A company that sells or licenses data about people it has no direct relationship with can owe registration, disclosure, security and deletion duties in several US states at once, and the four state regimes define "data broker" differently enough that a business can be in scope in one and out of scope in the next. California runs the most demanding regime, with the Delete Act and its Delete Request and Opt-out Platform (DROP). Vermont pioneered registration in 2019 and has enacted a major rewrite that takes effect on 1 January 2027. Texas requires registration, a website notice and a written security programme, and broadened its definition in September 2025. Oregon requires registration before a broker collects, sells or licenses brokered data in the state. This map compares the four side by side: definitions and thresholds, registration and fees, disclosures, consumer deletion and opt-out duties, security programme requirements and penalties. It is written for privacy, security and data platform leads at data brokers, ad tech, people search, marketing data and analytics companies, and for counsel and auditors who review them. States are listed in the same order throughout; order is not a ranking.
Status line: checked on 14 November 2026 against CalPrivacy (cppa.ca.gov and privacy.ca.gov), the Vermont Statutes Online, the Texas Legislature's enrolled bill texts and bill analyses, and the Oregon Revised Statutes on oregonlegislature.gov. Vermont's amended sections and California's 30-day DROP cycle take effect on 1 January 2027, and regulators continue to issue rules, so confirm the current text before relying on any date or amount.
Key takeaways
- Every state turns on the missing direct relationship. California, Vermont and Texas all target personal data about people the business did not collect directly or has no direct relationship with; Oregon's definition covers any business entity that collects and sells or licenses brokered personal data.
- Only Texas has numeric thresholds. Chapter 509 applies where, in a 12-month period, more than 50% of revenue comes from such data or revenue comes from such data on more than 50,000 individuals.
- Fees and penalties differ by an order of magnitude. California charges $6,000 a year and fines $200 a day; Texas charges $300 and caps penalties at $10,000 in 12 months; Oregon caps at $10,000 a calendar year; Vermont moves from $100 to $900 plus a $20,000 bond in 2027.
- California alone runs a central deletion platform. Brokers must process DROP deletion lists at least every 45 days from 1 August 2026, tightening to at least every 30 days from 1 January 2027 under AB 883.
- Security programmes are statutory in Vermont and Texas. Both require a written comprehensive information security programme with named minimum controls such as access control, encryption in transit and on portable devices, and annual review.
Regulations and frameworks at a glance
| State | Law | Regulator | In force | Latest change noted |
|---|---|---|---|---|
| California | Delete Act (SB 362), Cal. Civ. Code 1798.99.80 onwards, with CalPrivacy regulations | California Privacy Protection Agency (CalPrivacy) | Registry moved to CalPrivacy; DROP open to consumers January 2026; broker processing from 1 August 2026 | AB 883: DROP processing at least every 30 days from 1 January 2027 |
| Vermont | 9 V.S.A. 2430 (definitions), 2446 (registration), 2447 (security programme) | Secretary of State (registry); Attorney General (enforcement) | Registration since 1 January 2019 (2017 Act No. 171) | 2025 Act No. 138: new definitions, fees, bond and disclosures effective 1 January 2027 |
| Texas | Business and Commerce Code Chapter 509 (SB 2105, 2023) | Secretary of State (registry); Attorney General (enforcement) | Act effective 1 September 2023; chapter applied from 1 December 2023 | SB 2121 (definition) and SB 1343 (consumer rights notice), both effective 1 September 2025 |
| Oregon | ORS 646A.593 (2023 c.395) | Department of Consumer and Business Services (DCBS) | Registration required before collecting, selling or licensing brokered data in Oregon | No later amendment shown in the ORS source note when checked |
For California's processing pipeline in depth, see the California Delete Act and Data Broker Registration Guide. For the comprehensive state privacy laws that sit alongside these broker laws, see the US State Privacy Laws Guide.
Definitions and thresholds: who is a data broker
| State | Core definition | Thresholds | Notable exclusions |
|---|---|---|---|
| California | A business that knowingly collects and sells to third parties the personal information of a consumer with whom it does not have a direct relationship (Civ. Code 1798.99.80(c)), relying on the CCPA definition of "business" in 1798.140(d) | None in the broker definition itself; the CCPA "business" definition carries its own tests | Entities and data regulated by other laws, as listed in the Civil Code; each legal entity registers separately |
| Vermont (to 31 December 2026) | A business, or unit of a business, that knowingly collects and sells or licenses brokered personal information of a consumer with whom it has no direct relationship (2430(4)(A)) | None | Third-party e-commerce or app platforms, 411 directory assistance, public business or professional information, real-time health or safety alerts, incidental sales, one-off asset transfers |
| Vermont (from 1 January 2027) | Same core test, with "direct relationship" defined as intentional interaction to access, buy, use or request information about the business's products or services; exercising a privacy right or verifying identity does not create one (2430(6)) | None | Only the one-off asset transfer exclusion remains; "brokered personal information" widens to any information linked or reasonably linkable to an individual, device or household, excluding publicly available information |
| Texas | Since SB 2121, a business entity that collects, processes or transfers personal data that it did not collect directly from the individual linked or linkable to the data; the "principal source of revenue" test was removed | Applies if, in a 12-month period, more than 50% of revenue comes directly from processing or transferring such data, or revenue comes directly from such data on more than 50,000 individuals | Deidentified data meeting safeguards, employee data, publicly available information, GLBA data; service providers, government, certain child-safety nonprofits, FCRA consumer reporting agencies, GLBA financial institutions |
| Oregon | A business entity, or part of one, that collects and sells or licenses brokered personal data to another person (646A.593(1)(c)) | None | Public business or professional information, health or safety alerts, lawful government records, publishing, e-commerce or software development, directory assistance, one-off asset sales; government bodies |
Worked scenario: a marketing analytics firm licenses audience segments built from purchased loyalty data to advertisers. It has no direct relationship with the people in the segments. In California it is a data broker and must register and process DROP. In Vermont, under the 2027 definition, the fact that some of those people later sent it an opt-out request does not create a direct relationship, so it stays in scope. In Texas, if segment licensing brings in revenue from more than 50,000 individuals' data, it is covered even though analytics, not data sales, is its main business, which is exactly the gap SB 2121 closed. In Oregon, because it licenses brokered personal data about Oregon residents, it must register before doing so.
Registration, fees and disclosures
| Item | California | Vermont | Texas | Oregon |
|---|---|---|---|---|
| When | Annually, 1 to 31 January, through a DROP account | By 31 January after a qualifying year; from 2027, within 30 days of qualifying, then annually by 1 July | Before doing business as a covered broker; certificate expires on the first anniversary and is renewed | Before collecting, selling or licensing brokered data in Oregon; valid to 31 December of the approval year |
| Fee | $6,000 plus a payment processing fee; a DROP access fee from 1 August 2026 | $100; from 2027, $900 plus a $20,000 bond and a $100 amendment fee | $300 registration and $300 renewal | Set by DCBS rule to cover programme costs |
| Core disclosures | Identity and contacts, plus expanded disclosures on sensitive data and sharing (see the Delete Act guide) | Opt-out methods and scope, non-opt-out activities, purchaser credentialing, prior-year breaches, minors' data; from 2027, sensitive data categories, sharing with foreign actors, government, law enforcement or generative AI developers, deletion page URL, FCRA status, bond and privacy policy | Identity and contacts, data categories processed and transferred, purchaser credentialing, prior-year breaches, known child data practices; since SB 1343, a link to instructions for exercising Texas privacy rights | Identity and contacts, plus a declaration on whether residents can opt out, what it covers, how to use it and whether an authorised person may act |
| Public registry | CalPrivacy data broker registry | Secretary of State publishes registrations; from 2027, a downloadable spreadsheet and consumer rights page | Secretary of State searchable online registry | DCBS publishes registration information |
The disclosure that most often needs security input is the prior-year breach count, required in Vermont and Texas. It must reconcile with the breach notifications the business actually made, so the incident register and the registration filing should come from the same source.
Consumer deletion, opt-out and notice duties
- California, mandatory central deletion: consumers submit one request through DROP; brokers download their lists at least every 45 days from 1 August 2026 (30 days from 1 January 2027), match, delete or opt out, and report a status for each request. Brokers pay $200 a day per deletion request not honoured.
- Vermont, disclosure now, deletion page from 2027: today a broker discloses whether it offers an opt-out and how; from 2027 the registration must include a URL for a deletion request page and opt-out details, including authorised agent rules.
- Texas, notice plus privacy rights: a broker with a website or app must post a conspicuous notice that it is a data broker, in Secretary of State language, accessible to people with disabilities, and since SB 1343 explaining how consumers can exercise rights under Chapter 541, the Texas Data Privacy and Security Act. See the Texas Data Privacy and Security Act.
- Oregon, opt-out declaration: the broker declares whether residents can opt out, which activities and data it covers and how to exercise it.
Operationally, the strictest common design is a single suppression service: every deletion or opt-out from DROP, a state rights request or an authorised agent is written once, keyed on hashed identifiers, and checked at ingestion, at segment build and at backup restore. The DSAR Guide: Handling Data Subject Requests covers verification and response workflows for direct requests.
Security programme requirements
Two of the four states write security controls into the broker law itself. California relies on its audit and registration regime, and Oregon on registration and disclosure.
| Control | Vermont 9 V.S.A. 2447 | Texas 509.007 | Practical evidence |
|---|---|---|---|
| Programme ownership | Designate one or more employees to maintain the programme | Designated programme employee | Named owner in the policy, board or management minutes |
| Risk assessment and review | Assess foreseeable risks; review at least annually and on material business change | Annual and change-triggered reviews | Dated risk assessment and review record |
| Access control | Unique IDs, non-default passwords, need-to-know access, lockout after repeated failures, block terminated staff | Specified access controls | Access review results covering staff, contractors and service accounts |
| Encryption | Encrypt personal data over public or wireless networks and on laptops and portable devices | Specified encryption requirements | TLS configuration, endpoint encryption reports |
| Monitoring and patching | Reasonable monitoring for unauthorised access; current firewalls, patches and malware protection | Within the comprehensive programme | SIEM alerts on bulk export, patch compliance reports |
| Vendors | Select capable service providers and require security by contract | Vendor oversight | Contract clauses and vendor assessments |
| Incidents | Document breach responses and hold a mandatory post-incident review | Incident documentation | Incident records that reconcile with the registration breach count |
In Texas a breach of the security programme requirement is a deceptive trade practice under Chapter 17. In Vermont, from 2027, violations of the broker provisions are unfair and deceptive acts under 9 V.S.A. 2453.
Where identity and non-human identities fit
A broker's data leaves through machine channels: bulk export jobs, partner API keys, SFTP accounts and cloud storage credentials used by buyers. The access control duties in Vermont 2447 and Texas 509.007 apply to these accounts as much as to staff.
- Purchaser credentialing: Vermont and Texas both ask whether the broker credentials purchasers. Issue each buyer its own scoped API key or federated identity, never a shared account, so access can be revoked per customer.
- Service account review: include integration and export accounts in access reviews and remove those tied to ended contracts, mirroring the requirement to block terminated employees.
- Deletion job identity: the account that downloads DROP lists and performs deletions should be separate, least privileged and logged, because California's audits from 1 January 2028 will look for evidence that deletions happened.
See Audit Readiness for AI Agents and NHIs for building evidence on machine account controls.
Penalties and enforcement
| State | Failure to register | Other penalties | Enforcer |
|---|---|---|---|
| California | $200 a day, plus investigation and administrative costs | $200 a day per deletion request not honoured | CalPrivacy |
| Vermont (to 31 December 2026) | $50 a day, capped at $10,000 a year, plus unpaid fees | Other penalties imposed by law | Attorney General in Superior Court |
| Vermont (from 1 January 2027) | $200 a day, plus fees and reasonable investigation costs; no annual cap stated | $1,000 a day for omitted information not amended within 30 days; $25,000 for materially incorrect information, plus $1,000 a day if not corrected within 30 days | Attorney General, under the consumer protection chapter |
| Texas | At least $100 a day plus unpaid fees, capped at $10,000 against the same broker in any 12-month period | Security programme failures actionable as deceptive trade practices | Attorney General, with attorney's fees and costs |
| Oregon | Up to $500 per violation, or $500 a day for a continuing violation | Total penalties capped at $10,000 in any calendar year | DCBS |
Decision guidance: one multi-state broker programme
- Run the scope test per legal entity and per state each December. Record data sources, whether each person has a direct relationship (using Vermont's 2027 definition as the strictest wording), and Texas revenue and volume figures for the trailing 12 months.
- Diarise every window. California registers in January, Vermont moves to 1 July from 2027, Texas renews on the certificate anniversary, and Oregon registrations end on 31 December.
- Build disclosures from systems of record. Breach counts, minors' data statements, sensitive data categories and sharing with government or generative AI developers should come from the data inventory and incident register, not from memory.
- Adopt the strictest deletion clock. Design the suppression service for California's 30-day cycle from 2027 and apply it to every state's requests.
- Implement one security programme to the Vermont and Texas lists. Their minimum controls overlap almost entirely; map both to ISO/IEC 27001 or NIST controls you already run.
- Test before filing. Have a second person reconcile each filing against evidence, keep the submitted copy, and correct errors inside Vermont's 30-day amendment window to avoid daily penalties.
Small versus large organisations: a small people search site may face similar fixed duties to a large broker in California and Oregon, where there is no size threshold, but may fall outside Texas if below both tests. A large group should register each qualifying entity separately and run one shared compliance calendar.
Common failure patterns
- Relying on the old Texas revenue test: businesses that decided they were out of scope because data sales were not their principal revenue source need to reassess under SB 2121.
- Assuming an opt-out request creates a relationship: Vermont's 2027 definition says exercising a right or verifying identity does not.
- Registering the parent only: California requires each qualifying legal entity to register; check entity structure in every state.
- Deleting the live copy but not the backup or the next refresh: without a suppression check at ingestion and restore, deleted people reappear in the next data load.
- Breach counts that do not match notifications: Vermont and Texas filings ask for prior-year breaches; inconsistent numbers invite scrutiny and, in Vermont from 2027, the $25,000 incorrect information penalty.
- Shared buyer credentials: one API key or SFTP login shared by several customers makes purchaser credentialing claims hard to support and revocation impossible.
Practitioner checklist
- Record the scope decision per legal entity for California, Vermont (current and 2027 definitions), Texas and Oregon.
- Calculate Texas revenue share and individual counts for the trailing 12 months.
- Put all registration and renewal dates, including Vermont's 2027 change to 1 July, in one calendar.
- Budget for California's $6,000 fee and DROP access fee and Vermont's $900 fee and $20,000 bond from 2027.
- Publish the Texas data broker notice with Chapter 541 rights instructions and link it in the registration.
- Run DROP processing at least every 45 days now and build for 30 days from 1 January 2027.
- Implement a written security programme meeting Vermont 2447 and Texas 509.007 minimum controls.
- Issue each purchaser its own credential and include machine accounts in access reviews.
- Reconcile breach counts in filings with the incident register before submission.
Standards and references
- California Privacy Protection Agency: Data Brokers
- CalPrivacy: Data Brokers and DROP
- Vermont Statutes: 9 V.S.A. 2430 Definitions
- Vermont Statutes: 9 V.S.A. 2446 Data broker annual registration
- Vermont Statutes: 9 V.S.A. 2447 Data broker duty to protect information
- Texas Legislature: SB 2105 bill analysis (Chapter 509)
- Texas Legislature: SB 2121 enrolled text
- Oregon Legislature: ORS Chapter 646A (646A.593 Data brokers)
Related NHI Mgmt Group resources: California Delete Act and Data Broker Registration Guide · US State Privacy Laws Guide · Texas Data Privacy and Security Act · Deleting Your Data From Brokers Guide · US State Privacy and Security Laws Quick Reference. This guide summarises data broker laws in California, Vermont, Texas and Oregon and is not legal advice.