers intact: a model flagging a rare event will mostly be wrong when it fires, and that is not a defect to be engineered away.

None of this counsels doing nothing. The competitions exist because forecasting can be improved and has been. What the record supports is a particular posture: combine several ordinary methods rather than hunt for one brilliant one; insist on a baseline and a held-out period; count your attempts; ask what the base rate is before asking what the accuracy is; and treat the absence of a reproducible score as the finding it is. NIST's framework puts the general case plainly — the inability to measure a risk does not mean the risk is low. The same holds for accuracy. A model nobody has measured against the dull alternative is not a model. It is a guess that has been given a budget.

Technology · Data

Who Owns What You Collected

American law does not treat data as property. It allocates control through contracts, sector rules, a growing patchwork of state statutes and one federal agency's power to call a practice unfair. Here is the map, as of 2 November 2026.

The question business owners ask is who owns the customer list, and the honest answer is that the question is badly formed. United States law does not give personal data the status of owned property the way it does a building or a trademark. Control over data is allocated instead by three other mechanisms: what the contract says, whether the information qualifies as a trade secret, and what a statute permits or forbids a holder to do with it. Nothing in this article is legal advice, and the patchwork described below is genuinely difficult — any decision with real money or real exposure attached belongs with a lawyer licensed in the relevant state, reading the current text.

Start with what copyright will not do. In Feist Publications v. Rural Telephone Service, decided on 27 March 1991, the Supreme Court held that facts are discovered rather than created and are not copyrightable at all. A compilation of facts can be protected, but only in its selection, coordination and arrangement, and only where there is more than a minimal quantum of creativity. The Court expressly repudiated the older sweat of the brow doctrine, which had rewarded the labour of collection, on the ground that it had abandoned the most fundamental axiom of copyright law — that no one may copyright facts. A customer list, as a list of facts, is therefore not protected by copyright merely because it was expensive to assemble.

What may protect it is trade secret law. The Defend Trade Secrets Act of 2016 created a federal civil action: under Title 18, section 1836, an owner of a trade secret that is misappropriated may bring a civil action if the trade secret relates to a product or service used in or intended for interstate or foreign commerce. That route depends on the information being genuinely secret and on reasonable measures having been taken to keep it so, which is why access controls and confidentiality agreements do legal work and not merely operational work. The practical sequence is unromantic: a list is protectable because it is secret and guarded, not because it is yours.

• 19 States with enacted comprehensive consumer privacy laws, per IAPP's chart dated 24 November 2025 — source
• $26,625,000 California's inflation-adjusted CCPA revenue threshold, effective 1 January 2025 — source
• 625 Data brokers registered in California as of 30 October 2026 — source
• 500,000 Californians enrolled in the state's one-stop deletion mechanism by 25 August 2026 — source

There is no general federal consumer privacy statute. That is not an interpretation but a documented state of affairs: the Government Accountability Office recommended in January 2019, in GAO-19-52, that Congress consider developing comprehensive internet privacy legislation, and the report's page records that recommendation as still open as of February 2026, with no such legislation enacted. The most recent serious attempt, the American Privacy Rights Act, was introduced in the House on 25 June 2024 as H.R. 8818 in the 118th Congress and went no further than committee referral. Readers who believe a single national privacy rule governs their business are working from a mental model of a law that does not exist.

What exists instead is a growing set of state comprehensive laws with different thresholds and different rights. The International Association of Privacy Professionals, whose tracker is a reference work rather than a source of law, counted nineteen enacted state comprehensive privacy statutes on its chart dated 24 November 2025, all of them then in effect. California's came first, in 2018, operative from 1 January 2020. Virginia, Colorado and Connecticut followed in 2021 and 2022, with Colorado's and Connecticut's taking effect on 1 July 2023, and Utah's on 31 December 2023. Eight more took effect during 2025 — Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota and Maryland — and three on 1 January 2026, in Indiana, Kentucky and Rhode Island.

A reader who asks what the American rule is on customer data is asking a question with nineteen state answers, four sector answers, and one federal agency answer — and no national answer at all.

Thresholds matter more than rights for most small firms, because they decide whether a statute applies. California's is the most frequently misquoted. The statute names twenty-five million dollars of annual gross revenue, but the figure is adjusted for inflation in odd-numbered years, and the California Privacy Protection Agency puts the current threshold at 26,625,000 dollars, effective 1 January 2025. The other two routes into coverage are buying, selling or sharing the personal information of 100,000 or more consumers or households, or deriving fifty percent or more of annual revenue from selling or sharing personal information. Note that the California Attorney General's own public page still prints the unadjusted twenty-five million figure; the agency's page is the one to rely on for the number.

The gap that catches ordinary businesses is the health one. Because HIPAA's reach is a closed list of covered entities and their business associates, a wellness app, a telehealth marketing funnel or a discount service handling intimate information may sit entirely outside it. That is precisely why the Federal Trade Commission's Health Breach Notification Rule exists — it applies to vendors of personal health records not covered by HIPAA. In February 2023 the Commission brought what it described as its first enforcement action under that rule, against GoodRx, which paid a 1.5 million dollar civil penalty and accepted a prohibition on sharing health data for advertising. A month later BetterHelp agreed to 7.8 million dollars in consumer refunds over the disclosure of mental health information to advertising platforms.

Behind all of it sits section 5 of the Federal Trade Commission Act, codified at 15 USC 45, which declares unfair or deceptive acts or practices in or affecting commerce unlawful. That single sentence is the closest thing the country has to a general federal privacy rule, and its enforcement record is the best available guide to where the lines actually fall. In December 2023 Rite Aid was barred for five years from using facial recognition for surveillance after the Commission alleged thousands of false positives disproportionately affecting people of colour. In February 2024 Avast agreed to pay 16.5 million dollars over allegations it sold browsing data to more than a hundred third parties through a subsidiary while marketing itself as blocking tracking.

$16.5 million Paid by Avast after the FTC alleged it sold consumers' browsing data through a subsidiary while marketing itself as privacy protection — Federal Trade Commission, 22 February 2024

Two features of that record are routinely misread. First, many of these orders carry no money at all: the January 2024 actions against X-Mode Social and Outlogic, and against InMarket Media, imposed prohibitions on selling sensitive and precise location data without any monetary penalty. The remedy was a ban on a line of business. Second, the cases move slowly and then resolve. The Commission's suit against Kochava, filed in August 2022, was not a live piece of open litigation by late 2026; in May 2026 the agency announced a settlement barring the company and a subsidiary from selling sensitive location data without affirmative express consent, with a stipulated order filed in June 2026 subject to court approval. Anyone citing these matters should check the current posture before relying on it.

State attorneys general and the California agency now generate much of the practical enforcement risk. California's Attorney General settled with Sephora in August 2022 for 1.2 million dollars over failures to disclose the sale of personal information and to honour opt-out signals, and with DoorDash in February 2024 for 375,000 dollars over a transfer of customer data to a marketing cooperative. In July 2025 the office announced a 1.55 million dollar settlement with Healthline, which it called its largest under the state privacy act to date, citing unhonoured opt-outs, article titles that revealed medical diagnoses, missing contract terms with advertising partners and non-functional consent banners. In August 2026 the state privacy agency brought its first combined action under the privacy act and the state's data broker law, for 116,490 dollars.

The direction of travel is toward deletion as a default. California's Delete Act created a single mechanism, launched for consumers on 1 January 2026, through which a resident can demand deletion from every registered data broker at once; brokers were required to begin processing those requests on 1 August 2026 and to check the system at least every forty-five days. By 25 August 2026 the state reported that half a million Californians had signed up. A further statute signed on 27 September 2026 and effective 1 January 2027 closes a loophole that had let businesses retain third-party-sourced data after a deletion request. For any business holding consumer records, the planning assumption should be that deletion requests arrive in volume and must be executable, not merely answerable.

One last piece of the map is settled and often forgotten: breach notification. All fifty states, along with the District of Columbia, Guam, Puerto Rico and the Virgin Islands, require private businesses to notify individuals of security breaches involving personal information. The standard reference for that proposition, the National Conference of State Legislatures page, carries an update stamp from January 2022, so it should be cited for the all-fifty fact rather than for current statutory detail. The obligations themselves differ by state in triggers, timing and content, and several sector rules impose their own. A business operating in more than one state does not have one notification duty. It has as many as it has states of residence among the affected people.

The honest summary is that nobody owns data in the way people mean when they ask. A business holds information under conditions set by its contracts, by the sector it operates in, by the states its customers live in, and by a federal agency's judgment about fairness. Those conditions are tightening, they are not uniform, and they change annually. The defensible posture is therefore procedural rather than proprietary: know which statutes apply to you and recheck annually; record where every record came from and on what consent; put the four clauses above in every vendor contract; be able to execute a deletion, not just acknowledge one. And where the exposure is real, retain counsel in the relevant state. This article is a map, not an opinion on your facts.