Dormant Commerce Clause Challenge Fails: Supreme Court Upholds State Data Broker Registration Law 7–2

WASHINGTON — A state may require every business that sells personal information about its residents to register, pay a fee and disclose its practices, regardless of where the business is located, the Supreme Court held on Thursday, rejecting a dormant Commerce Clause challenge by a vote of 7–2 and removing the principal constitutional objection to the data broker laws now in force in a growing number of states. The decision in Lattice Data v. Ferreira also strengthens the footing of the twenty comprehensive state privacy statutes that regulate businesses on the same basis.

"A law that treats everyone the same does not become discriminatory because most of the regulated are elsewhere," the majority wrote.

The law and the challenge

The statute, modeled on Vermont's 2018 registry and California's Delete Act, defines a data broker as a business that collects and sells personal information about consumers with whom it has no direct relationship, requires brokers to register annually with the state and pay a fee, to disclose the categories of data they sell and the opt-out rights they offer, and to process deletion requests submitted through a state-run portal. Lattice Data, a broker headquartered in another state with no offices, employees or servers in the enacting state, argued that the law regulated commerce occurring wholly outside the state's borders, that its burdens fell almost entirely on out-of-state businesses, and that the cumulative effect of fifty such regimes would be an unconstitutional obstacle to a national market in data.

What the Court held

1. No discrimination. The law applies identically to in-state and out-of-state brokers, and the fact that few brokers are located in the state reflects the structure of the industry, not a legislative choice to favor local firms. The anti-discrimination rule, the Court said, protects against protectionism, not against regulation of an industry that happens to be concentrated elsewhere.
2. No extraterritoriality. The Court applied Ross, in which it upheld California's animal-welfare conditions on pork sold in the state and rejected a rule invalidating laws with practical effects beyond state lines. A law regulating the sale of data about the state's own residents, the majority held, regulates a transaction with an in-state subject, and the fact that the sale is consummated elsewhere does not make it a regulation of another state's commerce.
3. Pike balancing. The registration fee and disclosure duties are modest, the deletion mechanism uses the same request format other states have adopted, and the state's interest in letting residents know who holds their data and stop its sale is substantial. The burden is not clearly excessive. The Court declined to aggregate hypothetical burdens from laws other states might enact.
4. What is left open. The majority said a law that singled out out-of-state brokers, or one shown on a developed record to impose costs grossly disproportionate to any local benefit, could still fail, and that Congress may preempt the field at any time.

The dissent

Two justices dissented. They would have held that the dormant Commerce Clause retains a role in policing state regulation of the internet, where every transaction crosses state lines, and that the majority's approach leaves a national industry subject to fifty inconsistent registries with no court able to weigh the aggregate burden. They also faulted the Court for extending Ross, a decision about goods physically sold in the state, to data that never enters it.

A law that treats everyone the same does not become discriminatory because most of the regulated are elsewhere.

From the majority opinion

Why the case matters

Data broker registries are the sharpest edge of state privacy regulation because they reach companies that consumers have never heard of and that have no presence in the state. California's Delete Act, with its one-stop deletion platform operating since January 2026, has drawn the most attention; Texas, Oregon and Vermont run registries of their own, and several states have bills pending. Had the Court accepted the extraterritoriality argument, the same reasoning would have threatened the comprehensive privacy laws that twenty states now enforce against any business processing data about their residents, and the universal opt-out mechanisms those laws require.

The decision also confirms the direction set in Ross: the Court will not use the dormant Commerce Clause to referee the patchwork of state internet regulation. That task, the majority said, belongs to Congress, which has considered and not passed a national privacy law in every session since 2019. The practical consequence for businesses is the one compliance officers have already drawn — see The Counsel's map of the twenty state privacy laws and the six taking effect in January — that the patchwork is the law, and the courts will not simplify it.

What happens next

The case returns to the district court for entry of judgment for the state. Brokers that had suspended registration pending the ruling face enforcement in the states with active registries, where penalties accrue per day of non-registration. Legislatures in several states that had paused data broker bills are expected to take them up in their 2027 sessions.

The Counsel will report enforcement actions under the state registries as they are filed. Businesses that collect and sell consumer data should confirm whether they meet the broker definition in each state with a registry; the definitions differ.

This report is for general information only and is not legal advice. Readers should consult a licensed attorney about their own circumstances. Docket numbers and citations are to the official reporters unless otherwise stated.