Do you need to register as a data broker to sell data to AI?

AI developers pay for company records, and a sale of personal data is what state data broker laws regulate. This guide sets out the six state registration laws enacted by November 2026, how each defines a data broker, the exemptions and the federal rules on foreign buyers. It describes what the laws say, not how they apply to your records, so take independent legal advice before you sign a license.

Do you need to register as a data broker to sell data to AI?

You usually do not need to register as a data broker to sell data to AI if the data is about your own customers, users or staff. The state registration laws are aimed mainly at businesses that sell or license personal data about consumers they have no direct relationship with.

Registration can still apply if you hold personal data you bought or received from others, if relationships have lapsed under California's three-year test or if you sell to a data broker in New Jersey. Even with no registry, the license is still a sale under state privacy laws such as the CCPA, covered in our guide to CCPA, state privacy laws and GDPR.

Which states have data broker registration laws?

Six states have data broker registration laws: California, Vermont, Texas and Oregon run registries now, and Connecticut and New Jersey registration starts in 2027. Annual fees run from $100 in Vermont to $1.5 million for the largest brokers in New Jersey.

What counts as a data broker in California?

A data broker in California is "a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship", under Civil Code section 1798.99.80(c). The Delete Act of 2023 gave the registry to the California Privacy Protection Agency (CPPA).

The CPPA's data broker regulations narrow what counts as a direct relationship. A consumer must have intentionally interacted with the business "within the preceding three years", and a business "is still a data broker" if it also sells personal information about that consumer that it did not collect directly from them.

• Exclusions cover entities to the extent the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or the Insurance Information and Privacy Protection Act covers them, and HIPAA-exempt processing
• The CPPA set the 2026 registration fee at $6,000 plus a processing charge
• Since August 1, 2026 brokers must check the Delete Request and Opt-out Platform (DROP) at least every 45 days, or face a $200 fine per request per day
• From January 1, 2028 brokers need an independent audit every three years
• Section 1798.99.82(b)(2)(S) makes brokers disclose whether they sold or shared consumers' data with a generative AI developer in the past year

Our California seller guide covers the rest of California law on AI licensing.

How do Vermont, Texas and Oregon define a data broker?

Vermont, Texas and Oregon define a data broker by where the data came from. Each excludes a business's own customers or employees in some form, with different wording.

Vermont

Vermont's definition in 9 V.S.A. 2430 covers a business that "knowingly collects and sells or licenses" brokered personal information about consumers it has no direct relationship with. The current text lists past or present customers, employees, contractors, investors and donors as direct relationships, and excludes a license "merely incidental to the business".

Act 138 of the 2025 adjourned session, effective January 1, 2027, widens the data covered to any information reasonably linkable to a person and drops the incidental exclusion. Under section 2446 the fee rises to $900.

Texas

Texas covers a business that "collects, processes, or transfers personal data that the business entity did not collect directly", after SB 2121 took effect on September 1, 2025. It applies only where, in 12 months, over 50% of revenue comes from that data or the business earns revenue from such data on over 50,000 people.

The 2023 law, SB 2105, sets a $300 fee and exempts employee data and conditionally de-identified data. The employee data exemption is narrow: applicant, business contact, emergency contact and benefits information collected solely for those purposes. See our Texas seller guide.

Oregon

Oregon's ORS 646A.593 defines a data broker as a business "that collects and sells or licenses brokered personal data to another person". It excludes a business collecting information about its own customers, employees, agents, investors or donors, and businesses acting on their behalf. The 2024 rule order sets a $600 annual fee.

What changes in Connecticut and New Jersey in 2027?

Connecticut and New Jersey both start registration in 2027, and New Jersey's law reaches further than any earlier one. Connecticut's Public Act 26-64, signed May 27, 2026, bars unregistered brokers from selling or licensing brokered personal data from January 1, 2027, according to Fox Rothschild and Davis+Gilbert.

New Jersey's P.L. 2026, c.25, approved June 30, 2026, adds a data collector: a business with a direct relationship with consumers that sells or licenses their personal data to a data broker. It also states that "in no case shall a data broker or data collector sell or license sensitive data", with a $50,000 civil penalty for each record. Sensitive data includes health, biometric, precise geolocation and children's data.

A company licensing its own customer or employee records is usually not a data broker, because those people have a direct relationship with it. The exceptions come from where the records came from and what the buyer does next.

• Bought or received data: lists and records acquired from another business were not collected directly
• Lapsed customers: a California customer who last interacted more than three years ago may no longer count as a direct relationship
• Client data you hold as a vendor: an agency or call center has no direct relationship with its clients' customers, and client contracts usually forbid a sale anyway
• Sales to brokers and sensitive data: New Jersey's 2026 law covers both

Our guide to whether you can legally sell company data for AI covers the contract and copyright checks that sit alongside these laws.

Does de-identified data fall outside data broker laws?

De-identified data falls outside most state data broker laws only if it meets the statutory test. The CCPA's definition in Civil Code section 1798.140(m) requires that data cannot reasonably be linked to a consumer and that the business publicly commits not to re-identify it and contractually binds recipients to the same.

Texas sets the same three conditions, and New Jersey excludes de-identified data on similar terms. The FTC said in July 2024 that hashing does not make data anonymous. The federal bulk data rule in 28 CFR 202.206 applies "regardless of whether the data is anonymized, pseudonymized, de-identified, or encrypted". Our de-identification guide and the de-identification entry explain the methods.

What federal laws apply when you sell data to AI companies?

No federal law requires data broker registration, but the FTC Act, the Protecting Americans' Data from Foreign Adversaries Act of 2024 and the Justice Department's Data Security Program all apply when you sell data to AI companies.

The FTC Act

Section 5 of the FTC Act covers unfair or deceptive practices. In February 2024 the FTC warned that quietly changing terms of service or a privacy policy to allow new uses such as AI training could be unfair or deceptive.

The Protecting Americans' Data from Foreign Adversaries Act

The Protecting Americans' Data from Foreign Adversaries Act (15 USC 9901), in force since June 23, 2024, makes it unlawful for a data broker to sell, license or otherwise make available personally identifiable sensitive data of US individuals to a foreign adversary country or an entity it controls. Sensitive data includes health, financial, biometric, genetic and precise geolocation data and data on people under 17.

A data broker here is an entity that, for valuable consideration, makes available data of US individuals that it did not collect directly from them. An entity counts as controlled if foreign adversary persons hold at least a 20% stake. On February 9, 2026 the FTC sent warning letters to 13 data brokers, citing penalties of up to $53,088 per violation.

The DOJ bulk sensitive data rule

The Justice Department's Data Security Program, 28 CFR Part 202, in effect since April 8, 2025, prohibits US persons from data brokerage with countries of concern or covered persons involving bulk US sensitive personal data. It applies to any US company, not only registered brokers, and covers licensing access to data.

The countries of concern in 28 CFR 202.601 are China, Cuba, Iran, North Korea, Russia and Venezuela. For data brokerage with any other foreign person, 28 CFR 202.302 requires a contract term barring onward transfer to a country of concern, and a report within 14 days of a known or suspected breach of it. Civil penalties under 28 CFR 202.1301 reach $368,136 or twice the transaction value, whichever is greater.

What if you hold UK or EU data?

If you hold UK or EU data, there is no separate data broker register to join. UK GDPR and EU GDPR apply to any personal data you license whether or not you are a broker, so you need a lawful basis and a compatible purpose. The data privacy laws by country guide compares the rules.

How do you check whether a data broker law applies before you license data?

You check whether a data broker law applies by tracing every record to its source and every buyer to its owner before any sample leaves your systems.

1. 1

   Trace the source of each record

   Separate data collected directly from customers and staff from data you bought or hold for clients.

2. 2

   Check how recent the relationships are

   Flag California consumers with no interaction in the preceding three years.

3. 3

   Find sensitive data

   Health, biometric, geolocation and children's data carry the most risk under New Jersey law and the federal rules.

4. 4

   Ask what the buyer does next

   Confirm whether it trains its own models or resells data, and who owns it.

5. 5

   Take advice and register if required

   Have a privacy lawyer confirm the position in each state, and register before the sale if a law applies.

We verify every buyer's company identity, intended use and onward transfer limits before it sees a sample. See how we vet, or request a free data valuation for a realistic range and the rights issues to clear first.