# Do you need to register as a data broker to sell data to AI?

URL: https://sellmydatatoai.net/guides/do-you-need-to-register-as-a-data-broker
Reviewed: 2026-11-08

Most companies that license their own customer or employee records to an AI buyer do not need to register as a data broker. The six state registration laws target businesses that sell data about people they have no direct relationship with. Data you bought, lapsed California relationships, sales to resellers in New Jersey and sensitive data can still bring you within scope.

## Key takeaways

- Six states have data broker registration laws: California, Vermont, Texas and Oregon now, with Connecticut and New Jersey registration starting in 2027.
- Each law targets businesses that sell personal data about people they have no direct relationship with, so licensing records about your own customers or staff is usually outside it.
- California counts a direct relationship only for interactions in the preceding three years, and New Jersey makes a business that sells to a data broker register as a data collector.
- De-identified data is excluded in California, Texas and New Jersey only if you meet set conditions. The DOJ's bulk data rule applies even to anonymized data.
- Federal law bars data brokers from making sensitive data available to entities controlled by China, Russia, Iran or North Korea, and the FTC enforces it.

AI developers pay for company records, and a sale of personal data is what state data broker laws regulate. This guide sets out the six state registration laws enacted by November 2026, how each defines a data broker, the exemptions and the federal rules on foreign buyers. It describes what the laws say, not how they apply to your records, so take independent legal advice before you sign a license.

## Do you need to register as a data broker to sell data to AI?

You usually do not need to register as a data broker to sell data to AI if the data is about your own customers, users or staff. The state registration laws are aimed mainly at businesses that sell or license personal data about consumers they have no direct relationship with.

Registration can still apply if you hold personal data you bought or received from others, if relationships have lapsed under California's three-year test or if you sell to a data broker in New Jersey. Even with no registry, the license is still a sale under state privacy laws such as the CCPA, covered in our guide to [CCPA, state privacy laws and GDPR](https://sellmydatatoai.net/guides/gdpr-and-selling-data-for-ai-training).

## Which states have data broker registration laws?

Six states have data broker registration laws: California, Vermont, Texas and Oregon run registries now, and Connecticut and New Jersey registration starts in 2027. Annual fees run from $100 in Vermont to $1.5 million for the largest brokers in New Jersey.

| State and law | Who counts as a data broker | Registry and fee | Penalty for not registering |
| --- | --- | --- | --- |
| California, Delete Act | Knowingly collects and sells personal information of consumers it has no direct relationship with | CPPA, January 1 to 31 each year, $6,000 for 2026 | $200 a day, plus unpaid fees and costs |
| Vermont, 9 V.S.A. 2430 and 2446 | Knowingly collects and sells or licenses brokered personal information of consumers it has no direct relationship with | Secretary of State, $100 by January 31. From 2027: $900, then by July 1 each year | $50 a day up to $10,000 a year. From 2027: $200 a day |
| Texas, Business and Commerce Code Chapter 509 | Processes or transfers personal data it did not collect directly, above a revenue or volume threshold | Secretary of State, $300 a year | At least $100 a day, up to $10,000 in 12 months |
| Oregon, ORS 646A.593 | Collects and sells or licenses brokered personal data, excluding data on its own customers and staff | Department of Consumer and Business Services, $600 a year | Up to $500 a violation or a day, up to $10,000 a year |
| Connecticut, Public Act 26-64 | Sells or licenses brokered personal data, with a carve-out for direct relationships | Department of Consumer Protection, $2,500, from January 1, 2027 | Up to $200 a day, per law firm summaries |
| New Jersey, P.L. 2026, c.25 | A data broker with no direct relationship, and a data collector that sells its own consumers' data to a data broker | Division of Consumer Affairs, $5,000 to $1.5 million by consumer count, registry operative in 2027 | $2,500 a day, plus fees |

## What counts as a data broker in California?

A data broker in California is "a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship", under [Civil Code section 1798.99.80(c)](https://www.cppa.ca.gov/regulations/pdf/data_broker_reg_delete_act_statute_eff_20260101.pdf). The Delete Act of 2023 gave the registry to the California Privacy Protection Agency (CPPA).

The CPPA's [data broker regulations](https://www.cppa.ca.gov/regulations/pdf/20241226_dbr_final.pdf) narrow what counts as a direct relationship. A consumer must have intentionally interacted with the business "within the preceding three years", and a business "is still a data broker" if it also sells personal information about that consumer that it did not collect directly from them.

- Exclusions cover entities to the extent the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or the Insurance Information and Privacy Protection Act covers them, and HIPAA-exempt processing
- The [CPPA](https://cppa.ca.gov/data_brokers/) set the 2026 registration fee at $6,000 plus a processing charge
- Since August 1, 2026 brokers must check the Delete Request and Opt-out Platform (DROP) at least every 45 days, or face a $200 fine per request per day
- From January 1, 2028 brokers need an independent audit every three years
- Section 1798.99.82(b)(2)(S) makes brokers disclose whether they sold or shared consumers' data with a generative AI developer in the past year

Our [California seller guide](https://sellmydatatoai.net/guides/sell-company-data-to-ai-in-california) covers the rest of California law on AI licensing.

## How do Vermont, Texas and Oregon define a data broker?

Vermont, Texas and Oregon define a data broker by where the data came from. Each excludes a business's own customers or employees in some form, with different wording.

### Vermont

Vermont's definition in [9 V.S.A. 2430](https://legislature.vermont.gov/statutes/section/09/062/02430) covers a business that "knowingly collects and sells or licenses" brokered personal information about consumers it has no direct relationship with. The current text lists past or present customers, employees, contractors, investors and donors as direct relationships, and excludes a license "merely incidental to the business".

Act 138 of the 2025 adjourned session, effective January 1, 2027, widens the data covered to any information reasonably linkable to a person and drops the incidental exclusion. Under [section 2446](https://legislature.vermont.gov/statutes/section/09/062/02446) the fee rises to $900.

### Texas

Texas covers a business that "collects, processes, or transfers personal data that the business entity did not collect directly", after [SB 2121](https://capitol.texas.gov/tlodocs/89R/billtext/html/SB02121F.htm) took effect on September 1, 2025. It applies only where, in 12 months, over 50% of revenue comes from that data or the business earns revenue from such data on over 50,000 people.

The 2023 law, [SB 2105](https://capitol.texas.gov/tlodocs/88R/billtext/html/SB02105F.htm), sets a $300 fee and exempts employee data and conditionally de-identified data. The employee data exemption is narrow: applicant, business contact, emergency contact and benefits information collected solely for those purposes. See our [Texas seller guide](https://sellmydatatoai.net/guides/sell-company-data-to-ai-in-texas).

### Oregon

Oregon's [ORS 646A.593](https://oregon.public.law/statutes/ors_646a.593) defines a data broker as a business "that collects and sells or licenses brokered personal data to another person". It excludes a business collecting information about its own customers, employees, agents, investors or donors, and businesses acting on their behalf. The [2024 rule order](https://dfr.oregon.gov/laws-rules/Documents/fsr03-2024_rule-order.pdf) sets a $600 annual fee.

## What changes in Connecticut and New Jersey in 2027?

Connecticut and New Jersey both start registration in 2027, and New Jersey's law reaches further than any earlier one. Connecticut's Public Act 26-64, signed May 27, 2026, bars unregistered brokers from selling or licensing brokered personal data from January 1, 2027, according to [Fox Rothschild](https://dataprivacy.foxrothschild.com/2026/06/articles/general-privacy-data-security-news-developments/connecticuts-new-data-broker-law-sb-4-what-businesses-need-to-know/) and [Davis+Gilbert](https://www.dglaw.com/connecticuts-newly-enacted-data-broker-law-how-it-stacks-up-against-californias-delete-act/).

New Jersey's [P.L. 2026, c.25](https://pub.njleg.gov/Bills/2026/AL26/25_.HTM), approved June 30, 2026, adds a data collector: a business with a direct relationship with consumers that sells or licenses their personal data to a data broker. It also states that "in no case shall a data broker or data collector sell or license sensitive data", with a $50,000 civil penalty for each record. Sensitive data includes health, biometric, precise geolocation and children's data.

> **Who your buyer is matters in New Jersey** Licensing your customers' data to an AI developer that trains its own models is not, on the face of the definition, a sale to a data broker. Licensing the same records to a reseller could make you a data collector. Ask every buyer whether it resells.

## Is a company licensing its own customer or employee records a data broker?

A company licensing its own customer or employee records is usually not a data broker, because those people have a direct relationship with it. The exceptions come from where the records came from and what the buyer does next.

- Bought or received data: lists and records acquired from another business were not collected directly
- Lapsed customers: a California customer who last interacted more than three years ago may no longer count as a direct relationship
- Client data you hold as a vendor: an agency or call center has no direct relationship with its clients' customers, and client contracts usually forbid a sale anyway
- Sales to brokers and sensitive data: New Jersey's 2026 law covers both

Our guide to [whether you can legally sell company data for AI](https://sellmydatatoai.net/guides/can-you-legally-sell-company-data-for-ai) covers the contract and copyright checks that sit alongside these laws.

## Does de-identified data fall outside data broker laws?

De-identified data falls outside most state data broker laws only if it meets the statutory test. The CCPA's definition in [Civil Code section 1798.140(m)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.140.&lawCode=CIV) requires that data cannot reasonably be linked to a consumer and that the business publicly commits not to re-identify it and contractually binds recipients to the same.

Texas sets the same three conditions, and New Jersey excludes de-identified data on similar terms. The FTC said in July 2024 that [hashing does not make data anonymous](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous). The federal bulk data rule in [28 CFR 202.206](https://www.law.cornell.edu/cfr/text/28/202.206) applies "regardless of whether the data is anonymized, pseudonymized, de-identified, or encrypted". Our [de-identification guide](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data) and the [de-identification](https://sellmydatatoai.net/glossary/de-identification) entry explain the methods.

## What federal laws apply when you sell data to AI companies?

No federal law requires data broker registration, but the FTC Act, the Protecting Americans' Data from Foreign Adversaries Act of 2024 and the Justice Department's Data Security Program all apply when you sell data to AI companies.

### The FTC Act

Section 5 of the FTC Act covers unfair or deceptive practices. In February 2024 the FTC warned that quietly changing terms of service or a privacy policy to allow new uses such as AI training [could be unfair or deceptive](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive).

### The Protecting Americans' Data from Foreign Adversaries Act

The [Protecting Americans' Data from Foreign Adversaries Act](https://www.law.cornell.edu/uscode/text/15/9901) (15 USC 9901), in force since June 23, 2024, makes it unlawful for a data broker to sell, license or otherwise make available personally identifiable sensitive data of US individuals to a foreign adversary country or an entity it controls. Sensitive data includes health, financial, biometric, genetic and precise geolocation data and data on people under 17.

A data broker here is an entity that, for valuable consideration, makes available data of US individuals that it did not collect directly from them. An entity counts as controlled if foreign adversary persons hold at least a 20% stake. On February 9, 2026 the FTC [sent warning letters to 13 data brokers](https://www.ftc.gov/news-events/news/press-releases/2026/02/ftc-reminds-data-brokers-their-obligations-comply-padfaa), citing penalties of up to $53,088 per violation.

### The DOJ bulk sensitive data rule

The Justice Department's [Data Security Program](https://www.justice.gov/nsd/data-security), 28 CFR Part 202, in effect since April 8, 2025, prohibits US persons from data brokerage with countries of concern or covered persons involving bulk US sensitive personal data. It applies to any US company, not only registered brokers, and covers licensing access to data.

| Category | Threshold |
| --- | --- |
| Human genomic data | More than 100 US persons |
| Other human 'omic data and biometric identifiers | More than 1,000 US persons |
| Precise geolocation data | More than 1,000 US devices |
| Personal health data and personal financial data | More than 10,000 US persons |
| Covered personal identifiers | More than 100,000 US persons |

The countries of concern in [28 CFR 202.601](https://www.law.cornell.edu/cfr/text/28/202.601) are China, Cuba, Iran, North Korea, Russia and Venezuela. For data brokerage with any other foreign person, [28 CFR 202.302](https://www.law.cornell.edu/cfr/text/28/202.302) requires a contract term barring onward transfer to a country of concern, and a report within 14 days of a known or suspected breach of it. Civil penalties under [28 CFR 202.1301](https://www.law.cornell.edu/cfr/text/28/202.1301) reach $368,136 or twice the transaction value, whichever is greater.

## What if you hold UK or EU data?

If you hold UK or EU data, there is no separate data broker register to join. UK GDPR and EU GDPR apply to any personal data you license whether or not you are a broker, so you need a lawful basis and a compatible purpose. The [data privacy laws by country](https://sellmydatatoai.net/guides/data-privacy-laws-for-ai-training-by-country) guide compares the rules.

## How do you check whether a data broker law applies before you license data?

You check whether a data broker law applies by tracing every record to its source and every buyer to its owner before any sample leaves your systems.

1. **Trace the source of each record**: Separate data collected directly from customers and staff from data you bought or hold for clients.
2. **Check how recent the relationships are**: Flag California consumers with no interaction in the preceding three years.
3. **Find sensitive data**: Health, biometric, geolocation and children's data carry the most risk under New Jersey law and the federal rules.
4. **Ask what the buyer does next**: Confirm whether it trains its own models or resells data, and who owns it.
5. **Take advice and register if required**: Have a privacy lawyer confirm the position in each state, and register before the sale if a law applies.

> **Take advice** These laws turn on facts about your records and your buyer. We are a broker, not a law firm. We tell you what buyers will check and help you prepare, but you should take independent legal advice before signing any license.

We verify every buyer's company identity, intended use and onward transfer limits before it sees a sample. See [how we vet](https://sellmydatatoai.net/how-we-vet), or [request a free data valuation](https://sellmydatatoai.net/data-valuation) for a realistic range and the rights issues to clear first.

## Frequently asked questions

### Is an AI company that buys my data a data broker?

An AI company that buys data to train its own models is not usually a data broker under the state definitions, because those laws regulate selling or licensing data onward. An AI company that resells or relicenses datasets may be one. In New Jersey from 2027, selling your own consumers' data to a data broker makes you a data collector that must register.

### Do I need to register in California if I license employee data?

California's Delete Act covers businesses selling personal information of consumers they have no direct relationship with, and your employees have a direct relationship with you. Registration is therefore unlikely for your own staff records. The CCPA still treats employees as consumers, so a license can be a sale with notice and opt-out duties. Take advice on your records.

### What happens if I should have registered as a data broker and did not?

Penalties vary by state. California charges $200 a day plus unpaid fees and costs. Texas charges at least $100 a day, up to $10,000 in 12 months. Oregon caps fines at $10,000 a calendar year. New Jersey's law sets $2,500 a day once its registry operates. Vermont's fine rises to $200 a day from January 1, 2027.

### Does de-identified data avoid data broker registration?

De-identified data can fall outside California, Texas and New Jersey law, but only if it cannot reasonably be linked to a person and you publicly commit not to re-identify it and bind recipients by contract. The DOJ's bulk data rule counts data regardless of whether it is anonymized, so foreign deals need separate checks.

### Can I license data to a foreign AI company?

You can license data to most foreign AI companies, but not bulk sensitive personal data to anyone in or controlled from China, Cuba, Iran, North Korea, Russia or Venezuela under the DOJ rule. For other foreign buyers, 28 CFR 202.302 requires a contract term banning onward transfer to those countries. Check ownership before sharing samples.

## Sources

- [Data broker registration](https://cppa.ca.gov/data_brokers/), California Privacy Protection Agency, accessed November 2026
- [Delete Act statute, Civil Code sections 1798.99.80 to 1798.99.89, effective January 1, 2026](https://www.cppa.ca.gov/regulations/pdf/data_broker_reg_delete_act_statute_eff_20260101.pdf), California Privacy Protection Agency, accessed November 2026
- [Data broker registration regulations, final text](https://www.cppa.ca.gov/regulations/pdf/20241226_dbr_final.pdf), California Privacy Protection Agency, accessed November 2026
- [Account creation, fees, and annual registration](https://privacy.ca.gov/drop-for-data-brokers/account-creation-fees-and-annual-registration/), California Privacy Protection Agency, accessed November 2026
- [California Civil Code section 1798.140](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.140.&lawCode=CIV), California Legislative Information, accessed November 2026
- [9 V.S.A. section 2430, definitions](https://legislature.vermont.gov/statutes/section/09/062/02430), Vermont General Assembly, accessed November 2026
- [9 V.S.A. section 2446, annual registration](https://legislature.vermont.gov/statutes/section/09/062/02446), Vermont General Assembly, accessed November 2026
- [SB 2105, enrolled, 88th Legislature](https://capitol.texas.gov/tlodocs/88R/billtext/html/SB02105F.htm), Texas Legislature Online, accessed November 2026
- [SB 2121, enrolled, 89th Legislature](https://capitol.texas.gov/tlodocs/89R/billtext/html/SB02121F.htm), Texas Legislature Online, accessed November 2026
- [ORS 646A.593, data broker registration](https://oregon.public.law/statutes/ors_646a.593), Oregon Revised Statutes via Public.Law, accessed November 2026
- [Rule order FSR 3-2024, data broker registry](https://dfr.oregon.gov/laws-rules/Documents/fsr03-2024_rule-order.pdf), Oregon Division of Financial Regulation, accessed November 2026
- [P.L. 2026, c.25 (A5328 1R)](https://pub.njleg.gov/Bills/2026/AL26/25_.HTM), New Jersey Legislature, accessed November 2026
- [Connecticut's new data broker law (SB 4): what businesses need to know](https://dataprivacy.foxrothschild.com/2026/06/articles/general-privacy-data-security-news-developments/connecticuts-new-data-broker-law-sb-4-what-businesses-need-to-know/), Fox Rothschild, accessed November 2026
- [Connecticut's newly enacted data broker law: how it stacks up against California's Delete Act](https://www.dglaw.com/connecticuts-newly-enacted-data-broker-law-how-it-stacks-up-against-californias-delete-act/), Davis+Gilbert, accessed November 2026
- [15 USC 9901, prohibition on transfer of personally identifiable sensitive data of United States individuals to foreign adversaries](https://www.law.cornell.edu/uscode/text/15/9901), Legal Information Institute, Cornell Law School, accessed November 2026
- [FTC reminds data brokers of their obligations to comply with PADFAA](https://www.ftc.gov/news-events/news/press-releases/2026/02/ftc-reminds-data-brokers-their-obligations-comply-padfaa), Federal Trade Commission, accessed November 2026
- [Data Security Program](https://www.justice.gov/nsd/data-security), US Department of Justice, National Security Division, accessed November 2026
- [28 CFR 202.205, bulk thresholds](https://www.law.cornell.edu/cfr/text/28/202.205), Legal Information Institute, Cornell Law School, accessed November 2026
- [28 CFR 202.206, bulk](https://www.law.cornell.edu/cfr/text/28/202.206), Legal Information Institute, Cornell Law School, accessed November 2026
- [28 CFR 202.302, other prohibited data-brokerage transactions involving potential onward transfer](https://www.law.cornell.edu/cfr/text/28/202.302), Legal Information Institute, Cornell Law School, accessed November 2026
- [28 CFR 202.601, countries of concern](https://www.law.cornell.edu/cfr/text/28/202.601), Legal Information Institute, Cornell Law School, accessed November 2026
- [28 CFR 202.1301, penalties](https://www.law.cornell.edu/cfr/text/28/202.1301), Legal Information Institute, Cornell Law School, accessed November 2026
- [AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive), Federal Trade Commission, accessed November 2026
- [No, hashing still doesn't make your data anonymous](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous), Federal Trade Commission, accessed November 2026

---

Book a free consultation: https://sellmydatatoai.net/book-a-consultation