Core Research Findings (Answer-First Summary)
82 of 1,043 captured entities (7.9%) match at least two registries in this snapshot. The result is a crosswalk observation, not a statement about the complete broker market.
623 catalog entities matched the captured CPPA registry snapshot. CPPA publishes registration details submitted by data brokers; the count is not a complete-market estimate and the registry fields do not establish wrongdoing.
8catalog entities matched an SEC/EDGAR record in this snapshot. A match is not a conclusion about ownership, an exchange listing, or a company's legal status.
Regulatory Discrepancy & Legal Nuance QA
Q: Does absence from a state data broker registry mean an entity is operating illegally?
No. Registry absence is not, by itself, a finding of illegality. Definitions, exemptions, and registration rules vary by jurisdiction. The CPPA describes California data brokers as businesses that collect personal information from various sources and sell it to other companies, including where a consumer did not interact with the business for its products or services; the current registry is a snapshot of businesses that operated as data brokers in the prior calendar year. Check the current statute and exemptions before drawing a conclusion. In the OfflistMe framework, unlisted status is categorized as UNKNOWN_UNREGISTERED rather than unlawful non-compliance.
Q: Why do Vermont and California registries contain different company names for the same service?
Registrations may use a legal entity or filing name rather than a consumer-facing brand or domain. This crosswalk uses name and domain matching rules; a match is a research lead and is not proof that two names share ownership or that a request to one entity reaches another.
State-by-State Regulatory Requirements Comparison
Source-linked orientation only—not legal advice or a complete current legal matrix. Requirements, exemptions, agencies, and remedies can change; consult the cited statute or agency page for the controlling text.
| Jurisdiction & Statute | Regulatory Agency | Mandatory Disclosures | Enforcement Mechanism | Centralized Deletion (DROP) |
|---|---|---|---|---|
| California (SB 362 / Delete Act) | CPPA (Privacy Protection Agency) | Current CPPA registration fields include data-collection and recipient categories, contact details, and consumer-request metrics. | CPPA administers the registry; apply the current Delete Act, regulations, and agency enforcement materials. | DROP: one request to active data brokers; processing began August 1, 2026, subject to exceptions. |
| Vermont (9 V.S.A. § 2446) | Vermont Secretary of State | See current 9 V.S.A. § 2446 for the applicable data-broker disclosures and duties. | Do not rely on this page for a current penalty amount; check the Vermont statute and enforcement materials. | No Vermont DROP equivalent is claimed here; provider-specific routes require separate review. |
| Texas (Data Broker Act) | Texas Secretary of State | Annual SOS registration, data-category details, notice, security program, and a child-data statement where applicable. | Texas AG summary: at least $100 per day plus unpaid registration fees; the Act caps penalties at $10,000 in a 12-month period. | No centralized deletion tool is identified in the cited Texas overview; provider routes require separate review. |
| Oregon (HB 2052) | Oregon Dept of Consumer & Business | HB 2052 establishes registration requirements, application contents, and statutory exemptions. | HB 2052 summary: up to $500 per violation or continuing day, capped at $10,000 per calendar year. | No centralized deletion mechanism is identified in the cited Act summary; provider routes require separate review. |
Sources and snapshot limits
Primary legal and registry context was checked against the California CPPA registry, 9 V.S.A. § 2446, the Texas Attorney General's Data Broker Act overview, Oregon HB 2052, and SEC EDGAR company search on August 26, 2026.
The downloadable crosswalk was generated on August 20, 2026. Its catalog joins use captured source files plus name/domain matching, so a match is not proof of registration, ownership, exchange listing, compliance, or a deletion outcome. Recheck the source-of-record pages before relying on a legal or operational conclusion.
Download Registry Crosswalk Dataset
Machine-readable crosswalk linking the captured catalog to California CPPA, Vermont SOS, Oregon, Texas, and SEC evidence snapshots. Licensed under Creative Commons Attribution 4.0 International (CC-BY 4.0).
OfflistMe. (2026). State Data Broker Registry Crosswalk & Regulatory Discrepancy Matrix (Version 2026.08) [Data set]. OfflistMe. https://www.offlist.me/state-data-broker-registry-crosswalkRelated Canonical Research Assets
Data Broker Observatory
Multi-registry crosswalk and compliance intelligence.
Who Owns the Data Broker Industry?
Recorded parent relationships only; ownership is not inferred from registry overlap.
Data Broker Research Standard
4-Tier provenance hierarchy and evidence saturation formulas.