California data broker registration

Registration is what puts a business on the California data broker registry — and it is registration, not company size, that decides whether the Delete Act's deletion duties apply to you.

Who counts as a data broker

California's definition is narrower than most people expect. A data broker is a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship (Civ. Code § 1798.99.80(c)).

The "no direct relationship" clause is the whole test. A retailer selling its own customer list is not a data broker under this CCPA data broker definition; a lead-gen firm, list manager or people-search site reselling data about people who never dealt with it is.

Where the rule comes from

The California data broker registration law is older than the Delete Act: AB 1202 created the registry in 2019. SB 362 kept it in 2023 and bolted the deletion duty on top, which is why registration and deletion are governed by the same Civil Code title but carry separate penalties.

The deadline

The data broker registration California requires of every qualifying business is annual. It runs January 1 to January 31 each year, and reports on the previous calendar year (Civ. Code § 1798.99.82(a)). So a business that operated as a data broker during 2025 registered in January 2026; one that starts in 2026 registers for the first time in January 2027.

The registration fee

The California data broker registration fee for 2026 is $6,000, plus a third-party charge for processing the electronic payment that cannot exceed 2.99%. It cannot be prorated and it is not refundable.

Access fees for brokers starting mid-year

If you begin brokering Californians' data during 2026 rather than having operated in 2025, you pay a sliding access fee instead, decreasing by $500 a month:

Each amount carries the same electronic-payment processing charge, and all fees are paid by credit card inside DROP.

What you actually submit

Beyond contact details, registration asks what categories of data you collect and who you sell or share it with. CalPrivacy publishes those answers in the public California data broker registry once the window closes. The data broker registry California maintains is not a formality — the full dataset is downloadable as a CSV, and it is how competitors, press and plaintiffs' lawyers will read your disclosures.

Only a few fields can be corrected afterwards: business name, email, website, public-facing contact information, and your point of contact for CalPrivacy (Civil Code § 7604(b)).

Missing the deadline

Failing to register exposes you to an administrative fine of $200 for each day you are unregistered, plus the fees that were owed for that period, plus CalPrivacy's investigation costs (Civ. Code § 1798.99.82(c)).

Registration is only half of it

CCPA data broker registration puts you on the registry; being on the registry is what obliges you to process deletion requests through DROP from August 1, 2026. The two duties carry separate penalties — see SB 362, the Delete Act for the deletion side, and what the DROP program is for the mechanics.