Data Broker Registry and Deletion Mechanisms by State (composition matrix)
Composition matrix. Cite within scope, source dates, and limitations shown below.
| State | Registry Enacted | Deletion Right Enacted | Actionable At Scale | Centralized Deletion Portal | Portal Url | Registry Statute | Deletion Statute |
|---|---|---|---|---|---|---|---|
| AKchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| ALchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| ARchecked 2026-07-02 | No | Yes | No | No | not_applicable | not_applicable | Arkansas Data Privacy Act, Act 549 of 2023 (Ark. Code Ann. §4-[ADPA chapter], eff. 2026-07-01) |
| AZchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| CAchecked 2026-07-02 | Yes | Yes | Yes | Yes | https://oag.ca.gov/privacy/ccpa | cal_civ_code_1798_99_80_to_1798_99_89_delete_act_sb_362 | cal_civ_code_1798_105_ccpa_cpra |
| COchecked 2026-07-02 | No | Yes | No | No | https://coag.gov/resources/colorado-privacy-act/ | not_applicable | colo_rev_stat_6_1_1306_cpa |
| CTchecked 2026-07-02 | No | Yes | No | No | https://portal.ct.gov/AG/Privacy-Rights/Connecticut-Data-Privacy-Act | not_applicable | conn_gen_stat_42_518_ctdpa |
| DCchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| DEchecked 2026-07-02 | No | Yes | No | No | https://attorneygeneral.delaware.gov/fraud/cpu/ | not_applicable | 6_del_c_12d_104_dpdpa |
| FLchecked 2026-07-02 | No | Yes | No | No | not_applicable | not_applicable | Fla. Stat. §§501.701-501.721 (Florida Digital Bill of Rights, HB 9-B, Ch. 2023-11) |
| GAchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| HIchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| IAchecked 2026-07-02 | No | Yes | No | No | https://www.iowaattorneygeneral.gov/for-consumers/consumer-privacy-act | not_applicable | iowa_code_715d_3_consumer_data_protection_act |
| IDchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| ILchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| INchecked 2026-07-02 | No | Yes | No | No | not_applicable | not_applicable | IC Title 24 Article 15 (Indiana Consumer Data Protection Act — Indiana CDPA); deletion right at IC §24-15-3-1(b)(3) |
| KSchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| KYchecked 2026-07-02 | No | Yes | No | No | https://www.ag.ky.gov/Resources/Consumer-Resources/Pages/default.aspx | not_applicable | kcdpa_hb_15_2024_eff_2026_01_01 |
| LAchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| MAchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| MDchecked 2026-07-02 | No | Yes | No | No | not_applicable | not_applicable | Md. Commercial Law Code §§14-4701–14-4714 (Maryland Online Data Privacy Act) |
| MEchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| MIchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| MNchecked 2026-07-02 | No | Yes | No | No | https://www.ag.state.mn.us/Office/Communications/2024/05/24_Consumer.asp | not_applicable | minn_stat_325o_05_mcdpa |
| MOchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| MSchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| MTchecked 2026-07-02 | No | Yes | No | No | https://dojmt.gov/consumer/ | not_applicable | mont_code_30_14_2806_mcdpa |
| NCchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| NDchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| NEchecked 2026-07-02 | No | Yes | No | No | not_applicable | not_applicable | Nebraska_Data_Privacy_Act_LB_1074_2023_codified_Neb_Rev_Stat_Ch87 |
| NHchecked 2026-07-02 | No | Yes | No | No | not_applicable | not_applicable | NH_RSA_507-H_New_Hampshire_Data_Privacy_Act_SB_255_2023 |
| NJchecked 2026-07-02 | No | Yes | No | No | https://www.njoag.gov/about/divisions-and-offices/division-of-consumer-affairs/ | not_applicable | nj_stat_56_8_166_7_njdpa |
| NMchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| NVchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| NYchecked 2026-07-02 | No | No | No | No | https://ag.ny.gov/consumer-frauds-bureau/internet-and-technology | no_enacted_data_broker_registration_statute | no_enacted_comprehensive_privacy_law |
| OHchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| OKchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| ORchecked 2026-07-02 | Yes | Yes | No | No | https://www.doj.state.or.us/consumer-protection/privacy/ | ors_646a_593_hb_2052_2023_or_laws_ch395 | or_rev_stat_646a_574_ocpa |
| PAchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| RIchecked 2026-07-02 | No | Yes | No | No | http://webserver.rilin.state.ri.us/Statutes/TITLE6/6-48.1/INDEX.HTM | not_applicable | R.I. Gen. Laws §6-48.1-1 et seq. (Data Transparency and Privacy Protection Act, 2024 H.8012 / S.2500) |
| SCchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| SDchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| TNchecked 2026-07-02 | No | Yes | No | No | https://www.tn.gov/attorneygeneral/working-for-tennessee/consumer/consumer-resources.html | not_applicable | tenn_code_47_18_3203_tipa |
| TXchecked 2026-07-02 | Yes | Yes | No | No | https://www.texasattorneygeneral.gov/consumer-protection/data-privacy | tex_bus_com_code_ch510_sb2105_2023 | tex_bus_com_code_541_051_tdpsa |
| UTchecked 2026-07-02 | No | Yes | No | No | https://attorneygeneral.utah.gov/ | not_applicable | utah_code_13_61_202_ucpa |
| VAchecked 2026-07-02 | No | Yes | No | No | https://www.oag.state.va.us/consumer-protection/index.php/cdpa | not_applicable | va_code_59_1_577_cdpa |
| VTchecked 2026-07-02 | Yes | No | No | No | not_applicable | 9_vsa_2446_2447_act_171_2018 | not_applicable |
| WAchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| WIchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| WVchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
| WYchecked 2026-07-02 | No | No | No | No | not_applicable | not_applicable | not_applicable |
Hover column headers to see field definitions. Hover cell text to see source notes. Typed unknowns (e.g., “Portal not observable”) are methodological limits, not data gaps.
Research scope
50-state coverage (verified-51 with typed-unknown rows for unobservable cells). This composition matrix joins the data-broker-registry matrix with the right-to-delete matrix to produce a unified view: which states have both mandatory registration AND a consumer deletion right, which have one but not the other, and what the practical deletion mechanism looks like where both exist. In the 9-verb framework sense, this matrix tracks whether the "actionable" verb applies — whether deletion can be exercised at scale via a centralized portal rather than entity-by-entity requests.
How to read this matrix
Each row is a U.S. state. Typed unknowns mark deletion-mechanism access and registry enforcement that cannot be confirmed under the methodology at /about/methodology/.
Sources
Primary-source citations per row live in the matrix's sources.json companion. The full source taxonomy lives at /about/source-registry/.
Frequently asked questions
Which states have a data broker registry?
Four of the 51 rows carry registry_enacted = yes: California (Cal. Civ. Code §§1798.99.80–1798.99.89, Delete Act, SB 362), Oregon (ORS 646A.593, HB 2052), Texas (Tex. Bus. & Com. Code ch. 510, SB 2105), and Vermont (9 V.S.A. §§2446–2447, Act 171 of 2018). The other 47 jurisdictions record no registration requirement, so no official enumeration of brokers exists there.
Who runs each state's data broker registry?
California's is maintained by the California Privacy Protection Agency; Vermont and Texas take registrations at their Secretaries of State; Oregon at the Division of Financial Regulation. All four registries are public — statute-by-statute detail is at /data-brokers/data-broker-registry-by-state-explainer/.
Which states have a registry but no deletion right, or a deletion right but no registry?
Vermont is the only row with registry_enacted = yes and deletion_right_enacted = no. Eighteen states record a deletion right with no registry. California, Oregon, and Texas are the only three rows carrying both.
What does actionable at scale mean on this matrix?
The column is true only where a state has a registry, a deletion right, and a centralized deletion portal. One row qualifies: California. The other 50 record centralized_deletion_portal = no, which means deletion requests run broker by broker.
How do data brokers get my LLC's information?
State business filings are public records and brokers ingest them in bulk — formation filings are a common route by which a founder's home address enters the broker ecosystem, per /data-brokers/data-broker-registry-by-state-explainer/. This matrix tracks the statutory mechanisms that apply after collection, not the collection itself, and deletion rights typically carve public-records data out of their reach.
How do I opt out of business data broker listings?
In the four registry states the public roll names the brokers to petition, monitor, or opt out of; California is the only one where a single submission reaches every registered broker. Elsewhere it runs through each broker's own process, and where no deletion right is enacted the only path recorded is a broker's voluntary opt-out channel. Registry-based mechanisms reach only brokers that have registered — brokers below a statute's thresholds or in violation of it are absent from the roll by definition.
How current is the registry side of this matrix?
Composed rows were verified 2026-07-02 from the data-broker-registry and right-to-delete matrices; the registry inputs were last checked 2026-06-10. States enact privacy statutes on rolling sessions, so the positive sets can grow after the verification date.
Why combine registry and deletion in one matrix?
Operators need both the directory of who must register and the tool to remove data — splitting across pages caused missed pairs in early research drafts.
If a state has deletion but no registry, how is it marked?
Rows distinguish registry presence from deletion mechanism with separate cells — a state can grant deletion without operating a public broker list.
Do these rights apply to business entity data?
Scope varies — some laws focus on consumer personal data; business-owner records republished from SoS filings may fall in gray zones noted per row.
How does this interact with four-layer framework layer 3?
Layer 3 is commercial reuse — this matrix is the primary statutory mitigation map for US state broker regimes in the cohort.
Are federal credit freezes covered here?
No — this is state broker law only. Financial 'priced' exposure is verb #7 at /exposure/exposure-verbs/.
Go deeper with source-backed research
Explore methodology, datasets, and related matrices cited on this page.