Key point: State data broker laws require more than simply registering your business. California now requires recurring deletion through a centralized platform, Connecticut is building a similar system, Vermont has enacted substantial 2027 changes, and New Jersey has adopted a high-cost registry covering both data brokers and certain data collectors.

The U.S. still lacks a federal data broker registry. In its place, states are building a patchwork of laws that use different definitions, thresholds, exemptions, fees, disclosures, and consumer-rights mechanisms. A company may therefore qualify as a data broker in one state but not another, even when the same data flows are involved.

The first question is not whether a company calls itself a data broker. Rather, what matters is how it obtains personal data, whether it has a direct relationship with the individual, what it does with the data, and whether the transfer is a sale, license, or other covered disclosure. Thus, lead generation businesses, ad technology providers, website analytics businesses, data aggregators, and other intermediaries should not assume these laws apply only to traditional “list brokers.”

As of September 30, 2026, California, Oregon, Texas, and Vermont have active registration procedures. Connecticut requires registration beginning January 1, 2027. New Jersey enacted a separate registry framework in June 2026. Nevada does not require registration but provides a statutory opt-out right.

Threshold Question: Who Is a “Data Broker”?

There is no uniform definition. California focuses on a business that “knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.” Its regulations define a direct relationship by reference to the consumer’s intentional interaction with the business for the purpose of accessing, purchasing, using, requesting, or obtaining information about that business’s products or services.

Oregon covers business entities that collect and sell or license “brokered” personal data. Texas focuses on personal data not collected directly from the individual and applies revenue or volume thresholds tied to that indirectly collected data. New Jersey combines direct-relationship and sale-or-license concepts. Connecticut covers a business that sells or licenses specified categories of brokered personal data.

Collecting information directly from a consumer is relevant in Texas, but it does not necessarily establish the direct relationship required elsewhere. The substance of the consumer interaction matters, including the nature of the services the consumer understood the company itself to provide.

California: Registration Is Now Only the Beginning

California data brokers must register annually with the California Privacy Protection Agency. For 2026, the fee is $6,000 plus an electronic-payment processing fee of up to 2.99 percent.

California’s Delete Request and Opt-Out Platform, known as DROP, permits a resident to submit one deletion request to active data brokers. Beginning August 1, 2026, data brokers must access DROP and process requests at least once every 45 days.

California authorizes a $200-per-day administrative fine for failure to register, along with unpaid fees and enforcement costs. Failure to comply with a deletion request can result in a separate daily fine for each request. Independent compliance audits begin in 2028.

Oregon and Texas: Similar Label; Different Tests

Oregon requires registration before collecting, selling, or licensing brokered personal data in the state. Registration and annual renewal cost $600 and expire at the end of the calendar year.

Texas law applies only when specified revenue or volume thresholds are met for personal data not collected directly from relevant individuals. Covered data brokers must register for $300, renew annually, and provide disclosures regarding data categories, purchaser credentialing, known-child data, and security breaches.

Vermont: A Major Expansion Takes Effect in 2027

Vermont law currently requires annual registration and disclosures addressing opt-out practices, purchaser credentialing, breaches, and known holdings of minors’ information.

Vermont’s H.211, signed June 16, 2026, strengthens the framework effective January 1, 2027 by raising the annual fee to $900, increasing penalties, expanding registration disclosures, and adding purchaser verification requirements.

Connecticut and New Jersey: The Next Wave

Connecticut Public Act 26-64 takes effect October 1, 2026, and requires active registration before a data broker sells or licenses brokered personal data in the state on or after January 1, 2027. Initial fees and renewal fees are $2,500. The state must establish an accessible deletion mechanism by July 1, 2028. Starting October 1, 2028, each registered Connecticut data broker must keep checking the state deletion system at regular intervals and process the deletion requests it finds there.

New Jersey’s P.L. 2026, Chapter 25 establishes a public registry for data brokers and certain data collectors. Annual fees range from $5,000 for 100,000 consumers or fewer to $1.5 million for more than 4.5 million consumers. The law also imposes registration disclosure requirements, a sensitive data sale restriction, and daily penalties for specified failures.

Nevada: Opt-Out Rights Without a Registry

Nevada law requires a qualifying data broker to maintain a designated request address through which a consumer may submit a verified request not to sell covered information that the broker has purchased. Nevada law does not establish an annual data broker registry or registration fee.

Practical Implications

• The emerging trend is toward building the right data governance practices, not just posting the right disclosures. For example, California’s DROP and Connecticut’s planned deletion mechanism require data mapping, identity matching, suppression logic, recurring workflows, status reporting, service provider coordination, and auditable records.
• Businesses should evaluate separate data flows independently of each other. A first-party relationship for one service does not necessarily resolve the question of whether unrelated third-party data, advertising identifiers, inferred profiles, or purchased records are brokered. A business-model change may affect the analysis prospectively but generally does not eliminate obligations that arose under earlier practices.

Next Steps

• Map data sources, recipients, consideration, and purposes by state.
• Test each data flow against each state’s definition, thresholds, exemptions, and direct-relationship standard.
• Calendar registration and renewal deadlines, fees, disclosures, and effective dates.
• Build repeatable deletion and suppression processes for California DROP and Connecticut’s future mechanism.
• Review: 1) consumer-facing statements, 2) the processes used to screen, credential, and verify the people and businesses that buy or receive personal data, 3) service provider contract terms, and 4) website notices.
• Reassess the analysis anytime that data sources, monetization, or advertising and analytics practices change.

State data broker laws are developing quickly. Ultimately, whether a business is a data broker turns not on the label it gives itself but on how each state’s law treats its particular data flows, and in a patchwork expanding this fast, that question demands continuing attention rather than a one-time answer. Businesses that treat data broker compliance as an ongoing governance obligation, rather than a registration box to check, will be best positioned to keep pace as these laws take hold and multiply.

This article provides general legal information. It does not constitute legal advice to the reader and does not create an attorney-client relationship between the reader and Husch Blackwell LLP. The reader should seek legal advice if they have questions about how this legal information may apply to their own circumstances.