Does licensing your company's data make you a data broker?

What makes a business a data broker?#

A data broker, under most state broker laws, is a business that knowingly collects and sells or licenses personal information about consumers with whom it has no direct relationship. The missing relationship is the defining feature: brokers assemble information about people who never dealt with them.

An operating company licensing its own records starts from the opposite position. The people in its support tickets, job records and CRM histories are usually its customers, employees, vendors and business contacts. That relationship generally takes first-party records outside broker definitions, though each state words its law differently.

The relationship test is narrower than it sounds. California's regulator has said the relationship must be recent, and that a business with a direct relationship can still be a data broker for personal information about that person which it obtained from other sources rather than from its own dealings with them. Enrichment data appended to real customer records is the usual example.

Which states have data broker laws?#

Several states, including California and Texas, require data brokers to register with a state agency, and some add duties such as security programs or deletion mechanisms. Other states have considered similar laws, so check the current list at the time of each deal.

Some laws also weigh how much of a business's revenue comes from selling data it did not collect directly; others focus on the relationship alone. A company can fit one state's definition and not another's, which is why each license is checked against each law that may apply.

Edge cases that deserve a closer look#

Edge cases appear wherever a company's records include people it never dealt with directly, and these record families need examining before a license is scoped.

The usual fix is exclusion. Removing purchased contacts, enrichment fields and third-party sourced records from a package tends to resolve the broker question and also improves the dataset, since buyers want records created in real operations.

• 1Purchased lead lists and trade show scans in the CRM, whose contacts may never have dealt with you.
• 2Third-party enrichment fields, such as appended titles, phone numbers or firmographic data from a data vendor.
• 3End users of your customers, if you run a software product: you process their data for your customers, not for yourself.
• 4Records from an acquired company, where the relationship was with the predecessor and its privacy promises may still bind the data.
• 5Referral and partner contacts that another business shared with you.
• 6Scraped or public data collected for prospecting or research.

Do deidentified and employee records change the answer?#

Deidentified records generally change the answer, because broker laws apply to personal information and data meeting the deidentification standard is generally not personal information. The standard takes more than removing names, so the claim needs documented methods, a public commitment and contract terms behind it.

Employee records rarely raise broker questions, since employees have a direct relationship with their employer. They raise other issues instead. California treats employees as consumers under its privacy law, so employee personal information in a licensed package can bring notice and sale questions even when broker rules do not apply.

A self-check before you scope a license#

A self-check before scoping tells you whether the broker question needs counsel's time or can be closed quickly. Answer each question per record family, not for the company as a whole, because a clean support archive and a CRM full of purchased leads can sit side by side.

If every answer lands in the reassuring column, document the reasoning and move on to the privacy review. If any answer does not, bring that record family to counsel before it goes anywhere near a buyer.

Illustrative: an industrial supply distributor checks its CRM#

Illustrative: a fictional industrial supply distributor plans to license quote-to-order histories and service exception records from Epicor and its CRM. During the rights review, the team finds that the CRM also holds contacts imported from trade show scans and a purchased list of plant managers.

The company excludes every imported and purchased contact, strips enrichment fields added by a data vendor, and replaces remaining customer contact names with role labels such as purchasing manager or maintenance lead. Quote, order and exception records stay, because they describe the distributor's own transactions.

With the package limited to deidentified first-party records, counsel concludes that broker registration is not triggered for that license. The reasoning and the exclusion list go into the deal file.

Rules that can apply even if you are not a broker#

State privacy laws can still apply when broker laws do not. If a package contains personal information, licensing it for value may be a sale under the comprehensive state laws that apply to you, with notice, opt-out and contract duties attached.

Other rules depend on the buyer and the content. Sensitive data categories often need opt-in consent, and a federal rule from the Department of Justice restricts certain transfers of bulk sensitive personal data to countries of concern. Promises made to customers and employees in contracts and notices apply regardless of any statute.

How SourceX approaches the broker question#

SourceX works with companies licensing records created in their own operations, and the Supply and Rights steps of the SourceX five-step transaction trace where each record family came from. Purchased, inherited and third-party sourced records are flagged before preparation begins.

The SourceX Evidence Packet records provenance for every record family in the package, which gives counsel a clear basis for the broker analysis and gives the buyer a documented source.