Data broker compliance across eleven jurisdictions — the California DELETE Act (DROP), Connecticut, New Jersey, Texas, Oregon, Vermont, EU and UK GDPR, Brazil's LGPD, Canada's PIPEDA and Québec Law 25. Your customer data is matched inside your browser and never uploaded.
New Jersey prohibits selling or licensing sensitive data outright, at $50,000 per record, and has done since 30 June 2026. Not per cycle, not per month — per record, with no exception for disclosures to processors. On a file of ten thousand people the arithmetic stops being a compliance question.
Across the six US states that now run broker registries, the penalties accrue at $3,550 a day — $1.3 million a year — and every figure on this page is one you can check against the statute yourself. MCStanding is $12,000.
California alone is $200 per request, per day, with no cure period. That was the whole pricing argument here until June, when two states made it the smallest number on the page.
Nothing to approve, and nothing to review. Your customer data is matched inside your
browser, so there is no data-processing agreement to negotiate, no security questionnaire to
return, no vendor onboarding and no subprocessor to disclose. This site sends
connect-src 'none', which means the page cannot open a network connection at all —
your security reviewer confirms that from the response headers in about ten seconds, without
reading our code or taking our word for it. Most compliance software takes a quarter to get
through procurement. This takes an afternoon.
One price, everything included. Not tiered by request volume — the 45-day obligation is identical whether you receive thirty requests or thirty thousand.
| When | What changes, whether or not you are ready |
|---|---|
| In force 30 Jun 2026 |
New Jersey — selling or licensing sensitive data prohibited outright, $50,000 per record. Applies regardless of the size thresholds that gate the rest of the state's privacy law. |
| 1 Oct 2026 | Connecticut's act takes effect — including an outright ban on selling precise geolocation data, and a ban on surveillance pricing. |
| 1 Jan 2027 | Vermont — fee $100 → $900, a new $20,000 surety bond, and the penalty from $50 a day capped at $10,000 a year to $200 a day uncapped, plus $25,000 for materially incorrect information. Connecticut registration opens. |
| 27 Mar 2027 | New Jersey registration opens — $5,000 to $1,500,000 a year by volume, $2,500 a day uncapped for not registering. It reaches data collectors too, so selling your own customers' data onward counts. Check whether that is you → |
| 1 Jul 2028 | Connecticut's deletion platform goes live on a 45-day cadence — and it verifies consumers, where California forbids it. One process cannot satisfy both. |
30-day money-back guarantee. If MCStanding is not right for you, email us within 30 days and we refund the full amount — no questions, no retention call. We also email you 30 days before every renewal with the date and amount, so a four-figure charge is never a surprise. Terms · Privacy.
connect-src 'none', meaning the page cannot open a
network connection at all. Your security reviewer can confirm that from the response headers in
about ten seconds, without reading our code or trusting us.