Hundreds of Data Brokers Are Dodging State Registration Laws

A new investigation from the Electronic Frontier Foundation and Privacy Rights Clearinghouse¹ caught my attention this week. They found that hundreds of data brokers are systematically avoiding state registration requirements. The numbers tell the story: 291 companies failed to register in California, 524 in Texas, 475 in Oregon, and 309 in Vermont.

The registration gaps look deliberate

Data broker registration laws exist for a reason. They create transparency about who's collecting and selling personal information, and they give consumers a way to find these companies and exercise their privacy rights. When brokers skip registration, they operate in the shadows.

The EFF research shows companies playing jurisdictional games. A broker might register in California but skip Texas, even though it does the same business in both states. Or it registers as one entity while operating subsidiaries that should also be registering.

Nobody misses four states by accident. That pattern is systematic evasion.

An unregistered broker's problems become yours

I've spent years advocating for consent-based email marketing² because it works better and carries fewer risks.³ This investigation is one more reason purchased lists and data appending remain bad strategies.

When you work with an unregistered data broker, you're working with a vendor that has already shown it will cut corners on compliance. That tells you something about how it collects data, too.

If that broker collected data through deceptive practices or can't demonstrate valid consent, you've inherited those problems. When consumers complain or attorneys general start investigating, the complaints come to you first, because your name is on the message. Consumers only learn about the data broker if you tell them who it is.

Growbots and UpLead are a preview. The California Privacy Protection Agency fined them more than $30,000 each for failing to register as data brokers.⁴ Any email marketer using their services probably wasn't expecting to inherit vendor compliance problems when they signed those contracts.

Check registration if you buy data at all

If you're still buying lists or appending data, stop. The risks keep growing while the benefits keep shrinking.

If you're not ready to make that jump yet, at least verify your vendors' registration status and ask about it in your RFPs. California maintains a searchable registry of data brokers.⁵ Texas has one, too.⁶ Oregon⁷ and Vermont⁸ have their own systems. Check them at onboarding and then on a schedule. A vendor that registers in every state where it is required to is more likely to take its other compliance obligations seriously.

Registration is the easiest obligation to check. If a vendor won't register with state authorities, the harder questions follow: what other shortcuts it takes, how it collects its data, and whether it can show valid consent for the records it sells you.

The EFF just handed regulators a roadmap

State enforcement is ramping up, and the EFF and Privacy Rights Clearinghouse have given regulators a list of non-compliant companies to start with. A list built through direct subscriber sign-up never has to answer those vendor questions, because you collected the data, hold the consent records, and can respond to consumer requests yourself.

The marketers who will scramble are those whose list vendors show up in the next round of enforcement actions.