State Data Broker Registries Compared: What Each One Actually Publishes

A Registry Is Also a Publication

A registration statute has two outputs. One faces the regulator: a form arrives, a fee is paid, and an agency acquires a list of who is operating in a market that otherwise leaves few traces. The other faces everyone else, because each of these four statutes directs the agency to publish. Those two outputs are frequently discussed as if they were the same thing. They are not, and the gap between them is wide enough that the four registries offer the public materially different objects.

Read as publications rather than as obligations, the four sort into two groups. California's registry is a dataset: the agency publishes the complete set of responses as a downloadable file, for the current cycle and for prior years. Vermont, Texas and Oregon publish an interface — a search box, or a lookup keyed to opt-out information — that answers a question about a named company and does not hand over the corpus. That distinction determines what can be said about each with any precision.

What the California File Held

The California Privacy Protection Agency, which now brands itself CalPrivacy, publishes the registry at its data broker registry page with a download control offering the complete set of registration responses, alongside archived files for prior registration years. The current file retrieved on September 7, 2026 contained 603 rows carrying 603 distinct registrant names across 77 columns.

The two archived files on the same page each held 543 registrants. The registry file labelled 2024 carries 543 rows; the file labelled 2025 carries 543 rows across 67 columns, with an internal notes row above the header. Between the most recent archived cycle and the current one the registrant count rose by 60, or about eleven per cent.

Civil Code section 1798.99.82(a) sets the timing that produces those files: "On or before January 31 following each year in which a business meets the definition of data broker as provided in this title, the business shall register with the California Privacy Protection Agency." The agency states the same window on the registry page, describing registration as occurring annually between January 1 and 31 to report on activities from the previous calendar year.

The Questions That Were Added for This Cycle

The current file is wider than its predecessor because the statute grew. Senate Bill 361, chaptered as Stats. 2025, ch. 466 and effective January 1, 2026, amended section 1798.99.82 to add a block of disclosures about recipients rather than about collection. Subparagraphs (O) through (S) of subdivision (b)(2) now ask whether the data broker has shared or sold consumers' data, in the past year, to a foreign actor; to the federal government; to other state governments; to law enforcement, "unless that data was shared pursuant to a subpoena or court order"; and "to a developer of a GenAI system or model."

Two of those turn on defined terms supplied in the same amendment. Subdivision (f)(1) defines a "foreign actor" as either the government of a foreign adversary country or an entity organised under the laws of, or having its principal place of business in, such a country, with "foreign adversary country" carrying the meaning of "covered nation" as defined in section 4872 of title 10 of the United States Code. Subdivision (f)(3) defines a generative artificial intelligence system as one "that can generate derived synthetic content, including text, images, video, and audio, that emulates the structure and characteristics of the system's training data," and subdivision (f)(2) defines a developer of such a system as an entity that designs, codes, produces or substantially modifies one.

None of these five columns appears in the 2025 file. Neither do the columns asking whether the registrant collects citizenship data including immigration status, union membership status, sexual orientation status, gender identity and gender expression data, or biometric data — the 2025 form asked about minors, precise geolocation and reproductive health care data alone. Two further additions sit in the statute with later dates: subparagraph (T) requires up to three of the most common types of personal information collected where the registrant does not collect the categories named in subparagraphs (D) and (G), and subparagraph (U) begins January 1, 2029 and asks whether the broker has undergone an audit.

What the 603 Registrants Answered

Because the answers are published as data, they can be counted. The following are yes answers in the file retrieved on September 7, 2026, expressed against the 603 registrants in it.

The file also carries a self-identification of overlapping federal regulation, and those figures are small: 17 registrants report that they or a subsidiary are regulated by the Fair Credit Reporting Act, 20 by the Gramm-Leach-Bliley Act, and 29 by the HIPAA privacy, security and breach-notification rules. Beyond the yes-or-no fields, the current form collects per-right request metrics — totals received, complied in whole, complied in part, denied, and mean and median days to respond substantively — for deletion, the two flavours of request to know, opt-out of sale or sharing, and requests to limit the use of sensitive personal information.

These are counts of answers, not findings about the market. A yes is what a registrant reported about itself on a form, and a no may reflect a judgment about a definition rather than an absence of the activity. The registry's value as a published artifact is that both the question and the answer are on the record and can be checked.

What the Other Three Publish

Vermont's registry is administered by the Secretary of State, which describes the definition it applies — a business that "knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship," citing 9 V.S.A. § 2430(4)(A) — and states that "an Annual Registration is required between January 1st and January 31st following each calendar year in which you meet the definition a data broker." The public output is a Data Broker Search page. Retrieved for this piece, it returned an interface rather than a listing, and no total is stated.

Texas directs filers to the Secretary of State, which maintains what it describes as a searchable, central Data Broker Registry, hosted on a separate portal. Oregon's registry sits with the Division of Financial Regulation, which sets out the three steps a registrant completes — an active Oregon business registration with the Secretary of State, an application through eGov with the fee, and a narrative under 600 characters describing how consumers may opt out — and publishes an opt-out information resource keyed to registered brokers. Neither state's page states how many brokers are currently registered.

The fees diverge more sharply than any other feature. Vermont's fee schedule lists data broker registration at $100.00 under 9 V.S.A. § 2446. Texas charges $300 to register and $300 to renew, with a certificate expiring on the first anniversary of issuance. Oregon charges $600, with renewal at least 30 days before expiration. California sets its fee by regulation: section 7600(a) of title 11 of the California Code of Regulations, in the final regulations text published by the agency, carries the annual fee amended to $6,600 plus a third-party electronic payment processing charge not to exceed 2.99 per cent, and subsection (d) provides that the fee "cannot be prorated and is nonrefundable." The statutory ceiling behind that number is in section 1798.99.82(b)(1), which caps the fee at the reasonable costs of maintaining the informational website and the accessible deletion mechanism.

Where the Comparison Runs Out

Three of the four registries could not be counted for this piece. The Vermont search page and the Texas portal both returned application shells rather than listings when retrieved directly, and neither they nor the Oregon page publishes a registrant total. No number is offered here for Vermont, Texas or Oregon, and the absence is a limit of what those registries publish rather than an estimate withheld.

The California figures carry a narrower caveat. They are a snapshot of a file retrieved on one day, and registrations are added and lapse during a year, so a later download will differ. The counts above were taken from the published file itself rather than from any summary of it, and the file remains available on the agency's registry page for anyone who wants to repeat the count.

One structural point survives all of that. Where a registry publishes its filings as data, the disclosures become checkable by anyone, and a statutory amendment such as Senate Bill 361 produces a visible change in the record within a single cycle. Where a registry publishes a lookup, the same statutory disclosures exist on file and cannot be read in aggregate by the public at all.

Frequently Asked Questions