Guides · Published
Is Data Brokering Illegal? US Law Explained (2026)
Is data brokering illegal? In most of the US it is legal, with no single federal law. Here is what the rules cover, which states differ, and what it means for businesses.
Short answer
In most of the United States, data brokering is legal. No single federal law restricts it, and the rules that exist mostly come from individual states. Legal does not mean unregulated, though. Some states require brokers to register, and some give people rights over their data.
What a data broker is
A data broker collects information from many sources and sells or licenses it to other companies. The term usually brings to mind consumer profiles, such as contact details, purchase habits or location signals. The legal questions depend on what the data is, who it is about, and where the people and the buyer are located.
Why it is legal in the US
According to EPIC, there is no federal law in the United States that adequately regulates the data broker industry. StaySafeOnline makes the same point in plainer terms: data broker activities are generally legal because there is no single federal privacy law restricting them.
That gap is the reason the question keeps coming up. The law covers pieces of the market, not the whole of it, so a broker can be lawful in one state and face registration duties in another.
State rules are where the differences are
States have stepped in one at a time. In 2023, Texas and Oregon both passed data broker registration laws. EPIC's page also tracks registry and sensitive-data rules in other states, including Maryland, California and New Jersey.
For a business, the practical checks are:
- Which state the people in the data live in
- Whether that state requires brokers to register
- Whether the data includes sensitive categories that some states restrict
- What your own customer contracts allow
Why critics say some brokering should be illegal
The main objection is harm. California's privacy resource notes that data brokers may sell information to buyers with malicious intent, such as hate groups, hostile foreign governments and scammers. Critics argue that a market which cannot control its buyers creates risk for the people in the data, and they push for federal rules or outright bans on some uses.
Supporters argue that most brokering serves ordinary business needs, such as fraud checks, marketing and background screening. Whether the answer should change is a policy question, and it is being debated in Congress and in state legislatures.
Where business records fit
Not every data sale involves personal consumer profiles. Smelted works with a different kind of data: internal business records that a company already has and is not using, such as support tickets, CRM history, standard operating procedures, project files, code, CAD files and lab data. These records are licensed to AI data companies that train AI agents.
How Smelted handles that data:
- Names, contact details and IDs are removed before anything is shared.
- The company keeps ownership. It grants a license to a copy.
- The company chooses what is included and which buyers it meets.
- The company pays nothing. The buyer pays Smelted's fee.
- Payment usually comes a few weeks to two months after signing, so plan on one to three months from first call to payment.
| Question | Consumer data brokering | Licensing anonymized business records |
|---|---|---|
| Whose data | Usually individuals | The company's own internal records |
| Personal identifiers | Often central to the product | Removed before sharing |
| Who decides what is shared | Often the broker | The company, item by item |
| Main legal concern | Privacy and consumer protection | Confidentiality, contracts and anonymization |
Smelted does not give legal or compliance approval. Whether a specific deal fits your obligations depends on your contracts, your state and what your records contain. Talk to your own counsel before you sign anything.
How to check your own position
Before you license any records, a company should:
- Read customer and vendor contracts for confidentiality and data-use terms.
- Check whether any records include personal information about people who are not your business customers.
- Confirm the state rules where those people live.
- Ask counsel to review the license terms.
Next step
If you run a company with under 50 employees, or you are not sure of your size, the next step is the 2-minute form at smelted.ai/get-started. It asks about headcount, tools and history. If you have 50 or more employees, you can book a short intro call or use the form instead.
FAQ
Is it legal to be a data broker?
In most US states, yes. There is no single federal law restricting data brokers, so the rules come mostly from states. Some states require brokers to register, and the requirements differ.
Which US states have data broker laws?
Texas and Oregon passed registration laws in 2023. EPIC also tracks registry and sensitive-data rules in Maryland, California and New Jersey. Check the current law in your state, because this area changes often.
Should data brokers be illegal?
This is a policy question without a settled answer. Critics point to risks such as sales to scammers and malicious buyers, as noted by California's privacy resource. Supporters point to ordinary business uses. Both sides are active in current debates.
How do you sell your data to AI companies?
For business records, a company can license anonymized copies through a matching service. Smelted removes names, contact details and IDs, lets the company choose what is included and which buyers it meets, and charges the company nothing. Get your own legal review before signing.