Data Brokers Have No Direct Relationship With You by Definition

There is no account to close, because you never opened one. That is the difficulty with data brokers in one line, and it begins with the statutory test for being one rather than with anything they do.

The definition is built around an absence

Vermont has carried a data broker statute since 2017, and its definitions section states the shape plainly. Under 9 V.S.A. § 2430, a data broker is “a business, or unit or units of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship”.

California arrives in the same place more briefly. Civil Code § 1798.99.80, which sits inside a title headed Data Broker Registration, defines one as “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship”, then excludes businesses to the extent they are already covered by federal credit reporting, financial, insurance and medical privacy regimes.

The operative clause is the same in both. The qualifying fact is not that the company holds too much, or sold something it should not have. It is that you and it have had no direct dealings.

Vermont then spells out what dealing with each other would have looked like. Its examples of a direct relationship are a consumer who is a past or present “customer, client, subscriber, user, or registered user of the business’s goods or services”, or an “employee, contractor, or agent”, or an “investor in the business”, or a “donor to the business”.

Every entry on that list describes something you did on purpose. None of them describes a connection that fetched a page.

One statute names your address and the other does not

California names it twice, and the second time is the one worth sitting with.

Civil Code § 1798.140 supplies the definitions the registration title borrows, and it lists personal information by category. The first category is “Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers”.

The same section then defines a unique personal identifier as “a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services”, and files an Internet Protocol address under it, next to identifiers issued to a device.

Persistent is the load-bearing word. It is the property the category is named for, and an address on an ordinary home connection supplies it unevenly.

Vermont went the other way. Its brokered personal information is a list of named elements: name, address, date of birth, place of birth, mother’s maiden name, biometric data, the name or address of someone in your household, and a government-issued identification number. No IP address appears on it.

An address can still qualify, through the element the drafters put last: “other information that, alone or in combination with the other information sold or licensed, would allow a reasonable person to identify the consumer with reasonable certainty”.

So one statute treats your address as an identifier in its own right, and the other reaches it only through a clause about combination. Both readings are defensible, and they diverge because the thing itself is ambiguous.

The registration schedule leaves the address out

Registration is annual. Civil Code § 1798.99.82 requires a business that met the definition to register with the California Privacy Protection Agency “on or before January 31 following each year” in which it did, pay a fee, and answer a schedule of questions about what it holds. The text quoted here is the version that took effect on 1 January 2026.

That schedule is granular. It asks whether the broker collects names, dates of birth, ZIP Codes, email addresses or phone numbers. Whether it collects account logins. Whether it collects driver’s licence, identification card, tax, social security, passport or military identification numbers. Whether it collects mobile advertising identification numbers, connected television identification numbers or vehicle identification numbers. Whether it collects data on citizenship, union membership, sexual orientation, gender identity, biometrics, precise geolocation or reproductive health care. It asks whether the broker has sold data to a foreign actor, to the federal government, to other state governments, to law enforcement, or to the developer of a generative AI system.

No question in it asks about an IP address. A broker that collects neither the contact-detail group nor the device and vehicle identifier group must instead name “up to three, but no fewer than one, of the most common types of personal information” it collects, and that is the one question in the schedule that could oblige anybody to mention an address.

Set that beside the definitions section, which calls the same address a persistent identifier. The same body of law names it and then does not ask after it.

Why an address makes a poor spine for a record

The gap is less strange than it looks, because an address is a weak thing to build a file around, and our own tool pages are explicit about the parts of it that come back empty.

Our own lookup of a single address names the thin cases without hedging: “Some IP addresses do not have useful hostname or city data.” A lookup that sometimes returns neither a hostname nor a city is not a reliable column in anybody’s database.

The allocation record behind an address is sparser still, and it explains why. It says of the registry responsible for North American address space that it “does not return a country field at all”, and it notes that registries disagree about when a record was created or last amended. Then it states the awkward part plainly: “A missing field means the registry did not publish it, not that the lookup failed.”

A record whose fields are absent by design is a poor key to join other records on. An empty cell might mean the address has no country recorded, or that the registry holding it does not publish that field, and nothing in the record tells a buyer which.

Then there is the age of the row. A row records what an address pointed at on the day it was written, and the allocation underneath can move afterwards without leaving any mark in the row. Whether it still describes the same household a month later is not a question the row can answer, and how much one address can honestly support on its own sets out why.

So the address earns its place in a file by sitting next to something steadier. Where each of these identifiers physically sits is what decides whether you can act on any of them, and the address is the one nobody holds. How it reaches a buyer is a separate mechanism again: the auction that fills an advert slot lists it among the fields a seller fills in.

What a Vermont registration has to admit

Vermont’s registration section is the part worth reading for yourself, for what it forces into public view.

Under 9 V.S.A. § 2446, a broker must state, if it offers one at all, “the method for requesting an opt-out”, whether that route reaches some of its activities or sales rather than all of them, and whether it will accept a third party acting on your behalf. It must say whether it runs a credentialing process on the people buying from it. And it must file “a statement specifying the data collection, databases, or sales activities from which a consumer may not opt out”.

That last requirement is the unusual one. The statute does not assume an opt-out exists, or that it covers everything. It obliges the broker to write down, in a public filing, the parts of its business you cannot leave.

The duty is backed by penalties. Registration costs $100 a year in Vermont, and failing to register runs at “$50.00 for each day, not to exceed a total of $10,000.00 for each year”, plus the fees that went unpaid, recoverable by the Attorney General. California’s equivalent fine is $200 for each day a broker goes unregistered.

Two limits are worth stating rather than leaving implied. These are two US state statutes, quoted for their definitions and their filing duties, so nothing here describes the law elsewhere or how it is being enforced, and none of it is legal advice.

What follows for you

The thing with a legal handle on it is the record, not the address. A deletion or opt-out request is made against a company’s file. Your address comes from a network and goes back to it, without reference to any of that.

The registers are public, and they are the starting list. Both statutes exist to produce one: a named set of companies holding information about people who have had no dealings with them, readable before you ask anyone for anything.

An absent field is not reassurance. A file that does not mention your address may have used it to join two other things together and kept only those.

The absence in the definition is the useful part, because it tells you where pressure can be applied. There is nothing to unsubscribe from, so the question is not how to withdraw. It is which filing already says what it will not let you withdraw from.