California Data Broker Registration Requirements

If your business knowingly collects and sells personal information about California consumers you have no direct relationship with, California data broker registration requirements apply to you. You must register with the California Privacy Protection Agency (CalPrivacy) every January, pay a $6,000 fee for 2026, and submit detailed disclosures about your data practices under penalty of perjury. Missing the window costs $200 per day in administrative fines on top of the fees you still owe.

Who Has to Register

California Civil Code Section 1798.99.80 defines a data broker as a business that knowingly collects and sells the personal information of consumers it has no direct relationship with.¹ The “no direct relationship” piece is what sets brokers apart from ordinary businesses selling data about their own customers.

“Business” follows the California Consumer Privacy Act definition: a for-profit entity meeting at least one threshold such as gross annual revenue over $26,625,000, buying or selling the personal information of 100,000 or more consumers or households, or deriving 50 percent or more of annual revenue from selling or sharing personal information.²

Who Is Excluded

Entities regulated by the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, and California’s Insurance Information and Privacy Protection Act are excluded, but only to the extent their data handling falls under those frameworks.¹ Processing exempt under the CCPA’s HIPAA-related health data provisions is also outside the definition. Nonprofits sit outside the CCPA’s “business” definition and therefore outside the registration requirement.

Read “to the extent” literally. If part of your activity falls under one of the exempt federal laws but you also sell consumer data outside that framework, you still have to register for the non-exempt portion.

When and How to Register

Registration happens annually through CalPrivacy’s online portal at cppa.ca.gov. The window is fixed: January 1 through January 31, covering your prior calendar year’s activity.³ If your business first met the data broker definition during 2025, you register in January 2026.

The fee for 2026 is $6,000, plus a third-party processing fee for electronic payment.⁴ Your registration is not complete until the fee is paid. After the January window closes, CalPrivacy publishes the information from completed registrations in the public Data Broker Registry.³

What the Registration Form Asks For

Expect to supply more than contact details. Every response is made under penalty of perjury, and all links you provide must be functional when you submit.⁵

Business Identification

You provide your legal business name, any trade or “doing business as” name, your primary physical address, email, and website URL. You also name a point of contact with phone and email; that contact information stays internal and does not appear on the public registry. You must include a direct link to the page on your website where consumers can exercise their CCPA rights.⁵

Data Collection Disclosures

SB 361, passed in 2025, expanded what brokers must disclose. You now have to indicate whether you collect any of the following categories:⁶

Identity information such as names, dates of birth, ZIP codes, email addresses, phone numbers, or government-issued ID numbers (Social Security, driver’s license, passport, military ID)
Account credentials, meaning login information combined with security codes or passwords sufficient to access a consumer’s account
Device and vehicle identifiers, including mobile advertising IDs, connected television IDs, and vehicle identification numbers
Sensitive personal characteristics such as citizenship and immigration status, union membership, sexual orientation, gender identity and expression, or biometric data
Precise geolocation and reproductive health care data
Whether in the past year you sold or shared consumer data with foreign actors, the federal government, other state governments, law enforcement (except pursuant to a subpoena or court order), or developers of generative AI systems

If you don’t collect anything in the identity or device identifier categories, you still have to disclose up to three of the most common types of personal information your business does collect.⁶

Consumer Request Metrics

You must report prior-year metrics across five request types: deletion, requests to know or access collected information, requests to know what was sold or shared and to whom, requests to opt out of sale or sharing, and requests to limit use of sensitive personal information.⁴ For each type, report the number received, the number complied with in whole or in part, and the number denied. Include both the median and mean days to substantively respond.

These same metrics must also be posted in your website privacy policy by July 1 following your first year as a data broker, with a direct link to them in the policy itself.⁴

Regulated-Data Disclosures

If some of your activity falls under one of the enumerated federal or state exemptions, checking a box is not enough. You must describe the specific types of personal information covered by the other law, identify the products or services involved, and estimate the approximate percentage of your overall data brokering that falls under those exemptions.⁵

What You Have to Do After You Register

Registration is not one-and-done. Re-register every January with updated information, fresh metrics, and that year’s fee. Between windows, keep the filed information current. Updates to your company name, address, email, website, or consumer rights intake methods should be made promptly.

DROP Compliance by August 2026

California’s Delete Act (SB 362) created the Delete Request and Opt-Out Platform, or DROP, which launched on January 1, 2026 and lets California residents submit a single deletion request that reaches every registered broker.⁷ Starting August 1, 2026, registered brokers must process DROP requests and delete the consumer’s data within 90 days.⁸ Build the infrastructure to receive and act on these requests before that date.

Triennial Audit Starting 2028

Beginning January 1, 2028, and every three years after, data brokers must undergo an independent third-party audit of their compliance with the law. CalPrivacy can request the report in writing and you must produce it.⁴ Starting with the January 2029 registration, you will also disclose whether you have undergone the audit and the most recent year you submitted a report. Choosing an auditor and preparing internal documentation takes time, so plan for it now.

What Non-Compliance Costs

Missing the January 31 deadline triggers a $200-per-day administrative fine for every day your registration is overdue.⁹ On top of the daily fine, CalPrivacy can recover the full registration fees you should have paid and reasonable investigation expenses.

The arithmetic gets ugly fast. In 2025, CalPrivacy ordered Accurate Append, Inc., a Bellevue, Washington broker, to pay $55,400 for failing to register by the January 31, 2024 deadline covering its 2023 activity.¹⁰ CalPrivacy’s December 2025 advisory specifically warned unregistered brokers that enforcement is a priority.⁹

A Federal Rule Worth Knowing About

California registration is a state obligation, but a separate federal law applies in parallel. The Protecting Americans’ Data from Foreign Adversaries Act prohibits data brokers from selling, licensing, or otherwise providing access to personally identifiable sensitive data about Americans to foreign adversary countries, currently China, Iran, North Korea, and Russia, or entities they control. Covered data includes health, financial, genetic, biometric, and geolocation information, government-issued identifiers, and account login credentials. The FTC enforces the law and sent warning letters to 13 brokers in February 2026. Violations can bring civil penalties of up to $53,088 per violation.¹¹ SB 361’s requirement that you disclose foreign-actor data sharing on your California registration lines up with this federal rule.

1
California Legislative Information. California Code CIV 1798.99.80 – Data Broker Registration
2
California Privacy Protection Agency. Does My Business Need To Comply With The CCPA
3
California Privacy Protection Agency. Data Broker Registry
4
California Privacy Protection Agency. Information for Data Brokers
5
California Privacy Protection Agency. Data Broker Registration Final Text
6
California Legislative Information. California SB 361 – Data Broker Registration
7
Governor of California. Governor Newsom Announces First-in-the-Nation Privacy Tool Allowing Californians to Block the Sale of Their Data
8
California Privacy Protection Agency. Delete Request and Opt-Out Platform (DROP)
9
California Privacy Protection Agency. CalPrivacy Issues Enforcement Advisory Highlighting Data Broker Registration
10
California Privacy Protection Agency. Washington Data Broker Agrees to Pay Fine for Failing to Register
11
Federal Trade Commission. FTC Reminds Data Brokers of Their Obligations to Comply with PADFAA