La Tua Azienda è un Data Broker? Rischi di Conformità e Definizioni

The Hidden Definition of a Data Broker

For years, the term "data broker" conjured images of shadowy aggregators selling mailing lists. However, recent enforcement actions have signaled a shift in how regulators define the role. In August 2026, the California Privacy Protection Agency (CalPrivacy) issued its first joint enforcement actions under the CCPA and the Delete Act, fining LocateSmarter a disclosed $110,490 (https://www.jdsupra.com/legalnews/calprivacy-settles-with-two-data-8857468/) and Cybba a disclosed $52,400 (https://www.gov.ca.gov/2026/08/13/icymi-california-takes-historic-action-against-data-brokers/) for failing to register as data brokers. These companies were not traditional aggregators, yet they met the statutory criteria that many SMEs currently overlook.

The legal definition of a data broker is deceptively simple: a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. If your organization monetizes datasets containing third-party insights, you may already be operating as a broker in the eyes of the law. Understanding what you can legally sell under GDPR and US state laws is the first step in avoiding these escalating penalties.

The "Direct Relationship" Litmus Test

The pivot point for most enforcement actions is the "direct relationship" test. A direct relationship exists if a consumer is a current or former customer, or has otherwise interacted directly with your business. If you process data acquired from a partner, a public record, or a third-party API and subsequently license that data—even in an enriched or pseudonymized form—the direct relationship is severed. At that moment, you become a data broker.

Regulators are increasingly looking at "shadow brokers"—firms that provide marketing attribution, identity resolution, or credit risk modeling. If the data you sell was not collected directly from the individual by your entity, you are likely subject to registration. This is particularly critical for firms exploring our dataset catalogue to source or provide high-value AI training data; the provenance of the data dictates the regulatory burden.

Multi-State Registration Requirements: CA, TX, and OR

While California’s Delete Act (SB 362) is the most aggressive, it is not the only hurdle. As of 2026, several states have implemented mandatory registries with varying thresholds:

• California: Requires annual registration by January 31. Failure to register results in a disclosed administrative fine of $200 per day (https://www.jdsupra.com/legalnews/calprivacy-settles-with-two-data-8857468/).
• Texas: The Data Broker Transparency Act requires businesses that earn more than 50% of their revenue from data brokerage, or deal in data of more than 50,000 individuals, to register or face penalties up to $10,000 per violation.
• Oregon: Requires registration for any entity that maintains data on more than 10,000 Oregon residents and sells that data to third parties.

The estimated cost of compliance—including registration fees, legal audits, and the implementation of "delete all" requests—ranges from $15,000 to $50,000 annually for mid-sized firms, according to industry benchmarks. However, the cost of non-compliance is significantly higher, as evidenced by recent five- and six-figure settlements.

Financial and Operational Risks of Non-Compliance

Beyond the immediate administrative fines, being labeled a "non-compliant data broker" carries existential risks for data-driven enterprises. Institutional data buyers, particularly those in the AI and financial sectors, now conduct rigorous due diligence on data provenance. A failure to register under the Delete Act can render a dataset "toxic," making it unlicensable to major tech firms who fear secondary liability.

Furthermore, California's Delete Act mandates that by 2026, the state will provide a single "accessible deletion mechanism" allowing consumers to delete their data from all registered brokers with one click. If you are not registered, you cannot integrate this mechanism, putting you in direct violation of consumer rights and inviting class-action litigation.

What this means for you

For data owners, the era of "accidental brokerage" is over. You must audit your data supply chain to determine if you are selling information from consumers with whom you lack a direct relationship. If you fall into this category, registration is no longer optional—it is a prerequisite for market participation. For buyers on d-nvest, ensuring your partners are compliant with state broker laws is the only way to guarantee the long-term viability of your AI models and data assets. Compliance is not just a legal hurdle; it is a signal of data quality and institutional readiness.