Data Broker Registry by State — Explainer

Matrix explainer. Coverage: mandatory data broker registration + deletion mechanism availability. Source matrices: data-broker-registry-by-state + data-broker-registry-and-deletion-mechanisms-by-state. 50 states. Not legal advice.

Short answer

Four states require data brokers to register with the state: California, Vermont, Texas, and Oregon. All four publish the resulting registry publicly, which makes the broker population enumerable — you can see who is in the business of trading personal data. The other 47 states have no registration requirement, so no official list of brokers exists there.

Registration is the visibility half of the problem. The action half — making brokers delete what they hold — comes from consumer privacy statutes, which 21 states have enacted. The two rarely combine: only California pairs a public broker registry with a centralized deletion mechanism, and it is the only state the matrices grade as actionable at scale. Everywhere else, a consumer with a deletion right exercises it broker by broker.

The four registry states

• California — the Delete Act (SB 362; Cal. Civ. Code §§ 1798.99.80–1798.99.89) moved the registry to the California Privacy Protection Agency; the Delete Act became operative 2024-01-01, with an annual registration deadline of January 31. California is also the one state with a centralized deletion platform tied to the registry.
• Vermont — the original registry state: 9 V.S.A. §§ 2446–2447 (Act 171 of 2018), annual registration with the Secretary of State due each January 31. Registry is public; Vermont has not enacted a general consumer deletion right.
• Texas — Bus. & Com. Code ch. 510 (SB 2105, 2023), registration with the Secretary of State (first registration deadline 2024-03-01), public registry published. Texas also carries a consumer deletion right under its separate privacy statute.
• Oregon — ORS 646A.593 (HB 2052, 2023), registration with the Division of Financial Regulation effective 2024-01-01, public registry published. Oregon likewise has a separate consumer deletion right.

Registry ≠ deletion right

The composed matrix tracks the two mechanisms separately, and the separation is the finding. A registry statute obliges brokers to disclose their existence, pay a fee, and appear on a public list. It does not require them to honor deletion requests. A deletion right obliges covered businesses to delete personal data on request — but in a state with no registry, the consumer has no official enumeration of whom to ask.

As of the composed matrix's verification (2026-07-02): 4 states have an enacted registry; 21 states have an enacted consumer deletion right (Arkansas, California, Colorado, Connecticut, Delaware, Florida, Iowa, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia); exactly 1 state — California — has a centralized deletion portal and an at-scale actionable combination of the two.

That asymmetry is why “is my state on the list?” is the wrong first question. The practical question is: can I reach the brokers holding my data with one action? In California, increasingly yes. In the other 20 deletion-right states, the right is real but the process is broker-by-broker, using each state's attorney-general or agency process. In the 30 remaining states, neither mechanism exists, and removal happens only through brokers' voluntary opt-out channels.

What this means for LLC owners

Business formation is a common route by which a home address enters the broker ecosystem: registry filings are public records, and brokers ingest them in bulk. A broker registry does not stop that ingestion — public records are typically carved out of what deletion rights can reach, a boundary covered in Right to Delete Business Filing Data by State — Explainer. What the registry adds is a target list: the brokers you would petition, monitor, or opt out of are named on an official roll in the four registry states. The step-by-step consumer process is in Get Your Business Data Deleted, State by State.

What the matrices do not prove

• Registration does not imply compliance. The matrices track enacted statutes and published registries, not whether every broker that should register actually does, or what enforcement follows when they don't.
• Registry completeness is not verified. A public registry lists registrants; brokers operating outside the statute's thresholds or in violation of it are absent by definition.
• Deletion rights carry statutory exceptions. The composed matrix records whether a deletion right is enacted, not the exception set (fraud prevention, legal obligation, public records) that limits it in practice.
• Effective dates are as of last verification. Registry rows were last checked 2026-06-10 and the composed mechanism rows 2026-07-02; states enact privacy statutes on rolling sessions, and the positive sets can grow.
• The matrices do not cover public-records carve-outs. Whether a deletion right reaches data sourced from state business filings is a separate question with a generally negative answer — see the right-to-delete explainer.

See also: Data Broker Registry by State (matrix) · Data Broker Registry and Deletion Mechanisms by State (matrix) · Right to Delete Business Filing Data by State — Explainer · Get Your Business Data Deleted, State by State