Data Broker Registration

What it requires

A business that meets the definition of a data broker in a given year must register with the California Privacy Protection Agency on or before January 31 of the following year, pay a registration fee, and disclose what it collects and to whom it sells or shares. A broker that fails to register is liable for an administrative fine of $200 for each day it is unregistered, the fees that went unpaid, and the Agency's investigation costs; a broker that fails to process deletion requests under § 1798.99.86 is liable for $200 per request for each day it fails to delete. Registering is not the end of the exposure: the Agency reads "fails to register as required by this section" to reach a registration that carries wrong information, and its Enforcement Advisory 2026-01 (September 3, 2026) warns that a broker owes the $200 daily fine for each day incorrect information remains in the registry.

Statute text

(a) On or before January 31 following each year in which a business meets the definition of data broker as provided in this title, the business shall register with the California Privacy Protection Agency pursuant to the requirements of this section. [...] (c) A data broker that fails to register as required by this section is liable for administrative fines and costs in an administrative action brought by the California Privacy Protection Agency as follows: (1) An administrative fine of two hundred dollars ($200) for each day the data broker fails to register as required by this section. (2) An amount equal to the fees that were due during the period it failed to register. (3) Reasonable expenses incurred by the California Privacy Protection Agency in the investigation and administration of the action.

California Delete Act (Data Broker Registration), § 1798.99.82Read the full section from California Privacy Protection Agency (CalPrivacy)