Data broker registration fees by state, 2026
Six states have enacted data-broker registration requirements. All are current law. Nothing in this table is a proposal.
| State | Statute | Fee | Key dates |
|---|---|---|---|
| California | Delete Act (SB 362) | $6,000/yr for 2026 registrants (+ up to 2.99% card fee); rising to $9,500 for the 2027 registration period, adopted Aug 6-7, 2026 | Register Jan 1-31; DROP cycles already live; triennial audits from Jan 1, 2028 |
| Texas | SB 2105 | $300/yr | Live now; filed with the Secretary of State, enforced by the AG |
| Oregon | HB 2052 | $600/yr | Live now; renew by Dec 31 |
| Vermont | Act 138 (signed Jun 16, 2026) | $100 rising to $900/yr, plus a $20,000 surety bond from Jan 1, 2027 (bond premium roughly $150-600/yr) | Vermont’s planned central registration portal was replaced by a feasibility study |
| Connecticut | PA 26-64 (signed May 2026) | $2,500/yr | Act effective Oct 1, 2026; register by Jan 1, 2027; centralized deletion mechanism required by Jul 1, 2028 |
| New Jersey | A5328 (signed Jun 30, 2026) | $5,000-$1.5M/yr, tiered | Registry expected operative around Mar 27, 2027 (an Apr-Jun 2027 first filing window has been reported but isn’t confirmed); covers a broader “data collector” category and bans certain sensitive-data sales, with penalties up to $50,000 per record |
California’s SB 361 also widened what the state registration discloses, under §1798.99.82(b)(2): whether the broker sells or shares data to foreign actors, the federal government, other state governments, or law enforcement, and to developers of generative-AI systems (subsections (O) through (S)), plus which sensitive-data categories it holds: citizenship or immigration status, union membership, sexual orientation, gender identity, biometrics, precise geolocation, and reproductive-health data (subsections (H) through (N)). A broker’s counsel-reviewed registration should account for those added disclosure categories rather than treating the form as unchanged from prior years.
What non-registration actually costs
California’s penalty for failing to register is $200 per day (§1798.99.82(c)(1); SB 361 doubled this from $100 per day, effective January 1, 2026), a flat daily number with no grace period. It isn’t hypothetical: fourteen enforcement actions since November 2024 have totaled $697,290 across firms including Growbots, UpLead, Infillion, The Data Group, KMA, National Public Data, Background Alert, Accurate Append, ROR Partners, Datamasters, S&P Global, LocateSmarter, Cybba, and SalesIntel Research. Thirteen of those are registration cases; two, LocateSmarter (announced August 11, 2026) and Cybba (announced August 13, 2026), add a data-minimization or CCPA component on top of a registration failure. None is a deletion-cycle fine, because the DROP deletion obligation is too new for one to exist yet.
The ROR Partners case is worth sitting with. ROR Partners was a marketing firm, not a company that thought of itself as a “data broker” in the way the term usually gets used. CalPrivacy fined it $56,600 anyway, on the theory the agency stated plainly in its December 3, 2025 announcement (cppa.ca.gov/announcements/2025/20251203.html): a sale is a sale, regardless of what the seller calls its business. Firms that don’t see themselves fitting the definition are exactly the ones getting caught by it. Five of these cases, ROR’s included, are walked through in what $697,290 in fines actually looked like.
What’s proposed, not enacted
A few bills would extend this calendar further but aren’t law yet: Washington (HB 2483), Illinois, and Massachusetts have data-broker bills in progress, and a federal DELETE Act remains in committee. A proposal to shorten California’s 45-day DROP cycle to 30 days was previously tracked here under SB 1106; that bill was amended in the Assembly on July 2, 2026 to concern agentic-AI oversight instead, and no bill currently pending under a known number carries the 30-day-cycle proposal. None of these change a broker’s current obligations, but a bill in committee today is a filing deadline a year or two out, and the states that already moved (Connecticut and New Jersey both signed law in 2026) show how fast “proposed” turns into “enacted.”
Take the self-test to check which of these six states’ definitions are worth a closer look for a given business, or book a 20-minute cycle review to walk through the calendar against an actual filing history.
Related: Registration is only the entry point. See The 45-day DROP cycle, operationally for the recurring obligation that follows.
Common questions
We're registered in California but sell data into other states. Does that matter?
Yes, registration is state-specific, and each state's fee and deadline are independent of the others. CalPrivacy has already identified 291 firms registered elsewhere but not in California, which is exactly the gap regulators are watching for. Selling into a state doesn't register a broker there automatically.
When does the California registration window open?
Registration runs January 1-31 each year. 2026 registrants paid a $6,000 fee (plus a card-processing fee of up to 2.99% if paying by card). The CPPA board voted at its August 6-7, 2026 meeting to raise the fee to $9,500 for the 2027 registration period (Jan 1-31, 2027); that higher fee isn't in force yet.
What's a surety bond, in plain terms?
It's a third party's promise to pay if a broker doesn't meet an obligation: here, Vermont's requirement, starting January 1, 2027, that a broker post a $20,000 bond alongside its registration. A broker doesn't hand over $20,000 up front; it pays a bonding company a yearly premium, roughly $150-600, for that company to stand behind the bond.