Rights and contracts
Is a company that licenses data a 'data broker' under state laws?
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
A company that licenses its own business records is usually not a data broker under state laws, because definitions in states such as California, Texas, Vermont and Oregon generally target businesses selling personal information about consumers they have no direct relationship with. The answer can change if licensed records still contain personal data about people you never dealt with.
Key takeaways
- State data broker definitions generally turn on personal information about people the business has no direct relationship with.
- Records about your own customers, employees and operations usually sit outside those definitions, especially once personal details are removed.
- Shipment consignees, sourced candidates, purchased contact lists and enrichment data are the records most likely to change the answer.
- A company outside the broker definitions may still be selling personal information under state privacy laws if personal details remain.
- The federal DOJ rule uses its own, broader idea of data brokerage, so it needs a separate check.
How do state laws define a data broker?#
State laws define a data broker, in broad terms, as a business that collects personal information about consumers it has no direct relationship with and sells or licenses that information to others. The details differ by state, as do exemptions for businesses already regulated under other laws, but that core pattern recurs.
The phrase that does most of the work is direct relationship. A consumer who bought from you, called your support line or worked for you has a relationship with your company. A person whose details you bought from a list vendor, or who appears in your records only because a customer shipped them a package, may not.
These laws were written with people-search sites, marketing list sellers and data aggregators in mind. Their duties, such as registration and handling deletion requests, are built around businesses whose product is information about people.
How the main state data broker laws compare#
The state data broker laws most often discussed share a definition pattern but differ in emphasis and obligations. Check the current statute text with counsel, because these laws are amended often, exemptions vary and other states have considered similar registries.
Registration duties are the visible part of these laws, but the definitions decide everything. A company outside the definition has no registration duty in that state, however large its archive; a company inside it may have duties even for a modest dataset.
| State | Law | Definition generally turns on | What a licensing company should check |
|---|---|---|---|
| California | Delete Act and data broker registration law | Knowingly collecting and selling personal information of consumers with no direct relationship | Whether licensed records hold personal information about people you never dealt with; registry and deletion request duties if covered |
| Texas | Texas data broker law | Revenue from collecting, processing or transferring personal data the business did not collect directly from the individuals | Whether any licensed personal data came from someone other than the individual, and how the statute's current revenue test applies |
| Vermont | Vermont data broker law | Collecting and selling or licensing brokered personal information of consumers with no direct relationship | Whether licensed records include brokered personal information |
| Oregon | Oregon data broker law | A similar no-direct-relationship test | The same record-level question, plus registration duties if covered |
| States with privacy laws but no broker registry | Comprehensive privacy laws | No broker registration, but licensing personal data can count as a sale | Notice, opt-out and contract duties for any personal data left in the package |
Why licensing your own first-party records usually falls outside#
Licensing your own first-party records usually falls outside data broker definitions because the people in those records dealt with you directly, and because a well-prepared package removes their personal details before delivery. A support ticket, a dispatch record or a code review is evidence of your company's work, not a profile of a consumer.
Preparation strengthens that position. When names, contact details, account numbers and other identifiers are removed, the licensed records carry workflows and decisions rather than information about identifiable people. De-identified data is generally outside the personal information definitions these laws rely on, provided it meets the applicable de-identification standard.
The business model can matter too. An occasional license of operational records for a named AI use looks very different from a business line built on selling information about people.
Which records could change the answer?#
Records about people your company never dealt with directly are the ones that could change the answer. They sit in ordinary systems and are easy to overlook in an inventory.
If any of these remain in a licensed package with personal details intact, counsel should assess the broker definitions in each relevant state. The simpler course is usually to exclude or de-identify them during preparation.
Inventory these by field, not only by system. A Salesforce instance can hold first-party customer contacts and a purchased list in the same object, separated only by a lead source field, and that field is often the cleanest way to exclude the purchased records. Treat records inherited through acquisitions the same way, since an acquired company's CRM may hold lists of people who never dealt with either business.
- Consignee names and delivery addresses in 3PL, freight and distribution shipment records.
- Sourced candidate profiles in an ATS such as Bullhorn, where the candidate never applied to you.
- Purchased prospect and contact lists loaded into Salesforce or HubSpot.
- Third-party enrichment fields appended to CRM contacts by data vendors.
- Property owner or occupant details pulled from public records into estimates and permit files.
Illustrative: a staffing firm checks its ATS#
Illustrative: a fictional staffing firm wants to license records from its Bullhorn ATS and email showing how recruiters match job orders to candidates. Its database mixes candidates who applied directly, candidates who were placed, and a large set of profiles sourced from job boards and imported lists.
Counsel notes that the sourced profiles describe people with no direct relationship to the firm, the pattern data broker laws target. The firm excludes sourced-only profiles and imported enrichment fields entirely. In the remaining records, names, contact details and employment histories are removed, leaving job requirements, screening notes stripped of identifiers and placement outcomes.
The firm documents its exclusion logic in the deal file, so it can later show exactly what was licensed and how personal information was handled.
What applies even if you are not a data broker?#
Several rules can apply even when a company is clearly not a data broker, so the broker question is only one part of a privacy review. If personal information remains in licensed records, state comprehensive privacy laws such as the CCPA may treat the license as a sale, which brings notice and opt-out duties. California's risk assessment regulations may also be triggered by selling personal information.
Separately, the DOJ bulk sensitive data rule defines data brokerage broadly enough to include licensing access to data, with restrictions focused on countries of concern and covered persons. Customer contracts, employee notices and vendor terms apply regardless of any statute.
The practical sequence is the same in every case: inventory the records, identify whose personal information they contain, decide what to remove, and only then ask which laws still apply to what is left.
How SourceX approaches the data broker question#
SourceX licenses a supplier's own operational records for named AI uses; it does not resell data or build profiles of people. Within the SourceX five-step transaction, the Rights step flags record families about people without a direct relationship, and Preparation removes personal details before Approval and Delivery.
The privacy record in the SourceX Evidence Packet documents what was removed and how, which gives the supplier's counsel the facts needed to assess data broker and privacy obligations state by state.
Frequently asked questions
Does licensing records once make us a data broker?
A single license of first-party operational records is unlikely to fit the typical definition, which focuses on personal information about people you have no direct relationship with. Volume, revenue share and frequency can matter in some states, so counsel should review the specific package and your revenue mix.
Is de-identified data covered by data broker laws?
Data that meets the applicable de-identification standard is generally outside the personal information definitions these laws use. Standards differ, and pseudonymized data with a retained key often still counts as personal. Treat de-identification as something to document carefully, not a label to apply.
Are business contacts treated as consumers?
It depends on the state. California's privacy law generally covers business contacts and employees as well as household consumers, while several other states exclude people acting in a commercial or employment context. Check each law that applies to the records in your package.
Who decides whether we must register?
Your company and its counsel decide, based on the statute text in each state where a registration duty could apply. Registration brings its own obligations, such as periodic filings and deletion request handling in some states, so the analysis should happen before any license that could include personal information.
Does the buyer's status as a data broker affect us?
It can. If an AI developer or intermediary resells or redistributes data, it may carry broker obligations of its own, and your records could end up in its products. Bar resale and onward transfer in the license so your records stay with the named buyer for the named use.
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.