Data broker registration fees by state, 2026
Six states have enacted data-broker registration requirements. All are current law. Nothing in this table is a proposal.
| State | Statute | Fee | Key dates |
|---|---|---|---|
| California | Delete Act (SB 362) | $6,000/yr (+ up to 2.99% card fee) | Register Jan 1-31; DROP cycles already live; triennial audits from Jan 1, 2028 |
| Texas | SB 2105 | $300/yr | Live now; filed with the Secretary of State, enforced by the AG |
| Oregon | HB 2052 | $600/yr | Live now; renew by Dec 31 |
| Vermont | Act 138 (signed Jun 16, 2026) | $100 rising to $900/yr, plus a $20,000 surety bond from Jan 1, 2027 (bond premium roughly $150-600/yr) | Vermont’s planned central registration portal was replaced by a feasibility study |
| Connecticut | PA 26-64 (signed May 2026) | $2,500/yr | Act effective Oct 1, 2026; register by Jan 1, 2027; centralized deletion mechanism required by Jul 1, 2028 |
| New Jersey | A5328 (signed Jun 30, 2026) | $5,000-$1.5M/yr, tiered | Registry expected operative around Mar 27, 2027 (an Apr-Jun 2027 first filing window has been reported but isn’t confirmed); covers a broader “data collector” category and bans certain sensitive-data sales, with penalties up to $50,000 per record |
California’s SB 361 also widened what the state registration discloses, under §1798.99.82(b)(2): whether the broker sells or shares data to foreign actors, the federal government, other state governments, or law enforcement, and to developers of generative-AI systems (subsections (O) through (S)), plus which sensitive-data categories it holds: citizenship or immigration status, union membership, sexual orientation, gender identity, biometrics, precise geolocation, and reproductive-health data (subsections (H) through (N)). A broker’s counsel-reviewed registration should account for those added disclosure categories rather than treating the form as unchanged from prior years.
What non-registration actually costs
California’s penalty for failing to register is $200 per day (§1798.99.82(c)(1)), a flat daily number with no cure period. It isn’t hypothetical: eleven enforcement actions since November 2024 have totaled $492,000 across firms including Growbots, UpLead, Infillion, The Data Group, KMA, National Public Data, Background Alert, Accurate Append, ROR Partners, Datamasters, and S&P Global. Every one of those is a registration case. None is a deletion-cycle fine, because the DROP deletion obligation is too new for one to exist yet.
The ROR Partners case is worth sitting with. ROR Partners was a marketing firm, not a company that thought of itself as a “data broker” in the way the term usually gets used. CalPrivacy fined it $56,600 anyway, on the theory the agency stated plainly in its December 3, 2025 announcement (cppa.ca.gov/announcements/2025/20251203.html): a sale is a sale, regardless of what the seller calls its business. Firms that don’t see themselves fitting the definition are exactly the ones getting caught by it.
What’s proposed, not enacted
A few bills would extend this calendar further but aren’t law yet: California’s SB 1106 would shorten the 45-day DROP cycle to 30 days; Washington (HB 2483), Illinois, and Massachusetts have bills in progress; none is law; and a federal DELETE Act remains in committee. None of these change a broker’s current obligations, but a bill in committee today is a filing deadline a year or two out, and the states that already moved (Connecticut and New Jersey both signed law in 2026) show how fast “proposed” turns into “enacted.”
Take the self-test to check which of these six states’ definitions are worth a closer look for a given business, or book a 20-minute cycle review to walk through the calendar against an actual filing history.
Related: Registration is only the entry point. See The 45-day DROP cycle, operationally for the recurring obligation that follows.
Common questions
We're registered in California but sell data into other states. Does that matter?
Yes, registration is state-specific, and each state's fee and deadline are independent of the others. CalPrivacy has already identified 291 firms registered elsewhere but not in California, which is exactly the gap regulators are watching for. Selling into a state doesn't register a broker there automatically.
When does the California registration window open?
Registration runs January 1-31 each year, alongside the $6,000 annual fee (plus a card-processing fee of up to 2.99% if paying by card).
What's a surety bond, in plain terms?
It's a third party's promise to pay if a broker doesn't meet an obligation: here, Vermont's requirement, starting January 1, 2027, that a broker post a $20,000 bond alongside its registration. A broker doesn't hand over $20,000 up front; it pays a bonding company a yearly premium, roughly $150-600, for that company to stand behind the bond.