Do I need to register as a data broker in California?

If your business buys, licenses, or resells data about people who never dealt with you directly, California may class you as a data broker, and the rules changed materially in 2026. The Delete Act now runs through a state platform called DROP, and the deadlines are real. Here is who has to register, what DROP requires, and what it costs to get it wrong.

What is a data broker under California's Delete Act?

The definition is narrow but catches more businesses than owners expect. Under California Civil Code Section 1798.99.80(c), a data broker is a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. That definition borrows the CCPA meaning of "business" in Section 1798.140(d) and "personal information" in Section 1798.140(v). The direct-relationship test is the hinge: selling data about your own customers does not make you a broker, but buying and reselling data about people who never signed up with you often does.

How and when do you register?

Registration is annual and runs through the state platform. A business that meets the definition in a given year must register with CalPrivacy the following year, between January 1 and January 31, through the Delete Request and Opt-out Platform. For 2026 the fee is $6,000 plus a third-party processing fee for electronic payment. The 2025 SB 361 amendments expanded what brokers must disclose at registration, including whether they collect sensitive categories such as sexual orientation, union membership, or citizenship status, and whether they have shared data with foreign actors, law enforcement, or developers of generative AI systems. The broader duties sit alongside the core CCPA rules on the right to opt out of sale or sharing.

What is DROP and what must brokers do from August 1, 2026?

DROP lets a Californian submit a single verifiable request to delete their personal information across every registered broker at once, the broker-wide counterpart to the consumer right to delete. Under Civil Code Section 1798.99.86, brokers must access the platform and process these requests at least once every 45 days beginning August 1, 2026, and complete each within 45 days of receipt. When a consumer's record matches, the broker must delete the associated personal information, including inferences, unless a legal exemption applies. This is a standing obligation, not a one-time filing, and it overlaps with the sensitive personal information limits the CCPA already imposes.

What are the penalties?

The fines are per-day and add up quickly. A broker that misses the January 31 registration deadline may owe administrative fines and CalPrivacy's investigation costs under Section 1798.99.82(d), with a penalty of $200 for each day it is late. Once DROP processing is live, a broker that fails to delete information as required faces $200 for each deletion request for each day the request goes unprocessed. Because both penalties accrue daily and per request, a backlog can compound fast.

Next step

If you are not sure whether the direct-relationship test makes you a data broker, the free 2-minute Obligation Scan checks your profile against California's thresholds and flags the registration, deletion, and disclosure duties that follow. The California privacy overview explains the underlying CCPA thresholds, and the US state privacy laws hub sets the wider picture.