Data broker laws

Why this matters to investigators

Registration laws at a glance

State registration laws

• California

  Law

  Cal. Civ. Code §§ 1798.99.80–1798.99.89 (Delete Act, SB 362 of 2023; amended by SB 361, Stats. 2025, ch. 466)

  Who must register

  A business that knowingly collects and sells to third parties the personal information of a consumer it has no direct relationship with. A business is excluded only to the extent it is covered by the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, California’s Insurance Information and Privacy Protection Act, or exempt HIPAA processing.

  Fee

  $6,000 for 2026, set each year by the California Privacy Protection Agency, plus a payment processing fee. The 2027 fee has not been published. A broker that first registers after the January window pays a prorated platform access fee instead, from $6,000 in January down to $500 in December (11 CCR § 7611).

  When to register

  On or before January 31 after each year the business met the definition.

  Penalties

  $200 per day for failing to register. $200 per deletion request per day for failing to delete. Plus unpaid fees and the agency’s costs.

  Deletion and opt-out

  Since August 1, 2026, registered brokers must check the state’s Delete Request and Opt-out Platform (DROP) at least once every 45 days and process requests within 45 days. They must repeat the deletion every 45 days and may not sell or share new data about the person. A request the broker cannot verify is treated as an opt-out of sale or sharing. Independent compliance audits start January 1, 2028, and repeat every three years.

  Exemptions

  Deletion is not required where the California Consumer Privacy Act’s exceptions apply (§ 1798.99.86(c)(2)). No exemption names private investigators.

  For investigators

  People-search and skip-trace vendors that sell Californians’ data must register and honor DROP requests, so expect thinner or missing results for California subjects who have filed one. Registrations must also disclose whether the broker sold data to law enforcement, government, foreign actors, or generative AI developers.

  Recent changes

  SB 361 expanded what registrations must disclose, effective January 1, 2026. DROP processing began August 1, 2026.

  Registry

  Official registry

  Delete Act text effective Jan. 1, 2026 (CPPA) Civ. Code § 1798.99.82 Data broker and DROP regulations CPPA data broker page

• Connecticut

  Law

  Public Act 26-64 (Substitute SB 4, 2026), §§ 1–10. General Statutes section numbers have not yet been assigned.

  Who must register

  A business that sells or licenses Connecticut consumers’ “brokered personal data” to another person: name, address, date or place of birth, Social Security number, biometrics, family members’ data, or other identifying information. Excluded: activity regulated by the Fair Credit Reporting Act or the Gramm-Leach-Bliley Act (to the extent regulated), HIPAA covered entities and business associates, political committees, and businesses with a contractual, investor, donor, or similar relationship with the consumer.

  Fee

  $2,500 to register and $2,500 to renew each year. Registrations expire December 31.

  When to register

  From January 1, 2027, a broker may not sell or license brokered personal data in Connecticut unless it is registered with the Department of Consumer Protection.

  Penalties

  Up to $200 per day for each violation, imposed by the Commissioner after notice and a hearing.

  Deletion and opt-out

  The Department must launch a deletion mechanism by July 1, 2028. From October 1, 2028, registered brokers must check it at least every 45 days, delete the data of verified requesters, repeat the deletion every 45 days, and treat unverified requests as opt-outs. Independent audits are due by July 1, 2031, and every three years after.

  Exemptions

  An unregistered business may sell publicly available business or profession data, health or safety alerts, or government-record data, but not if that data is “collated and combined to create a consumer profile” offered on a public website (§ 7(b)). Deletion is not required where data is reasonably needed to comply with law, respond to a subpoena, or “investigate, establish, exercise, prepare for or defend any legal claim” (§ 5(c)(5)). No exemption names private investigators.

  For investigators

  People-search sites that build public records into profiles must register; the public-records exemption does not cover them. Once deletion starts in late 2028, Connecticut subjects who use the state mechanism will drop out of registered brokers’ data. The legal-claims exception lets a broker keep data it needs for litigation; it gives investigators no right of access.

  Recent changes

  Signed May 27, 2026. Sections 1–10 took effect October 1, 2026.

  Registry

  Not live yet. The Department of Consumer Protection must post registrant information and the deletion mechanism on its website (PA 26-64 § 4).

  Public Act 26-64 SB 4 (2026) bill status

• New Jersey

  Law

  P.L.2026, c.25 (A5328), N.J.S.A. 56:8-166.20 to -166.24, amending N.J.S.A. 56:8-166.12

  Who must register

  Any person or entity that knowingly collects or buys personal data of a consumer it has no direct relationship with and sells or licenses it to a third party. The law also covers “data collectors”: businesses that sell or license data about their own customers to a data broker. Excluded: HIPAA protected health information, Gramm-Leach-Bliley financial institutions and data, consumer reporting agency data used only as the Fair Credit Reporting Act allows, Motor Vehicle Commission sales the Driver’s Privacy Protection Act permits, insurance institutions and insurance-support organizations, state agencies, and others.

  Fee

  Set by the number of New Jersey consumers whose data the broker sells: from $5,000 (100,000 or fewer) up to $1,500,000 (more than 4.5 million).

  When to register

  The duty to register each year and pay the fee took effect June 30, 2026, but no filing date or registration portal has been announced.

  Penalties

  $2,500 per day for failing to register or pay. $2,500 per day for failing to submit or update required information. $50,000 per record for selling, offering, or licensing sensitive data.

  Deletion and opt-out

  No state deletion platform. Registrants must disclose their opt-out and deletion options. Since June 30, 2026, no data broker or data collector may sell or license “sensitive data” to anyone.

  Exemptions

  Also excluded as incidental: e-commerce platforms, 411 directory services, publicly available business, profession, financial, or real estate information, health or safety alerts, and regulated title services (§ 2(e)). No exemption names private investigators.

  For investigators

  “Sensitive data” includes precise geolocation (within 1,750 feet), financial account numbers with access codes, immigration status, health, sexual orientation, and data from known children. A vendor selling any of it about New Jersey residents faces $50,000 per record. “Personal data” excludes publicly available information, including government records, so a vendor that resells only public-record data may fall outside the law. Insurance-support organizations, which can include insurance investigators, are exempt.

  Recent changes

  Introduced June 28, 2026 and approved June 30, 2026 (Senate vote 25–15).

  Registry

  Not live yet. The Division of Consumer Affairs must create a public registry; that subsection takes effect 270 days after enactment, which works out to about March 27, 2027.

  P.L.2026, c.25 A5328 bill page

• Oregon

  Law

  ORS 646A.593 (HB 2052, Or. Laws 2023 ch. 395)

  Who must register

  A business that collects and sells or licenses “brokered personal data” (name, address, date of birth, Social Security number, biometric data, and similar) about Oregon residents to another person. Excluded: activity regulated by the Fair Credit Reporting Act or the Gramm-Leach-Bliley Act (to the extent regulated), and businesses with a customer, employee, investor, donor, or similar relationship with the person.

  Fee

  $600 per year. Registrations run through December 31.

  When to register

  Before collecting, selling, or licensing brokered personal data in Oregon. The Division of Financial Regulation asks for renewal at least 30 days before December 31.

  Penalties

  Up to $500 per violation, or $500 per day for a continuing violation, capped at $10,000 per calendar year.

  Deletion and opt-out

  No state deletion platform. Registrants must say whether and how residents can opt out, and whether an authorized agent can opt out for them. The Division publishes these statements.

  Exemptions

  No registration is needed if the activity involves only publicly available business or profession information, health or safety alerts, information lawfully available from government records, news publishing, e-commerce software, directory assistance, or one-time asset sales (ORS 646A.593(2)(b)). No exemption names private investigators.

  For investigators

  A vendor that sells only government-record data may not have to register. Separately, HB 2008 (Or. Laws 2025 ch. 251, effective January 1, 2026) bars businesses covered by the Oregon Consumer Privacy Act from selling precise geolocation data (within 1,750 feet), which limits location-data products. SB 1587 (Or. Laws 2026 ch. 96, effective June 5, 2026) bars Oregon public bodies from giving personal information to a data broker unless it attests in writing that the data will not go to immigration enforcement.

  Recent changes

  The 2025 edition of the statutes shows no amendment to ORS 646A.593 itself.

  Registry

  Official registry

  ORS chapter 646A Oregon data broker registry HB 2008 (2025) SB 1587 (2026)

• Texas

  Law

  Texas Business and Commerce Code ch. 510 (formerly ch. 509; SB 2105 of 2023, renumbered by HB 1620 and amended by SB 1343 and SB 2121 in 2025)

  Who must register

  A business that collects, processes, or transfers personal data it did not collect directly from the individual. The chapter applies only if, in a 12-month period, the business gets more than half its revenue from that data, or earns revenue from that data on more than 50,000 individuals. Publicly available information, deidentified data, and employee data fall outside the chapter.

  Fee

  $300 to register and $300 to renew each year.

  When to register

  Before doing business in Texas, then every year on the anniversary of the certificate.

  Penalties

  At least $100 per day, capped at $10,000 per broker in any 12 months, plus unpaid fees and the Attorney General’s costs. A breach of the security-program duty (§ 510.007) is a deceptive trade practice.

  Deletion and opt-out

  No state deletion platform. Brokers must post a “data broker” notice explaining how to use rights under the Texas Data Privacy and Security Act. Since September 1, 2025, registrations must link to those instructions.

  Exemptions

  Consumer reporting agencies and furnishers and users of consumer reports, only to the extent they act under the Fair Credit Reporting Act. Also exempt: Gramm-Leach-Bliley financial institutions and data, government entities, service providers, and missing-children clearinghouses. No exemption names private investigators.

  For investigators

  Most people-search and skip-trace vendors serving Texas must register. SB 2121 removed the “principal source of revenue” test, so more vendors are now covered.

  Recent changes

  Effective September 1, 2025: renumbered from chapter 509 to 510 (HB 1620), definition broadened (SB 2121), and consumer-rights link required (SB 1343).

  Registry

  Official registry

  Bus. & Com. Code ch. 510 SB 2121 (2025) enrolled Texas data broker registry

• Vermont

  Law

  9 V.S.A. §§ 2430, 2431, 2446, 2447 (Act 171 of 2018; rewritten by 2025, No. 138 (Adj. Sess.), effective January 1, 2027)

  Who must register

  A business that knowingly collects and sells or licenses to third parties the “brokered personal information” of a Vermont consumer it has no direct relationship with. From January 1, 2027, brokered personal information means any information linked or reasonably linkable to a person, excluding publicly available information. The consumer must also have intentionally interacted with the business for a direct relationship to exist.

  Fee

  $100 per year through 2026. From January 1, 2027: $900 per year, a $20,000 bond, and $100 per amendment.

  When to register

  Through 2026: on or before January 31 after each year the business met the definition. From 2027: within 30 days of becoming a data broker, then every year on or before July 1.

  Penalties

  Through 2026: $50 per day, capped at $10,000 per year. From 2027: $200 per day for failing to register. Omitted information not supplied within 30 days: $1,000 per day. Materially incorrect information: $25,000, plus $1,000 per day if it is not corrected within 30 days of discovery or notice. Violations are also unfair and deceptive acts.

  Deletion and opt-out

  No state deletion platform. From 2027 a registration must link to the broker’s deletion page, if any, and its opt-out instructions. The Secretary of State is studying a California-style deletion mechanism, with reports due December 1, 2027 and December 1, 2028.

  Exemptions

  Current law excludes publicly available business or profession information, 411 directory services, e-commerce platforms, and health or safety alert services. There is no Fair Credit Reporting Act exemption; from 2027 registrants must state whether the Act regulates them. No exemption names private investigators.

  For investigators

  From January 1, 2027, brokers must require buyers to identify themselves, state their purpose, and certify they will use the data for no other purpose. Brokers must make a reasonable effort to verify the buyer and must refuse a sale if they believe the data will be misused (§ 2431(b)). Expect identity and purpose checks from vendors selling Vermont data. Acquiring brokered data “through fraudulent means”, or using it to stalk or harass, is already barred (§ 2431(a)).

  Recent changes

  Signed June 16, 2026. The rewrite takes effect January 1, 2027; the deletion study began July 1, 2026.

  Registry

  Official registry

  9 V.S.A. § 2430 9 V.S.A. § 2431 9 V.S.A. § 2446 Act 138 as enacted Vermont data broker page

Federal law

• Protecting Americans’ Data from Foreign Adversaries Act of 2024

  A data broker may not sell or otherwise make available personally identifiable sensitive data of a U.S. resident to a foreign adversary country or an entity it controls. Sensitive data includes government IDs, precise geolocation, financial account data, health data, biometrics, private communications, and military status. The Federal Trade Commission enforces it. In force since June 23, 2024.

  For investigators: The duty falls on the broker, not the buyer. It matters to a firm controlled by a foreign adversary, for example one that is 20% or more owned by people domiciled in a foreign adversary country: a broker may not sell it covered sensitive data.

  15 U.S.C. ch. 123 15 U.S.C. § 9901 (Pub. L. 118-50, div. I)

• DOJ bulk sensitive data rule

  U.S. persons may not knowingly engage in data brokerage of government-related data or bulk U.S. sensitive personal data with a country of concern (China, Cuba, Iran, North Korea, Russia, Venezuela) or a covered person. Brokerage with any other foreign person requires a contract barring onward transfer to those countries. Bulk thresholds include identifiers on more than 100,000 U.S. persons, precise geolocation on more than 1,000 devices, and financial or health data on more than 10,000 persons. In force since April 8, 2025.

  For investigators: It does not regulate a U.S. investigator buying from or selling to U.S. persons. It matters if a firm shares bulk data with an overseas client or subcontractor.

  28 C.F.R. Part 202 28 C.F.R. Part 202 (Executive Order 14117)

• CFPB proposed data broker rule (withdrawn)

  Would have treated data brokers that sell certain consumer data as consumer reporting agencies, and made “credit header” data (name, date of birth, address, Social Security number, phone) a consumer report. The Consumer Financial Protection Bureau withdrew the proposal on May 15, 2025.

  For investigators: Had it been adopted, investigator tools built on credit header data would have needed a Fair Credit Reporting Act permissible purpose for every search. With the withdrawal, current practice continues. The Act still applies whenever an investigator obtains an actual consumer report.

  Proposed rule Withdrawal 89 FR 101402 (Dec. 13, 2024); withdrawn at 90 FR 20568 (May 15, 2025)

Home address takedown laws for judges and officers

• Illinois: Judicial Privacy Act

  Law

  705 ILCS 90 (amended by P.A. 104-278, effective January 1, 2026)

  Who is protected

  Active, former, and deceased federal and Illinois judges and justices. Administrative law judges are covered from January 1, 2026.

  Who must comply

  All persons, businesses, and associations, expressly including internet phone directories, search engines, data aggregators, and internet service providers. After a request they also may not transfer the information to anyone.

  Deadline after a request

  72 hours

  Remedies

  Injunctive or declaratory relief, with costs and attorney’s fees if relief is granted. Posting the information when the person knows or reasonably should know it poses an imminent and serious threat is a Class 3 felony if the posting is a proximate cause of bodily injury or death.

  705 ILCS 90 705 ILCS 90/3-1

• Maryland: Judge Andrew F. Wilkinson Judicial Security Act

  Law

  Md. Code, Courts and Judicial Proceedings §§ 3-2301 to 3-2304 (2024 Md. Laws ch. 415)

  Who is protected

  Current and retired Maryland judges and justices, federal judges and magistrate judges living in Maryland, circuit court magistrates, and District Court commissioners, plus a spouse, child, or dependent in the same household.

  Who must comply

  Any person who has published the protected person’s information to the public online: home address, phone numbers, personal email, Social Security number, license plate, school, or place of worship. Information shown as part of news or other speech on matters of public concern is excluded.

  Deadline after a request

  72 hours

  Remedies

  The protected person, or the Judiciary’s Office of Information Privacy, may sue for declaratory or injunctive relief, damages, and attorney’s fees; punitive damages for a willful refusal. Knowingly publishing the information when the person knows or should know it poses an imminent and serious threat, if assault, harassment, trespass, or property destruction results, is a misdemeanor (up to 18 months, $5,000, or both).

  2024 Md. Laws ch. 415

• Minnesota: Judicial official personal information protections

  Law

  Minn. Stat. §§ 480.40, 480.45 (2024 ch. 123; amended 2025 ch. 35 and 2026 ch. 97)

  Who is protected

  Minnesota state judges (including senior and retired), federal judges living in Minnesota, judicial branch employees, referees, and certain administrative judges and staff. The 2026 amendment adds judges and employees of the state’s Unemployment Insurance and Paid Leave appeals divisions.

  Who must comply

  Any person, business, association, or government entity that posts the information online, after a sworn removal request. Exempt: activity regulated by the Fair Credit Reporting Act, uses the Driver’s Privacy Protection Act permits, Gramm-Leach-Bliley data, insurers, and commercial use to prevent fraud or investigate illegal activity. “Personal information” excludes publicly available information, including anything lawfully available from government records.

  Deadline after a request

  30 days

  Remedies

  A court order compelling compliance. Damages, costs, and attorney fees are available only if the defendant knowingly violates that order.

  Minn. Stat. § 480.40 Minn. Stat. § 480.45 2026 Minn. Laws ch. 97

• Missouri: Missouri Judicial Privacy Act

  Law

  RSMo §§ 476.1300–476.1313 (2023 S.B. 103; amended 2025)

  Who is protected

  “Court-related officers”: federal and state judges, prosecutors and their employees, circuit clerks, court administrators, and juvenile officers, plus immediate family.

  Who must comply

  Persons and businesses that post the information online, expressly including internet data aggregators.

  Deadline after a request

  5 business days

  Remedies

  Injunctive or declaratory relief, plus costs and attorney fees.

  RSMo § 476.1306

• New Jersey: Daniel’s Law

  Law

  N.J.S.A. 56:8-166.1 and 2C:20-31.1 (P.L.2020, c.125; amended by P.L.2021, c.371 and P.L.2023, c.113)

  Who is protected

  Active, former, and retired judges, law enforcement officers, prosecutors, and child protective investigators, plus immediate family in the same household.

  Who must comply

  Any person, business, or association that discloses or re-discloses a covered person’s home address or unpublished home phone number, including making it viewable in a searchable database. A covered person can assign the claim in writing to another party, which can sue.

  Deadline after a request

  10 business days

  Remedies

  Actual damages, but at least $1,000 per violation; punitive damages for willful or reckless disregard; attorney’s fees and costs. Posting a covered person’s home address after notice, with purpose to expose them to harassment or harm or in reckless disregard of that risk, is a crime: fourth degree if reckless, third degree if purposeful.

  Court rulings

  On August 12, 2026, answering a question from the Third Circuit, the New Jersey Supreme Court held that a defendant can be liable for actual damages without any particular mental state. In 2025 the court rejected a journalist’s as-applied free-speech challenge under the New Jersey Constitution, applying First Amendment principles. The Third Circuit has not yet ruled on the law’s constitutionality as of October 16, 2026.

  P.L.2023, c.113 P.L.2020, c.125 Atlas Data Privacy Corp. v. We Inform (N.J. 2026) Kratovil v. City of New Brunswick (N.J. 2025)

• New York: New York State Judicial Security Act

  Law

  N.Y. Judiciary Law § 859 (article 22-C)

  Who is protected

  Active and former state judges and federal judges sitting in New York, and optionally their immediate family. The court system’s Office of Court Administration sends the notice by certified mail.

  Who must comply

  Anyone making the information public. Exempt: consumer reporting agencies under the Fair Credit Reporting Act, Gramm-Leach-Bliley institutions, news, information received from a public agency, and uses the Driver’s Privacy Protection Act permits.

  Deadline after a request

  72 hours

  Remedies

  Injunctive or declaratory relief with fees. A private party who violates the court’s order can owe up to treble damages, at least $4,000.

  Judiciary Law § 859

• Wisconsin: Judicial privacy

  Law

  Wis. Stat. § 757.07 (2023 Wis. Act 235; amended by 2025 Acts 25, 129, and 130)

  Who is protected

  Current and former justices, judges (appeals, circuit, municipal, tribal, and reserve), and court commissioners, plus immediate family. Requests use a notarized form and last 10 years.

  Who must comply

  Data brokers must stop selling the information, and other persons and businesses must remove it and not transfer it. The data broker definition excludes Fair Credit Reporting Act, Driver’s Privacy Protection Act, Gramm-Leach-Bliley, HIPAA, government-record, and fraud-investigation uses.

  Deadline after a request

  10 business days

  Remedies

  Injunctive or declaratory relief with costs and attorney fees. Intentionally posting the information to threaten is a Class G felony.

  Wis. Stat. § 757.07

• Federal: Daniel Anderl Judicial Security and Privacy Act of 2022

  Law

  Pub. L. 117-263, div. E, title LIX, subtitle D, §§ 5931–5939

  Who is protected

  Federal judges (including senior, recalled, and retired) and their spouse, parent, sibling, child, or anyone in their household.

  Who must comply

  Data brokers may not knowingly sell, license, trade, transfer, or buy these people’s covered information (home address, personal phone and email, Social Security number, date of birth, license plate, children’s schools, employer, and similar), with no request needed. Others must take posted information down within 72 hours of a written request. The data broker definition excludes consumer reporting agencies, Gramm-Leach-Bliley financial institutions, and HIPAA covered entities.

  Deadline after a request

  72 hours

  Remedies

  No private suit for damages. The Administrative Office of the U.S. Courts may seek an injunction through the Justice Department; a private party who knowingly violates that order can owe actual damages, costs, and attorney’s fees.

  Pub. L. 117-263