Anyone engaged in the collection and sale of data should be required to maintain a list of their customers. Upon the sale of data, the customer should be required to provide their list to the broker. At the point of collection/consent, the list should be made available to the consumer.<p>For example:
You want to vote in an online poll by company A. Company A collects data about you and sells it, so you must agree to their privacy policy. Company A's privacy policy discloses that they sell your data to Companies B, C and D. Companies B, C and D have provided a list of its customers to Company A, and Company A includes those lists as well. In addition, the customers of those companies provide lists (as all data brokers would be required to do).<p>If its seems like it could get overly complicated with huge lists of data brokers for a simple online poll, that's the idea. You shouldn't have to wonder how many entities you're giving access to your information when, for example, you want to vote for MLB All-stars. MLB wants your name, address, email, phone number, and they disclose they'll "share it with partners" but they don't say who those partners are, how many exist, and if they have their own "partners". Vote for your favorite player and you could be getting a phone call for life insurance 15 minutes later after your number has been passed through 5 different companies.