California Data Broker Registration Rules for Lead-Generation Firms

What is a data broker in plain language?

A California data broker is a business that knowingly collects and sells consumers’ personal information to third parties when it does not have a direct relationship with those consumers, subject to statutory exclusions. “Business” incorporates the CCPA definition. [Source: §1798.99.80(a), (c)]

For a lead-generation firm, a sale can include making personal information available to another business for money or other valuable consideration. Selling lead lists, licensing profiles, or supplying consumer details to clients are data flows to examine—not automatic findings that each transaction is a sale. [Source: §1798.140(ad)]

A form submission alone does not establish a direct relationship. The consumer must intentionally interact with your business to access, purchase, use, request, or learn about its own products or services. A form used to get matched with a third-party provider needs a fact-specific review. Privacy-rights requests and identity verification do not establish a direct relationship either. [Source: §7601(d)]

Even if a first-party relationship exists, the business can remain a data broker for information collected outside that interaction and sold to third parties. Review individual data flows, not just the label in a contract. [Source: §7601(d)]

Which lead-generation businesses may need to register?

First assess whether your firm is a CCPA “business.” The ordinary standalone test generally covers a for-profit entity doing business in California that determines the purposes and means of processing personal information and meets at least one threshold: prior-year gross annual revenue exceeding $26,625,000; annually buying, selling, or sharing personal information of 100,000 or more consumers or households; or deriving 50% or more of annual revenue from selling or sharing consumers’ personal information. Related-entity, joint-venture, and voluntary-certification provisions can also apply. [Source: §1798.140(d)][Source: adjusted revenue threshold]

The data-broker definition excludes entities to the extent covered by the FCRA, GLBA and implementing regulations, or California’s Insurance Information and Privacy Protection Act. It also excludes an entity or a covered entity’s business associate to the extent its processing is exempt under Civil Code §1798.146. These are not necessarily blanket exemptions for every activity or data set. [Source: §1798.99.80(c)(1)–(4)]

Examples to examine include:

• Lead sellers collecting inquiries and selling or distributing them to clients.
• Data aggregators combining information from multiple sources into consumer profiles.
• List owners licensing contact lists or other consumer information.
• Marketing firms gathering consumer information for third-party campaigns or audiences.

These are review scenarios, not determinations that every firm in these categories must register. Ask what you collect, where it comes from, who receives it, and how consumers interacted with your business. [Source: §1798.99.80][Source: §7601(d)]

When do California data brokers register?

Registration is annual, through the CPPA’s DROP system, during January 1–31 for qualifying data-broker activity in the previous calendar year. A firm operating as a broker during 2025 generally had to register by the end of the January 2026 window; one first operating during 2026 generally registers in January 2027. [Source: §1798.99.82(a)][Source: §7601(k), §7602(a)]

Waiting for the next registration window does not postpone DROP account, access-fee, or request-processing duties. CPPA guidance says brokers starting after August 1, 2026 must create an account before commencing operations. If you missed a deadline, check agency instructions and get advice specific to your situation. [Source: account requirements for new brokers]

[Source: §7600(a), §§7601–7602][Source: §1798.99.86(c)]

The fee above is for 2026—not a promise of another year’s fee. Check current agency instructions before paying. [Source: fees and registration instructions]

What does DROP require from a data broker?

DROP is California’s Delete Request and Opt-Out Platform. A consumer can submit a single request to delete personal information held by data brokers, subject to applicable exceptions. [Source: §1798.99.86(a)–(b)]

Beginning August 1, 2026, brokers must access DROP at least once every 45 days. Access means retrieving the consumer deletion list, not merely logging in. At each subsequent access session, report the status of requests received in the previous session. [Source: §1798.99.86(c)][Source: §7601(a), §§7612, 7614]

Within 45 days after receiving a request, process it and delete covered personal information, subject to applicable exceptions. Direct associated service providers and contractors to delete it as well. Access and processing are separate clocks—not one deadline measured from the consumer’s submission. [Source: §1798.99.86(c)(1)(A), (D)]

If a deletion request is denied because it cannot be verified, process it as an opt-out of sale or sharing within the same 45-day period after receipt, subject to statutory limitations, and direct associated service providers and contractors to do likewise. [Source: §1798.99.86(c)(1)(B), (D)]

After honoring a request, continue deleting the consumer’s covered information at least every 45 days and do not sell or share newly acquired information unless the consumer requests otherwise or an applicable exception permits it. Retain unmatched requests and compare newly collected records before selling or sharing them. [Source: §1798.99.86(d)][Source: §7613(c)]

A calendar reminder alone is not a complete workflow. Plan record matching, vendor instructions, exceptions, status reporting, and evidence of completion.

What are the penalties for missing registration or deletion requests?

Failure to register may carry an administrative fine of $200 for each day the business remains unregistered, plus unpaid registration fees and reasonable investigation and administrative-action expenses. [Source: §1798.99.82(c)]

Failure to honor a required deletion request through the accessible mechanism may carry $200 per request for each day the business fails to delete as required, plus reasonable agency expenses. These are statutory exposure amounts, not predictions of a particular enforcement outcome. [Source: §1798.99.82(d)]

For illustration, a full 365 days at the registration-failure rate is $73,000, before fees and costs. Deletion-failure exposure depends on the affected requests and days involved. [Source: §1798.99.82(c)–(d)]

Plan ahead for independent audits

Beginning January 1, 2028, and every 3 years thereafter, brokers must undergo an independent third-party compliance audit. Retain the report and related materials for at least 6 years and provide them to CPPA within 5 business days of its written request. [Source: §1798.99.86(e)]

What should a lead-generation firm do this month?

Use this operational checklist to identify gaps and assign owners:

• Inventory your data flows. Include forms, append services, audiences, profiles, and list licenses.
• Map each source. Separate first-party interactions from partner-provided and other acquired data.
• Review coverage and relationships. Assess CCPA business status, exclusions, and how consumers interacted with your firm.
• Check the calendar. Identify which activity year is due for registration.
• Assign DROP operations. Name owners for retrieval, matching, deletion, vendor instructions, and status reporting.
• Keep records. Track request dates, exceptions, actions, and completion dates; prepare for future audits.
• Review agency guidance. Check current instructions and the public data-broker registry.

[Source: §§7601–7614][Source: §§1798.99.80–1798.99.86][Source: public registry]

How can Everproof support data-broker monitoring?

Everproof provides software and operations support for monitoring, documentation, and deadline tracking. It does not replace your team’s decisions, registration, deletion workflows, independent audits, or legal review.

Monthly plan prices are Essentials $299/month, Pro $599/month, and Suite $999/month. Annual prepay charges for 10 months of a year—two months free. See Everproof’s plans for scope and included services.

Primary sources

• Delete Act statute text (Civ. Code §1798.99.80 et seq.) — cppa.ca.gov
• CPPA — Data Broker Registration and DROP Regulations (11 CCR §§7600–7614)
• CPPA — DROP information and account requirements for data brokers
• CCPA statute text (Civ. Code §1798.100 et seq.), effective Jan 1, 2026 — cppa.ca.gov
• CPPA — Updated Monetary Thresholds in CCPA (Civ. Code §1798.199.95(d))
• CPPA — Data Broker Registry

Everproof provides compliance software and operations support. It is not a law firm and does not provide legal advice. Using Everproof does not guarantee compliance or prevent fines.