In plain terms
The test is the relationship, not the industry. If a person gave you their details because they bought something from you, subscribed to you, or signed up with you, that is a direct relationship and the data broker rules are not aimed at you. If you bought, scraped, licensed, or appended that person's details and then sold or licensed them onward, you are the kind of business the definition was written for. Marketing list vendors, people search sites, identity and lead enrichment providers, and location data suppliers all sit inside it. Selling is the second half of the test. Collecting alone is not enough.
What it means for a registered broker
Once the definition reaches you in California, three duties follow. You register with the CPPA every year by January 31 and pay the annual fee. You process the state deletion list at least once every 45 days. You keep a record showing that you did. The registry is public, so your entry is the first thing a regulator, a journalist, or a customer's counsel will look at. If you are not sure whether the definition reaches you, work through the questions before the registration deadline rather than after it.
- Where it comes from
- Delete Act, SB 362 (2023)