Who We Insure
Data Broker Insurance: State Registries, the Delete Act and Privacy Class Actions
A data broker is insured against the consequences of selling information about people who never agreed to the sale. The main risks are a privacy class action after a breach or a disputed use of the data, enforcement under state data broker registries and California's Delete Act, Fair Credit Reporting Act claims when a product is used for eligibility decisions it was not built for, and the professional liability that follows when a customer relies on inaccurate records. Standard cyber and E&O forms were written for companies that hold data incidentally; a broker's data is its product.
Why data brokers carry specialized insurance
Regulators now treat the business model itself as the exposure. California, Vermont, Texas, and Oregon run data broker registries with their own penalties, the Delete Act is building a one-stop deletion mechanism, and the Federal Trade Commission has pursued brokers over the sale of precise location data and health inferences. Each theory can appear in a complaint beside the breach claim, and each is treated differently by a cyber policy's regulatory coverage. This guide covers cyber and privacy liability for a data broker's own operations and for the data it sells, Tech E&O for accuracy and delivery, media liability for inferences and profiles, D&O, and the contract and underwriting questions that decide whether coverage is available at all.
Who this guide is for
Written for founders, general counsel, privacy officers, and finance leads at companies that collect, aggregate, enrich, or license personal information to third parties. People-search and identity resolution companies, data enrichment and B2B contact providers, and audience-data sellers; Location, mobility, and alternative-data vendors selling to advertisers, hedge funds, or insurers; Analytics companies that have started reselling or licensing the datasets they built for their own products; Not for consumer reporting agencies regulated primarily under the FCRA — the background screening guide covers that model.
The risk profile of a data broker
A data broker's exposure grows with the sensitivity of the data, the number of downstream buyers, and the distance between the individual and the use. Claims usually arrive in groups rather than one at a time. Key exposures: Breach of a consolidated dataset covering millions of people, with notification duties in every state and class actions that follow the notice; Regulatory actions under state registration laws, the Delete Act, comprehensive privacy laws, and FTC authority over sensitive categories; FCRA claims when a buyer uses a product to screen tenants, employees, or borrowers, bringing accuracy and permissible-purpose duties the broker did not price; Professional liability to customers for inaccurate, stale, or incomplete records that drive their marketing, underwriting, or fraud decisions; Media and privacy torts — false light, public disclosure of private facts, misappropriation — from profiles, inferences, and people-search listings; Contract disputes with data suppliers over scope of license, scraping, and consent representations that flow downstream.
Cyber & Privacy Liability for data brokers
The central policy, and the hardest to place well. Beyond breach response and extortion, a data broker needs privacy liability that covers wrongful collection and sale, not only security failures; regulatory coverage for state attorneys general, the California Privacy Protection Agency, and the FTC; and a definition of protected information wide enough to include inferred data. Many forms exclude claims arising from the intentional sale of data or from biometric, location, or health categories, so exclusions are read before limits. Typically responds to: breach response, notification, and credit monitoring across a national population; privacy class actions and regulatory investigations over collection and sale practices; extortion, business interruption, and recovery for the broker's own systems.
Technology E&O for data brokers
Customers buy data to make decisions, and when the data is wrong the decision is wrong. Tech E&O covers claims that records, match rates, or delivery failed to meet the contract, and it should be issued together with the cyber policy so a single incident — a corrupted file that is also a leaked file — is not split between two carriers who each point at the other.
Media Liability for data brokers
People-search listings, enrichment profiles, and inferred attributes can be defamatory, place someone in a false light, or disclose private facts. Media liability, whether as an insuring agreement in the cyber policy or a separate form, covers those torts for content the broker publishes or licenses. FCRA-related claims are often excluded and need to be negotiated back if any customer could use the data for eligibility decisions.
Directors & Officers (D&O) for data brokers
Investors, acquirers, and regulators ask whether the board understood the legal basis for the company's data. D&O defends directors and officers in securities, investor, and regulatory proceedings and in the derivative claims that follow a public enforcement action.
Contract and certificate requirements
Enterprise data buyers and platforms impose the requirements: cyber and Tech E&O at stated limits, often with privacy liability called out specifically, plus general liability and workers' compensation. Advertising platforms and cloud marketplaces add their own data-partner insurance terms. Suppliers of raw data increasingly ask for evidence of cyber coverage as a condition of licensing. Supplier and customer contracts also define the exposure the policy must match. Consent representations made upstream, use restrictions imposed downstream, and the indemnities in both directions decide who defends a privacy suit. A policy whose contractual liability exclusion is broader than the indemnities the company signed leaves the company funding its own defense.
What coverage costs
Cyber and privacy pricing for a data broker depends on the number of individuals in the dataset, the categories held (precise location, health, children's, biometric, and financial data are rated hardest), the number and type of buyers, registration status in the states that require it, consumer-request handling, and claims and regulatory history. Several carriers decline the class entirely, so the available market is smaller and pricing reflects that. Security controls move the price within the available market: encryption, access logging, multi-factor authentication, data minimization, and a documented deletion workflow for Delete Act and state requests.
What underwriters will ask for
Underwriters want to understand the data lifecycle from source to sale, because that lifecycle is what the privacy claims will be about. Have ready: Data inventory: categories held, number of individuals, sources, and the legal basis or consent for each source; Customer segments and use cases, with any FCRA, insurance, or employment uses identified and contractually restricted; Registrations under state data broker laws and the process for handling deletion and opt-out requests; Security program: encryption, access controls, logging, multi-factor authentication, and penetration-test results; Supplier and customer contract templates, including indemnities and use restrictions; Breach, complaint, regulatory inquiry, and litigation history.
Illustrative example: The location dataset that reached a regulator
A mobility-data vendor licenses de-identified location histories to advertisers. A journalist re-identifies visits to clinics and places of worship from a sample. The FTC opens an inquiry into the sale of sensitive location data, and a class action follows citing the same reporting. Privacy liability and regulatory coverage within the cyber policy fund defense of the inquiry and the class action, subject to the policy's treatment of claims arising from intentional sale and sensitive categories — the terms that should have been negotiated at placement.
Illustrative example: The enrichment file used for tenant screening
A B2B contact-data provider sells enrichment records to a property-management software company, which uses them to flag rental applicants. Applicants denied housing sue under the FCRA, naming the data provider as a consumer reporting agency that failed to ensure accuracy. Tech E&O and media liability respond to the extent the FCRA exclusion was removed or narrowed; the customer contract's use restriction and the provider's compliance with it decide the allocation between the two companies.
Illustrative example: The credential-stuffing attack on the customer portal
Attackers use reused passwords to log into customer accounts on the broker's portal and export search results on hundreds of thousands of individuals. The export is sold on a criminal forum, and notification letters go to residents of every state. The cyber policy funds forensics, counsel, notification, and credit monitoring, then defends the class actions that follow. The adjuster will ask whether multi-factor authentication was enforced on the portal, as the application represented.
What does data broker insurance cost?
There is no standard figure. Pricing follows the number of individuals in the dataset, the sensitivity of the categories, the buyer base and use cases, state registration and consumer-request compliance, security controls, and claims history. As of 2026, the market willing to write data brokers is narrower than for ordinary software companies, so a complete submission matters more than usual.
Does a standard cyber policy cover a data broker?
Often not without changes. Many cyber forms exclude claims arising from the intentional collection or sale of personal data, from biometric or location data, or from FCRA-regulated activity. A data broker needs those exclusions removed or narrowed and a definition of protected information that includes inferred data, or the policy will not respond to its most likely claims.
Does registering as a data broker change the insurance?
Registration itself does not change coverage, but underwriters ask whether the company is registered where required and how it handles deletion and opt-out requests. Unregistered operation in a state that requires it is a penalty exposure and a sign to underwriters that the compliance program is immature.
Are we a consumer reporting agency if a customer uses our data for screening?
You may be, depending on what the data is and how it is used, and the FCRA's accuracy, dispute, and permissible-purpose duties then apply. Restrict eligibility uses by contract, monitor for them, and make sure media liability and Tech E&O do not exclude FCRA claims entirely.
Do data brokers need D&O insurance?
Companies with outside investors or regulatory exposure should carry it. Enforcement actions and public breaches lead to investor and derivative claims that D&O defends, and acquirers look for it in diligence because the legal basis for the data is a central deal question.
Caveats and common gaps
Cyber and privacy forms differ sharply on intentional-sale, sensitive-category, and FCRA exclusions, and those terms decide whether a data broker is insured for its actual business. Regulatory fines and penalties are covered only where insurable by law and where the policy says so. Media liability may carry a separate retention and sublimit. Read the exclusions before comparing limits.
Related guides
Insurance for Data Analytics Platforms — analytics companies that process customer data without reselling it · Data and analytics companies — the broader industry page · Insurance for AdTech Companies — the buyers of audience data and their own privacy exposures · Insurance for Background Screening Companies — the FCRA-regulated model · Insurance for Identity Verification & KYC Companies · Cyber liability coverage · Tech E&O insurance
Frequently asked questions
What does data broker insurance cost?
There is no standard figure. Pricing follows the number of individuals in the dataset, the sensitivity of the categories, the buyer base and use cases, state registration and consumer-request compliance, security controls, and claims history. As of 2026, the market willing to write data brokers is narrower than for ordinary software companies, so a complete submission matters more than usual.
Does a standard cyber policy cover a data broker?
Often not without changes. Many cyber forms exclude claims arising from the intentional collection or sale of personal data, from biometric or location data, or from FCRA-regulated activity. A data broker needs those exclusions removed or narrowed and a definition of protected information that includes inferred data, or the policy will not respond to its most likely claims.
Does registering as a data broker change the insurance?
Registration itself does not change coverage, but underwriters ask whether the company is registered where required and how it handles deletion and opt-out requests. Unregistered operation in a state that requires it is a penalty exposure and a sign to underwriters that the compliance program is immature.
Are we a consumer reporting agency if a customer uses our data for screening?
You may be, depending on what the data is and how it is used, and the FCRA's accuracy, dispute, and permissible-purpose duties then apply. Restrict eligibility uses by contract, monitor for them, and make sure media liability and Tech E&O do not exclude FCRA claims entirely.
Do data brokers need D&O insurance?
Companies with outside investors or regulatory exposure should carry it. Enforcement actions and public breaches lead to investor and derivative claims that D&O defends, and acquirers look for it in diligence because the legal basis for the data is a central deal question.
This material is general educational information, not legal, tax, or insurance advice. Coverage availability, policy terms, and regulatory requirements vary by state, carrier, and applicant.