Do I need to register as a data broker to license my data?
The short answer
On plain text, Vermont and Oregon treat staff and customers as direct relationships, so you may not be a broker. Texas and California leave more room for mixed archives. No regulator guidance or ruling settles the question. Ask counsel in your state.
Every state data broker law starts from the same idea. A broker sells or licenses personal data about people it has no direct relationship with. The states differ on who counts as a direct relationship.
Legally, a "data broker" resells consumer data and must register in some states. This site calls AI data companies buyers. It keeps "data broker" for that legal term.
What do Vermont and Oregon say about staff and customers?
Vermont defines a data broker in two steps. The business knowingly collects and sells or licenses brokered personal information to third parties. The consumer must be someone it has no direct relationship with. Vermont's list of direct relationships includes these:
- a past or present customer, client, subscriber or user
- a past or present employee, contractor or agent
Oregon excludes a business that collects information about a resident who is or was a customer, subscriber, user, employee, agent, contractor, investor or donor. Its registration section has a second rule. A broker can skip registering in one case. The sale involves only business assets, sold "a single time, or only occasionally," as part of a transfer of control.
What do Texas and California add?
Texas drops the relationship wording. Its definition covers a business that collects, processes or transfers personal data. The business must not have collected it directly from the individual. The chapter applies in two cases:
- the business gets more than half its revenue from that activity in 12 months
- the business gets any revenue from the data of more than 50,000 individuals
Someone named in an email thread never handed the company that data directly. How the wording meets an archive license is my reading of the text. No source settles it.
California defines a broker as a business that knowingly collects and sells personal information. The consumers must be ones it has no direct relationship with. The text has no test for how often a sale happens.
What about New Jersey?
New Jersey signed its broker law in June 2026. It defines a data collector as an entity that collects personal data from consumers it has a direct relationship with. The collector then sells or licenses it to a data broker. So it matters there whether your buyer counts as a data broker. The state plans to open its registry in spring 2027.
Does a finder who never touches the data register?
A finder neither receives nor discloses personal data. On the plain text, that does not fit the verbs in the definitions. I found no guidance on finders either. That is why we never take samples, credentials or data-room access.
What should I gather first?
Note where each person in your archive came from. Also note whether any lists were bought, imported or enriched. The rights check and the risks page cover that inventory. The Texas and Vermont pages give each state's details.
Talk to a privacy or commercial lawyer in your state before you sign.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
