Data Broker Registration Laws by State: Who Has to Register, What It Costs, and What Happens If You Don't
By ClauseAudit Research · 21 sources ·
Which states have data broker laws?
Four states had data broker registration in force as of September 30, 2026: California, Oregon, Texas and Vermont. Connecticut and New Jersey enacted laws that start in 2027. California has the highest current fee, $6,000 a year, a $200 daily fine for not registering, and a statewide deletion platform called DROP.
- States with data broker registration in force: California, Oregon, Texas, Vermont (September 30, 2026, Husch Blackwell LLP (Byte Back))
- 4
- Data brokers registered in at least one state registry (April 2025, Privacy Rights Clearinghouse)
- 750
- Registered data brokers reachable through California's DROP deletion platform (October 12, 2026, California Privacy Protection Agency (CalPrivacy))
- Over 660
- Californians registered on DROP to delete their data from brokers (October 12, 2026, California Privacy Protection Agency (CalPrivacy))
- More than 560,000
- Consumer profiles data brokers have reported deleting via DROP (October 12, 2026, California Privacy Protection Agency (CalPrivacy))
- Approaching 100 million
- California's annual data broker registration fee (2026 registration year, California Privacy Protection Agency (CalPrivacy))
- $6,000
- California fine per day a data broker fails to register (2026, California Privacy Protection Agency (CalPrivacy))
- $200
- New Jersey's annual registration fee, scaled by consumers whose data is sold (A5328 (signed June 30, 2026); fees apply from 2027, Future of Privacy Forum)
- $5,000 to $1,500,000
If your company buys, sells or licenses personal data about people it has no direct relationship with, a handful of states want your name on a public list. Registration sounds like paperwork. In practice it comes with annual fees, daily fines and, in California, a deletion system that can force you to wipe records in bulk.
The map is small but growing. Four states have registries running now, two more open in 2027, and California regulators have spent 2026 fining companies that registered late. Here is what the rules mean if you run a data business, buy data from one, or just want your own information out of these databases.
Data broker registration fee by state (lowest tier where fees vary) (USD)
Chart data
| Label | Value (USD) |
|---|---|
| California | $6,000 |
| New Jersey (from 2027) | $5,000 to $1,500,000 |
| Connecticut (from 2027) | $2,500 |
| Oregon | $600 |
| Texas | $300 |
| Vermont | $100 |
California charges the highest flat fee at $6,000 for the 2026 registration year. New Jersey's tiered fee starts at $5,000 but can reach $1,500,000 for the largest sellers, and Vermont's $100 fee rises to $900 from January 1, 2027.
Download this chart (PNG)Penalty per day for failing to register as a data broker (USD per day)
Chart data
| Label | Value (USD per day) |
|---|---|
| New Jersey | $2,500 |
| California | $200 |
| Texas | $100 (minimum) |
| Vermont | $50 |
Late registration gets expensive fast. New Jersey's $2,500 a day is the steepest once its registry opens, while Texas and current Vermont law cap the yearly total at $10,000 plus unpaid fees.
Download this chart (PNG)Data brokers registered in another state but not in this state's registry (companies)
Chart data
| Label | Value |
|---|---|
| Texas | 524 |
| Oregon | 475 |
| Vermont | 309 |
| California | 291 |
These are companies that registered somewhere but skipped this state. Texas had 524 missing names in the April 2025 cross-check, though some of those companies may not do business in Texas at all.
Download this chart (PNG)California fines against data brokers that failed to register on time (USD)
Chart data
| Label | Value |
|---|---|
| LocateSmarter LLC (Aug 2026) | $116,490 |
| S&P Global, Inc. (Jan 2026) | $62,600 |
| Cybba, Inc. (Aug 2026) | $52,400 |
| Rickenbacher Data LLC / Datamasters (Jan 2026) | $45,000 |
| SalesIntel Research, Inc. (Sep 2026) | $36,400 |
Every fine here started with a missed registration. LocateSmarter's $116,490 penalty also covered a separate CCPA problem with its opt-out process.
Download this chart (PNG)Data brokers registered in California
Chart data
| Label | Value |
|---|---|
| June 2025 | 522 |
| Aug 2026 | 654 |
| Oct 2026 | Over 660 |
California's list grew from 522 in June 2025 to over 660 by October 2026. The 2026 figures count brokers in the DROP system, as reported by CalPrivacy.
Download this chart (PNG)The six state data broker registration laws compared
| State | Law | Regulator | Annual fee | When to register | Penalty for not registering | Deletion mechanism |
|---|---|---|---|---|---|---|
| California | Delete Act (SB 362, 2023), Cal. Civ. Code §1798.99.80 et seq. | California Privacy Protection Agency (CalPrivacy) | $6,000 (2026) plus payment processing fee | Annually, January 1-31 | $200 per day | Yes: DROP; brokers must process requests at least every 45 days from August 1, 2026 |
| Vermont | 9 V.S.A. §§ 2430, 2446 (Act 171 of 2018; amended by H.211, signed June 16, 2026) | Vermont Secretary of State | $100 (rises to $900 from January 1, 2027) | Annually, by January 31 | $50 per day, up to $10,000 per year, plus the fee (from January 1, 2027: $200 per day) | No |
| Texas | Tex. Bus. & Com. Code ch. 509 (SB 2105, 2023; amended by SB 1343, 2025) | Texas Secretary of State | $300 | Required to conduct business in Texas; renew annually (certificate expires one year after issuance) | At least $100 per day, up to $10,000 per 12 months, plus unpaid fees | No |
| Oregon | ORS 646A.593 (HB 2052, 2023) | Oregon Division of Financial Regulation | $600 to register and to renew | Required from January 1, 2024; renews each calendar year | Not confirmed | No |
| Connecticut | Public Act 26-64 (SB 4, 2026) | Connecticut Department of Consumer Protection | $2,500 | Register by January 1, 2027 | No separate failure-to-register penalty stated; data broker provisions carry civil penalties of up to $200 per day per violation | Planned: deletion mechanism by July 1, 2028 |
| New Jersey | A5328 (signed June 30, 2026) | New Jersey Division of Consumer Affairs | $5,000 to $1,500,000, by number of consumers | Annually; registry inoperative for 270 days after enactment, first window April 1 to June 30, 2027 | $2,500 per day plus unpaid fees | No |
Source: California Privacy Protection Agency (CalPrivacy), Data Brokers (registration and DROP obligations); California Privacy Protection Agency (CalPrivacy), Enforcement Advisory Targets Incorrect Information in Data Broker Registration; Vermont Office of the Attorney General, Guidance on Vermont's Act 171 of 2018 Data Broker Regulation (9 V.S.A. §§ 2430, 2433, 2446 and 2447); Texas Legislature, S.B. No. 2105 (88th Legislature), enrolled: Business & Commerce Code Chapter 509, Data Brokers; Texas Legislature, S.B. No. 1343 (89th Legislature), enrolled: amends Business & Commerce Code Sections 509.004 and 509.005; Oregon Division of Financial Regulation, Data Broker Registry; Oregon Division of Financial Regulation, Data Broker Registry FAQs; Privacy Rights Clearinghouse, Data Broker Database; Hunton Andrews Kurth LLP, Vermont Enacts Significant Amendments to Data Broker Legislation; Connecticut Office of the Attorney General, Rights and Requirements Related to New and Updated Privacy Laws; Davis+Gilbert LLP, Connecticut's Newly Enacted Data Broker Law: How It Stacks Up Against California's Delete Act; Future of Privacy Forum, Data Brokers & Beyond: Navigating New Jersey's Data Broker & "Data Collector" Registration Law; Hunton Andrews Kurth LLP, New Jersey Adopts New Data Broker Registration Regime and Sensitive Data Sale and Licensing Restrictions. Download as image
Data broker registration law by state
- 1Registration law in force plus a statewide deletion platform
- 3Registration law in force
- 2Registration law enacted in 2026, registration starts 2027
- 45No data broker registration law identified
- Registration law in force plus a statewide deletion platform1
- Registration law in force3
- Registration law enacted in 2026, registration starts 20272
- No data broker registration law identified45
Which states have data broker registration laws?
Six states have enacted one. California, Oregon, Texas and Vermont were taking registrations as of September 30, 2026. Connecticut requires registration by January 1, 2027. New Jersey signed its law on June 30, 2026, and its first registration window runs April 1 to June 30, 2027.
Every other state shows up on the map as having no registration law. That does not mean data brokers are unregulated there. Many states have broad consumer privacy laws that give people opt-out rights against the sale of their data, and those apply whether or not a registry exists. The registry laws add one more layer: you have to tell the state who you are.
Definitions vary, but the common thread is a business that collects and sells or licenses personal information about consumers it does not deal with directly. A people-search site, a marketing list vendor or a company that resells location data is the classic example. A retailer selling its own customers' data is usually treated differently, though New Jersey's new law also reaches some "data collectors", so read each statute before you assume you are out.
How much does data broker registration cost?
Fees range from cheap to serious. Vermont charges $100 today, Texas $300, Oregon $600, and Connecticut will charge $2,500. California charges $6,000 for the 2026 year, plus a processing fee for electronic payments. New Jersey scales by how many consumers' data you sell, from $5,000 for the smallest tier up to $1,500,000 at the top.
The fee is rarely the big cost. Penalties are. California fines $200 for each day you are not registered, and its regulator has been collecting. S&P Global paid $62,600 and SalesIntel paid $36,400 for late registration, according to CalPrivacy announcements. New Jersey's penalty will be $2,500 a day plus unpaid fees once its registry is live.
Put those together and a company that misses California's January 1-31 window and does not notice for a few months can owe far more than the fee itself. Put the deadline for every state you sell into on the calendar, not just your home state.
What is California's DROP and why does it matter?
DROP is California's Delete Request and Opt-out Platform, created by the Delete Act. A consumer files one request and it goes to every registered broker. As of October 12, 2026, more than 560,000 Californians had signed up and over 660 brokers were in the system. Brokers have reported deleting close to 100 million consumer profiles.
From August 1, 2026, registered brokers must process DROP requests at least every 45 days. If you are a broker, that is an engineering job, not a legal footnote: you need to pull the list, match records and delete on a schedule you can prove. Connecticut plans its own deletion mechanism by July 1, 2028, so expect this model to spread.
If you buy data from brokers, DROP matters to you too. Records you licensed last year may vanish from the next delivery, and your contract should say what happens when they do. Does the vendor credit you for deleted records? Must you purge copies you already hold? Who pays if a regulator decides you kept data you should have dropped?
Why do so many data brokers fail to register?
In April 2025, 750 data brokers were registered in at least one state. Yet 524 of them were missing from Texas's registry and 475 from Oregon's. Some companies may not do business in every state. Others read the definitions narrowly, or simply never got around to it.
That gap is now closing through enforcement rather than goodwill. Every 2026 California fine in the chart above involved late registration, and a September 2026 advisory warned brokers about filing incorrect registration information. If you are on the fence about whether you count as a broker, get a written legal view. Guessing wrong costs a daily rate.
Picture a small sales team that buys a contact list from a vendor it found online. The vendor never registered anywhere and ignores deletion requests. Buying the list may not break any registry law, but now it is emailing people who asked to be removed, using data with no clear chain of consent. A two-minute registry search before signing would have raised a red flag.
What should a business do now?
- Map where your data comes from and who you sell or license it to. If you sell data about people you never dealt with, assume you may be a broker until you confirm otherwise.
- List every state where you do business and check its registry rules, fee and deadline. Put California's January window and New Jersey's 2027 window on the calendar.
- If you operate in California, build the DROP workflow before you need it. Test the 45-day cycle end to end.
- If you buy data, ask your vendors in writing which registries they are on and how they handle deletion requests.
- Recheck in early 2027. Vermont's fee and penalty go up, Connecticut's deadline passes and New Jersey's registry opens.
What can you do as a consumer?
If you live in California, sign up for DROP. It is free and covers every registered broker at once, which beats emailing hundreds of companies one by one. Elsewhere, the public registries in Vermont, Texas and Oregon at least tell you who the brokers are, so you can send opt-out requests under your state's privacy law if it has one.
Freelancers and small business owners are often in these databases too, because business contact details are a product in their own right. A deletion request through DROP, or a direct opt-out to each broker, cuts down the cold pitches and the scams that ride on them. Do it once, then repeat every so often, since new brokers keep registering.
How ClauseAudit helps
Most companies run into data broker law through a contract: a data license, a marketing list purchase or a SaaS tool that enriches your leads in the background. If your vendor is unregistered or ignores deletion requests, the fallout can land on you.
Upload the agreement and ClauseAudit's automated review flags the terms that decide who carries that risk, with plain-English notes and wording you can ask for.
- Compliance warranties: does the vendor promise it is registered where required and follows state privacy laws?
- Deletion and suppression terms that require the vendor to honor DROP and opt-out requests on your data
- Indemnities for fines or claims caused by the vendor's data sourcing
- Liability caps too low to cover state penalties, and whether regulatory fines are carved out
- Rights to use, resell or combine your own customer data with other sources
- Termination and refund rights if a vendor is fined or loses the right to sell data in your state
Frequently asked questions
What is a data broker?
Generally, a business that collects personal information about consumers it does not have a direct relationship with, then sells or licenses that data to others. People-search sites, marketing list sellers and location data resellers are common examples. Each state writes its own definition, so a company can be a broker in one state and not another.
Which states require data brokers to register?
California, Oregon, Texas and Vermont had active registries as of September 30, 2026. Connecticut requires registration by January 1, 2027, and New Jersey's first window runs April 1 to June 30, 2027. That makes six states with enacted laws. Other states may still regulate brokers through general consumer privacy laws.
When is the California data broker registration deadline?
California's registration window runs January 1 to 31 each year. The 2026 fee is $6,000 plus a payment processing fee. Missing the window can cost $200 for each day you stay unregistered, and CalPrivacy has fined several brokers for registering late.
What is the Delete Act?
California's Delete Act (SB 362) moved data broker registration to the state privacy agency and created DROP, a single platform where consumers can ask every registered broker to delete their data. From August 1, 2026, brokers must process those requests at least every 45 days.
How do I get my data removed from data brokers?
Californians can use DROP, which sends one request to over 660 registered brokers. In other states, check the public registries in Vermont, Texas and Oregon for broker names and contact details, then send opt-out or deletion requests under your state privacy law if one applies to you.
What is the penalty for not registering as a data broker?
It depends on the state. California charges $200 a day. Texas charges at least $100 a day, capped at $10,000 a year plus unpaid fees. Vermont charges $50 a day today, rising to $200 from January 1, 2027. New Jersey's penalty will be $2,500 a day plus unpaid fees.
Does New Jersey's data broker law apply to my company?
Possibly, even if you do not think of yourself as a broker. The law, signed June 30, 2026, also covers some data collectors, and fees scale from $5,000 to $1,500,000 by the number of consumers whose data is sold. Have counsel review it before the first window opens in April 2027.
Do I need to register if I only buy data from brokers?
Usually not, since registration targets the seller. But you still carry risk. If your supplier is unregistered or ignores deletion requests, you may be using data you should not have. Ask vendors which registries they are on and get compliance promises and an indemnity in the contract.
Use this data
Every chart and card below is free to reuse under CC BY 4.0. Download what you need and link back to this page.
Stat cards
Key findings card
Infographic
Data broker registration fee by state (lowest tier where fees vary) (USD)
Penalty per day for failing to register as a data broker (USD per day)
Data brokers registered in another state but not in this state's registry (companies)
California fines against data brokers that failed to register on time (USD)
Data brokers registered in California
The six state data broker registration laws comparedEmbed the infographic
Free to share on your site, blog or slides under CC BY 4.0. Please keep the credit link.
Sources and method
Every number on this page comes from the sources below, each opened and read on or before October 18, 2026. A second, independent review checked every figure against its source and corrected anything that did not match. 51 of 51 state entries were confirmed; any that could not be are marked "Not yet confirmed" and left out of every count and chart.
- California Privacy Protection Agency (CalPrivacy), Data Brokers (registration and DROP obligations) (2026 registration year page (accessed 2026-10-18))
- California Privacy Protection Agency (CalPrivacy), Enforcement Advisory Targets Incorrect Information in Data Broker Registration (September 3, 2026)
- California Privacy Protection Agency (CalPrivacy), CalPrivacy Launches First-Ever Delete Week to Help Californians Protect Their Personal Information (October 12, 2026)
- California Privacy Protection Agency (CalPrivacy), Half a Million Californians Have Signed up for DROP to Delete their Personal Information from Data Brokers (August 25, 2026)
- California Privacy Protection Agency (CalPrivacy), CalPrivacy Brings New Round of Enforcement Actions Against Data Brokers (January 8, 2026)
- California Privacy Protection Agency (CalPrivacy), CalPrivacy Brings First Action Against a Data Broker Under Both the CCPA and Delete Act (August 11, 2026)
- California Privacy Protection Agency (CalPrivacy), CalPrivacy Announces Second Data Broker Enforcement Action in Less than a Week (August 13, 2026)
- California Privacy Protection Agency (CalPrivacy), CalPrivacy Continues Enforcement Blitz with Action Against Virginia Data Broker (September 1, 2026)
- Texas Legislature, S.B. No. 2105 (88th Legislature), enrolled: Business & Commerce Code Chapter 509, Data Brokers (2023 (effective September 1, 2023))
- Texas Legislature, S.B. No. 1343 (89th Legislature), enrolled: amends Business & Commerce Code Sections 509.004 and 509.005 (2025 (effective September 1, 2025))
- Oregon Division of Financial Regulation, Data Broker Registry (Accessed 2026-10-18 (no date printed))
- Oregon Division of Financial Regulation, Data Broker Registry FAQs (Accessed 2026-10-18 (no date printed))
- Vermont Office of the Attorney General, Guidance on Vermont's Act 171 of 2018 Data Broker Regulation (9 V.S.A. §§ 2430, 2433, 2446 and 2447) (December 11, 2018)
- Privacy Rights Clearinghouse, Data Broker Database (Accessed 2026-10-18 (page references DROP launch of January 1, 2026; no update date printed))
- Privacy Rights Clearinghouse, Why Are Hundreds of Data Brokers Not Registering with States? (June 20, 2025 (registry data collected April 2025))
- Husch Blackwell LLP (Byte Back), Is Your Business Model Subject to Data Broker Laws? (October 5, 2026)
- Future of Privacy Forum, Data Brokers & Beyond: Navigating New Jersey's Data Broker & "Data Collector" Registration Law (July 10, 2026 (last updated July 15, 2026))
- Hunton Andrews Kurth LLP, New Jersey Adopts New Data Broker Registration Regime and Sensitive Data Sale and Licensing Restrictions (July 17, 2026)
- Hunton Andrews Kurth LLP, Vermont Enacts Significant Amendments to Data Broker Legislation (June 22, 2026)
- Connecticut Office of the Attorney General, Rights and Requirements Related to New and Updated Privacy Laws (September 16, 2026)
- Davis+Gilbert LLP, Connecticut's Newly Enacted Data Broker Law: How It Stacks Up Against California's Delete Act (June 4, 2026)
Cite this page
ClauseAudit, “Data Broker Registration Laws by State: Who Has to Register, What It Costs, and What Happens If You Don't”, updated October 18, 2026, https://clauseaudit.com/data/data-broker-registration-laws-by-state. Free to reuse with a link back (CC BY 4.0).
This page summarises published data and law as checked on October 18, 2026. Figures are updated as new editions are released, and your own situation may differ. It is general information, not legal, tax or financial advice.