How To Register As A California Data Broker

Registration happens in one place: the Data Broker Portal run by the state. One account covers registration, the annual fee and the API key you will use to access DROP. You do the registration yourself, on the state's site, with your own account. DropDue does not file the registration and cannot hold the account for you.

The reason for that is published guidance, not a product limitation. The portal account must be associated with the data broker itself, not with an agent or a third-party service provider acting in its own independent capacity. A broker may allow an authorized agent to access the account on its behalf, and may add that agent as a primary or secondary contact, but the registration is the broker's own act.

Before you start

Have three things to hand. The legal entity name and address exactly as you want them to appear in the public registry. A contact email that a real person monitors, because the portal notifies by email and DROP delivers validation results by email. And your answers to the disclosure questions, which ask what categories of personal information you handle, including sensitive categories, and who you share data with.

Also decide, before you reach the last step, which consumer deletion lists you will process. The API key you issue is scoped to that selection, and changing the selection later means issuing a new key.

The steps

1. 01Create an account on the Data Broker Portal at https://databroker.drop.privacy.ca.gov/ using an email address associated with the data broker itself.
2. 02Wait for the state to approve the account. Published guidance says approval typically takes no longer than two business days, and the agency notifies you by email.
3. 03Sign in and answer the registration disclosure questions, including the expanded categories covering sensitive data and who you share information with.
4. 04Pay the registration fee to the state on the portal. The fee is $6,000 plus a processing fee.
5. 05Record the confirmation number and the date you registered. You will want both when you renew and if anyone asks you to evidence the registration.
6. 06In the portal, go to Home, then Consumer Deletion Lists, select the consumer deletion list or lists your business will process, and click Save.
7. 07Open the API Key tab and click Get a new API key. This key is what your systems use to read DROP and to upload status files.
8. 08Store the key somewhere access-controlled. Regenerate it if it is compromised or if your list selection changes, and note that issuing a new key deactivates all previous keys.

There is also a sandbox path in the portal, reached through the sandbox environment section and the option to issue a sandbox API key. Use it to test your matching and upload code against something other than live consumer requests.

The deadline and the fee

Where

Data Broker Portal, databroker.drop.privacy.ca.gov

Annual deadline

January 31

Fee

$6,000 plus a processing fee, paid to the state

Approval time

Typically no longer than two business days

Credential

An API key, sent as the X-API-KEY header

Key scope

The deletion lists selected in the portal

Registration is annual. Every year by January 31 you register again, answer the disclosures again against your current practices, and pay the fee again. It is not a one-time filing that stays valid until something changes. See the 2027 registration checklist for what to gather each year.

What registering commits you to

This is the part people underestimate. Registration puts you on a public list and starts a recurring operational duty. From August 1, 2026, registered brokers must process DROP requests, and after that they must access the platform at least once every 45 days. Each interval means pulling the current deletion list, hashing your own records to the published specification, matching, deciding a status for each match, and uploading a status file.

• A recurring 45-day cycle, whether or not any matches turn up.
• A per-record decision between deleted and a lawful exemption, which is yours to make.
• An upload that is accepted first and validated afterward, so acceptance is not the end of the cycle.
• An annual registration and fee, and a public entry that consumers and the agency can see.

What DropDue does and does not do

DropDue is software for the recurring part. It pulls the list on schedule or takes your CSV, hashes and matches, builds the status file in the format DROP expects, and keeps a tamper-evident record of every cycle you can export as a PDF or JSON. You review the matches and confirm the statuses yourself before anything is submitted, because the deleted-versus-exempted call is a legal determination and it belongs to you.

What it does not do is register you. The account, the disclosures, the fee and the confirmation number all happen on the state portal under your own login. If you have not registered yet, do that first, then bring the API key across.

If you are not certain you meet the California definition of a data broker, do not register to be safe. Registering commits you to the cycle and the annual fee. Work through the definition first: a business that knowingly collects and sells personal information about consumers with whom it does not have a direct relationship. All three parts have to be true.

What to keep once you are registered

Registration produces a small set of artefacts that are easy to lose and awkward to reconstruct. Keep them somewhere that outlives the person who filed.

• The confirmation number and the exact date you registered.
• A copy of the disclosure answers you submitted, not only the confirmation page.
• The contact email on the account, and a note of who monitors it.
• Your consumer deletion list selection, so you can tell later whether it still matches your data.
• The date you issued the current API key, and where it is stored.

Then set the reminder for the next January 31 immediately. Annual duties fail in year two more often than year one, because year one had someone's attention and year two does not.

Official sources

• Data Broker Portal: https://databroker.drop.privacy.ca.gov/
• Account creation, fees and annual registration: https://privacy.ca.gov/drop-for-data-brokers/account-creation-fees-and-annual-registration/
• Getting started, including obtaining an API key: https://privacy.ca.gov/drop-for-data-brokers/technical-specifications/getting-started/
• The public registry of registered brokers: https://cppa.ca.gov/data_broker_registry/