What Is a Data Broker? What Companies Need to Know

Despite the name, a data broker is not someone standing in a busy room trading datasets. It is generally a company that collects personal information, often from sources other than the individuals directly, and sells, licenses, shares, or otherwise provides that information to others. Pretty simple, right? Only with those definitions comes an extensive list of responsibilities and regulatory requirements, some of which we’ll cover here. 

Data brokers are at the center of many activities we encounter daily. They support activities related to advertising, identity verification, fraud prevention, and background screening. Their limited direct contact with consumers often creates transparency and privacy risks, which is why regulators wish to ensure their data practices are ethical. And as always, when regulators pay closer attention, organizations need to understand what qualifies as data brokerage and which rules to follow.

Meet the data broker

Data brokers typically operate behind the scenes, but their impact is significant. They collect information from multiple sources, including public records, various websites and mobile apps, retailers, surveys, other data providers, and commercial transactions. In some cases, they combine these details, connect them to specific individuals or households, and generate additional classifications or inferences. In other words: they could be building a data-based user profile. 

The data can be used to target the right marketing personas, verify identities, assess potential fraud, conduct research, or support consumer-related decisions. As we all know, there’s no end to what you can potentially do with data, but data brokers are often prohibited by law from performing these very actions. 

Speaking of laws, there is no single legal definition of a data broker. Many laws focus on whether a company has a direct relationship with the individual whose data it processes. Others consider how the information was obtained, whether it is sold or transferred, which purpose it served, and what the recipient uses it for. Companies acting solely as service providers may also be excluded from certain definitions. And so, the current answer to the question “What is a data broker?” is always “That depends.” But these definitions matter because being classified as a data broker can trigger specific registration, disclosure, security, audit, and consumer-request obligations. 

How different laws define and regulate data brokers

The regulatory picture is fragmented, and definitions do not always align. Some examples include:

• California: California defines a data broker as a business that knowingly collects and sells personal information about consumers with whom it has no direct relationship, subject to exemptions for certain regulated entities and activities. Under the Delete Act, data brokers must register annually and provide detailed disclosures. They must access the Delete Request and Opt-Out Platform (DROP) at least once every 45 days and process applicable deletion requests within 45 days.

• Texas: Unlike California, Texas does not require a business to sell personal data to meet the definition. A data broker is a business that collects, processes, or transfers personal data it did not collect directly from the individual. However, the Data Broker Act applies only when the broker derives more than 50% of its revenue directly from processing or transferring such data, or derives revenue from processing or transferring the data of more than 50,000 individuals. Covered brokers must register, publish a conspicuous notice about their activities and consumer rights, and maintain a comprehensive information security program.

• Nevada: Nevada uses a narrower definition. A data broker is a person whose primary business involves purchasing covered information about consumers with whom they have no direct relationship and selling that information. Data brokers must provide a designated address through which consumers can opt out of sales and must respond to verified requests within 60 days, with a possible 30-day extension.

What data brokers should keep in mind

Data brokers first need to determine where they meet the applicable definitions. This requires visibility into data sources, processing purposes, jurisdictions, and more. 

Accurate data mapping is particularly important. Organizations must know whether information was collected directly, purchased, inferred, obtained from public sources, or received through a partner. They should also identify sensitive data, children’s data, precise geolocation, biometrics, and information used in eligibility decisions, since these categories may carry additional restrictions.

Consumer-rights workflows require similar attention. Access, correction, deletion, and opt-out requests must be matched against relevant records and communicated to service providers where required. Deletion may also require ongoing controls to prevent the same person’s information from being repurchased and sold again.

In addition, data brokers should maintain current registrations and disclosures and document compliance. Centralized discovery, data mapping, request management, and compliance evidence help turn these obligations into repeatable processes.

Data brokerage regulation is moving toward greater transparency, easier deletion, stronger security, and tighter control over sensitive information. Definitions will continue to vary, but the fundamental notion is that companies must understand their data sources, uses, and transfers to identify their obligations and respond as new rules emerge. For data brokers, complete visibility into the data lifecycle is becoming a basic requirement for doing business.

‍