States Move Beyond Data-Broker Registration

Less than a decade after Vermont became the first state to enact a data-broker registration law, states are beginning to demand more from data brokers than basic registration and disclosure. In 2023, California authorized the creation of a mechanism allowing consumers to request the deletion of personal information about them held by data brokers. This year, Connecticut took similar action, while New Jersey restricted the sale and licensing of sensitive data and required the registration of certain data collectors as well as data brokers.

Connecticut’s SB 4, signed by Gov. Ned Lamont (D) in late May, provides for the establishment of a mechanism to allow consumers to direct registered brokers to delete their data.

New Jersey’s AB 5328, signed by Gov. Mikie Sherrill (D) in late June, generally prohibits the sale or licensing of sensitive data, with violations carrying “a civil penalty of $50,000 for each record sold, offered for sale or licensed.”

The law also requires certain data collectors, as well as data brokers, to register with the state, with annual registration fees ranging from $5,000 to $1.5 million, based on the number of New Jersey consumers whose data is sold or licensed.

The law defines a data collector as a business that knowingly collects the personal data of a consumer with whom it has a direct relationship and sells or licenses that data to a data broker. It defines a data broker as a person or entity that knowingly collects or purchases the personal data of a consumer with whom it does not have a direct relationship and sells or licenses that data to a third party.

The Connecticut and New Jersey laws were enacted in the months before a major provision of California’s 2023 Delete Act took effect. SB 362 (2023), by Sen. Josh Becker (D), allows state residents to send a deletion request to every data broker registered in the state through a single online form.

On Aug. 1 of this year, data brokers became legally required to access California’s Delete Request and Opt-out Platform and process deletion requests at least once every 45 days. Connecticut’s new law will essentially bring that idea to the East Coast when the provision in SB 4 requiring data brokers to regularly access that state’s deletion mechanism takes effect on Oct. 1, 2028.

Together, these three pieces of legislation point to the next generation of data-broker regulation.

Bills Dealing with Data Brokers Considered in Over Half of States in 2026

Lawmakers in at least 27 states have considered legislation dealing with data brokers this year, according to the LexisNexis® State Net® legislative tracking system. Seven of those states have enacted such measures.

Diverging State Approaches Create Compliance Challenges

Vermont became the first state to enact a data-broker registration law in 2018. It was followed by California, which enacted its own registry law in 2019.

These registry laws began to make brokers visible. The new generation of data-broker legislation is beginning to take the next step by implementing limits and empowering consumers to delete their own information.

This step, however, is also adding complexity to the task of complying with the new requirements.

California has launched a centralized deletion process, Connecticut has enacted a law providing for a similar system, and New Jersey has restricted the sale and licensing of sensitive data.

For multistate operators, the differences now extend beyond registration forms and fees to the types of data covered, deletion procedures, exemptions, effective dates and penalties. 

Data-Broker Regulation Remains Priority for Legislators

Connecticut SB 4 and New Jersey AB 5328 aren’t the only bills dealing with data brokers that have been considered by state lawmakers this year. State lawmakers in 25 other states have taken up more than 50 other data-broker-related measures, five of which have been enacted.

One of those enactments was Vermont’s HB 211. The new law, Act 138, expands registration disclosure requirements for data brokers, requires brokers to vet prospective data users and provide notification of data breaches, raises the annual registration fee and penalties, and directs the state to study a consumer deletion mechanism. Those provisions demonstrate that the nation’s first data-broker registration model is also evolving.

Lawmakers in several states also considered California-style centralized consumer data deletion systems. New York’s Senate passed a bill (SB 9088) pairing a data-broker registry with such a deletion mechanism. The measure remains pending in an Assembly committee. Similar proposals were introduced but have stalled or failed in Hawaii (HB 2463), Illinois (HB 4809), New Hampshire (HB 1694) and Rhode Island (SB 2766).

Massachusetts lawmakers also considered the deletion-mechanism approach. An early joint committee draft (SB 2516) included a data-broker registry and a centralized deletion system, but those provisions were omitted from the version of the bill passed by the full Senate (SB 2619). The House later amended the bill to require a study of data-broker regulation and the feasibility of a registry. The measure is now before a conference committee. 

Other states pursued narrower or distinctly different policies, showing that state regulation is developing on multiple tracks. For example, Virginia prohibited the sale of precise geolocation data (SB 338), and New Hampshire barred the sale of children’s personal data (HB 1460), while Kentucky extended its sales and use tax to data-brokering services (HB 757).

The Electronic Privacy Information Center, a privacy advocacy organization, argues that more data-broker regulation is needed to combat the “significant harm” caused by data brokers “indiscriminately collecting and selling sensitive personal information.”

EPIC also says data brokers can threaten national security by exposing sensitive information about members of the military and government officials, help perpetrators of domestic violence locate and track their victims, and put public officials at risk by making their personal details searchable.

Groups including the Consumer Data Industry Association and Privacy for America argue that brokered data can support fraud prevention, identity verification, risk management and advertising-supported services. Other advertising-industry organizations have advocated for a uniform national privacy framework rather than divergent state requirements.

Implementation Also Poses Challenge

While privacy advocates and industry groups disagree over the shape of future data-broker regulation, compliance with existing state requirements presents a separate challenge.

A study this year by researchers from Stanford and the University of Washington found substantial gaps in compliance with California’s data-broker reporting requirements. Only 9% of 522 data brokers registered in the state fully complied with all of the transparency requirements the researchers examined, while 45% did not report any consumer-rights request metrics.

“This is a surprisingly low compliance rate,” said Stanford HAI Privacy and Data Policy Fellow Jennifer King. “It’s possible data brokers are still working out how to report on the required metrics, but they’ve been on notice for more than three years and this step is now mandatory.”

The findings suggest that enactment is just the first step in this new generation of data-broker regulation. The new laws’ practical impact will depend on whether regulators can provide clear guidance and consistent enforcement, and whether brokers comply with differing state requirements. With more states taking different approaches, implementation may become the next focus of the state debate.

—By SNCJ Correspondent BRIAN JOSEPH

Visit our webpage to connect with a LexisNexis® State Net® representative and learn how the State Net legislative and regulatory tracking service can help you identify, track, analyze and report on relevant legislative and regulatory developments.