Methodology
This site republishes public data broker registries, matches companies across them, and dates every statement. Data here was last retrieved September 19, 2026; registry snapshots are from September 17, 2026.
Where does the data come from?
Directly from each registry's own published data: California's CPPA registry (CSV), Texas's Secretary of State portal, Oregon's Division of Financial Regulation downloads, and archived California Attorney General registrations from the Internet Archive. Each raw download is stored unchanged and hashed with SHA-256 before parsing. See sources.
How are companies matched across registries?
Names are normalised (case, punctuation, corporate suffixes such as "LLC" and "Inc.") and companies are merged automatically only on an exact normalised name or a shared website domain. Address matches and fuzzy name matches are queued for review and are not merged automatically. Manual decisions override every automatic rule. The result was also compared with the Privacy Rights Clearinghouse and Electronic Frontier Foundation unified database, which credit deserves: their work is the independent check that found where this matching disagrees.
What does "not found" mean?
It means only that a name did not appear in a registry's listing on a given date. It is a fact about a registry. It is not a finding that a company failed to comply with any law. Reasons a company may be absent include a different statutory definition of "data broker", an exemption, a different legal entity name, restructuring, or a match this site missed.
What do the statuses mean?
- Registered: found in the most recent listing this site holds for that registry.
- Not found: not in that listing on that date.
- Not checked: this site has not looked. Vermont's search requires a CAPTCHA, which this site does not automate; the UK register is searched only for companies with other UK evidence.
- Registry pending: the registry does not exist yet (Connecticut).
The site's "active" and "lapsed" wording follows the same rule: a company is described as not in any current registry, never as having broken a rule.
How is presence in another country established?
Only from public evidence, and each entry names its type: the company's own US filing giving a non-US headquarters ("registry" evidence), the UK ICO register, the EU data intermediary register, or a keyword match on the company's own privacy page ("probable" only). A headquarters abroad does not prove the company handles data about people there.
What about ownership?
Not yet researched. Every company page states ownership is unknown, with confidence "unknown", until it is.
Known gaps
- One snapshot per registry so far, so there is no change history yet.
- No Vermont or Connecticut data. Enforcement actions, opt-out instructions and ownership are not yet on the site.
- All companies are currently categorised "other".
- The 2023 California Attorney General cohort is a partial reconstruction.
How do corrections work?
Anyone can submit a correction. A named company can dispute a fact and expects a reply within five business days. Corrections stay visible in a dated log.