Data Broker Registry by State — Explainer

Matrix explainer. Coverage: registry existence + deletion mechanism availability. Source matrices: data-broker-registry-by-state + data-broker-registry-and-deletion-mechanisms-by-state. 50 states. Not legal advice.

Short answer

Four states — California, Vermont, Texas, and Oregon — require data brokers to register with a state agency and publish a public list of registered brokers. Every other state has no mandatory registration law as of the matrix verification date. A registry entry tells you which brokers operate in a state; it does not automatically give you a right to delete your data from those brokers. Only California combines a mandatory registry with an actionable centralized deletion mechanism. Texas and Oregon have both a registry and a separate deletion right, but no centralized opt-out portal linking the two.

States with mandatory data broker registration

The four enacted registries, in order of enactment:

• Vermont — 9 V.S.A. §§ 2446–2447 (Act 171 of 2018), the first state data broker registration law in the United States. Annual registration with the Vermont Secretary of State Business Services Division; public registry searchable at bizfilings.vermont.gov/databrokersearch/Search. Vermont has no companion deletion-right statute.
• California — Cal. Civ. Code §§ 1798.99.80–1798.99.89 (Delete Act, SB 362, signed October 2023; first registration deadline January 31, 2024). Annual registration with the California Privacy Protection Agency (CPPA); public registry at cppa.ca.gov/data_broker_registry/. California also has a deletion right under Cal. Civ. Code § 1798.105 (CCPA/CPRA); the CPPA is developing a centralized deletion mechanism under the Delete Act.
• Oregon — ORS § 646A.593 (HB 2052, 2023 Oregon Laws Ch. 395; effective January 1, 2024). Registration with the Oregon Division of Financial Regulation (DFR) required before collecting, selling, or licensing brokered personal data within Oregon; public registry at dfr.oregon.gov/business/licensing/data-broker-registry/pages/index.aspx. Oregon also enacted a deletion right under ORS § 646A.574 (Oregon Consumer Privacy Act), but no centralized portal connects the registry to deletion requests.
• Texas — Tex. Bus. & Com. Code Ch. 510 (SB 2105, 2023; effective March 1, 2024). Registration with the Texas Secretary of State; public registry at texas-sos.appianportalsgov.com/data-broker-registry. Texas also has a deletion right under Tex. Bus. & Com. Code § 541.051 (Texas Data Privacy and Security Act), but no centralized opt-out portal.

All other 46 states (plus DC) have no mandatory data broker registration statute as of the matrix verification date. Some states — including Colorado, Connecticut, and Delaware — have enacted comprehensive privacy laws that grant individual deletion rights without requiring brokers to register with a public agency.

What deletion mechanisms exist and where

The composition matrix (data-broker-registry-and-deletion-mechanisms-by-state) tracks two overlapping signals: whether a state has a broker registry and whether it has enacted a consumer deletion right. Twenty-one states have enacted a deletion right; four have a mandatory broker registry; only California has both and marks actionable_at_scale: yes.

A deletion right without a registry creates an asymmetry: the consumer may have a legal right to request deletion but no official list of which brokers hold their data. A registry without a deletion right (Vermont) creates the inverse: you can see who is operating, but the statute provides no deletion lever. Only in California does the combination approach practical scale — the Delete Act directs the CPPA to build a single centralized mechanism so consumers can submit one request rather than individual requests to each registered broker.

CA vs. other states: why the gap is structural

California's advantage is not merely that it has both a registry and a deletion right — it is that the Delete Act (Cal. Civ. Code §§ 1798.99.80–89) mandates a single accessible deletion mechanism operated by the CPPA, and it requires every registered broker to honor requests processed through that mechanism. Texas and Oregon each enacted a registry and a separate deletion statute, but the two instruments are not linked by a common portal obligation. In Texas, a consumer must identify the brokers they want to reach via the SoS registry and submit individual deletion requests under the Texas Data Privacy and Security Act. In Oregon, the same fragmentation applies.

Vermont sits in a third category: the registry is the oldest in the country and publicly searchable, but Vermont has not enacted a companion privacy law granting deletion rights. The Vermont registry documents who is operating; it creates no obligation on those operators to honor deletion requests.

The structural gap is this: registry + deletion right + centralized portal = actionable at scale. Registry only (VT) or deletion right only (CO, CT, DE, and others) are less powerful in practice because the consumer must supply additional friction — finding brokers, identifying which hold their data, and submitting individual requests — without the tooling to do so at scale.

What the matrix does not prove

• Registry existence ≠ deletion right. A state appearing in the registry column does not mean consumers have a statutory right to delete their data from those brokers. Vermont is the clearest example.
• Deletion right ≠ enforcement outcome. The matrix tracks whether a deletion right has been enacted, not whether enforcement actions have occurred or how brokers respond to requests in practice.
• Registry enrollment is not exhaustive. Unregistered brokers operating in a state with a registry law are out-of-compliance, not absent from the market. The registry reflects who has filed, not who is operating.
• No coverage for data broker sub-types outside the statutory scope. Each state's statute defines "data broker" differently. Some exclude first-party businesses, financial institutions covered by GLBA, or HIPAA-covered entities. The matrix tracks whether a registration requirement exists, not whether any specific entity is covered.
• The matrix does not prove what CA's centralized deletion mechanism will do at operational scale. The CPPA portal is required by statute, but operational effectiveness depends on broker compliance rates and enforcement posture — both outside the matrix's scope.

See also: Data Broker Registry and Deletion Mechanisms by State (composition matrix) · Right to Delete by State — Explainer