Four US states require data brokers to register: California, Vermont, Texas and Oregon. A registry is simply a public list of companies that self-identify as being in the business — which is genuinely useful even where, unlike California, there's no deletion platform attached, because it tells you who to send opt-out requests to. California's registry is the one that does more, since it underpins DROP.
What a registry is for
Data brokers are, by definition, companies you have no relationship with. That creates an obvious problem: you can't opt out of an organisation you've never heard of.
A registry solves the discovery half. It doesn't remove anything, but it converts "who has my data?" from unanswerable to a list you can work through.
The four states
California
The most developed. Brokers register annually with the California Privacy Protection Agency in a 1–31 January window, with a 2026 registration fee of $6,000 plus processing. Crucially, registration is tied to the Delete Request and Opt-Out Platform: since 1 August 2026 registered brokers must access DROP at least once every 45 days and process the deletion requests they find, with a first independent audit due by 1 January 2028 and every three years after. Source: California Privacy Protection Agency. Checked: 2026-08-19.
This is the only registry with a working one-request-reaches-all mechanism attached. How to use it
Vermont
The oldest, dating from 2018. Brokers register with the Secretary of State annually, and the law also requires them to maintain information security measures.
Texas
Introduced by SB 2105, signed in 2023, with registry rules adopted by the Secretary of State later that year. Requires registration, a website notice, and a security programme.
Oregon
Introduced by HB 2052, also 2023. Brokers register with the Department of Consumer and Business Services, and must disclose whether they let consumers opt out of collection.
The California details above are from the CPPA directly. The Vermont, Texas and Oregon specifics come from secondary legal commentary rather than from each state's own registry pages, so treat the dates and mechanics as indicative and check the relevant state agency before relying on them. We'd rather flag that than present second-hand detail as verified.
How to actually use one
- Search your own name first and note which sites publish your details. That's your real priority list.
- Use a registry to find contact and opt-out details for the brokers on it — registries typically record a website and opt-out information.
- If you're a California resident, use DROP first. One request, free, statutorily backed.
- Otherwise work through your list manually, or pay a service for breadth. A method for doing it yourself
The gap
Registration is self-declared. A company that meets a state's definition of a data broker but simply doesn't register is breaking the law — and still won't appear on the list, so your requests never reach it.
That's the structural weakness of registries generally: they're excellent at surfacing the compliant and useless against the rest. Worth holding in mind when a removal service quotes a coverage number, because coverage is measured against the visible portion of the industry. How to judge one
If you're not in those four states
No registry exists for you, which makes discovery harder rather than impossible — you're back to searching your own name and working from what's published. EU and UK residents have a stronger route in the GDPR right to erasure, which applies to brokers without needing a registry. How