Data Broker Registration

What it requires

A business that meets the definition of a data broker in a given year must register with the California Privacy Protection Agency on or before January 31 of the following year, pay a registration fee, and disclose what it collects and to whom it sells or shares. A broker that fails to register is liable for an administrative fine of $200 for each day it is unregistered, the fees that went unpaid, and the Agency's investigation costs; a broker that fails to process deletion requests under § 1798.99.86 is liable for $200 per request for each day it fails to delete.

Legal text (excerpt)

(a) On or before January 31 following each year in which a business meets the definition of data broker as provided in this title, the business shall register with the California Privacy Protection Agency pursuant to the requirements of this section. [...] (c) A data broker that fails to register as required by this section is liable for administrative fines and costs in an administrative action brought by the California Privacy Protection Agency as follows: (1) An administrative fine of two hundred dollars ($200) for each day the data broker fails to register as required by this section. (2) An amount equal to the fees that were due during the period it failed to register. (3) Reasonable expenses incurred by the California Privacy Protection Agency in the investigation and administration of the action.

Primary source