Topics and Issues

Data brokers (44)

California

Statute: California’s data broker law is codified at Cal. Civ. Code Sec. 1798.99.80 et seq. The data broker law was first passed in 2019 and amended several times since. The most recent amendments were in 2023, via S.B. 362 (Ch. 709).

List of data brokers: The California Office of the Attorney General lists data brokers registered with the state under its data broker law, Cal. Civ. Code Secs. 1798.99.80 – .88.

Nevada

Statute: Nevada passed its data broker law in 2021. The bill, S.B. 260 (Ch. 292), is codified at Chapter 603A.

Oregon

Statute: In 2023, Oregon passed its data broker law via H.B. 2052 (Ch. 395) to be codified at ____.

Texas

Statute: In 2023, Texas passed a data broker law, S.B. 2105, codified at Chapter 509 of the Texas Business and Commerce Code.

Rules: In 2023, the Office of the Secretary of State (Office) proposed a new Chapter 106, §§106.1 – 106.5, concerning registration of data brokers. 48 Tex. Reg. 5593 (Sept. 29, 2023).

Vermont

Statute: 9 V.S.A. § 2430 et seq. Vermont passed its data broker registration law in 2017 (No. 171 (Adj. Sess.), § 2, eff. Jan. 1, 2019) and amended in 2019 (No. 89 (Adj. Sess.), § 2.)

List of data brokers: The Vermont Secretary of State lists data brokers registered with the state under its data broker law, 9 V.S.A. Secs. 2430, 2466 – 2467.

CFPB

Each year, the CFPB publishes a list of consumer reporting agencies. This is not a list of “data brokers,” but it is a list of consumer reporting agencies that handle personal information government by the Federal Fair Credit Reporting Act (FCRA), 15 U.S.C. Sec. 1681 et seq. As noted by the CFPB, this list “helps [consumers] take advantage of [their] right[s] to review the information in your consumer reports, and dispute possible inaccuracies with companies as needed. The list includes the three nationwide consumer reporting companies—Equifax, TransUnion, and Experian—and several other reporting companies that focus on creating consumer reports for certain industries.” The list comprises CRAs that provide information for employment screening, tenant screening, check and bank account screening, personal property insurance, medical purposes, low-income and subprime financial empowerment, supplementary reporting, utility decision-making, retail purposes, and gaming. In all cases, a user of a consumer report must have a “permissible purpose” required by law (15 U.S. Code § 1681b, FCRA Sec. 604).T

The Privacy Rights Clearinghouse published a summary of state data broker laws in the U.S. in 2021. The Privacy Rights Clearinghouse “is a nonprofit organization focused on increasing access to information, policy discussions and meaningful rights so that data privacy can be a reality for everyone.”