There is no license to apply for. California does not grant data broker status and there is no approval that turns a business into one. The category is defined by conduct: if what you do fits the statutory definition, you are a data broker, and the duty to register follows automatically. If it does not fit, registering does not make you one.
That reframes the question most people are actually asking. The useful version is not how do I become a data broker. It is: does what I am building fall inside the definition, and am I willing to take on what falls out of that.
The California definition
A data broker is a business that knowingly collects and sells personal information about consumers with whom it does not have a direct relationship. Read that as three separate conditions joined by and, because that is how it works in practice.
The three-part test
| Part | The question | What takes you out of it |
|---|---|---|
| Knowingly collects | Do you gather personal information about identifiable people on purpose? | Incidental data you do not seek out or retain |
| Sells | Do you disclose it to another business or third party for money or other valuable consideration? | You use it only internally, or only through a service provider relationship |
| No direct relationship | Are these people your own customers or users? | The consumers signed up with you and know they did |
Most edge cases live in parts two and three. A company that sells lists of its own subscribers is selling personal information, but there is a direct relationship, so it falls outside. A company that enriches a client's file with third-party attributes and hands it back is dealing in personal information about people it has never met, and the sale question is whether the exchange is for valuable consideration or is a service provider arrangement under contract.
Do not settle this with a gut answer. Work through it deliberately, write down the reasoning, and keep it. Our data broker check asks the same questions in order.
What registering commits you to
If you land inside the definition, registration is not the end of the work. It is the start of a recurring operational cycle with dates attached.
- Register by
- January 31, every year
- Fee
- $6,000 plus a processing fee, paid to the state
- Where
- Data Broker Portal, databroker.drop.privacy.ca.gov
- Processing began
- August 1, 2026 for DROP deletion requests
- Cadence
- Access DROP at least once every 45 days
- Public
- Your entry appears in the state's data broker registry
- An engineering job: pull the deletion list, standardize and hash identifiers to the published specification, match, and upload a status file.
- A legal job: for every match, decide whether the record is deleted or covered by a lawful exemption, and record why.
- A calendar job: the 45-day interval runs whether or not anyone is watching, and whether or not there were matches.
- A records job: for any interval, be able to show the pull happened, the match ran, and a status was filed.
- A public listing: your entity name, address and contact appear in a registry anyone can read.
The hashing part is quietly the hardest. Matching is done on hashed identifiers so that neither side hands over raw data, which means a normalization mistake does not produce a loud error. It produces a silent miss: a consumer who asked to be deleted is never found in your file, and nothing in your logs says so.
You may not want to be one
This section is here because most pages on this topic skip it. Being a data broker in California is a real ongoing cost, and for a lot of business models the same revenue is reachable without stepping inside the definition.
- The fee is $6,000 a year, before any of the work.
- The 45-day cycle is permanent staffing or permanent tooling, not a project with an end date.
- Failure to register is enforceable, with an administrative fine of up to $200 per day plus unpaid fees and the agency's costs.
- You are publicly listed, which changes who contacts you and what they ask for.
- California is unlikely to be the only jurisdiction you have to answer to, so check what else applies before you commit.
The alternatives are worth pricing before you commit. Working strictly as a service provider under contract, with no sale, is a different legal position. Building on a direct relationship, where the consumer knows you and signed up with you, is a different position again. Licensing analysis or scores derived from data, rather than the personal information itself, may be another. Each of these is a real business shape, not a loophole, and each one needs counsel to confirm against your actual contracts.
Do not register defensively. Registering when you do not meet the definition buys you a public listing, an annual fee and a recurring processing duty you did not owe.
If you are inside the definition
Then the order is: confirm the analysis with counsel, register on the state portal before the January 31 deadline, select your consumer deletion lists, issue an API key, and stand up the cycle before your first interval closes. The registration is the fast part. The cycle is the part that has to keep working every 45 days after everyone has stopped paying attention to it.
- The definition and the program: https://privacy.ca.gov/drop-for-data-brokers/
- Account creation, fees and annual registration: https://privacy.ca.gov/drop-for-data-brokers/account-creation-fees-and-annual-registration/
- The public registry of who has registered: https://cppa.ca.gov/data_broker_registry/
- The bill that created the Delete Act: https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB362