Test data-broker status separately from general CCPA scope: the statutory definition turns on knowingly collecting and selling personal information about consumers with whom the business lacks a direct relationship.
A data broker keeps its CCPA duties and may also have registration, DROP, deletion, metrics, and audit obligations under California's Data Broker Registration and Delete Act framework.
Structured answer sets in this page tree.
Cited legal and guidance references.
A California is a CCPA business that knowingly collects and sells to third parties personal information about a consumer with whom it lacks a direct relationship, subject to statutory exclusions. Test this definition separately from general CCPA coverage, then assign registration, metrics, , deletion, downstream, and audit work.
Map where personal information originates, whether the consumer has a direct relationship with the entity, every recipient, and whether the disclosure is a statutory sale. Then apply the data-broker definition and exclusions independently from the entity's general CCPA business analysis.
If the entity is a , connect its CCPA sale and sharing opt-outs to the separate registration and workflow. Beginning August 1, 2026, covered data brokers must access the deletion mechanism at least once every 45 days and process requests subject to the statutory exceptions.
The definition requires all elements: the entity is a CCPA business, knowingly collects personal information, sells it to third parties, and lacks a direct relationship with the consumer. A disclosure that is only sharing for cross-context behavioral advertising does not satisfy the word 'sells' unless it also fits the statutory sale definition.
The statute excludes an entity only to the extent it is covered by the federal Fair Credit Reporting Act, the Gramm-Leach-Bliley Act and its implementing regulations, or the California Insurance Information and Privacy Protection Act. It also excludes a covered entity or business associate to the extent its processing is exempt under Civil Code section 1798.146. A first-party transaction is not a separate statutory exclusion; it matters because the data-broker definition requires the business to lack a direct relationship with the consumer. Apply each condition to the exact entity and activity.
A remains subject to the CCPA duties that apply to its business activity, including sale-or-sharing opt-outs and consumer requests. The Delete Act adds a separate registration and centralized deletion layer; registering does not replace the CCPA privacy policy or request channels.
Annual registration and the fee are due by January 31 following each year in which a business meets the data-broker definition. By July 1 following each calendar year in which it meets the definition, the broker must compile and disclose specified prior-year request metrics. Beginning August 1, 2026, it must access at least once every 45 days and process requests subject to statutory exceptions.
Keep the classification, direct-relationship evidence, annual registration, fee, public disclosures, access logs, identity matching, deletion results, exceptions, downstream instructions, and metrics together.
Track the separate dates: registration by January 31, metrics disclosure by July 1, processing from August 1, 2026, and an independent third-party audit beginning January 1, 2028 and every three years thereafter.
Keep data-broker classification, annual registration, metrics, DROP cycles, deletions, exceptions, downstream instructions, and audit evidence in one record.
Turn Data Broker Crossover into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
"Collect, use, retain, sell, share, or disclose consumers’ personal information that is deidentified"
"refrain from selling or sharing the consumer’s personal information"
"The definitions in Section 1798.140 shall apply unless otherwise specified"
"The regulations became effective on March 29, 2023."
"To fulfill its duties, the Agency is authorized to adopt and amend regulations through the Administrative Procedures Act"