California data broker registration: does it apply?
The short answer
California data broker registration applies to a business that knowingly collects and sells personal data about people it has no direct relationship with. Brokers register each January. Missing it costs $200 a day plus fees. Whether your own email or CRM archive counts depends on whose data it holds.
A "data broker" resells consumer data and must register in some states. This site calls AI data companies buyers and keeps "data broker" for the legal term.
What does the definition say?
The Delete Act defines a data broker as a business that "knowingly collects and sells" the personal information of a consumer it has no direct relationship with. The sale must be to third parties.
Some groups are excluded. Examples are those covered by the federal Fair Credit Reporting Act and the Gramm-Leach-Bliley Act (statute text).
Registration runs through the California Privacy Protection Agency, which goes by CalPrivacy. The registration window is 1 to 31 January each year.
What counts as a direct relationship?
A consumer has one when they intentionally interact with a business in the past three years. They do it to get information about, use or buy its products or services.
A business with a direct relationship can still be a data broker. That holds for personal information it sells but did not collect straight from that consumer (regulation text, section 7601).
Could licensing your own archive trigger registration?
Maybe, if the archive is mixed. Your customers and employees plausibly have a direct relationship with you.
An email archive also holds messages from vendor staff, prospects and people who never used your product. A CRM may hold imported or enriched lists.
The statute and the regulation do not say whether those people count. I found no guidance or enforcement on archive sales. That is my reading of the text, not legal advice. The answer for your records belongs to a lawyer.
What happens to brokers that skip registration?
$200 a day
Fine for each day a broker fails to register, plus the fees due
CalPrivacy's Data Broker Enforcement Strike Force settled with Rickenbacher Data (Datamasters) for $45,000 and S&P Global for $62,600 in Jan 2026. Both cases were about failing to register.
On 11 Aug 2026 it fined LocateSmarter $116,490. That was its first action under both the CCPA and the Delete Act (CalPrivacy, CalPrivacy).
Why does the form ask about AI?
The registration form asks if the broker shared or sold consumer data to a generative AI developer in the past year. The statute defines that developer as an entity that designs, codes, produces or substantially modifies such a system.
What about deletion requests?
From 1 Aug 2026, brokers must check the state's deletion mechanism at least once every 45 days. They must process requests within 45 days. A consumer files one request to reach every registered data broker.
Do other states have rules?
Yes. Vermont, Texas, Oregon and others run their own regimes. Definitions and penalties differ. I'd read each statute for the states you operate in.
My data broker glossary entry explains the two meanings of the term. The risk map lists the other exposures in a data deal.
Have a privacy lawyer in your state read this before you act. They like that.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
