California data broker registration is annual. It is due by January 31 each year, on the state's Data Broker Portal, with the fee paid to the state. The 2027 filing is not a renewal button. You answer the disclosure questions again, against how your business actually operates now, which for most brokers means the answers are not identical to last year's.
This page is a working checklist. Gather first, file once, record afterwards. Doing it in that order takes an afternoon. Doing it in the portal, question by question, while hunting for answers, is how the deadline gets missed.
Gather before you open the portal
- Legal entity name and registered address, exactly as they should appear in the public registry.
- The contact email that will receive portal notifications and DROP validation results, and confirmation that a person actually reads it.
- Last year's confirmation number and registration date, so you can compare what changed.
- The categories of personal information you collect and sell, including sensitive categories.
- Who you share or sell data to, described the way the disclosure asks.
- Your consumer deletion list selection, and whether it is still correct.
- The URL and method a consumer uses to reach you directly, if the form asks for it.
Pull those from the same source every year. The single biggest cause of an inconsistent registration record is one person answering from memory in year one and a different person answering from a different memory in year two.
What the disclosure asks
The registration disclosures were expanded by SB 361 to cover sensitive data categories and who you share data with. In practice that means the form is asking you to characterize your business, not just to identify it. Two answers deserve care.
The first is sensitive categories. If your data includes precise geolocation, government identifiers, health or biometric data, or anything else the statute treats as sensitive, that answer should match what your privacy notice already says. A registration that contradicts your own published notice is a document you will be asked about.
The second is sharing. Answer it as your contracts describe your data flows, not as your marketing describes them. If you resell, say so. If you disclose to service providers only, that is a different answer and it should be the true one.
What changes if your list types changed
Your deletion list selection in the portal drives everything downstream. It determines which lists DROP will return to you, and your API key is scoped to that selection. If your data changed during the year, for example you started handling connected TV identifiers or dropped mobile advertising identifiers, the selection is now wrong.
| What changed | What you do |
|---|---|
| You handle a new identifier type | Add that consumer deletion list in the portal, save, then issue a new API key |
| You stopped handling a type | Remove it from the selection, save, and reissue the key so scope matches reality |
| Your entity name or address changed | Update it in the registration so the public registry entry is accurate |
| Your privacy contact changed | Update the contact email, because validation results arrive there |
| Your data practices changed | Answer the disclosure questions to the new practices, not last year's |
Issuing a new API key deactivates all previous keys. Update every place the old key was stored on the same day, or your next cycle pull will fail with an authentication error.
The filing itself
- Deadline
- January 31, 2027
- Where
- Data Broker Portal, databroker.drop.privacy.ca.gov
- Fee
- $6,000 plus a processing fee, paid to the state
- Approval
- Typically no longer than two business days for a new account
- Cadence after
- Access DROP at least once every 45 days
The fee goes to the state on the state's portal. No vendor pays it for you and no vendor files the registration for you. If you already have a portal account from a prior year, you are signing in to it rather than creating one.
Record it afterwards
- 01Save the confirmation number and the exact date and time you filed.
- 02Save a copy of the answers you submitted, not just the confirmation.
- 03Check your entry on the public registry once it appears, and read it as a stranger would.
- 04Note who inside the business approved the disclosure answers.
- 05Set the reminder for the next January 31 the same day, while you still remember what was annoying about this one.
The confirmation number is the thing an adviser or an auditor asks for first, and it is the thing most often lost. Keep it somewhere that survives the person who filed leaving the company.
DropDue tracks the registration date, the confirmation number and the countdown to the next January 31 alongside your deletion cycles, and prepares the disclosure worksheet from your saved company profile so you are copying from one place rather than reconstructing answers. The worksheet is a preparation aid. The filing is still yours, on the state portal, under your own login.
Where annual registrations go wrong
The failures are boring and repetitive, which is good news, because that makes them preventable with a checklist rather than with expertise.
- Nobody owned the date. The person who filed last year changed roles and the reminder left with them.
- The notification email points at an inbox that is no longer read, so the portal's messages and the platform's validation results both go nowhere.
- The disclosure answers were copied forward unchanged after the business started handling a new category of data.
- The list selection was updated in the portal but the new API key never reached the system that pulls from DROP.
- The confirmation number was never recorded, so evidencing the registration means logging into the portal and hoping.
- The registry entry names an entity that no longer matches the one on the contracts.
Missing the deadline is not a paperwork inconvenience. The registration duty is enforceable by the California Privacy Protection Agency, and the exposure grows with the number of days a broker operates unregistered. Filing late is materially better than not filing, and filing on time is better than both.
One more thing worth doing in January while the file is open: read your own registry entry as an outsider. It is a public document. Consumers, journalists, prospective customers and the agency all read it, and it is often the first description of your business any of them see.
Official sources
- Account creation, fees and annual registration: https://privacy.ca.gov/drop-for-data-brokers/account-creation-fees-and-annual-registration/
- Data Broker Portal: https://databroker.drop.privacy.ca.gov/
- The public registry: https://cppa.ca.gov/data_broker_registry/