The Data-Broker Registration Scope Read, State by State

This guide is for recruiting operations, revenue operations, and whoever signs off on how your contact data was gathered. It gives you a scoring matrix to apply to your own data flows so you can reach a defensible in-scope or out-of-scope verdict in each registering state, with the deadline, fee, and post-registration duty attached to every state where you land in scope. It is a read on the "direct relationship" and "sale or share" tests as they actually bite on a sourcing operation, not a parallel survey of statutes.

Most ranking pages list each state's rules side by side and stop at the exact fork that matters: whether you are in scope. That fork lives in two tests - whether you have a direct relationship with the people in your database, and whether your outbound flows count as a sale, share, or license. Both tests read differently against a sourcing pipeline than against a consumer app, and that is where the surveys hand the question back to you.

Which states require data-broker registration, and what does each cost

Four states currently require data-broker registration: California, Vermont, Texas, and Oregon. Each sets its own deadline, fee, penalty formula, and enforcer, so a single calendar entry produces late filings that accrue per-day penalties.

Connecticut has enacted a regime, but its start date is reported inconsistently across secondary sources - one places the registration requirement under Public Act 26-64 at January 1, 2027, another describes a Department of Consumer Protection regime effective October 1, 2026. Treat Connecticut as pending and verify the effective date against the primary statute before you calendar anything there.

Two cells above carry known conflicts. The Vermont fee is reported as $100 for 2026 rising to $900 in 2027 by one source and as $200 with a February 15 deadline by another; the Vermont deadline is similarly unsettled. Do not file Vermont off this table alone - reconcile the fee and deadline against the Vermont Secretary of State's own registry page. California's fee also carries an associated third-party processing fee for electronic payments on top of the $6,000.

What "direct relationship" actually means, and why it is the fork

The direct-relationship exemption is a three-year intent test, not a data-source test. California defines a data broker as a business that knowingly collects and sells or shares the personal information of consumers with whom it does not have a direct relationship, and the California Privacy Protection Agency has narrowed what counts.

The agency's language is precise: a business does not have a direct relationship with a consumer simply because it collects personal information directly from the consumer; the consumer must intend to interact with the business. A direct relationship exists only when consumers intentionally interact to obtain information about accessing, purchasing, using, or requesting the business's products or services within the preceding three years.

Read that against a sourcing pipeline and the exemption shrinks fast. A person whose email you appended from a third-party supplier never intended to interact with you. A contact who filled in a form four years ago has aged out of the three-year window. A profile you scraped and then verified was never a direct relationship, because collection method alone does not create one. Each of those record classes is brokered data even though your team might describe all of them as "our contacts."

Oregon and Vermont capture businesses that collect and sell or license brokered data, using the same rough shape as California. Texas is the outlier and it matters more than the survey pages admit.

Texas abandons the direct-relationship standard

Texas defines a data broker as a business entity whose principal source of revenue is derived from collecting, processing, or transferring personal data that the entity did not collect directly from the individual. There is no direct-relationship carve-out. That means Texas can treat you as a broker with respect to information about your own customers or employees when that data was sourced from a third party.

For a recruiting team, this is the trap. Buying enriched profiles about your own applicants - data you did not collect from the applicant directly - can pull that data into the Texas definition even though the applicant is, in every ordinary sense, your own candidate. The direct relationship you clearly have does not save you, because Texas is not asking about the relationship. It is asking where the data came from.

The scoring matrix: how to score each data flow

Score every data flow on two axes and the verdict falls out of the quadrant. The first axis is whether you have a direct, in-window relationship with the people in the flow. The second is whether the flow leaves your organization as a sale, share, or license for value.

The matrix reads left to right, top to bottom. A flow in the top-left - no direct relationship and sold onward - is the archetypal broker activity and puts you in scope in California, Oregon, and Vermont. A flow in the bottom-right - a genuine in-window customer whose data you never sell - is out of scope everywhere. The two off-diagonal quadrants are where judgement lives, and where Texas keeps pulling flows back into scope that the other three states would release.

Score one flow at a time, not the whole database at once. A pipeline that mixes true first-party form fills with appended third-party emails has flows in more than one quadrant, and the appended flow is enough to make you a broker even if the form flow is clean.

The step-by-step scope read

Run these eight steps in order. The first five reach a verdict; the last three keep you compliant once you are in.

The inventory step is the one people skip and the one enforcement guidance actually names. Conduct a data-flow analysis mapping how consumer data moves through your organization, identify whether you collect directly, purchase from third parties, or both, and ensure consent language is clear, specific, and documented. That data-flow map is the artefact you will point to when an enforcer asks how you reached your verdict.

The Texas quantitative test, both prongs

Texas is the only one of the four states with a numeric threshold, and it has two prongs you must test separately. California and Oregon have no numeric revenue or consumer threshold at all - status turns purely on the definition.

The law applies if, in the past 12 months, more than half a data broker's revenue came from processing or transferring personal data it did not collect directly, OR if the broker earned revenue from processing or transferring personal data of over 50,000 individuals not collected directly. Either prong is sufficient.

The volume prong is where the revenue prong lulls people into a miss. A company that reasons "data broking is only a tenth of our revenue, so we are safe" can still be caught if it processes indirectly-collected data on more than 50,000 individuals. The Texas Attorney General filed a January 13, 2025 lawsuit against Allstate and its subsidiary Arity alleging they processed the personal data of over 50,000 individuals but failed to register - the volume prong, not the revenue prong.

What the enforcement record proves about your assumptions

The clearest signal in the enforcement record is that the exact tooling recruiting and revenue operations rely on has already been penalized as broker activity. The first California fines hit an outbound sales platform and a B2B lead generator, which tells you regulators read "data broker" to include sales-intelligence and contact-enrichment tools.

The derived column confirms the pre-DROP formula is a flat $200 per day per entity. According to the CPPA, a direct relationship only applies to first-party data, so companies using third-party data may qualify as brokers even if they do not consider themselves one. Growbots was an outbound sales platform and UpLead was a B2B lead generator - neither thought of itself as a data broker, and both paid.

If your operation buys, enriches, or resells contact data, the honest starting assumption is that you are in the Growbots and UpLead category until your scope read proves otherwise. The read below is how you find out before an enforcer does.

Reaching the verdict is a data-flow question before it is a legal one, and the friction is almost always in the inventory: nobody has written down where each field in the contact record came from. Refolk is built to answer the "find me the people who own this" half of that problem in plain English, so you can pull the operators and privacy owners who have already worked the registration question rather than starting cold.

How this goes wrong: the false positives that cost the fine

The expensive mistakes here are false negatives - reasons a team convinces itself it is out of scope when it is in. Each one below has a specific test that breaks the assumption.

• "We collect it directly, so we're exempt." This treats web-form or scraped-then-verified contacts as first-party. Test it against the rule that the consumer must intend to interact with the business within three years. Collection method alone does not create a direct relationship.
• "It's B2B work-contact data, not consumer data." Growbots and UpLead were B2B tools and were still fined. Test it by asking whether any single record is about a person you have no intended interaction with. If yes, that record is in scope regardless of how professional the contact is.
• "It's public-record data, so we're out." Oregon exempts some publicly available business and government-record data, but California does not blanket-exempt it. Check each state's specific carve-out rather than assuming one generous rule applies everywhere.
• "The 50% revenue prong doesn't apply to us." This misses the Texas volume prong. A company below the revenue threshold can still be caught by processing indirectly-collected data on more than 50,000 individuals. Test both prongs.
• "One deadline covers all our states." California January 31, Texas March 1, and Oregon before activity are three different triggers. A single calendar entry accrues per-day penalties in whichever state it missed.
• "We registered, so we're done." From August 1, 2026 the risk shifts from a flat $200 per day to $200 per deletion request per day. A registration certificate with no 45-day DROP retrieval pipeline behind it is the more dangerous state, not the safe one.
• "Our registration is accurate enough." Enforcement Advisory No. 2025-01, issued December 2025, warned that some brokers may be evading registration by using trade names or websites not disclosed in their registrations. Verify that your registry entries match your live operating entities and every trade name you use.

Why the penalty geometry inverts on August 1, 2026

Before August 1, 2026, California non-registration exposure is a single daily clock: $200 per day per entity, which is why Growbots' 177 late days produced exactly $35,400. After that date, the geometry changes shape, and the change is the single most important thing on your calendar.

Beginning August 1, 2026, data brokers must access the accessible deletion mechanism - DROP - at least once every 45 days and process consumer deletion requests, subject to limited exceptions. The penalty for missing a deletion request is $200 per request per day. That is per record, not per entity.

The scale is not hypothetical. The DROP queue already exceeded 300,000 consumer requests before the August 1 processing deadline. A broker holding matchable records on 5,000 consumers for a full 45-day period could face $45 million in potential statutory exposure. The mechanism is simple and unforgiving: the fine multiplies across every record you fail to delete.

Note one source tension on the deletion clock worth resolving locally: the statute frames it as access every 45 days and process within 45 days of receipt, while some summaries describe a 90-day determination window after retrieval. Build to the tighter reading and verify the exact window against the CPPA regulation page before you rely on the looser one.

The artefacts to have before you call the job done

No published enforcement action specifies a mandated day-one artefact list beyond the registration disclosures themselves and, for Texas, a written information security program - so a formal regulator checklist is not publicly established. What enforcement guidance does emphasize is a data-flow map and documented consent language, and those are the artefacts that let you defend your verdict.

The template below is the scoring record to keep per flow. It is what turns "we think we're out of scope" into a dated, sourced determination you can hand to counsel or an enforcer.

Flow name:
Source (public record / supplier / SDK / pixel / purchased list / form):
First-party? (Y/N) - consumer intended to interact within last 3 years? (Y/N):
Outbound use: sold / shared / licensed / internal-only / exempt disclosure type:
Sale-or-share-for-value determination: (yes / no + reasoning):
Texas revenue prong contribution (% of trailing-12-mo revenue):
Texas volume prong contribution (# of individuals):
Resident states implicated (CA / TX / OR / VT):
Per-state verdict: CA ___ TX ___ OR ___ VT ___
Determined by / date:

Keeping the verdict current

A scope read is not a one-time document. Your verdict can flip when a new supplier feed enters the pipeline, when a customer relationship ages past the three-year window, or when your Texas revenue mix crosses either prong. Re-run the per-flow record whenever a source or an outbound use changes, and re-check the Texas thresholds each fiscal quarter rather than once a year.

Three moving parts need active monitoring. The Connecticut effective date is genuinely unsettled - one source says January 1, 2027 under Public Act 26-64, another says October 1, 2026 - so track it against the primary statute rather than trusting a survey. The Vermont fee and deadline are reported inconsistently and must be reconciled against the Vermont Secretary of State's own page before each filing. And the California DROP determination window carries a statute-versus-summary tension that you should resolve to the tighter 45-day reading until the regulation text says otherwise. Where the evidence is thin, that is the honest position: hold the conservative reading and re-verify at the primary source before you rely on the looser one.