What is a data broker under state law, and is licensing your own records the same thing?

The short answer

It depends on the state and the facts. The common thread in state data broker statutes is a business that sells or licenses personal information about people it has no direct relationship with. A company licensing records it created while running its own business is generally in a different position, but personal information inside those records can raise separate privacy questions. This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

What do California's privacy rules say?

California is the best-known example, and its privacy framework is the one most owners ask about. The California Attorney General's CCPA overview describes consumer rights to know, delete and opt out of the sale or sharing of personal information. It applies to for-profit businesses that meet one of three tests: an annual revenue threshold, buying, selling or sharing the personal information of a large number of California residents or households, or deriving a large share of revenue from selling or sharing personal information.

The statute text sets out notice duties, limits on use and a requirement for a written agreement when personal information is sold, shared or passed to a service provider. See the official CCPA text. Regulations are administered by the California Privacy Protection Agency, and its regulations index shows updates took effect in 2026, so check current text rather than relying on summaries.

Data broker registration is a separate registry regime under California law and other states, and this page does not quote those definitions. Read the current registry statute, and its exact wording, in each state where the company operates or where individuals reside, and ask counsel to apply it.

Data broker vs data licensor: what to check

How does SourceX's process handle personal information?

De-identification and redaction requirements are agreed with the company before any work begins, and data is delivered only after an executed agreement and the company's authorization. Records that are mainly consumer personal data with no licensing basis, or mainly medical information without authorization or de-identification, are red flags in qualification. The company keeps ownership and approves scope.

The FTC has also said in staff guidance that promises not to use customer data for undisclosed purposes such as model training are enforceable, so an owner should read its own privacy policy and customer terms before licensing anything.

Questions an owner should ask counsel

• Does any state registry definition reach our business?
• Which of our records contain personal information, and what do our privacy notices say about them?
• Which customer contracts restrict reuse of information we hold?
• What should be redacted before delivery?
• Does the answer change for California residents?

What this means for a referral partner

Partners do not give legal advice and should not tell an owner they are or are not a data broker. The role is to ask whether the company created the records and may license them, then point to the right professionals. Start with what is proprietary data, then use the company fit checker for a preliminary, non-binding screen. The who qualifies page lists the baseline. If the company sits in an insolvency process, a trustee or court may control its assets; see state court receivership vs bankruptcy. Related background: what is a virtual data room, what is exit readiness and the average private equity holding period.

Next step

If the owner has cleared rights with counsel, register as a partner and introduce them, or send them to sourcex.si/apply. Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is paid only after the buyer pays and SourceX receives its fee; an introduction, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed.