How to Use Your State's Data Broker Registry
Six states now require data brokers to register publicly, and the resulting lists are one of the most useful free privacy tools almost nobody uses. Instead of guessing which companies hold your information, you can read the names, find their required privacy contact details, and send deletion requests directly. California, Vermont, Oregon, Texas, Connecticut, and New Jersey all maintain or are standing up registries, and here is the part that surprises people: you do not have to live in those states to read the lists. Here is how to use them, and what they cannot tell you.
What is a data broker registry?
A public list of companies that have declared themselves data brokers to a state government, usually as an annual legal requirement carrying a fee and a penalty for failing to comply. Vermont pioneered the idea, and California expanded on it substantially, requiring registered brokers to report metrics about the data rights requests they receive. The registries typically include each company's name, website, and a contact route for privacy requests, and often a description of the categories of data it handles and whether it collects information about minors or precise geolocation.
The penalties are real. California can impose administrative fines of 200 dollars per day for failing to register, and it has now brought more than a dozen enforcement actions on exactly that basis.
Why should I care if I do not live in those states?
Because a registry is a directory, and directories are useful to everyone. The overwhelming majority of registered brokers are national businesses that hold data on Americans regardless of state. The list tells you who they are and where to reach their privacy team, and that information is just as actionable from Ohio as from Sacramento.
Your enforceable rights still depend on your own state's law, and if you live in one of the roughly thirty states without a comprehensive privacy law you cannot compel most of these companies to act. In practice, though, many large brokers apply California-style processes nationwide rather than run separate systems per state, so a request often gets honored anyway. The registry gives you the target list; your state law determines how much leverage comes with it, which we cover in does the US have a federal data privacy law.
How do I actually use one?
- Open the registry and download the list. California's is the largest and most detailed, so it is the sensible starting point. Most registries publish a searchable table or a downloadable file.
- Filter for the brokers that matter to you. Hundreds of entries will look like business-to-business analytics firms you will never interact with. Look for people-search and background-check companies, marketing list compilers, and anything flagged as handling precise geolocation.
- Search yourself on the consumer-facing ones. Many registered brokers run public search sites. Find out whether you actually appear before spending time on a request.
- Use the listed privacy contact. This is the registry's quiet advantage: brokers must supply a working route for data requests, which saves you hunting through a footer for a buried opt-out link.
- Keep a record. Note the date you submitted each request, since response windows under state laws are commonly around 45 days and you will want evidence if you need to escalate.
Is California's central deletion platform easier?
Much easier, if you qualify. California residents can use the state's central deletion platform to submit one request that registered brokers must process, rather than contacting each company. Every other state's registry is a directory only, with no central deletion mechanism attached, which means the list tells you where to write but you still do the writing. Connecticut has moved toward building a centralized deletion framework of its own, so this may change.
What the registry will not tell you
Three limitations, and the last one is the important one:
- It does not tell you whether they hold your data. The registry lists companies, not people. You still have to check each one, or submit a request blind.
- Definitions vary between states, so a company that counts as a data broker in one state may not in another, and the lists do not fully overlap.
- It only contains companies that registered. California has roughly 575 brokers registered for 2026, while the state's own privacy agency believes thousands more are operating without registering. Both companies it penalized in August 2026 were caught for precisely that.
That last gap is the one to internalize. A registry is a list of the companies willing to be counted. The site publishing your address may simply not be on it, which is why working from the registry alone leaves real exposure untouched, and why a scan of what is actually visible about you is a better starting point than a list of corporate names. And because listings rebuild from fresh public records after any removal, this is recurring work. Consumer Reports found that opt-outs done by hand or by automation cleared only about 27 percent of exposed listings, while removals run by real people who monitor and refile reached roughly 70 percent.
A registry lists companies. A scan shows your actual exposure.
Registries are worth reading, and they miss every broker that never signed up. A free scan works the other direction, showing which sites are publishing your name, address, and phone right now, and our team of real people removes them and keeps checking as they return.
Run my free scan Start free trialFrequently asked questions
Which states have data broker registries?
California, Vermont, Oregon, Texas, Connecticut, and New Jersey have enacted standalone data broker registration requirements, with some provisions phasing in over the next couple of years. The list has grown steadily, so it is worth checking whether your own state has since joined.
Are the registries free to search?
Yes. They are public records maintained by state agencies and free to browse or download. The registration fees are paid by the brokers, not by consumers looking them up.
If a company is not registered, can I still request deletion?
Yes. Registration is a separate obligation from honoring consumer rights, so an unregistered company may still be required to respond depending on your state's law. You can also report a company you believe should have registered to the relevant state agency.
Should I send requests to every broker on the list?
Probably not, since hundreds of them are business-focused firms with no public listing of you. Prioritize the consumer-facing people-search and background-check companies, which are the ones creating visible, everyday exposure.