Think you’re a data broker? You must file annually in several states. Oregon, Vermont, Texas, California, Colorado, and Connecticut all impose registration on firms that collect consumer data without a direct relationship. Each state demands detailed disclosures: who you are, what data, security measures, and consumer opt‑out links. Deadlines vary—most fall on the last month of the year—and fines range from $500 to $10 000. Stay tuned to see how each state refines its rules.

Key Takeaways

• Oregon mandates data‑broker registration for entities handling ≥100 000 Oregon residents’ data or earning > 50 % revenue from data; filing deadline is January 31.
• Vermont requires all data brokers to file yearly, pay the current $0 fee (2024) or $200 thereafter, and meet encryption and breach‑notification rules; deadline is January 31.
• California’s CCPA obligates brokers to disclose personal‑info categories, data sources, purposes, opt‑out links, and report annual consumer‑request metrics; penalties reach $7 500.
• Texas mandates broker registration within 30 days of acquisition, annual renewal by January 31 with a $1 000 fee, and quarterly audits; daily fines apply for non‑renewal.
• Colorado and Connecticut require annual filings: Colorado’s $100 fee due March 1; Connecticut’s $125 fee (incl. $25 admin surcharge) due January 31.

What Data Broker Registration Is

The Data Broker Registration system requires any for‑profit business that gathers, aggregates, or stores personal data about consumers with whom it lacks a direct relationship to file a formal record with the state’s regulatory office. You must disclose your business identity, address, tax identifiers, and privacy lead contact. You’ll also list every category of data you collect—demographics, purchase history, geolocation, browsing behavior—and the third‑party sources feeding each set. A core purpose of the filing is to provide transparency mechanisms that expose entities engaged in data monetization without consumer notice. You’ll describe opt‑out tools you offer and explain how you handle security breaches, ensuring compliance with state breach notification rules. Annual renewal keeps your record current, lets regulators track shifts, and signals your commitment to privacy responsibilities. By registering, you demonstrate accountability, support privacy workforce standards, and protect consumers from opaque data practices and uphold data integrity for everyone.

Oregon Data Broker Filing: How to Register

Because the Oregon Consumer Privacy Act (SB 619) took effect on January 1, 2024, any for‑profit entity that knowingly collects, processes, or sells personal data of 100,000 or more Oregon residents—or earns more than 50 % of its revenue from data sales while processing data on at least 25,000 residents—must file a registration with the DOJ.

If you collect, process, or sell data of 100k+ Oregonians, or earn >50% revenue from data sales while handling 25k+ residents, register with DOJ.

To complete your Oregon filing, log into the Oregon DOJ’s online portal, locate the Data Broker Registration section, and provide the required facts: legal name, addresses, website, contact person, and a description of the data you handle.

1. Submit the disclosure covering minors, opt‑out links, deletion procedures, data categories—including sensitive items—and retention policies.
2. Confirm your filing closes before the compliance deadlines of January 31 each year.
3. Pay fee, which the DOJ sets; monitor any changes.

Missing the deadline triggers penalties to $1,000. Keep track of fee updates—it was $0 in 2024 but may change—a element of compliance.

Vermont: Fees, Security & Opt‑Out Disclosures

Vermont’s data broker registration law mandates a $100 annual fee per entity, payable to the Secretary of State either electronically or by check; the fee is non‑refundable and covers only the basic registration, with no extra charges for amendments or updates. You must file by January 31 each year and disclose your data collection practices. The fee structure remains flat, with no tiering by revenue or volume. Failure to register or submit accurate information can trigger civil penalties up to $10,000 per violation and daily fines of $500. To comply, you must implement security standards that protect personal data from unauthorized access—including encryption in transit, access controls, security testing, and a written incident‑response plan. You must also notify consumers of any breach within a timeframe, 30 days. Opt‑out notices must appear on privacy policy or website account creation, and you must honor requests within 45 days free of charge.

California CCPA Registration: Key Disclosures

When you navigate the California Attorney General’s portal to register as a data broker, you’ll encounter mandatory disclosures that outline your data collection and processing practices. These disclosures demand that you specify the categories of personal information you acquire, such as identifiers, commercial data, and geolocation, and state the origin of each source—public records, commercial vendors, or online tracking. You must also detail the purposes for which you process or sell data, the parties you share it with, and whether you employ automated decision‑making or profiling. Finally, the portal requires a succinct opt‑out link titled “Do Not Sell or Share My Personal Information” and a mechanism that lets consumers exercise their rights without friction.

1. Deploy Privacy Prompts during data collection to provide signals of intent.
2. Publish Data Transparency statements that explain logic behind profiling and automated decisions.
3. Report yearly metrics on consumer requests, compliance rates, and response times.

Texas: Annual Deadline & Penalties

Since Texas Occupations Code Chapter 102 requires annual registration, you must file your application by January 31 of each calendar year.

Register annually under Texas Occupations Code 102; file by January 31 each year.

Your deadline strategy should focus on the filing window from January 1 to December 31, ensuring compliance before the mandatory cut‑off.

The initial registration must arrive within 30 days of acquiring broker status; thereafter, renewals occur annually, invoicing a $1,000 fee payable electronically.

Non‑compliance triggers a $100 daily penalty, capped at $10,000 per year, and elevates violations to Class A misdemeanors if false statements are made.

The Secretary of State monitors filings via an online portal, can investigate without consumer complaints, and, if necessary, files civil action in Travis County.

You must update registration within 30 days of any material change; failing to do so risks revocation and additional penalties.

Maintain a minimum of three years of registration records, and consider a quarterly audit schedule to guarantee ongoing accuracy and readiness for any enforcement review.

New York’s New Rule: Security Reporting

While Texas centers on annual registration, New York’s latest cybersecurity rule shifts the focus to mandatory, timely reporting of security events.

You’ll embed a Certification Framework that obliges you to file an annual cybersecurity certification by April 15, affirming compliance or detailing non‑compliance. The rule demands Incident Reporting within 72 hours after any ransomware or extortion payment, providing justification and evidence of good‑faith mitigation efforts. It also requires notification of any event that could materially harm operations, even if no data is breached.

Key compliance steps include:

1. Register and authenticate on the NYDFS Cybersecurity Portal, then submit a signed Notice of Submission.
2. File the certification, attach your executive attestation, and receive a confirmation number for archival.
3. Report ransomware or extortion incidents within 72 hours, with supporting documentation.

You should review guidance annually. Non‑compliance incurs up to $500 k per violation plus daily fines, so prompt execution is essential.

Connecticut vs. Colorado: State Fee Differences

Although Connecticut imposes a $75 base fee—$25 more than Colorado’s $50—both states maintain identical flat‑rate structures for initial registration. You’ll see that the cost comparison reveals a 33 % higher outlay in Connecticut, which directly affects your budget impact. Each year, renewal follows the same pattern: Connecticut charges $75, Colorado $50, again a steep 50 % increase that can accumulate over multiple cycles. Late filing penalties also diverge sharply. Connecticut can tack on $10 daily after the initial $100, potentially breaching $1,000 after three months, whereas Colorado caps penalties at a single $1,000 with no daily rise. Neither jurisdiction offers small‑entity discounts or fee waivers, so you must budget full amounts regardless of size. Revenue from these fees sustains state‑specific enforcement bodies—Connecticut’s Consumer Protection Department and Colorado’s Office of the Attorney General—ensuring that the fees produce a predictable, though divergent, fiscal support for regulatory activities. While ensuring compliance with law.

State‑by‑State Fee Comparison Table

To compare costs beyond the Connecticut‑Colorado split, the table below aggregates filing fees, renewal schedules, and applicable exemptions for six states—Vermont, California, Colorado, Connecticut, Oregon, and Texas.

This table aggregates filing fees, renewal schedules, and exemptions for Vermont, California, Colorado, Connecticut, Oregon, and Texas.

1. Vermont charges $200 annually, with a 3 % card surcharge and a February 15 deadline.
2. California and Colorado each require $100 yearly, due by January 31 and March 1 respectively, and accept ACH or credit card payment.
3. Connecticut and Oregon also set $100 and $100 fees, but Connecticut includes an embedded $25 administrative surcharge; Oregon offers a $50 small‑business discount.

Review state’s portal for receipts, noting Vermont’s 3 % surcharge applies only to card payments; ACH stays free. California’s AG portal confirms instantly; Colorado’s check payment takes up to five business days for verification. Oregon’s small‑business rebate activates automatically when revenue and staff thresholds are met. Texas’s free registration requires data by July 1.

Penalties for Unregistered Brokers

Because Vermont’s data‑broker statute hinges on daily fines, each day a broker remains unregistered can rack up to $10,000—an amount that compounds quickly as violations accumulate. You’re required to recognize that Vermont’s 9 V.S.A. § 2446 imposes a civil penalty of up to $10,000 per knowing violation; the attorney general enforces it exclusively, with no private consumer claim. In 2023 a settlement exceeded $500,000, demonstrating the statute’s bite. Your operations in California face $100 per consumer per incident, capping at $7,500 for intentional breaches; California Privacy Protection Agency levied more than $1.2 million in 2024. Texas applies the same $10,000 threshold, yet repeats trigger $25,000 and possible criminal referrals. Oregon imposes $500 daily for the first 30 days, then $1,000 thereafter, totaling $3.5 million in penalties that year. Court rulings consistently emphasize strict liability, and civil damages become unstoppable once a violation is established. You risk civil damages and injunctions without recourse today.

Federal Outlook: Will a National Registry Arrive?

Given the steep state‑level penalties you face—$10,000 a day in Vermont, daily fines in Oregon, and multi‑million settlements in California—the need for a uniform federal system is now compelling. The Legislative Pulse indicates that the Data Broker Accountability and Transparency Act (DATPA) is progressing through committees, while bipartisan House and Senate members repeatedly refile the bill to secure a federal registry. Enforcement Prospects hinge on FTC authority: the agency is poised to expand enforcement against “unfair or deceptive” practices, yet Supreme Court precedent limits penalty power, raising questions about regulatory weight. Consider these factors:

With drastic state fines, DATPA stalls, FTC power limited— a unified federal registry is now inevitable.

1. Federal registry costs estimate $5–10 million annual administration, a figure weighing on congressional debate.
2. Public searchability demands clash with industry requests for limited disclosure, delaying final framing.
3. State‑level registries already expose 300+ unregistered brokers, supporting national momentum yet exposing compliance complexity.

Adapting to a unified system will require balancing statutory clarity with enforcement feasibility today.

Frequently Asked Questions

Are Small Startups Exempt From Data Broker Registration?

Yes, many small startups enjoy Startup Exceptions that shield them from mandatory data broker registration, provided they stay below revenue or consumer‑record thresholds. Compliance Requirements still mandate that you’ll track sales, document calculations, and notify regulators promptly if you cross those limits. For instance, Vermont’s 1,000‑consumer, $25K exemption, or Texas’s $1,500 revenue cap, can apply, but each state’s rules vary. Vigilant record‑keeping keeps you compliant until you’ll outgrow the thresholds.

How Long Does State Registration Processing Usually Take?

Processing Duration for state registration generally spans per state 5–20 business days, varying by state and filing method. The most efficient electronic filings finish in about 5–7 days; paper submissions may take 10–14. Peak seasons can extend processing by 30–50%, while errors add an additional 7–10 days. Electronic filing can cut time by up to 60%, and premium services can reduce the total to as low as exactly 3 days today.

What Records Must Brokers Keep After Filing?

You must keep retention schedules for all documents, including copies of annual filings, internal policies, consent forms, third‑party contracts, audit logs, and reports. Compliance logs should document every retention action. Keep records for the statutory period—three years in Vermont, five in Texas, at least two after filing in California, current plus three previous years in Oregon, and three years after the registration year in Colorado. Make them ready for audit.

Can Foreign Companies Register as Data Brokers in US States?

Yes, you can register as a foreign data broker. States like Vermont, California, Texas, and Oregon explicitly permit foreign entities, provided you satisfy foreign‑law formation, evidence of good standing, and a local registered agent. Fees vary—Vermont is free, Texas tiers up to $30,000, California $400. Additionally, you must disclose ultimate parent ownership and officer citizenship per Cross Border Compliance rules to meet Foreign Eligibility requirements, including state requirements and enforcement.

Is There a Public Database of Registered Brokers?

Yes, you’ve access to public access databases that list registered data brokers. In Vermont, the Secretary of State hosts a searchable registry with names, addresses, and online‑data activity. California’s Attorney General keeps a public list of about 500 brokers, though missing detailed contact info. Oregon’s SB 619 and Texas’s Secretary of State maintain annual files providing names and contact details. These state‑level resources supply data visibility, but no federal list exists.

Conclusion

Imagine a fleet sailing a stormy sea, each vessel representing your data‑broker operations. By filing annually, you become the lighthouse that steers them clear of cliffs of fines and reputational ruin. The deadline approaches like a rising tide—miss it, and penalties surge. A clear treasury of state requirements acts as a compass, ensuring you chart a compliant course. Stay vigilant, register promptly, and protect both your business and the info you steward with care.