Data broker

How data brokers work

A data broker sits between the places where personal information is collected and the businesses that buy it. The broker gathers records from many sources, links them into profiles about people and sells or licenses access. The people in those profiles never dealt with the broker directly, which is what separates a broker from a company holding data about its own customers.

The legal definitions turn on two tests.

• No direct relationship. California asks whether the business sells personal information of a consumer with whom it has no direct relationship 1. Vermont gives examples of a direct relationship, such as a past or present customer, employee, investor or donor 3.
• Sale or license. The business has to sell or license the information to third parties. Vermont excludes a one-time sale of assets as part of a transfer of control 3.

Registration comes first. In California, a business registers on or before January 31 after each year in which it met the definition 2. The filing reports details such as whether the broker collects consumers' names, dates of birth, email addresses or phone numbers 2.

California added a deletion duty through the Delete Act. A consumer can send one verifiable request through the Delete Request and Opt-out Platform, known as DROP, and it reaches every data broker that holds their personal information 1. From August 1, 2026, brokers must access that mechanism at least once every 45 days and process the requests 1. After deleting a consumer's data, a broker must keep deleting it at least once every 45 days and may not sell or share new personal information about that consumer, subject to exceptions 2.

Audits come next. Beginning January 1, 2028, and every three years after that, a California data broker must undergo an independent audit of its compliance with the deletion rules 2.

For B2B teams, the topic overlaps with third-party data and with PII, since contact records that name a person are personal information in many privacy laws. The CCPA and CPRA page covers the consumer rights that sit behind the California rules.

Questions that decide data broker status

Whether a business counts as a data broker depends on each statute. The questions below help screen a business, and legal counsel should make the final call. This is general information, not legal advice.

**Does it sell or license personal information to third parties?** A data product that returns records about people to paying customers needs to answer this carefully. A business that uses data only for its own outreach is in a different position from one whose product is the data.

**Does it have a direct relationship with the people in the data?** A software vendor that stores its own customers' records has one. Vermont's examples of a direct relationship are customers, clients, subscribers, users, employees, contractors, investors and donors 3. A business that compiles profiles of professionals who never interacted with it has none of these.

**Is the information about a person's business or profession?** Vermont's current definition excludes publicly available information related to a consumer's business or profession from brokered personal information 3. California's definition relies on the state's general definition of personal information instead 1.

**Does an exemption apply?** California excludes entities to the extent they are covered by laws such as the federal Fair Credit Reporting Act and the Gramm-Leach-Bliley Act 2.

**Which residents are in the data?** Each statute protects residents of its own state. Vermont defines a consumer as an individual residing in the state 3. A national B2B database can trigger more than one state's rules at once.

**Is the answer written down?** Record the reasoning for each state, the date of the review and who signed off. A B2B data provider that has done this work can usually show it to a buyer on request.

Example of checking a contact data vendor for data broker status

A sales team is choosing a contact data vendor for a campaign that will reach prospects in California. Before signing, the team runs a short data broker check and writes the answers into its vendor file.

Check 1   Search the California Data Broker Registry for the vendor
Check 2   Ask whether the vendor sells or licenses records to other customers
Check 3   Ask whether the vendor processes DROP deletion lists
Check 4   Ask how a deletion reaches cached and resold copies
Check 5   Ask how removed identifiers are suppressed on future lookups

The registry is public. A vendor that meets California's definition must register each year 2, and the CPPA states that a broker that fails to register by January 31 may be liable for administrative fines and costs 1.

The deletion questions matter for the buyer as well. If a prospect deletes their data through DROP, a registered vendor must process that request within 45 days of receiving it 2. Copies already exported into the buyer's CRM sit outside the vendor's control, so the buyer needs its own deletion and suppression process.

The team also compares how vendors handle removal. RichAPI, for example, removes data by the identifier a person provides, propagates removals to caches and keeps a minimal record of the identifier so it is suppressed on future lookups 4. RichAPI also states that it does not operate a public people directory and does not sell or republish bulk datasets 4.

The team files the answers next to the vendor's data processing agreement. When the campaign goes live, the CRM carries a suppression list that is checked before every send, and any deletion request that reaches the team is applied to the CRM copy and passed to the vendor.

The same check runs again at renewal, since a vendor's business model and registration status can change from year to year.

Data broker vs a business with a direct relationship

The legal line is the direct relationship. Vermont gives customers, employees, investors and donors as examples of people a business has a direct relationship with 3.