State data broker removal laws vary because each state writes its own rules on four fronts: how it defines a “data broker,” whether registration is required, how deletion requests actually get processed, and who enforces violations. There’s no single federal standard forcing consistency, so lawmakers make their own trade-offs.
- Legal scope: States draw the line on who counts as a broker differently.
- Politics and lobbying: Consumer advocacy groups and industry pressure pull legislatures in opposite directions.
- Regulatory design: Some states build centralized deletion tools (like California’s Delete Act). Others rely on Attorney General enforcement with no central system.
- Technical feasibility: Building something like Connecticut’s Public Act No. 26-64 deletion mechanism takes money and staff most states don’t have yet.
Key Takeaways
State data broker removal laws vary because each legislature independently sets its own definition, registration rules, deletion mechanism, and enforcement model with no federal baseline forcing alignment.
| Point | Details |
|---|---|
| No federal standard | State legislatures independently decide scope, registration, and enforcement with no unifying baseline. |
| Definitions decide coverage | Direct-relationship carve-outs and revenue thresholds can exempt a broker in one state but not another. |
| Centralized tools work better | California’s DROP processes deletion requests faster than states relying on self-reporting registries. |
| Registries stay incomplete | Self-reporting systems miss many brokers, so submitting requests directly still matters. |
| Deadlines keep shifting | Connecticut’s accessible deletion mechanism and 45-day access window take effect through 2028. |
Table of Contents
- Why State Data Broker Removal Laws Vary So Widely
- What Political and Legal Forces Drive The Differences?
- How Do These Legal Choices Play Out in Practice?
- Five States, Five Different Approaches
- What Does This Patchwork Mean for You?
- What Compliance Dates Should You Watch Next?
- Our Take on the Broker Law Patchwork
- Frequently Asked Questions
- Sources
Why State Data Broker Removal Laws Vary So Widely
Every state law touches the same handful of legal levers. Where states diverge is how far they pull each one.
- Definition and scope. Who counts as a “data broker” in the first place? A company selling to a direct customer relationship might be exempt in one state and covered in another.
- Registration and fees. Some states require brokers to register annually and pay a fee; others ask for nothing at all.
- Deletion mechanism. A centralized system where one request reaches every registered broker looks nothing like a state with no deletion infrastructure at all.
- Enforcement authority and penalties. A dedicated privacy agency with audit power behaves very differently from an Attorney General’s office handling complaints case by case.
- Exceptions and carve-outs. Public records, journalism, research, and legal-obligation exemptions all shrink or expand coverage.
- Data-security obligations. Some statutes spell out specific safeguards; others just require “reasonable” security.
- Thresholds and exemptions. Revenue or data-volume cutoffs determine which companies even have to comply.
Later sections walk through statutory citations like Cal. Civ. Code § 1798.99.80 to show exactly how these axes play out in specific state laws.
What Political and Legal Forces Drive The Differences?
State choices on data broker law reflect a trade-off between consumer protection, administrative cost, and the economic burden placed on businesses. No legislature gets all three at once, so each state picks its priorities.
- Political drivers. States with strong privacy advocacy networks, like California, tend to pass broader statutes with more enforcement teeth. States with heavier industry lobbying presence often settle for lighter-touch registration requirements. Partisan control of a legislature shapes appetite for creating new enforcement agencies versus leaning on existing Attorney General offices.
- Legal drivers. Lawmakers worry about federal preemption and conflicting with sectoral laws already covering credit reporting or health data. That’s part of why some states use broad, catch-all definitions of “data broker” while others use narrow, threshold-based triggers tied to revenue or record volume.
- Practical drivers. Building a centralized deletion mechanism, the kind Connecticut’s law requires by 2028, costs money and staff. Registries that rely on brokers self-reporting are cheaper to run but produce incomplete rosters, and enforcing against out-of-state brokers raises jurisdictional headaches most legislatures would rather avoid.
How Do These Legal Choices Play Out in Practice?
The practical result: coverage, deletion rights, and penalties depend entirely on which state’s broker touched your data, and small wording differences decide who has to comply at all.
| Dimension | What varies | Example |
|---|---|---|
| Definition/scope | Broad catch-all vs. threshold-based | California covers most brokers; Texas ties coverage to revenue thresholds |
| Registration | Required with fees vs. none | Connecticut requires a substantial registration fee; some states require no registration |
| Deletion mechanism | Centralized platform vs. none | California’s DROP vs. states with no central deletion system |
| Enforcement | Specialized agency vs. Attorney General | CalPrivacy audits brokers directly; other states route complaints through the AG |
| Exceptions | Public records, research, safety carve-outs | Most states exempt journalism and legal-compliance data |
| Security obligations | Prescriptive rules vs. general “reasonable” standard | Some statutes list specific safeguards; others leave it vague |
Pro Tip: Watch the fine print on “license” versus “sale” language. A broker that licenses your data instead of selling it outright can dodge coverage entirely under some state definitions, even though the practical effect on your privacy is identical.
California’s Delete Act built its centralized DROP system specifically to close the gap where consumers had to submit separate requests to dozens of brokers. Connecticut chose a different path, mandating an accessible deletion mechanism with a 45-day broker access schedule after October 1, 2028, rather than a single unified portal. A comparative analysis of California, Texas, Vermont, and Oregon found that direct-relationship carve-outs and revenue thresholds are often what quietly exempts a company from coverage, not the headline definition of “broker” itself.
Five States, Five Different Approaches
California built the most centralized system in the country. Its Delete Act created DROP, a single deletion request tool that reaches every registered broker, with CalPrivacy handling audits and enforcement.
Connecticut took a fee-and-deadline approach. Public Act No. 26-64 requires a $2,500 initial and renewal registration fee, with an accessible deletion mechanism required by July 1, 2028, and a 45-day broker processing window after that.
Texas relies on threshold-based coverage under Tex. Bus. & Com. Code § 510, meaning smaller brokers can fall outside the statute entirely depending on revenue and data volume.
Vermont leans on transparency. 9 V.S.A. § 2430 focuses on a public registry so consumers can at least see who’s collecting their data, even without a centralized deletion tool.
Oregon folded broker obligations into its broader consumer privacy law, Ore. Rev. Stat. § 646A.593, layering registration requirements on top of general privacy rights rather than building a standalone broker statute.
| State | Registry | Deletion mechanism | Enforcement |
|---|---|---|---|
| California | Yes | Centralized (DROP) | CalPrivacy audits |
| Connecticut | Yes, $2,500 fee | Accessible mechanism by 2028 | State enforcement |
| Texas | Threshold-based | None centralized | Attorney General |
| Vermont | Yes, public | None centralized | Attorney General |
| Oregon | Yes | Folded into OCPA rights | State enforcement |
What Does This Patchwork Mean for You?
Your deletion and opt-out rights depend heavily on where the broker operates, and most states offer no private right to sue if a broker ignores your request. California is the exception, giving consumers real enforcement leverage most other states don’t.
Registry incompleteness makes this worse. Privacy Rights Clearinghouse found that hundreds of brokers registered in one state simply don’t register in others, since self-reporting systems have no real way to catch companies that skip the paperwork.
Brokers exploit the gaps in a few predictable ways:
- Relabeling a “sale” of your data as a “license” to dodge coverage.
- Using API access agreements that fall outside statutory definitions.
- Re-aggregating your information from public records after you’ve already opted out.
- Simply not registering in states with weak enforcement.
Submit removal requests anyway, even in states with no registry. Many comprehensive privacy laws passed since 2024 still grant deletion rights that apply broadly. Check your listings every few months, since brokers frequently re-add data pulled from public records, and lean on national opt-out tools where they exist rather than chasing every broker one by one.
What Compliance Dates Should You Watch Next?
Near-term deadlines matter because they determine when consumers actually gain access to tools like centralized deletion, not just when a law technically passes.
- California’s DROP requires registered brokers to check the platform on a recurring basis, with deletion requests processed on a 45-day cycle.
- Connecticut’s accessible deletion mechanism must exist by July 1, 2028, with a 45-day broker access window starting October 1, 2028.
- Other states continue rolling out registration deadlines and fee schedules through 2026 and beyond.
- The CFPB has proposed restricting brokers from selling sensitive personal data outright, which would sit alongside state law rather than replace it. Full preemption isn’t on the table yet.
Our Take on the Broker Law Patchwork
Techstacktoday has spent years testing removal workflows across dozens of privacy services, and the pattern is consistent: centralized systems like California’s DROP work better than self-reporting registries almost every time. Our hands-on removal testing backs that up directly.
The patchwork isn’t going away soon, and honestly, waiting for federal legislation to fix it is a bad bet. If you live in a state without strong deletion infrastructure, don’t assume the law will catch up before your data gets re-listed somewhere else. A paid removal service that monitors and resubmits requests on a schedule solves a problem that most state statutes simply weren’t built to solve on their own. That’s not a knock on the laws themselves. It’s just a recognition that legislation moves slower than data brokers do.
Frequently Asked Questions
Why do data broker removal laws vary by state instead of following one federal rule?
Congress hasn’t passed a comprehensive federal data broker law, so states fill the gap independently. Each legislature balances consumer protection against business cost differently, producing the current patchwork.
Which state has the strongest data broker removal law?
California’s Delete Act is widely viewed as the most comprehensive, thanks to its centralized DROP deletion platform and CalPrivacy’s audit authority, according to comparative legal analysis.
Can a company be a “data broker” in one state but not another?
Yes. Direct-relationship carve-outs, revenue thresholds, and the distinction between licensing and selling data can place the same company inside one state’s definition and outside another’s.
Does submitting a deletion request work in states without a broker registry?
Often, yes. Many states passed broader privacy laws with deletion rights that apply even without a dedicated broker statute, though enforcement options remain limited outside California.
Will federal action replace state data broker laws?
Not fully. The CFPB’s proposed rule targets sensitive data sales specifically and would layer on top of state law rather than preempt it entirely.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
Sources
- Why are hundreds of data brokers not registering in states?
- Public Act No. 26-64 (Connecticut) — data broker registration and accessible deletion mechanism provisions
- California Delete Act statutory text and DROP requirements
- CFPB proposes rule to stop data brokers from selling sensitive personal data to scammers, stalkers, and spies
- Data-broker regulation framework: comparative analysis of California, Texas, Vermont, and Oregon