# What is Data broker?

> A data broker is a business that collects personal information about people it has no direct relationship with and sells, licenses or otherwise shares that information with others. Exact legal definitions vary by law and jurisdiction.

Source: https://sellmydata.com/glossary/data-broker/
Published: 2026-10-28

## Where the term comes from

The U.S. Federal Trade Commission's [May 2014 report](https://www.ftc.gov/system/files/documents/reports/data-brokers-call-transparency-accountability-report-federal-trade-commission-may-2014/140527databrokerreport.pdf) described data brokers as companies that collect consumers' personal information and resell or share it with others. After studying [nine data brokers](https://www.ftc.gov/node/47671), the FTC found they obtain and share vast amounts of consumer information, typically behind the scenes and without consumer knowledge, for purposes such as marketing and fraud prevention.

## How legal definitions differ

There is no single definition. Each law draws the line in a different place:

- **California** covers a business that knowingly collects and sells the personal information of a consumer it has no direct relationship with, and excludes entities to the extent they are covered by the federal Fair Credit Reporting Act ([Cal. Civ. Code](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.48.&part=4.&chapter=&article=)). Under the Delete Act regulations, a direct relationship exists only with consumers who engaged with the business in the last 3 years ([Freshfields](https://www.freshfields.com/en/our-thinking/blogs/a-fresh-take/california-expands-its-data-broker-rules-in-the-b2c-context-unpacking-california-102jpiw)), and "sell" includes non-monetary consideration ([Cooley](https://cdp.cooley.com/californias-delete-act-key-takeaways-for-data-brokers/)).
- **Vermont** expressly adds licensing ([9 V.S.A. § 2430](https://legislature.vermont.gov/statutes/section/09/062/02430)). Customers, employees, contractors, investors and donors all count as direct relationships, and sales that are merely incidental to the business don't count ([Vermont Secretary of State](https://sos.vermont.gov/business-services/other-filings/data-broker)).
- **Federal law (PADFA)**, in effect since June 23, 2024 ([Wiley](https://www.wiley.law/alert-New-Federal-Data-Broker-Law-Will-Restrict-Certain-Foreign-Data-Sales-Effective-June-23)), covers any entity that, for valuable consideration, makes available data of U.S. individuals it did not collect directly from them ([15 U.S.C. ch. 123](https://uscode.house.gov/view.xhtml?path=%2Fprelim%40title15%2Fchapter123&edition=prelim)). It bars transfers of sensitive data to North Korea, China, Russia or Iran, with FTC enforcement ([bill summary](https://www.govinfo.gov/bulkdata/BILLSUM/118/hr/BILLSUM-118hr7520.xml)). On February 9, 2026, the FTC sent warning letters to 13 data brokers ([Wiley](https://www.wiley.law/alert-FTC-Sends-Warning-Letters-to-Data-Brokers-on-PADFA-Compliance)).
- **The DOJ's bulk data rule** treats "data brokerage" as a kind of transaction, not a kind of company, and applies to bulk U.S. sensitive [personal data](/glossary/pii/) even if it is de-identified ([28 CFR Part 202](https://www.ecfr.gov/current/title-28/chapter-I/part-202)). One law firm notes it reaches transactions many businesses wouldn't think of as brokering ([Covington](https://www.cov.com/en/news-and-insights/insights/2025/01/department-of-justice-issues-final-rule-to-implement-bulk-us-sensitive-personal-data-and-government-related-data-executive-order)).
- **In the EU**, a related but different concept is the data intermediation service under the Data Governance Act, which can include data marketplaces ([Lexology](https://www.lexology.com/library/detail.aspx?g=e6de2af3-1c96-4b2c-978d-b9add7d6fb3f)): a neutral middleman that doesn't process the data for its own ends ([CLSR](https://www.sciencedirect.com/science/article/pii/S0267364923000407)).

## Registration

As of September 30, 2026, California, Oregon, Texas and Vermont run active registries, and Connecticut requires registration from January 1, 2027 ([Byte Back](https://www.bytebacklaw.com/2026/10/is-your-business-model-subject-to-data-broker-laws/)). Texas charges a $300 fee ([WilmerHale](https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20231214-texas-and-oregon-adopt-new-rules-for-data-broker-laws)). Because the laws differ, a company may need to register in one state and not another ([Privacy Rights Clearinghouse](https://privacyrights.org/resources-tools/reports/why-are-hundreds-data-brokers-not-registering-states)).

## Why it matters if you sell business data

Most definitions turn on personal information about people a company doesn't deal with directly. Licensing your own operational records is a different situation from gathering information on strangers, but the DOJ rule shows [de-identification](/glossary/de-identification/) doesn't take data outside every regime. Whether a law applies depends on your facts, so treat this as general information and check with counsel. For reference, SellMyData [doesn't buy consumer personal data](https://sellmydata.com/sell-my-data/), [removes names and identifiers](https://sellmydata.com/de-identification/) before listing, and runs a [rights check](https://sellmydata.com/rights/) with each company first.

## Frequently asked questions

### What is a data broker?

A data broker is a company that gathers personal information about people it has no direct relationship with and sells or shares it with others. The FTC has described them as companies that collect consumers' personal information and resell or share it, typically behind the scenes.

### Is a data marketplace the same as a data broker?

Not necessarily. Under the EU Data Governance Act, a data marketplace can be a data intermediation service, a neutral middleman between data holders and users that doesn't process the data for its own ends. U.S. state broker laws instead focus on who collects and sells personal information about consumers.

### Do data brokers have to register?

In some U.S. states, yes. As of September 30, 2026, California, Oregon, Texas and Vermont had active registration procedures, and Connecticut requires registration from January 1, 2027.

### Does selling de-identified data make you a data broker?

It depends on the law and the facts. Most state definitions focus on personal information, but the DOJ's bulk sensitive data rule applies even to de-identified data, so it's worth asking counsel about your specific situation.

## Sources

- [California Civil Code, Title 1.81.48 (Data Brokers)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.48.&part=4.&chapter=&article=)
- [Data Brokers](https://cppa.ca.gov/data_brokers/)
- [California expands its data broker rules in the B2C context](https://www.freshfields.com/en/our-thinking/blogs/a-fresh-take/california-expands-its-data-broker-rules-in-the-b2c-context-unpacking-california-102jpiw)
- [California's Delete Act: Key Takeaways for Data Brokers](https://cdp.cooley.com/californias-delete-act-key-takeaways-for-data-brokers/)
- [9 V.S.A. § 2430 Definitions](https://legislature.vermont.gov/statutes/section/09/062/02430)
- [Data Broker](https://sos.vermont.gov/business-services/other-filings/data-broker)
- [Data Brokers: A Call for Transparency and Accountability](https://www.ftc.gov/system/files/documents/reports/data-brokers-call-transparency-accountability-report-federal-trade-commission-may-2014/140527databrokerreport.pdf)
- [FTC Recommends Congress Require the Data Broker Industry to be More Transparent](https://www.ftc.gov/node/47671)
- [15 U.S.C. Chapter 123 (Protecting Americans' Data from Foreign Adversaries)](https://uscode.house.gov/view.xhtml?path=%2Fprelim%40title15%2Fchapter123&edition=prelim)
- [H.R. 7520 Bill Summary](https://www.govinfo.gov/bulkdata/BILLSUM/118/hr/BILLSUM-118hr7520.xml)
- [New Federal Data Broker Law Will Restrict Certain Foreign Data Sales, Effective June 23](https://www.wiley.law/alert-New-Federal-Data-Broker-Law-Will-Restrict-Certain-Foreign-Data-Sales-Effective-June-23)
- [FTC Sends Warning Letters to Data Brokers on PADFA Compliance](https://www.wiley.law/alert-FTC-Sends-Warning-Letters-to-Data-Brokers-on-PADFA-Compliance)
- [28 CFR Part 202](https://www.ecfr.gov/current/title-28/chapter-I/part-202)
- [Department of Justice Issues Final Rule to Implement Bulk U.S. Sensitive Personal Data Executive Order](https://www.cov.com/en/news-and-insights/insights/2025/01/department-of-justice-issues-final-rule-to-implement-bulk-us-sensitive-personal-data-and-government-related-data-executive-order)
- [Final Rule on Bulk Sensitive Data](https://www.justice.gov/opa/media/1396356/dl)
- [Data intermediation services under the Data Governance Act](https://www.lexology.com/library/detail.aspx?g=e6de2af3-1c96-4b2c-978d-b9add7d6fb3f)
- [Data intermediaries under the Data Governance Act](https://www.sciencedirect.com/science/article/pii/S0267364923000407)
- [The Data Governance Act](https://journals.sagepub.com/doi/full/10.1177/17835917221141324)
- [Is Your Business Model Subject to Data Broker Laws?](https://www.bytebacklaw.com/2026/10/is-your-business-model-subject-to-data-broker-laws/)
- [Texas and Oregon Adopt New Rules for Data Broker Laws](https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20231214-texas-and-oregon-adopt-new-rules-for-data-broker-laws)
- [Why Are Hundreds of Data Brokers Not Registering with States?](https://privacyrights.org/resources-tools/reports/why-are-hundreds-data-brokers-not-registering-states)