Data broker laws by state
Data broker laws in the United States, state by state: who must register, what it costs, when it is due and what happens if you don't.
Updated
No federal law, five state registries
The United States has no federal statute aimed at data brokers as such. Instead, a handful of states require businesses that sell personal information about people they don't deal with directly to register, publish basic facts about themselves and, in some states, honour deletion requests. Federal rules still bite at the edges: the Fair Credit Reporting Act when data is used for credit, jobs, insurance or housing, and the FTC Act against unfair or deceptive practices.
Vermont went first, in 2018. California, Texas and Oregon followed, and New Jersey enacted the most expensive regime yet in June 2026. Each state words its definition differently, so a business can be a broker in one and not in another.
State-by-state comparison
| State | Registration required? | Who must register | Fee | Deadline | Penalties | Deletion obligations |
|---|---|---|---|---|---|---|
| California | Yes, with CalPrivacy (CPPA) | Businesses that knowingly collect and sell personal information of consumers they have no direct relationship with | $6,000 for 2026, plus processing charge | January 1 to 31 each year | $200 for each day unregistered; $200 for each deletion request for each day unprocessed | Yes: process DROP requests at least every 45 days since August 1, 2026 |
| Vermont | Yes, with the Secretary of State | Businesses that knowingly collect and sell or license brokered personal information of consumers they have no direct relationship with | $100 today; $900 and a $20,000 bond from 2027 | January 31 today; within 30 days, then July 1, from 2027 | $50 for each day, up to $10,000 in one year; $200 for each day from 2027 | No deletion mandate in the registry law; opt-out practices must be disclosed |
| Texas | Yes, with the Secretary of State | Brokers earning over half their revenue, or revenue from over 50,000 people's data, from personal data not collected directly | $300, renewed yearly | Before doing business; certificate lasts one year | At least $100 for each day, up to $10,000 in 12 months | Not in the registry law; rights come from the Texas Data Privacy and Security Act |
| Oregon | Yes, with DCBS | Businesses that collect and sell or license brokered personal data, excluding data about their own customers | $600 | Before brokering; expires December 31 | Up to $500 for each violation or day, up to $10,000 in a calendar year | Not in the registry law; rights come from Oregon's privacy law |
| New Jersey | Yes, from 2027, with the Division of Consumer Affairs | Data brokers, and data collectors that sell their own customers' data to brokers | $5,000 to $1,500,000 by consumer count | First window expected April 1 to June 30, 2027 | $2,500 for each day; $50,000 for each sensitive record sold | Sensitive data sales banned since June 30, 2026 |
Patterns across the states
- The core test is similar everywhere: selling or licensing personal data about people the business has no direct relationship with. Texas adds revenue thresholds; New Jersey extends duties to the businesses that supply brokers.
- Exemptions follow other laws. Activity already regulated by the Fair Credit Reporting Act or Gramm-Leach-Bliley is usually carved out, but only to the extent of that regulation.
- Only California runs a state deletion platform. Elsewhere, deletion and opt-out rights come from each state's general privacy law, which has its own thresholds.
- Costs are rising. Vermont's fee goes from $100 to $900 with a bond in 2027, and New Jersey's top tier is $1,500,000.
Do these laws apply to dataset brokering?
Only when personal data is involved. Licensing source code, machine telemetry, satellite imagery or other data that doesn't identify people falls outside every registry on this page. Once a dataset contains names, contact details, device identifiers or location tied to individuals, the questions change: who collected it, whether the seller has a direct relationship with those people, and whether the buyer will resell it. The safest habit is to ask whether personal data is in scope before any sample moves, and to bring in a privacy lawyer when the answer is yes.
Sources
| Source | Rows it supports | Checked |
|---|---|---|
| CalPrivacy data broker page | California fee, window, DROP | 2026-11-07 |
| Vermont 9 V.S.A. § 2446 | Vermont fee, deadline, penalties, 2027 changes | 2026-11-07 |
| Texas SOS data broker page | Texas fee and term | 2026-11-07 |
| Texas SB 2105 analysis | Texas penalty and cap | 2026-11-07 |
| ORS 646A.593 | Oregon definition, penalties | 2026-11-07 |
| Oregon DFR registry page | Oregon fee and expiry | 2026-11-07 |
| NJ OLS fiscal estimate, A5328 | New Jersey fees and penalties | 2026-11-07 |
Questions people ask
Which states require data brokers to register?
California, Vermont, Texas and Oregon run registries today, and New Jersey's opens in 2027. Each defines a data broker a little differently.
Is there a federal data broker law?
Not one aimed at data brokers generally. Federal rules such as the Fair Credit Reporting Act and the FTC Act apply to parts of the industry depending on what is sold and how it is used.
Are data brokers legal?
Yes, in the United States they operate legally, subject to state registration where it applies, privacy laws that give people opt-out and deletion rights, and federal rules on credit reporting and deceptive practices.
Do I need to register if I only broker business datasets?
Not under these registries if the data contains no personal information. If it does, check each state where the people in the data live, and ask a lawyer.
Related
Become a data broker
The DataBroker course and tools: find companies with data to sell, price it, license it and close the deal.