Data Broker Laws – Personal Information Sales Registration and Consumer Rights

Data brokers operate differently from businesses that collect information directly from their customers. They may gather, combine, analyze, license, or sell information about people with whom they have no direct relationship, which is why several states impose registration, disclosure, security, opt-out, or deletion requirements specifically on this industry.

What Legally Counts as a Data Broker?

Definitions differ by state. California generally describes a data broker as a covered business that knowingly collects and sells personal information about consumers with whom it lacks a direct relationship, while providing statutory exemptions for certain regulated entities.

Vermont uses a similar direct-relationship concept in its data-broker statute and requires qualifying brokers to register annually.

Why Registration Requirements Matter

Registration creates a public point of accountability. Companies maintaining Pennsylvania regional content or unrelated online properties are not automatically data brokers simply because they collect visitor information; the statutory definition and actual business model determine coverage.

California’s system requires covered data brokers to register and provide specified business information. Vermont’s law also requires annual registration and disclosures concerning matters such as opt-out practices.

Consumer Rights Are Expanding

California’s Delete Act created the Delete Request and Opt-Out Platform, or DROP. Beginning August 1, 2026, registered brokers subject to the law must periodically access the system and process qualifying deletion requests, subject to limited exceptions.

Someone browsing a Tennessee listing platform may encounter many businesses, but ordinary directory presence does not establish data-broker status. What matters is whether the company satisfies the applicable legal definition.

Requirement	Possible Purpose	Who It Affects
Registration	Identify covered brokers	Qualifying businesses
Disclosure	Explain data practices	Brokers and consumers
Opt-out	Restrict certain processing	Eligible consumers
Deletion	Remove covered data	Subject to exceptions

The California Privacy Protection Agency data-broker guidance provides current information on registration and DROP obligations.

Selling Data Is Not the Only Issue

Broker regulation can concern collection, licensing, sharing, security, deletion, and consumer-request procedures—not merely a traditional cash sale. Companies using Indiana catalog resources for ordinary publication or marketing activity should not assume the word “broker” applies merely because information moves between organizations.

Legal definitions are technical. Some statutes also exclude particular institutions or information already governed by separate federal or state laws.

Where Businesses Commonly Misjudge the Rules

One mistake is assuming that having no consumer-facing brand means privacy law does not apply. In fact, lack of a direct consumer relationship can be part of the very definition that brings a company into a data-broker statute.

The opposite mistake is labeling every advertising company, directory, analytics provider, or database operator a data broker. Coverage depends on statutory language, information practices, business relationships, and exemptions.

When Should Legal Help Be Considered?

A company should consider legal review when it buys or licenses large consumer datasets, combines information from unrelated sources, resells profiles, receives broker-registration notices, or is uncertain whether an exemption applies.

Consumers may want advice when sensitive information continues circulating after a valid statutory request, when identity theft or serious harm is involved, or when a broker’s explanation appears inconsistent with state-law rights.

Frequently Asked Questions

Are data brokers illegal in the United States?

No. Data brokering is generally a regulated business activity rather than inherently unlawful. Particular collection, sale, disclosure, security, or consumer-request practices may be restricted by applicable federal or state law.

Can consumers find registered data brokers?

Some states maintain registries. California’s Privacy Protection Agency operates a data-broker registry, while Oregon explains that its Department of Consumer and Business Services maintains registration information for covered brokers.

Does deleting information from one broker remove it everywhere?

Not necessarily. Different companies may hold independent copies obtained from separate sources. A centralized mechanism such as California’s DROP can broaden the reach of a request where the statute applies, but legal exceptions may still preserve some information.

Identify the Business Model First

Consumers should start by identifying the company holding their data and the state law that may provide access, opt-out, or deletion rights. Businesses should examine what information they obtain, from whom, for what purpose, and whether it is transferred onward.

Data broker laws increasingly focus on making previously invisible information flows more accountable. Classification comes before compliance: a company needs to understand whether it legally qualifies as a broker before it can accurately determine its duties.

This article provides general legal information and is not a substitute for advice from a qualified attorney.