Your Privacy Rights
States That Make Data Brokers Register (2026)
The short version
Four states - Vermont, California, Texas and Oregon - require data brokers to register with the state and publish the results. Anyone, anywhere, can read those lists for free. They are the closest thing that exists to a directory of companies that sell information about people who never gave it to them. Registration is a filing, not a seal of approval, and only California turns its registry into a one-click deletion tool. Connecticut becomes the fifth registry state on January 1, 2027.
Which states make data brokers register
As of August 2026, four states run a public data broker registry: Vermont, California, Texas and Oregon. Each requires companies that sell personal information about people they have no direct relationship with to file with a state agency every year and pay a fee. Connecticut joins them on January 1, 2027.
That is the whole list. There is no federal registry, and in the other 45 states a data broker can buy and sell your address history without ever telling a government agency it exists. The four registries matter anyway, because the brokers that file in them are national businesses - the same companies selling data about you are usually on Vermont's list and California's.
Why a public registry is useful to you
A registry turns an invisible industry into a list of names you can search. Without one, finding the companies that profile you means guessing at brand names. With one, you get legal names, contact details, and in some states a written description of how to opt out - which is exactly the information a removal request needs.
It also gives you leverage. If a company that clearly sells brokered data is missing from a registry it should be on, that is a reportable fact, not just a suspicion. California has already fined brokers for exactly that.
Vermont: the first state, and the smallest fee
Vermont started all of this. Act 171 of 2018 made it the first state to require data broker registration, and its rules still shape the others: brokers register with the Secretary of State by January 31 each year and pay a $100 fee. Failure to register costs $50 per day, capped at $10,000 a year.
Vermont's registration form asks the questions consumers care about. Brokers must say whether people can opt out and, if so, the methods and scope of that opt-out; whether the broker screens who buys the data; how many known unauthorized accesses to brokered personal information it had in the prior year; and what it does with minors' data. You can search the filings at bizfilings.vermont.gov.
Vermont is also about to get sharper. Amendments enacted in 2026 raise the annual fee to $900, require a $20,000 surety bond, and oblige brokers to process consumer deletion requests within 30 days, with the substantive provisions taking effect January 1, 2027. Notably, Vermont did not build a central deletion platform - consumers still file with each broker directly, though the Secretary of State must study whether a single mechanism is feasible.
California: the biggest registry, wired to a delete button
California's registry is the one that does the most for you, because it is plumbed into a deletion platform. Under the Delete Act (SB 362, signed October 2023), brokers register with CalPrivacy - the California Privacy Protection Agency - by January 31 each year, and the annual fee is $6,600, set high specifically to fund the state's deletion system.
Registered brokers grew from 459 in June 2025 to more than 575 by February 2026. Every one of them is reachable through DROP, the free state-run Delete Request and Opt-out Platform: California residents submit one request, and from August 1, 2026 registered brokers are legally required to retrieve and process it, checking at least every 45 days. Our California DROP guide walks through the sign-up.
Enforcement here has teeth. CalPrivacy charges $200 per day for failing to register, and in July 2025 a Washington-based broker, Accurate Append, paid $55,400 for missing the deadline. In December 2025 CalPrivacy announced a $56,600 penalty against ROR Partners over registration failures.
Texas: a searchable registry, no regulator behind it
Texas requires registration under Chapter 510 of the Business and Commerce Code, enacted in 2023. A broker files a registration statement with the Secretary of State with a $300 fee, and the certificate lasts one year with a $300 renewal. Violating the registration or notice requirement carries a civil penalty of up to $10,000 in a 12-month period.
The public Data Broker Registry Search shows a broker's legal name, contact information, the categories of data it processes, its purchaser credentialing practices, and security breach information. Texas also requires registered brokers to post a conspicuous notice on their website or app.
Read the Secretary of State's own caveat before you get your hopes up: it does not have authority to regulate a data broker's business practices, investigate alleged violations, or enforce the requirements. It keeps the list. Complaints go elsewhere - see where to file a privacy complaint.
Oregon: the registry that has to explain opt-outs
Oregon's registry, created by House Bill 2052 and mandatory since January 1, 2024, is run by the Division of Financial Regulation inside the Department of Consumer and Business Services. Registration and annual renewal each cost $600, registrations expire every December 31, and a lapsed broker can reinstate until March 1 for the $600 fee plus a $50 late fee.
Oregon's most consumer-friendly detail is a paperwork requirement: an applicant must supply a succinct narrative describing how a consumer may opt out of its data collecting, licensing and selling activities. That narrative is a written admission, filed with the state, of the removal path a broker offers - useful ammunition when a broker's website makes opting out hard to find.
What registration costs, state by state
The fees say a lot about what each state is trying to do. Vermont and Texas charge enough to maintain a list. Oregon charges enough to run a licensing desk. California charges 66 times Vermont's fee because its registry has to pay for a statewide deletion platform, not just a database.
| State | Law | Registry run by | Annual fee | Deadline |
|---|---|---|---|---|
| Vermont | Act 171 (2018) | Secretary of State | $100 | January 31 |
| Texas | Bus. & Com. Code ch. 510 (2023) | Secretary of State | $300 | Before doing business; renews yearly |
| Oregon | HB 2052 (2023) | Division of Financial Regulation | $600 | Expires December 31 |
| California | Delete Act, SB 362 (2023) | CalPrivacy (CPPA) | $6,600 | January 31 |
Sources: Texas Secretary of State data broker pages; Oregon DFR data broker registry FAQs; Vermont fee and deadline per Zwillgen's summary of the Vermont regulations; California fee per IAPP reporting on the CalPrivacy board vote.
None of these fees is large enough to deter a real data broker. A $6,600 annual cost is rounding error against the revenue from selling millions of profiles. The fees are administrative, not punitive.
Connecticut is next, and it is copying California
Connecticut becomes the fifth registry state under Public Act 26-64, signed May 27, 2026. From January 1, 2027, brokers must register with the Department of Consumer Protection, which will publish what they file. Penalties run up to $200 per day, per consumer, per violation.
The more interesting part is what comes after. Connecticut's Department of Consumer Protection must build a universal deletion mechanism by July 1, 2028, with brokers required to check it and process requests from that October. That is the California model - registry first, one-click deletion second - being copied by a second state, which is the clearest signal yet of where these laws are heading.
How to actually use a registry to get removed
Treat the registry as a target list, not a solution. Open Vermont's or Texas's search, look for the brands you recognise from searching your own name, and pull the contact details and opt-out narrative each broker filed. Then work the opt-outs one by one, exactly as you would from a search result.
Three practical notes. Start with the brokers whose listings rank for your name, because those cause the actual harm. Use the registered legal name when a removal form asks who you are contacting, since brands and filing entities often differ. And expect to repeat this: listings commonly reappear within three to six months as brokers re-ingest public records. Our guide to removing yourself from data brokers covers the per-site mechanics, and we publish dated step-by-step opt-out guides for the major brokers.
What a registry does not do
Registration does not mean a state has vetted, licensed or approved anyone. It does not delete anything - outside California's DROP, being on a list creates no obligation to remove you. And it does not cover every company holding your data, because businesses you have a direct relationship with generally fall outside the definition.
The most important gap: an unregistered broker is invisible in exactly the way registration was meant to prevent. Enforcement is catching some of them, but a registry can only show you the companies that filed.
If you do not live in a registry state
You still get most of the value. The lists are public and free to read from anywhere, and the brokers on them sell data nationally, so a Vermont or Texas filing tells an Ohio resident who to opt out from too. What does not travel is the enforcement: DROP is for California residents only.
If you are outside California, your route is the standard one - opt out site by site, and use whatever deletion rights your own state gives you. We wrote what to do if you are not in California and your data deletion rights by state for exactly that situation.
Find out who lists you first
Run a free exposure scan to see which data brokers likely list you, plus any breaches tied to your email - no account, nothing stored.
Frequently asked questions
Which states require data brokers to register?
Four states have live data broker registries in 2026: Vermont, California, Texas and Oregon. Connecticut becomes the fifth, with registration required from January 1, 2027 under Public Act 26-64. Every other state has no registry at all.
Can I use a state data broker registry if I do not live in that state?
You can read any of the four registries from anywhere, and that is genuinely useful because most listed brokers operate nationally. What you cannot do is use a state's enforcement rights from outside it - California's DROP deletion platform, for example, is for California residents only.
Does registering mean a data broker is approved by the state?
No. Registration is a filing, not a licence or an endorsement. The Texas Secretary of State says plainly that it does not have authority to regulate a data broker's business practices, investigate alleged violations, or enforce the requirements beyond maintaining the registry.
What does a data broker registry actually tell me?
Names and contact details of companies that sell data about people they have no relationship with, plus, depending on the state, how to opt out, what categories of data they process, whether they screen purchasers, and how many unauthorized-access incidents they had last year.
How much does it cost a data broker to register?
It ranges widely: $100 a year in Vermont, $300 in Texas, $600 in Oregon and $6,600 in California. California's fee is high by design because it funds the state's DROP deletion platform.
What happens to a data broker that does not register?
Penalties are real but modest. Vermont charges $50 per day up to $10,000 a year, Texas allows civil penalties up to $10,000 in a 12-month period, and California charges $200 per day. California has collected five-figure settlements from unregistered brokers.
Do the registries list every data broker that has my data?
No. Registries only cover brokers that meet a state's definition and actually comply. Companies you have a direct relationship with are generally excluded, and unregistered brokers are, by definition, missing from the list until enforcement catches them.
Is Vermont's data broker law changing?
Yes. Vermont's 2026 amendments raise the annual registration fee to $900, add a $20,000 surety bond, and require brokers to process deletion requests within 30 days, with the substantive provisions taking effect January 1, 2027.
Sources: Texas Secretary of State (data broker registration pages and FAQ); Oregon Division of Financial Regulation (data broker registry and FAQs); California Privacy Protection Agency / CalPrivacy (Delete Act announcements, December 17, 2025 and July 29, 2025); IAPP reporting on CalPrivacy board decisions and DROP participation; Zwillgen and Hunton Andrews Kurth on Vermont's Act 171 and its 2026 amendments; Hunton Andrews Kurth on Connecticut Public Act 26-64.