Question 1

What is a data broker?

Accepted Answer

A data broker is a business that knowingly collects and sells or licenses the personal information of consumers with whom it does not have a direct relationship. Under California's Data Broker Registration law (SB 362 / Delete Act), data brokers must register with the California Privacy Protection Agency (CPPA) and comply with centralized deletion requests through the DELETE platform. Other states like Vermont, Texas, and Oregon also have data broker registration requirements.

Question 2

How do I know if my business is a data broker?

Accepted Answer

Your business may be a data broker if you: (1) collect personal information about consumers you don't have a direct relationship with, (2) sell, license, or share that data with third parties, (3) aggregate data from public records, social media, or other sources for resale. Our quiz evaluates your data practices against the legal definitions used in California, Vermont, Texas, and Oregon to determine if you qualify as a data broker.

Question 3

What is the California Delete Act?

Accepted Answer

The California Delete Act (SB 362, effective 2024) requires all data brokers to register with the CPPA, pay annual fees, and comply with the centralized DELETE Request and Opt-out Platform (DROP). The DROP system launched January 1, 2026, allowing consumers to submit a single deletion request that applies to all registered data brokers. Data brokers must check the platform at least every 45 days and process deletion requests. Failure to register carries penalties of $200 per day.

Question 4

What are the penalties for unregistered data brokers?

Accepted Answer

In California, failure to register as a data broker carries fines of $200 per day. Failure to process deletion requests from the DROP platform incurs $200 per request per day of non-compliance. The CPPA launched a Data Broker Enforcement Strike Force in January 2026 to pursue non-compliant brokers. Vermont imposes $10,000 per year of non-registration. Texas and Oregon have their own penalty structures enforced by their respective Attorneys General.

Question 5

Which states require data broker registration?

Accepted Answer

As of 2026, the following states require data broker registration: California (Delete Act / SB 362), Vermont (H.121 Data Broker Registration), Texas (HB 4, data broker provisions), and Oregon (data broker registration requirements). California has the most comprehensive requirements, including the centralized DROP deletion system. Several other states are considering data broker legislation.

Am I a Data Broker?

Do you collect personal information about people who are NOT your direct customers or users?

Am I a Data Broker?

Do you collect personal information about people who are NOT your direct customers or users?