Am I A Data Broker?: A Quick Primer On State Laws Regulating A Growing Industry

Recently, multiple states have enacted and passed new data privacy laws and bills (Colorado, Virginia, Utah, California Privacy Rights Act, Connecticut, Indiana, and Ohio). Rightfully so, these laws and bills have garnered much of the media attention. However, in the midst of all the new state data privacy laws, new bills regulating "data brokers" have begun to emerge. To no surprise, California is leading the way with its Data Broker Registration Law, which was enacted in 2019.

Applicability

Clearly noted on the California Attorney General's CCPA website (the "AG Website") is that the California Consumer Privacy Act (the "CCPA") applies to "many businesses, including data brokers." This means that while the Data Broker Registration Law has specific requirements for a data broker, such as registering with the Attorney General, a data broker can also be subject to the CCPA's requirements if it meets the thresholds of a "business" as defined under the CCPA.