WhatsApp and Telegram +44 7563 115980
[email protected]
We assess whether your business is a data broker in each state, file the registrations and renewals, prepare the disclosures and set up the deletion and security obligations that come with them. Every fee, date and penalty on this page is taken from the state's own law or regulator.
Since 2013 we have helped firms with due diligence and data services, in more than 60 countries.
The short answer
A data broker is a business that sells or licenses personal information about people it does not have a direct relationship with. California, Texas, Oregon and Vermont run data broker registries, New Jersey opens its first registration period on 1 April 2027 and Connecticut requires registration by 1 January 2027. Fees run from $100 in Vermont to $1,500,000 for the largest New Jersey registrants. Missing a deadline brings daily penalties, such as $200 a day in California. We assess which states apply, file and renew the registrations, prepare the disclosures and set up deletion request processing.
On this page
Each state defines the term in its own law, but the core idea is the same. A data broker collects personal information about people and sells or licenses it to others, where the people concerned have no direct relationship with the business. A direct relationship means the person is, or was, a customer, user, employee, investor or donor of that business.
Personal information means information that identifies, or can reasonably be linked to, a particular person. Information that has been properly deidentified, meaning it can no longer reasonably be linked to anyone, is excluded in California and, on stated conditions, in Texas. That is why de-identification can take a dataset outside these laws altogether. Our data de-identification service does exactly that, with the records to prove it.
New Jersey has added a second category. A data collector is a business that collects personal data from its own customers, with whom it has a direct relationship, and sells or licenses that data to a data broker. Data collectors must register in New Jersey too.
| State | Who must register | Fee | Deadline | Penalties |
|---|---|---|---|---|
| California | A business that knowingly collects and sells to third parties the personal information of a consumer with whom it has no direct relationship (Delete Act). Registers with CalPrivacy (the California Privacy Protection Agency) | $6,000 for 2026, plus an electronic payment processing fee | 1 to 31 January each year, for the year after the business operated as a broker | $200 a day for failing to register; $200 a day for each deletion request not processed; plus costs |
| Texas | A data broker that, in a 12-month period, earns more than 50% of revenue from personal data it did not collect directly, or earns revenue from such data about more than 50,000 people (Business and Commerce Code, Chapter 510). Registers with the Secretary of State | $300, and $300 to renew | Before conducting business in Texas; the certificate expires one year after issue | At least $100 a day plus unpaid fees, up to $10,000 in any 12 months |
| Oregon | A business that collects and sells or licenses brokered personal data about Oregon residents, with stated exemptions (ORS 646A.593). Registers with the Division of Financial Regulation | $600, and $600 each year to renew | Before collecting, selling or licensing; registration runs to 31 December; renew at least 30 days before expiry | Up to $500 per violation or $500 a day for continuing violations, up to $10,000 a year |
| Vermont (until 31 December 2026) | A business that knowingly collects and sells or licenses brokered personal information of a consumer with whom it has no direct relationship (9 V.S.A. 2430 and 2446). Registers with the Secretary of State | $100 | On or before 31 January following a year as a data broker | $50 a day, up to $10,000 a year, plus unpaid fees |
| Vermont (from 1 January 2027) | As above, with a narrower meaning of direct relationship: the consumer must intend to interact with the business | $900, plus a $20,000 bond | Within 30 days of becoming a data broker, then by 1 July each year | $200 a day for failing to register; $1,000 a day for missing information; $25,000 for materially incorrect information |
| New Jersey | Data brokers, and data collectors that sell or license their customers' personal data to a data broker (P.L.2026, c.25). Registers with the Division of Consumer Affairs | Tiered by number of New Jersey consumers: $5,000 for 100,000 or fewer, rising to $1,500,000 for more than 4.5 million | First registration period 1 April to 30 June 2027, then annually | $2,500 a day for failing to register or update; $50,000 per record for selling or licensing sensitive data unlawfully |
| Connecticut | Data brokers, as defined in Public Act 26-64. Registers with the Department of Consumer Protection | Set by the Act | By 1 January 2027 | Set by the Act |
Registration laws are in force or enacted in at least these six states, and further bills are pending elsewhere. We check the position in every state that applies to a client at the time of each engagement.
California has the most demanding regime. Under the Delete Act, data brokers register each January through the Delete Request and Opt-out Platform (DROP), the state's system for consumer deletion requests. The 2026 registration fee was $6,000. Registration now includes expanded disclosures under SB 361, including whether the broker has shared data with foreign actors, law enforcement or developers of generative AI systems.
We assess each state's test against your business and data, then file and maintain every registration that applies.
Speak to an expertData de-identificationCompanies that license data to AI developers should check these laws before the first delivery. Two points matter most.
Owners preparing data for AI buyers can read our guide on how to sell data to AI companies. AI teams checking their suppliers can use our AI training data due diligence checklist.
| Work | What it covers | What you receive |
|---|---|---|
| Applicability assessment | Each state's test applied to your business model, data sources, relationships and volumes, including New Jersey's data collector test | A written assessment for each state with the reasoning |
| Registration and renewal | Preparing and filing registrations, arranging payment of the state fees, and diarising renewals | Filed registrations and a compliance calendar |
| Disclosures | Drafting registration disclosures, website notices and privacy policy statements, including California's SB 361 and Texas's website notice | Approved disclosure text |
| Deletion processing | Setting up the California DROP process: downloads, matching, deletion and status reporting within 45 days | A documented procedure and records of each cycle |
| Security programme | The written information security programme Texas requires of data brokers | A programme document and review schedule |
| Audit readiness | Preparing for California's independent audits from 2028 | A readiness review and remediation plan |
| De-identification | Where it suits the business, de-identifying datasets so they fall outside the regimes | De-identification report and test results |
A business that collects personal information about people and sells or licenses it to others, where those people have no direct relationship with the business, such as being its customers, employees or investors. Each state defines the term in its own law.
California, Texas, Oregon and Vermont run registries. New Jersey's first registration period runs from 1 April to 30 June 2027, and Connecticut requires registration by 1 January 2027.
A business that knowingly collects and sells to third parties the personal information of California consumers with whom it has no direct relationship. It registers each January for the year after it operated as a broker.
CalPrivacy set the 2026 annual registration fee at $6,000, plus a third-party processing fee for electronic payment.
The Delete Request and Opt-out Platform, California's system that lets a consumer send one deletion request to every registered data broker. From 1 August 2026 data brokers must access it at least once every 45 days and process the requests.
Yes, for data brokers that earn more than half their revenue from personal data they did not collect directly, or earn revenue from such data about more than 50,000 people. The fee is $300 and the certificate lasts one year.
Yes. New Jersey's 2026 law requires data collectors, meaning businesses that sell or license their own customers' personal data to a data broker, to register alongside data brokers.
Generally not. California excludes deidentified information from personal information, and Texas excludes deidentified data where stated safeguards and contracts are in place. The de-identification must be genuine and documented.
They vary by state: $200 a day in California, at least $100 a day in Texas, up to $500 a day in Oregon, $50 a day in Vermont until 2027 and $200 a day after, and $2,500 a day in New Jersey.
Only if the data identifies people and your business meets a state's test. Properly de-identified data generally falls outside these laws, and both California and Vermont ask brokers whether they share data with generative AI developers.
Each point of law and each reported figure on this page was checked against these sources on 27 October 2026. This page is general information, not legal advice.
Tell us what data you sell or license, about whom, and in which states.