Data Broker
Definition
A company that collects personal information about people it does not deal with directly, then sells, licenses, or shares that information with other businesses. Data brokers typically combine public records, commercial purchase data, app or web tracking data, and other third-party sources into consumer profiles used for marketing, risk scoring, people search, fraud prevention, or analytics.
Legal Definition
Under the CCPA and California Delete Act, a data broker is generally a business that knowingly collects and sells personal information about a consumer with whom it does not have a direct relationship. California Privacy Protection Agency (CalPrivacy) guidance, retrieved 2026-05-26, says data brokers must register annually through DROP and pay the 2026 registration fee. Texas Secretary of State guidance, retrieved 2026-05-26, requires data brokers conducting business in Texas to register with the Secretary of State. Oregon Division of Financial Regulation guidance, retrieved 2026-05-26, defines a data broker as a business that collects and sells or licenses brokered personal data and requires registration before collecting, selling, or licensing brokered personal data in Oregon. Vermont requires annual registration under 9 V.S.A. § 2446. Connecticut Public Act 26-64 creates a Department of Consumer Protection registration regime effective October 1, 2026, and bars unregistered brokers from selling or licensing brokered personal data in Connecticut on or after January 1, 2027.
State Laws Using This Term
Practical Example
A company buys recent dating-app signup lists, appends public-record address data and purchase-history segments, then sells "new mover" or "fitness interest" audiences to advertisers. The people in the list never opened an account with the company selling the audience, so the business may be acting as a data broker.
Data Broker Registration Rules Compared
State data broker laws are not identical. The same company may need separate filings, fees, consumer notices, and deletion workflows depending on where it brokers personal data.
| State | Registration trigger | Fee / timing | Notable 2026 duty |
|---|---|---|---|
| California | Business knowingly collects and sells personal information about consumers with no direct relationship, unless an exemption applies. | Register with CalPrivacy through DROP by January 31; 2026 fee is $6,000 plus payment processing costs. | Consumers can submit DROP deletion requests as of January 1, 2026; brokers begin processing through DROP on August 1, 2026 and must access it at least every 45 days. |
| Texas | Data broker conducts business in Texas and meets Chapter 509 registration requirements. | $300 initial registration and $300 annual renewal through the Secretary of State. | Website or app must post the statutory data broker notice, and the broker must maintain a comprehensive information security program. |
| Oregon | Business collects and sells or licenses brokered personal data about Oregon residents. | $600 registration or renewal fee; registration is valid through the end of the calendar year. | Broker must provide a short consumer opt-out narrative that Oregon publishes with the registration record. |
| Vermont | Person met Vermont's data broker definition during the prior year. | Annual Secretary of State registration by January 31; $100 fee for 2026, rising to $900 effective January 1, 2027 under Act 138 (signed June 16, 2026). | Registration must disclose opt-out methods, opt-out limits, purchaser credentialing, breach count, and minors-data practices where applicable. |
| Connecticut | Data broker sells or licenses brokered personal data in Connecticut once Public Act 26-64 registration applies. | $2,500 initial registration and $2,500 annual renewal; framework is effective October 1, 2026. | Unregistered brokers may not sell or license brokered personal data in Connecticut on or after January 1, 2027; DCP must build an accessible deletion mechanism by July 1, 2028. |
Data Broker Classification Checklist
- Map whether the business gets personal data from public records, third-party suppliers, SDKs, pixels, purchased lists, or other sources outside a direct customer relationship.
- Separate true sales or licenses of personal data from service-provider, processor, affiliate, fraud-prevention, or consumer-directed disclosures that may be excluded under a specific state law.
- Keep a state-by-state registry calendar: California, Texas, Oregon, and Vermont use annual registrations now; Connecticut registration duties start in late 2026 with a 2027 sales/licensing gate.
- Document consumer-facing opt-out and deletion workflows before filing, because several registries require public descriptions of how consumers can limit collection, sale, licensing, or deletion.
Primary Sources
- CalPrivacy data broker registration and DROP guidance (date_retrieved: 2026-05-26)
- California Data Broker Registry (date_retrieved: 2026-05-26)
- Texas Secretary of State data broker registration guidance (date_retrieved: 2026-05-26)
- Oregon Division of Financial Regulation data broker registry guidance (date_retrieved: 2026-05-26)
- Vermont 9 V.S.A. § 2446 annual registration (date_retrieved: 2026-05-26)
- Vermont H.211 (Act 138) bill status — signed June 16, 2026, effective January 1, 2027 (date_retrieved: 2026-06-22)
- Connecticut Public Act 26-64 (date_retrieved: 2026-05-26)
Related Terms
Frequently Asked Questions
What does data broker mean in plain English?
A data broker is an information middleman. The broker is not the store, app, employer, or service that the person intentionally dealt with; it gets data from other sources and sells, licenses, or shares profiles about those people to third parties.
How do I know if my business is a data broker?
Use a three-part test: (1) do you collect data about people who do not have a direct relationship with your business, (2) do you get that data from public records, third-party suppliers, tracking pixels, SDKs, or other outside sources, and (3) do you sell, license, or otherwise make that data available to another party for money or other value? If all three are true, review each state data broker registration law before assuming you are exempt.
Do data brokers need to register with the state?
Yes in several states. California requires annual CalPrivacy registration and, for 2026, a $6,000 fee plus payment processing costs. Texas requires registration with the Secretary of State and lists a $300 registration or renewal fee. Oregon requires registration with the Division of Financial Regulation before collecting, selling, or licensing brokered personal data in Oregon and lists a $600 registration fee. Vermont requires annual Secretary of State registration; the fee is $100 for 2026 but rises to $900 effective January 1, 2027 under Act 138 (H.211), which Governor Scott signed June 16, 2026 and which also raises the non-registration penalty to $200 per day (9 V.S.A. § 2446, date_retrieved 2026-06-22). Connecticut creates a Department of Consumer Protection data broker registration program effective October 1, 2026, with a $2,500 registration or renewal fee and a January 1, 2027 sales/licensing gate. Source check date_retrieved: 2026-05-26 (Vermont fee re-verified 2026-06-22).
What do data brokers do with personal information?
Common uses include marketing audiences, people-search databases, fraud or identity verification, risk scoring, location-based analytics, and enrichment of customer records. Privacy laws focus on whether the broker has a direct relationship with the consumer and whether the broker sells, licenses, or shares the data with third parties.