Core Research Findings (Answer-First Summary)
82 of 1,018 captured entities (8.1%) match at least two registries in this snapshot. The result is a crosswalk observation, not a statement about the complete broker market.
The California Privacy Protection Agency (CPPA) data broker registry captures 500+ active registrants, providing detailed statutory disclosures on minor data and reproductive health telemetry.
Over 40 public market filings link consumer broker brands to corporate parent holding companies traded on the NYSE, NASDAQ, and London Stock Exchange.
Regulatory Discrepancy & Legal Nuance QA
Q: Does absence from a state data broker registry mean an entity is operating illegally?
No. Statutory definitions vary significantly across jurisdictions. For example, under California CCPA/Delete Act, a business only qualifies as a "data broker" if it sells personal information of California consumers with whom it lacks a direct relationship. An entity operating purely as a first-party processor or non-US data provider may have no statutory obligation to register in California or Vermont. In the OfflistMe framework, unlisted status is categorized as UNKNOWN_UNREGISTERED rather than unlawful non-compliance.
Q: Why do Vermont and California registries contain different company names for the same service?
Registrations are frequently filed under parent legal entities, statutory holding companies, or corporate LLCs rather than consumer-facing brand trade names (DBAs). For example, TruthFinder, Instant Checkmate, and Intelius register under PeopleConnect, Inc., while CLEAR registers under Thomson Reuters Enterprise Centre GmbH.
State-by-State Regulatory Requirements Comparison
Comparison of key disclosure requirements, enforcement authorities, and statutory scopes across primary state data broker registries.
| Jurisdiction & Statute | Regulatory Agency | Mandatory Disclosures | Enforcement Mechanism | Centralized Deletion (DROP) |
|---|---|---|---|---|
| California (SB 362 / Delete Act) | CPPA (Privacy Protection Agency) | Minor data, geolocation telemetry, reproductive health, metrics of opt-outs fulfilled. | $200/day administrative fines + investigative fees | Yes (Mandatory DROP API by 2026) |
| Vermont (9 V.S.A. § 2446) | Vermont Secretary of State | Opt-out availability, credential verification requirements, data security breaches. | $50/day civil penalties (up to $10,000/year) | No (Individual broker opt-out) |
| Texas (HB 2544 / TDPA) | Texas Secretary of State | Notice of data broker operation, point of contact, registration fee. | $100/day civil penalties + injunctive relief | No (Individual broker opt-out) |
| Oregon (HB 2052) | Oregon Dept of Consumer & Business | Business categorization, consumer opt-out instructions, declaration of compliance. | $500/day civil penalties | No (Individual broker opt-out) |
Download Registry Crosswalk Dataset
Machine-readable crosswalk linking the captured catalog to California CPPA, Vermont SOS, Oregon, Texas, and SEC evidence snapshots. Licensed under Creative Commons Attribution 4.0 International (CC-BY 4.0).
OfflistMe Privacy Intelligence Lab. (2026). State Data Broker Registry Crosswalk & Regulatory Discrepancy Matrix (Version 2026.08) [Data set]. OfflistMe. https://www.offlist.me/state-data-broker-registry-crosswalkRelated Canonical Research Assets
Data Broker Observatory
Multi-registry crosswalk and compliance intelligence.
Who Owns the Data Broker Industry?
Recorded parent relationships only; ownership is not inferred from registry overlap.
Data Broker Research Standard
4-Tier provenance hierarchy and evidence saturation formulas.