Just DROPped: A Data Broker Law Update

California’s Delete Request and Opt-Out Platform (DROP) requirements went into effect on August 1, 2026, marking a meaningful operational shift for regulated data brokers and a clear reminder that enforcement of the Delete Act is no longer theoretical.

Separately, several other states have advanced their own data broker frameworks. New Jersey introduced an aggressive data broker regime, Connecticut expanded its privacy law to build out a data broker registration and centralized deletion framework, and Vermont updated its existing data broker law. Against that backdrop, and with regulators taking action, it is a good time for personal data-driven companies to take stock of their compliance obligations and risk exposure under these evolving data broker laws.

California’s DROP

 As of August 1, 2026, registered data brokers in California must access DROP at least once every 45 days and process consumer deletion requests submitted through the platform. Operationally, this requires data brokers to integrate DROP retrieval and monitoring into existing request-handling workflows to ensure proper processing across relevant systems.

The California Privacy Protection Agency has indicated that hundreds of thousands of Californians have signed up for DROP. This suggests meaningful consumer uptake and involvement, underscoring the importance of operational readiness for data brokers. Additionally, noncompliance carries penalties of up to $200 per day for failure to register and failure to process deletion requests. The daily accrual means delays in onboarding and gaps in processing workflows will quickly become material.

As a reminder, California defines a “data broker” as any business that knowingly collects and sells personal information about consumers with whom the it does not have a direct relationship, subject to limited exclusions. In practice, this definition reaches beyond companies that sell marketing lists and could implicate analytics and enrichment vendors, referral programs, and others where data may be exchanged for “other valuable consideration” rather than cash.

New Jersey’s New Law

On June 30, 2026, New Jersey quietly and quickly enacted its own data broker law that adds a notable, and potentially costly, twist to the data broker laws we have seen to date. At first glance, the law looks familiar, applying to businesses that sell or license personal data of consumers with whom they lack a direct relationship. However, New Jersey expands applicability by also imposing obligations on “data collectors,” entities that do have a direct relationship with the consumer but sell or license the data to a data broker.

This structure effectively regulates both sides of the data supply chain, which is different from other state data broker law structures that focus primarily on downstream brokers. Beginning March 27, 2027 data brokers and data collectors will be required to register annually with New Jersey’s Division of Consumer Affairs in the Department of Law and Public Safety.

New Jersey also adopted a tiered annual registration fee structure, which escalates based on the volume of consumer records processed:

• Fewer than 100,000 consumers: $5,000
• 100,001 to 499,999 consumers: $10,000
• 500,001 to 999,999 consumers: $100,000
• 1,000,001 to 1,499,999 consumers: $500,000
• 1,500,001 to 2,499,999 consumers: $750,000
• 2,500,001 to 4,499,999 consumers: $1,000,000
• More than 4,500,000 consumers: $1,500,000

This fee structure could arguably function as a deterrent. For many organizations, the threshold analysis alone will require a reassessment of data flows, consumer counts, and whether restructuring or segmentation strategies are viable.

Connecticut’s Comprehensive Privacy Law Amendments

On May 27, 2026, Connecticut amended the Connecticut Data Privacy Act to regulate data brokers, introducing several notable features. Under the amendments, “data brokers” are businesses that sell or license brokered personal data. “Brokered personal data” is personal data that is categorized or organized for sale or license to a third party. Rather than building the “direct relationship” concept into the definition itself, Connecticut treats it as an exemption from the law’s scope, alongside other entity-level exemptions.

Beginning October 1, 2026, data brokers must register with the Connecticut Department of Consumer Protection. They will also be required to comply with consumer requests submitted through the forthcoming universal deletion mechanism. In addition, data brokers must maintain a privacy policy that, at a minimum, describes measures designed to ensure compliance with the law.

Vermont’s Revisions to its Existing Data Broker Law

On June 16, 2026 Vermont amended its existing data broker law to notably add breach notification obligations and annual registration requirements for data brokers which go into effect January 1, 2027. It also calls upon the Secretary of State to develop a universal deletion mechanism for consumers. The definition of “data broker” remains the same, a business that sells or licenses brokered personal information of a consumer with whom the business does not have a direct relationship. However, the definition for “brokered personal information” was revised to match the standard definition of personal data and explicitly excludes publicly available information.

Enforcement This Year

Earlier this year, the California Privacy Protection Agency’s Data Broker Enforcement Strike Force issued enforcement actions against data brokers for failure to register. The Federal Trade Commission has also taken time this year to remind data brokers of their obligation to comply with the Protecting Americans’ Data from Foreign Adversaries Act of 2024 (“PADFAA”), sending 13 letters to data brokers warning them that PADFAA prohibits data brokers from selling, releasing, disclosing, or providing access to personally identifiable sensitive data about Americans to foreign adversaries. While data broker laws continue to evolve and enforcement dates draw closer, further developments are likely.

Conclusion

Together, these developments suggest that data broker laws are evolving, with increasing expectations around accountability, infrastructure, and ongoing compliance. Meanwhile, consumer requests and enforcement activity continue to drive organizational attention.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.