Since Vermont became the first state to regulate data brokers comprehensively, numerous states have followed suit. Substantial, dedicated regulation now exists in California, New Jersey, Oregon, Texas, and Vermont. Enforcement is growing.

Companies whose services involve selling, trading, or otherwise providing data about individuals with whom they do not have a direct relationship should carefully consider the applicability of these laws.

If applicable, critical requirements that data brokers should have on their essential “to-do” list will likely need to include the following:

• Registration: California, New Jersey, Oregon, Texas and Vermont each contain formal registration requirements. In California and Texas, revenue or other thresholds may apply; in other states, no such threshold is required. Registration fees are required. For large data brokers, New Jersey’s requires notably large registration fees (annual registration fee of over $1,000,000 dollars if the broker sells or licenses data on more than 2.5 million New Jersey consumers). Companies should be prepared to update registrations annually and provide detailed information in those registrations. (e.g., New Jersey requires companies to detail data breaches and cybersecurity events, to detail data collection practices, and other requirements.)

• Connecticut Surety Bond. Effective January 1, 2027, data brokers must maintain a $20,000 surety bond in Connecticut. The bond must cover any liability to the state arising under relevant provisions of law.

• Mass / Automatic Deletion. Data brokers should be prepared to honor deletion request and/or other consumer rights’ requests such as rights of access. Several states require data brokers to participate in automated, mass opt-out procedures. Though details vary, generally these programs enables consumers to make a single opt-out to the state regulator which then apply to all registered data brokers. Data brokers should plan to regularly check these systems for relevant requests applicable to their data. In California, the regulator contemplates that data brokers will participate in an automated API process to handle these “DROP” requests. In cases where a data broker does not match an individual in their records, they may nevertheless need to maintain a suppression list to prevent acquisition and sale of consumers information in case the broker comes into contact with that information in the future.

• Compile / Report on Statistics. In California, data brokers should be prepared to compile statistics about their processing of deletion requests, including the speed of their substantive responses.

• Update Privacy Notices or Policies. In some states (e.g., Texas, California, and Connecticut), the data broker statute and/or regulatory material requires companies to maintain specific notices or policies, including public notices. Notices and policies will need to be updated and maintained to meet the specific content requirements of these laws, which can include the offer of consumer rights, disclosures about the data broker’s processing of rights requests, and specific notice identifying the company as a data broker.

• Data Rights Policies / Procedures. Data brokers should strongly consider developing standard written policies and processes for responding to consumer rights requests, including deletion requests. These policies could address timing, communication content, procedures for validating requests and identifying consumers, procedures for dealing with authorized agents and/or parental requests (on behalf of their minor children), and procedures for tracking counts and statistics relating to responses. Policies and procedures could also identify exception cases where the company would deny a request as permitted or required by law.
  
  Data brokers may also face requirements to “flow down” certain deletion requests to third parties. These third parties will need to be identified and processes established to ensure that relevant deletion requests are communicated appropriately.

• Data Broker Audit. In some states (e.g., California and Connecticut), specific data broker audits will become required (in California, starting in 2028, and in Connecticut, in 2031). These data broker audits stand apart from other audits required under law.

• Cybersecurity.  Multiple state laws require data brokers to implement comprehensive written information security programs. These include detailed control requirements defying neat summary. Existing security controls should be reviewed to ensure appropriate controls and documentation.

• Prohibited Data. Under New Jersey law, “sensitive data” may not be sold. Under other laws, sale of sensitive data may also be discouraged or inadvisable. New Jersey, for example, defines “sensitive data” as, “personal data revealing racial or ethnic origin; religious beliefs; mental or physical health condition, treatment, or diagnosis; financial information, which shall include a consumer’s account number, account log-in, financial account, or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a consumer’s financial account; sex life or sexual orientation; citizenship or immigration status; status as transgender or non-binary; genetic or biometric data that may be processed for the purpose of uniquely identifying an individual; personal data collected from a known child; or precise geolocation data.“

Outside of data broker statutes and regulations, companies should also consider their obligations under other state privacy laws. Some key requirements include, for example:

• Risk Assessments. Data brokers should generally expect that they will be required to conduct and record risk assessments under state comprehensive privacy laws. In California, company executives will be required to certify completion of these assessments under penalty of perjury to the regulator.

• California Cyber Audit. Data brokers operating in California must assess the need to conduct a formal cyber audit. Many data brokers will be subject to the requirement to conduct an independent, objective, rigorous annual review of cybersecurity controls relating to systems managing brokered data.  Company executives will be required to make certifications under penalty of perjury regarding these audits.

• Children’s Privacy. For data brokers dealing with the data of minors, additional considerations and law may apply, including the need to honor parental opt-outs on behalf of minor children.

• Data Collection. Data brokers should always consider the legal defensibility of their data sourcing practices. Privacy and IP law will typically bear on data collection in a substantial way. Data brokers should have procedures to identify and govern their data sources, including maintenance and review of contracts with relevant data suppliers, consideration of whether data was collected subject to appropriate privacy notices and consents, and consideration of IP issues. For data brokers who generate data from AI processes, the substantial body of emerging law governing AI also merits consideration.

Taft will continue to monitor for updates and new developments. If you have questions about this consumer privacy laws or data broker requirements in general, Taft’s Privacy, Security & AI attorneys are available to assist. As always, please sign up to receive emails of our latest posts here on Privacy and Data Security Insights, and follow us on LinkedIn for the latest in privacy, security and artificial intelligence legal news.