Data Brokers & the California Delete Act
2 articles
The newest regulatory front for lead generators and aggregators is data-broker law. California’s Delete Act created a registry and a one-stop consumer deletion platform (DROP) that reaches far beyond California’s own residents in practice. If your business collects and sells personal information about people you don’t have a direct relationship with, you may be a "data broker" with registration duties — and real penalties for getting it wrong. This cluster covers the definition, the deadlines, and what DROP means for how you handle data going forward.
All Articles
Are You a “Data Broker” Under California Law? The Direct-Relationship Test
California’s data-broker definition turns on one question: do you have a direct relationship with the consumer? Here’s how the test works for a lead-gen business — and where the GLBA/FCRA carve-outs stop.
Jun 29, 2026
California’s DROP Goes Live: What August 1, 2026 Means If You Buy or Sell Consumer Data
California’s Delete Request and Opt-out Platform lets a consumer delete their data across every registered broker with one request. Registered brokers must start honoring those requests on August 1, 2026.
Jun 22, 2026
Frequently Asked Questions
What counts as a "data broker" under the California Delete Act?
California defines a data broker as a business that knowingly collects and sells the personal information of consumers with whom it does not have a direct relationship. There are carve-outs for data already covered by other regimes — for example, certain information governed by the GLBA, the FCRA, or HIPAA. Whether you qualify turns on your specific data flows, so it is worth mapping them carefully rather than assuming you are exempt.
What is the registration deadline and penalty?
Data brokers must register with California each year by January 31. Failing to register carries a penalty of $200 for each day the business is not registered, plus fees and costs. Because the registry is public and the penalty accrues daily, this is a clean, easy-to-enforce obligation — exactly the kind regulators like.
What is DROP and when do its deadlines hit?
DROP — the Delete Request and Opt-out Platform — lets a consumer submit a single deletion request that every registered data broker must honor. Consumers have been able to submit requests since January 1, 2026. Registered data brokers must begin processing those deletions starting August 1, 2026, and then check the platform on a recurring basis. Failing to process a valid deletion carries its own per-request, per-day penalty.
Do other states have data-broker registries too?
Yes. Vermont, Texas, and Oregon each operate their own data-broker registration requirements with their own thresholds and penalties. The triggers and fees differ by state, so a business operating nationally may have obligations in several at once. Treat California as the leading edge, not the whole map.
The Operator’s Compliance Brief
What changed in lead-gen compliance, and what to do about it. Free, no spam.
Related Calculators
Key Terms to Know
California Delete Act
SB 362 (2023), which amended California’s data-broker law, moved registration to the California Privacy Protection Agency, and created DROP — a single platform for consumers to request deletion across all registered brokers.
DROP
California’s Delete Request and Opt-out Platform. It launched January 1, 2026 (consumers can submit requests); registered data brokers must begin processing deletion requests by August 1, 2026 and check the platform at least every 45 days.
Data Broker
Under California’s Delete Act (Civ. Code § 1798.99.80(c)), “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.” Many lead aggregators fall squarely within it.
GLBA
The Gramm-Leach-Bliley Act. To the extent information or activity is covered by GLBA (or FCRA), it is exempt from California’s data-broker definition — but the exemption attaches to the covered activity, not to the company as a whole.
Other Topics
The Operator’s Compliance Brief
What changed in lead-gen compliance, and what to do about it. Free, no spam.