What Is a Data Broker?
Plain-language definition. Grounded in the Data Broker Registry by State and Registry and Deletion Mechanisms matrices and their explainer. Not legal advice.
Short answer
A data broker is a business whose trade is other people's personal information — collecting it, organizing it, and selling or licensing it to third parties. There is no single federal definition; the term is defined statute by statute in the states that regulate the practice. The registration statutes converge on a similar shape — a business that knowingly collects and sells personal information about consumers with whom it has no direct relationship. California codifies that definition at Cal. Civ. Code §1798.99.80(c) (“collects and sells to third parties”); Vermont's equivalent is 9 V.S.A. §2430(4) — but each statute defines the term itself, and the edges differ.
The “no direct relationship” element is what separates a broker from an ordinary business that holds customer data: a broker's subjects are generally not its customers, so most people never learn which brokers hold records about them.
How the registration statutes define the term
- California — the Delete Act (SB 362; Cal. Civ. Code §§1798.99.80–1798.99.89) defines a data broker as a business that knowingly collects and sells the personal information of California consumers with whom it has no direct relationship, and requires annual registration with the California Privacy Protection Agency (Delete Act operative 2024-01-01; annual registration deadline January 31).
- Vermont — the first state registry law (Act 171 of 2018; 9 V.S.A. §§2446–2447) reaches any business that knowingly collects and sells brokered personal information of consumers (9 V.S.A. §2430(4)), with annual registration filed with the Secretary of State (annual registration deadline January 31).
- Texas — Bus. & Com. Code ch. 510 (SB 2105, 2023) applies to data brokers as defined at §510.001(4), registering with the Secretary of State (registration deadline 2024-03-01) with a public registry required by §510.006.
- Oregon — ORS 646A.593 (HB 2052, 2023) requires data brokers (subject to the statute's carve-outs) to register with the Division of Financial Regulation before collecting, selling, or licensing brokered personal data within Oregon (effective 2024-01-01).
In the other 47 jurisdictions there is no registration requirement — and therefore no official enumeration of who is in the brokerage business at all.
Registries make brokers enumerable — nothing more
What a registry statute buys the public is a list: brokers must disclose their existence, pay a fee, and appear on an official roll. That makes the broker population visible and gives a consumer a target list for opt-outs or deletion requests. It does not oblige any broker to honor those requests. The action half comes from consumer privacy statutes — enacted in 21 states as of the composed matrix's verification — and the two mechanisms rarely combine: only California pairs a public registry with a centralized deletion platform, making it the one state the matrices grade as actionable at scale. The full split is in the registry explainer.
Where business filings fit in
Business formation is a common route by which a founder's home address enters the broker ecosystem: state registry filings are public records, and brokers ingest them in bulk. Deletion rights typically carve public-records data out of their reach — covered in Right to Delete Business Filing Data by State — so what appears on a formation document matters more than any after-the-fact broker remedy. What each state publishes is tracked in Public Filing Fields by State; the consumer removal process, state by state, is in Get Your Business Data Deleted, State by State.
Not legal advice
Statutory definitions, thresholds, and effective dates are per the matrices' cited sources as of their last verification. Confirm against the enacting statute before relying on a definition.
See also: Data Broker Registry (matrix) · Data Broker Registry — Explainer · What Makes a Business Filing a Public Record?
Frequently asked questions
Is there one legal definition of a data broker?
No. The term is defined statute by statute, in the four states that require registration, and the definitions differ at the edges. California's: a business that knowingly collects and sells to third parties the personal information of a consumer with whom it has no direct relationship (Cal. Civ. Code §1798.99.80(c)); Vermont's analog is at 9 V.S.A. §2430(4).
Which states require data brokers to register?
Four, as of the matrices' last verification: California (Delete Act, SB 362), Vermont (9 V.S.A. §§2446–2447), Texas (Bus. & Com. Code ch. 510), and Oregon (ORS 646A.593). All four publish the resulting registry publicly.
Does a registry mean I can make brokers delete my data?
No. A registry statute makes brokers disclose their existence to the state; deletion rights come from separate consumer privacy statutes, enacted in 21 states. Only California pairs a registry with a centralized, at-scale deletion mechanism.
How do data brokers get business-filing data in the first place?
State business registries are public records, and brokers ingest them in bulk. Deletion rights typically carve out data sourced from public records, which is why formation-filing exposure is addressed at the filing layer, not the broker layer.
Go deeper with source-backed research
Explore methodology, datasets, and related matrices cited on this page.