California data broker registry and the Delete Act

California has had a data broker registry since 2020, but the Delete Act (Senate Bill 362, signed in 2023) rebuilt it.

Registration moved from the Attorney General to the California Privacy Protection Agency, which now calls itself CalPrivacy, and the Act added something no other state had: one website where a resident can ask every registered broker to delete their data at once. That website is the Delete Request and Opt-out Platform, usually shortened to DROP.

Who counts as a data broker in California

The definition sits in Civil Code section 1798.99.80. A data broker is a business that knowingly collects and sells to third parties the personal information of a consumer with whom it has no direct relationship.

The words that decide most cases are "knowingly", "sells" and "no direct relationship". A retailer selling its own customers' data is not a broker under this definition, although other parts of California privacy law still apply to it.

The partial exemptions

Some businesses are carved out, but only to the extent another law already covers them: activity regulated by the federal Fair Credit Reporting Act, by the Gramm-Leach-Bliley Act, by California's Insurance Information and Privacy Protection Act, and certain health data handling exempt under Civil Code section 1798.146.

The carve-outs are partial. A credit bureau that also runs an unregulated marketing list business may still need to register for that side.

Senate Bill 361 (2025) also widened what the registration form asks: the agency says brokers now disclose more about the sensitive data types they handle and who they share data with. The form changes year to year, so read the current one rather than last year's filing.

Section 1798.99.82 lets CalPrivacy bring an administrative action. A business that should have registered and didn't faces a fine of $200 for each day it was unregistered, plus the fees it should have paid and the agency's costs.

A registered broker that fails its DROP deletion duties faces $200 for each deletion request for each day it goes unprocessed, again plus costs. The second fine multiplies quickly: it counts requests as well as days. Money recovered goes into the Data Brokers' Registry Fund.

Many datasets that change hands between companies contain no personal information at all: sensor readings, source code, product catalogues, anonymised logistics records. California's registry law is about personal information, so those deals sit outside it. The question changes the moment a dataset includes names, emails, device IDs or anything else that identifies or can reasonably be linked to a Californian.

• A seller licensing data about its own users usually has a direct relationship with them, so it is not a broker under this law, though California's wider privacy rules on selling personal information still apply.
• A buyer that acquires that data and resells it has no direct relationship with the people in it, which is the core of the broker definition.
• An intermediary who only arranges the licence, never holding or selling the data, is in a less clear position. The statute talks about collecting and selling; how that applies to a pure introducer is a question for a lawyer, not a guess.
• Stripping personal information out, or proving it was never there, is usually cheaper than registering, processing DROP requests and paying for audits.

For a broker of company datasets, the practical step is to ask early whether personal data is in scope, and to put the answer in writing before any sample moves.

• You buy or receive personal information about Californians from someone else and pass it on for money or other value.
• You are unsure whether an exemption (FCRA, GLBA, insurance or health) covers all of your activity or only part of it.
• You missed a January window and want to know how to come into compliance.
• You received a DROP deletion list and aren't sure which records match or which exemptions let you keep data.