How to find out data brokers have my information is usually the question that follows a strange phone call a debt collector asking about a loan that isn’t yours, or a text message that already knows your full name and street address. In the United States, a handful of states now require data brokers to identify themselves publicly, which gives consumers an actual starting point instead of guesswork. Here’s how those registries work, and how the search connects to the broader process to opt out of data brokers.
The Short Version
- No master list names every broker that holds a specific person’s data. State data broker registries only list which companies have declared themselves data brokers not who’s in their databases.
- As of 2026, California, Vermont, Oregon, and Texas each run a searchable state data broker registry, and Connecticut has added broker-specific obligations to its own privacy law.
- Registered brokers rarely include the household-name people-search sites, so checking Whitepages, Spokeo, and similar sites by name directly is still a necessary step.
- Services like DeleteMe scan hundreds of broker and people-search databases under your actual name and report back what they find, which a government registry can’t do.
What the Law Actually Says About Data Brokers and Your Information
A data broker a business that collects personal information about people it has no direct relationship with, then sells or licenses that information to others has become a specific legal category, not just an industry description.
Under California law, Civil Code Section 1798.99.80 defines a data broker in almost exactly those terms, and the definition applies regardless of company size. There’s no small-business carve-out. Since the Delete Act (Senate Bill 362) took effect, any business meeting that definition must register annually with the California Privacy Protection Agency (CPPA) the state agency enforcing California’s privacy laws and the CPPA publishes the resulting list as a public data broker registry consumers can search by company name.
Vermont data broker registration works on a similar structure. Under Vermont’s data broker statute, a business with no direct relationship to a consumer meaning no customer, employee, or donor relationship that sells personal information must register each January through the Vermont Secretary of State. The state’s Online Business Service Center includes a public Data Broker Search tool for looking up registered companies.
Oregon followed with its own registration law, enforced by the Department of Consumer and Business Services, requiring data brokers to register starting January 1, 2024. Texas takes a narrower approach: its data broker law, filed with the Secretary of State, only applies to companies that draw at least half their revenue from data broker activity or that handle data on 50,000 or more people a real threshold that exempts most small operations.
None of these registries confirm that a specific broker holds your file. They confirm that a company has legally identified itself as one, which narrows down where to look next.
Real-World Examples
Scenario one: A remote worker in Ohio starts receiving pre-approved loan offers addressed to an old apartment she moved out of two years ago. She isn’t a California, Vermont, Oregon, or Texas resident, so none of those registries cover her directly but she can still search each state’s list for companies, then check whether those same companies operate nationally and accept requests from any U.S. resident.
Scenario two: A small e-commerce owner in Vermont gets a notice that his customer list qualifies as data broker activity because a partner service resells the anonymized purchase data. He checks Vermont’s registration requirements and realizes his direct-relationship exemption likely applies, since he sells to his own customers rather than to strangers with no prior connection.
Scenario three: A California resident wants to know exactly which companies have profiled her before deciding whether to file individual deletion requests or use the state’s Delete Act tool. She searches the CPPA’s data broker registry by name, cross-references it against a handful of well-known people-search sites, and finds three overlapping companies worth contacting directly.
What People in This Situation Typically Do
Many people trying to figure out who’s holding their data follow a similar sequence:
- They search their home state’s registry first, if it has one California, Vermont, Oregon, and Texas each publish one, and they’re free to use.
- They run their own name, past addresses, and phone numbers through a handful of well-known people-search sites, since most of those don’t limit themselves to a single state’s registry.
- Californians typically also check the Delete Act’s DROP tool the Delete Request and Opt-out Platform which sends one deletion request to every broker registered with the state, covering brokers a manual registry search might miss.
- Some send a formal access request to companies they suspect hold their data, citing whichever state privacy law applies, to get a direct answer instead of guessing.
- Many repeat the search every few months, since brokers continually rebuild profiles from public records, real estate filings, and old data breaches.
- People who find the manual process too slow often turn to a paid monitoring service that automates the search and the removal requests going forward.
Tools That Can Help
State registries and DROP are free, official, and worth using first there’s no reason to pay for something a government agency already provides. But none of them scan the full universe of active people-search and marketing databases, and none of them repeat the search automatically over time.
That’s the gap a service like DeleteMe is built to close. It searches hundreds of data broker and people-search sites under your actual name, tells you which ones turned up a match, and files removal requests on an ongoing basis so profiles that reappear later get caught too.
[Affiliate placement: DeleteMe link/CTA goes here]
Related Articles
- What Is the California Delete Act DROP Tool and How Do You Use It?
- CCPA Explained: California’s Privacy Law and What It Means for You
- The Right to Be Forgotten: How to Request Deletion
Frequently Asked Questions
Which states require data brokers to register?
As of 2026, California, Vermont, Oregon, and Texas each require data brokers meeting their state’s definition to register annually with a state agency. Connecticut has added its own data-broker-specific disclosure requirements as part of a broader privacy law update. Requirements, deadlines, and fees vary by state, so a company registered in one state isn’t necessarily registered everywhere it operates.
What is a data broker registry?
A data broker registry is a public list, maintained by a state agency, of companies that have formally identified themselves as data brokers under that state’s law. It typically shows a company’s name, contact information, and sometimes what categories of data it collects. It doesn’t show which specific consumers appear in a company’s internal database.
How is a data broker defined by law?
Definitions vary slightly by state, but most, including California’s, describe a data broker as a business that knowingly collects and sells or licenses personal information about consumers with whom it has no direct relationship no customer, employee, or similar connection. Texas adds a revenue and data-volume threshold; Vermont and Oregon use definitions closer to California’s.
Do data broker laws apply to small businesses?
It depends on the state. California’s law applies to any qualifying business regardless of size, with no small-business exemption. Texas exempts companies that don’t meet its revenue or data-volume thresholds. Vermont and Oregon generally apply their definitions without a size-based carve-out, though both exclude businesses with a direct relationship to the people in their data.
Conclusion
There’s no single switch that reveals every company holding a copy of your personal information, but how to find out data brokers have my information doesn’t have to mean starting from zero either. State data broker registries in California, Vermont, Oregon, and Texas name the companies that have legally identified themselves, California’s Delete Act adds a free tool that reaches every registered broker at once, and a paid monitoring service can cover the rest of the field those registries don’t touch. Combining a couple of these approaches, and repeating the search periodically, is generally the most realistic way to find out who actually has your data in 2026.
Sources
- California Privacy Protection Agency Information for Data Brokers official CPPA guidance on registration and the public data broker registry
- California Civil Code Section 1798.99.80 the statutory definition of “data broker” under California law
- Vermont Secretary of State Data Broker Filings Vermont’s registration requirements and public Data Broker Search tool
- Oregon Division of Financial Regulation Data Broker Registry Oregon’s registration rules and license verification search
- Texas Secretary of State Data Brokers Texas registration requirements and revenue/data-volume thresholds
