Skip to content
GSDSI LogoGSDSI
Reference

State Data Broker Registration Tracker

This tracker covers six states with enacted data broker registration laws and puts each state's deadline, fee, penalty and deletion rules in one place, with a link to the law itself, so you can check any row at the source. The full table is also available as a CSV file.

Download the CSV

Last verified against each state's own sources:

At a glance

StateStatusFeePenalty for not registering
CaliforniaIn force$6,000 for 2026, plus an electronic payment processing fee of up to 2.99%. A staff memo for the agency board’s August 6, 2026 meeting proposed $9,500 for 2027; check the agency’s site for whether it was adopted.$200 for each day unregistered, plus the fees due for that period and the agency’s reasonable expenses of the investigation and administration of the action.
VermontIn force$100$50 for each day unregistered, capped at $10,000 per year, plus the fees due for that period.
TexasIn force$300 to register and $300 to renewAt least $100 for each day in violation plus unpaid registration fees, capped at $10,000 in any 12-month period.
OregonIn force$600 to register and $600 to renew (set by rule)Up to $500 per violation, or $500 per day for a continuing violation, capped at $10,000 per calendar year.
ConnecticutEnacted; registration required from January 1, 2027$2,500 to register and $2,500 to renewUp to $200 per day for each violation, after notice and a hearing.
New JerseyEnacted June 30, 2026; registry section inoperative through March 27, 2027Tiered by the number of New Jersey consumers whose data is sold or licensed: 100,000 or fewer, $5,000; more than 100,000 and fewer than 500,000, $10,000; more than 500,000 and fewer than 1 million, $100,000; more than 1 million and fewer than 1.5 million, $500,000; more than 1.5 million and fewer than 2.5 million, $750,000; more than 2.5 million and fewer than 4.5 million, $1,000,000; more than 4.5 million, $1,500,000. As written, the tiers do not assign a fee to exactly 500,000, 1 million, 1.5 million, 2.5 million or 4.5 million consumers.$2,500 for each day a broker or collector fails to register or pay, plus unpaid fees; another $2,500 per day for failing to file or update the required information.

State by state

California

Registers with
California Privacy Protection Agency (CalPrivacy)
When to register
Register on or before January 31 following each year the business meets the data broker definition.
Deletion and opt-out duties
The state deletion platform (DROP) opened January 1, 2026. From August 1, 2026, brokers must check it at least every 45 days and process deletion requests. Brokers that start operating during 2026 also pay a one-time DROP access fee.

Vermont

Registers with
Vermont Secretary of State (the Attorney General enforces)
When to register
Register on or before January 31 following each year the business meets the data broker definition.
Deletion and opt-out duties
If the broker lets consumers opt out, the registration must describe how and what the opt-out covers.

Texas

Registers with
Texas Secretary of State (the Attorney General enforces)
When to register
Register to conduct business in Texas. A registration certificate is effective for one year and can be renewed.
Deletion and opt-out duties
Brokers must post a notice on their website or app saying they are a data broker and explaining how consumers can use their Texas privacy rights.

Oregon

Registers with
Department of Consumer and Business Services, Division of Financial Regulation
When to register
Register before collecting, selling or licensing brokered personal data. Registrations expire December 31, except that one obtained after November 1 stays active through the following calendar year. The division asks for renewal applications at least 30 days before expiration; a lapsed registration can be reinstated until March 1 by paying the $600 renewal fee plus a $50 late fee.
Deletion and opt-out duties
The registration must say whether and how Oregon residents can opt out of the broker’s collection, sale or licensing of their data.

Connecticut

Registers with
Department of Consumer Protection
When to register
No sale or licensing of brokered personal data in Connecticut on or after January 1, 2027 without an active registration. Registrations expire December 31 and renew for one-year terms.
Deletion and opt-out duties
The state must set up a deletion mechanism no later than July 1, 2028, letting a consumer ask every registered broker to delete their data in one request.
Public registry
No registry link verified as of September 23, 2026

New Jersey

Registers with
Division of Consumer Affairs, Department of Law and Public Safety
When to register
Data brokers and data collectors that sell or license New Jersey consumers’ personal data register every year. The section that creates the public registry stays inoperative for 270 days after enactment, through March 27, 2027.
Deletion and opt-out duties
The public registry must list each registrant’s opt-out information. The law also restricts selling or licensing sensitive data.
Public registry
No registry link verified as of September 23, 2026

How this was checked. Every fee, deadline and penalty above was read from the state's own statute, public act or agency page, linked in each row. Where a guide you have seen disagrees, go by the linked source. Texas moved its data broker law from chapter 509 to chapter 510 of the Business and Commerce Code on September 1, 2025.

This page is general information, not legal advice. Whether a law applies to your business turns on its definitions and exemptions, so confirm with counsel before you rely on any row.

Frequently asked questions about state data broker registration

Which states require data brokers to register?

As of September 23, 2026, this tracker covers 6 states with enacted data broker registration laws. In force: California, Vermont, Texas and Oregon. Connecticut: enacted; registration required from January 1, 2027. New Jersey: enacted June 30, 2026; registry section inoperative through March 27, 2027.

When is the California data broker registration deadline?

Register on or before January 31 following each year the business meets the data broker definition. The registrar is the California Privacy Protection Agency (CalPrivacy). Fee: $6,000 for 2026, plus an electronic payment processing fee of up to 2.99%. A staff memo for the agency board’s August 6, 2026 meeting proposed $9,500 for 2027; check the agency’s site for whether it was adopted.

How much does data broker registration cost?

California: $6,000 for 2026, plus an electronic payment processing fee of up to 2.99%. A staff memo for the agency board’s August 6, 2026 meeting proposed $9,500 for 2027; check the agency’s site for whether it was adopted. Vermont: $100. Texas: $300 to register and $300 to renew. Oregon: $600 to register and $600 to renew (set by rule). Connecticut: $2,500 to register and $2,500 to renew. New Jersey: Tiered by the number of New Jersey consumers whose data is sold or licensed: 100,000 or fewer, $5,000; more than 100,000 and fewer than 500,000, $10,000; more than 500,000 and fewer than 1 million, $100,000; more than 1 million and fewer than 1.5 million, $500,000; more than 1.5 million and fewer than 2.5 million, $750,000; more than 2.5 million and fewer than 4.5 million, $1,000,000; more than 4.5 million, $1,500,000. As written, the tiers do not assign a fee to exactly 500,000, 1 million, 1.5 million, 2.5 million or 4.5 million consumers.

What is the penalty for not registering as a data broker?

California: $200 for each day unregistered, plus the fees due for that period and the agency’s reasonable expenses of the investigation and administration of the action. Vermont: $50 for each day unregistered, capped at $10,000 per year, plus the fees due for that period. Texas: At least $100 for each day in violation plus unpaid registration fees, capped at $10,000 in any 12-month period. Oregon: Up to $500 per violation, or $500 per day for a continuing violation, capped at $10,000 per calendar year. Connecticut: Up to $200 per day for each violation, after notice and a hearing. New Jersey: $2,500 for each day a broker or collector fails to register or pay, plus unpaid fees; another $2,500 per day for failing to file or update the required information.

What is California’s DROP and when must data brokers use it?

The state deletion platform (DROP) opened January 1, 2026. From August 1, 2026, brokers must check it at least every 45 days and process deletion requests. Brokers that start operating during 2026 also pay a one-time DROP access fee.

Which Texas statute covers data broker registration?

Tex. Bus. & Com. Code ch. 510 (renumbered from ch. 509 effective September 1, 2025). Register to conduct business in Texas. A registration certificate is effective for one year and can be renewed.

For how buyers use these registries in vendor reviews, read state data broker registration diligence. For GSDSI's own filings, see our data broker registrations.

Questions about this tracker

✓ Opt-Out Request Honored via Global Privacy Control