What is Data broker?

Where the term comes from

The U.S. Federal Trade Commission’s May 2014 report described data brokers as companies that collect consumers’ personal information and resell or share it with others. After studying nine data brokers, the FTC found they obtain and share vast amounts of consumer information, typically behind the scenes and without consumer knowledge, for purposes such as marketing and fraud prevention.

How legal definitions differ

There is no single definition. Each law draws the line in a different place:

• California covers a business that knowingly collects and sells the personal information of a consumer it has no direct relationship with, and excludes entities to the extent they are covered by the federal Fair Credit Reporting Act (Cal. Civ. Code). Under the Delete Act regulations, a direct relationship exists only with consumers who engaged with the business in the last 3 years (Freshfields), and “sell” includes non-monetary consideration (Cooley).
• Vermont expressly adds licensing (9 V.S.A. § 2430). Customers, employees, contractors, investors and donors all count as direct relationships, and sales that are merely incidental to the business don’t count (Vermont Secretary of State).
• Federal law (PADFA), in effect since June 23, 2024 (Wiley), covers any entity that, for valuable consideration, makes available data of U.S. individuals it did not collect directly from them (15 U.S.C. ch. 123). It bars transfers of sensitive data to North Korea, China, Russia or Iran, with FTC enforcement (bill summary). On February 9, 2026, the FTC sent warning letters to 13 data brokers (Wiley).
• The DOJ’s bulk data rule treats “data brokerage” as a kind of transaction, not a kind of company, and applies to bulk U.S. sensitive personal data even if it is de-identified (28 CFR Part 202). One law firm notes it reaches transactions many businesses wouldn’t think of as brokering (Covington).
• In the EU, a related but different concept is the data intermediation service under the Data Governance Act, which can include data marketplaces (Lexology): a neutral middleman that doesn’t process the data for its own ends (CLSR).

Registration

As of September 30, 2026, California, Oregon, Texas and Vermont run active registries, and Connecticut requires registration from January 1, 2027 (Byte Back). Texas charges a $300 fee (WilmerHale). Because the laws differ, a company may need to register in one state and not another (Privacy Rights Clearinghouse).

Why it matters if you sell business data

Most definitions turn on personal information about people a company doesn’t deal with directly. Licensing your own operational records is a different situation from gathering information on strangers, but the DOJ rule shows de-identification doesn’t take data outside every regime. Whether a law applies depends on your facts, so treat this as general information and check with counsel. For reference, SellMyData doesn’t buy consumer personal data, removes names and identifiers before listing, and runs a rights check with each company first.