> Data brokers are defined in the bill as businesses that we don’t have a direct relationship with — and likely have never even heard of — that scrape and collect our personal information from various offline and online sources, and then aggregate our personal information, and then sell it to third parties

Credit agencies like Equifax and TransUnion satisfy that condition. They should be subject to the law, especially given Equifax's security history [0]

[0]: https://en.wikipedia.org/wiki/2017_Equifax_data_breach

No, they're regulated under the federal FCRA, not state law.