Buying data
Buying consumer data: the checks before you pay
Buy consumer data only after five checks: the seller's registration, the data's source, sensitive categories, your purpose and who else gets it.
Published
The short answer
You can buy consumer data legally in the US from registered data brokers and providers, but the duty to use it lawfully stays with you. Before paying, check the seller's state registration, where the records came from, whether sensitive categories such as precise location are included, whether your use makes it a consumer report under the FCRA, and the foreign-transfer limits.
Who sells consumer data
- brokers on California's 2026 registry
- 625
- collect at least one sensitive category
- 217
- collect precise geolocation
- 116
- say they or a subsidiary are FCRA-covered
- 18
Consumer data is sold by data brokers that compile it from public records, commercial sources and each other, by companies licensing data about their own customers, and by marketplaces that resell both.
California's registry is the best census of the first group: 625 brokers registered for 2026, each answering yes or no to questions about sensitive data and buyers. Our page on consumer data providers covers who they are and how they price; this page is about the checks a buyer makes.
Five checks before you buy consumer data
| Check | Ask the seller | How to verify | On California's 2026 registry |
|---|---|---|---|
| 1. Is the seller registered? | Which states are you registered in as a data broker? | Search California's downloadable registry and Vermont's search | 625 registered; about 750 broker groups appear across the state registries |
| 2. Where did the records come from? | Which sources, collected under which notices or consents? | A written source list and the promise in the licence | Not on the form; ask |
| 3. Are sensitive categories included? | Does the file include precise location, health, minors, biometrics or government IDs? | The registry answers plus a sample | 217 brokers collect at least one sensitive category; 116 precise geolocation |
| 4. Is your use a consumer report? | Will you use it for credit, insurance, employment or housing decisions? | If yes, buy only from an FCRA-compliant consumer reporting agency | 18 brokers say they or a subsidiary are FCRA-covered |
| 5. Who else is in the chain? | Do you sell to foreign buyers, governments or AI developers, and could my copy end up there? | Contract limits on onward transfer | 26 sold or shared to a foreign actor; 56 to the federal government; 32 to a generative AI developer |
Why each check matters
- 1
Registration
In California, a broker that should have registered and didn't faces daily fines, and since 1 August 2026 registered brokers must process deletion requests from the DROP platform at least every 45 days under California's Delete Act. A registered seller's file shrinks as people use it; an unregistered one is a red flag.
- 2
Source
The seller's right to license the data is only as good as the notices under which it was first collected. Ask for it in writing.
- 3
Sensitive data
These are the ten categories California asks every broker about, because they carry the most risk for the people described. If you don't need them, ask for a file without them.
- 4
Purpose
The FTC says consumer report information can't be given to anyone without a purpose the Fair Credit Reporting Act allows, and users who deny credit, insurance or employment on a report must tell the consumer.
- 5
Onward transfer
Since 8 April 2025 the Justice Department's bulk sensitive data rule bars data brokerage of bulk US sensitive personal data to countries of concern such as China, Russia and Iran. Your licence should forbid resale to them.
What to put in the contract
- The permitted uses and channels, and a ban on everything else.
- The seller's warranty that it may license the data and collected it lawfully, with an indemnity behind it.
- A list of what was excluded: sensitive categories, minors, people who opted out.
- Deletion passthrough: the seller tells you about deletion and opt-out requests that affect your copy, and you act on them.
- No onward sale or sharing without consent, and none to countries of concern.
Sources
6 sources · checked Nov 9, 2026
The DataBroker team checked the facts on this page against 6 public sources, last on .
- 2026 California Data Broker Registry, CalPrivacyChecked
- Data brokers: registration, fee and DROP, CalPrivacyChecked
- Why are hundreds of data brokers not registering with states?, Privacy Rights ClearinghouseChecked
- Fair Credit Reporting Act, Federal Trade CommissionChecked
- Bulk sensitive data access rule, University of Colorado Anschutz research complianceChecked
- DOJ rule restricting sensitive data transfers takes effect, National Law ReviewChecked
Buying consumer data FAQ
Is it legal to buy consumer data?
In the US, yes, within limits: the seller may need to be a registered data broker, eligibility uses fall under the FCRA, sensitive categories draw extra rules, and bulk sensitive data can't be brokered to countries of concern.
How do I check whether a data broker is registered?
Download California's registry from CalPrivacy or browse our copy of its 2026 entries, and search Vermont's registry by name. Texas and Oregon keep registries too.
Can I buy consumer data for tenant or employee screening?
Only from a consumer reporting agency that follows the Fair Credit Reporting Act, and only with a purpose the Act allows. Marketing data bought from a broker can't be used for those decisions.
What should a consumer data licence include?
Permitted uses, the seller's warranty that it collected and may license the data lawfully, excluded categories, deletion passthrough and limits on onward transfer.
Related
- Data broker sites
Data broker sites and the companies behind them: every broker in California's 2026 registry, with what each says it collects and who it sells to.
- California data broker registry and the Delete Act
The California data broker registry, run by the state privacy agency, sets yearly registration, a deletion platform every broker must check, and daily fines.
- Is selling data legal?
Is selling data legal? A plain look at when a sale is allowed, when registration applies, and when to call a lawyer first.
Take the DataBroker course
The DataBroker course and tools: find companies with data to sell, price it, license it and close the deal.