The four state laws
| State | Who's a data broker | Notes |
|---|---|---|
| California | Knowingly collects and sells personal info of consumers with no direct relationship (§1798.99.80) | $6,000 fee for 2026 (CPPA); SB 361 adds disclosure of sales to AI developers (Hunton) |
| Vermont | Collects and sells or licenses brokered personal info of consumers with no direct relationship (9 V.S.A. §2430) | Customers, employees, investors count as direct relationships; amendments take effect Jan 1, 2027 (Hunton) |
| Texas | Collects, processes or transfers personal data it didn't collect directly, above revenue or volume thresholds (WilmerHale) | Amended effective Sept 1, 2025 |
| Oregon | Collects and sells or licenses brokered personal data (ORS 646A.593) | Excludes data about your own customers, employees and counterparties |
Where an operating company stands
If your dataset covers your own customers, employees and contractors, the "direct relationship" exclusions generally apply. The gray area is personal information about third parties you didn't collect directly, such as your clients' customers inside support tickets. Removing or de-identifying that data avoids the question.
A note on the word "broker"
Because "data broker" is a regulated term in several states, be careful about using it to describe your own business. A company that refers businesses to data buyers, without collecting or selling personal information itself, is better described as a licensing or referral partner.
Frequently asked questions
Is a company that licenses its own data a data broker?
Generally not under California, Vermont and Oregon 'direct relationship' tests when the data is about its own customers and employees. Third-party personal data inside the files can raise questions.
Which states have data broker registration laws?
California, Vermont, Texas and Oregon.