Are data brokers legal? A state-by-state map
The short answer
Yes, data brokers are legal. Six states now regulate them. California, Vermont, Oregon and Texas run registries, and Connecticut and New Jersey enacted laws in 2026. California fined Datamasters $45,000 and S&P Global $62,600 for registration failures. Some sales are barred, such as bulk data to countries of concern.
Each of the six state laws is a registration law with its own definition, deadline and penalty. The California fines below all cite failures to register.
Legally, a "data broker" resells consumer data and must register in some states. This site calls AI data companies buyers. It keeps "data broker" for that legal term.
Which states regulate data brokers?
California, Vermont, Oregon and Texas run registries today. Two more states have signed laws:
- Connecticut signed in May 2026. Brokers must register with the Department of Consumer Protection by 1 January 2027.
- New Jersey signed in June 2026. It plans to open its registry in spring 2027.
The states define a broker in different ways. Most focus on a business that sells data about people it has no direct tie to. Vermont and Texas have their own pages.
What have regulators done about data brokers?
California's privacy agency announced a Data Broker Enforcement Strike Force on 19 November 2025. Its 8 January 2026 actions hit two firms for failing to register as brokers.
Its 11 August 2026 action against LocateSmarter came next. It was the first against a broker under both the CCPA and the Delete Act.
In June 2024, Texas told more than 100 companies they had apparently failed to register. It sued Allstate and Arity in January 2025. The complaint includes a failure-to-register allegation. I haven't confirmed how that case ended.
Is selling any kind of data barred?
Yes, in narrow cases. The Justice Department's rule at 28 CFR 202.301 bars a US person from knowingly engaging in data brokerage with a country of concern or a covered person.
HIPAA bars selling protected health information without authorization. The bulk data page and the health and financial data page cover each.
Does a company licensing its own data count?
The state definitions mostly turn on direct relationships. On the text, a company licensing only its own staff and customer data may sit outside those definitions. Mixed archives are less clear. No authority decides it. The register or not page goes through the tests.
Talk to a privacy or commercial lawyer in your state before you sign.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
