California data broker registry

The registry, all entries, searchable

All 603 rows of the CPPA’s download, in the CPPA’s order and spelling, last updated by the CPPA on 29 July 2026. The table opens on the first 25; the line above it always says how many of the full list are on screen, and “Show all” lists every match. Search covers trading names too: many people-search and lead brands sit under a parent company’s name.

Every “Open the record” link goes to the CPPA’s registry page, where the “View” button on each row shows the broker’s contact details and full answers; the CPPA’s download holds every column. We do not link to any broker from this page. A name on the list is a registration, not a recommendation, and that includes the people-search sites.

What the brokers told the CPPA, counted

Registration is a questionnaire. Since SB 361 (passed in 2025) every broker answers Yes or No to ten kinds of sensitive data it might collect and five kinds of recipient it might have sold or shared data to, and reports how many consumer requests it handled. These are the brokers’ own answers; the CPPA publishes them as submitted. Counted across all 603 entries:

Three more things the list shows. 163 of the 602 brokers that filled in the figure reported receiving no requests to delete in 2024; the median was 107. That was the year before DROP: since 1 January 2026, Californians can send one DROP request to all active data brokers. 39 registered brokers are based outside the United States. And 261 entries trade under at least one other name, which is why the search above looks at trading names too.

A broker can also say that part of its activity falls under a federal or California sector law (answers counted: FCRA 17, GLBA 20, IIPPA 1, CMIA 6, HIPAA 29). The Delete Act’s definition leaves an entity out only “to the extent” the FCRA, the GLBA or the IIPPA covers it, or its processing is exempt under the CCPA’s health-data section (§ 1798.146), so such a broker is on the list for the rest of its brokering. For the request side of the CCPA itself, the DSAR deadline calculator works out the clocks.

What a listing means under the Delete Act

A business is a data broker if it knowingly collects and sells to “third parties the personal information of a consumer with whom the business does not have a direct relationship”, in the CPPA’s summary of Civ. Code § 1798.99.80(c). The definition builds on the CCPA’s definition of a “business”, so the CCPA thresholds come first; the CCPA threshold calculator tests them.

A row on the list therefore says three things: the business told the CPPA it operated as a data broker in 2025, it registered and paid in the January window, and it is one of the brokers DROP sends deletion requests to. The CPPA’s own page puts it this way: within DROP, consumers “can view a list of all active data brokers that will be required to process deletion requests.”

DROP in one paragraph

A Californian makes one request on DROP; from 1 August 2026 each registered broker must pick up the deletion lists at least once every 45 days and process the requests within 45 days. DROP reaches brokers, the businesses with no direct relationship to the person. A business people deal with directly still answers their requests and opt-outs itself, through its “Do Not Sell or Share” link and signals such as Global Privacy Control.

What it costs a broker that ignores it

These are the Delete Act’s own fines, separate from CCPA penalties; the CCPA penalties guide covers those.

Using the list from the business side

Most firms reading this are not brokers; they buy from them, or wonder whether a side line makes them one. Four working checks, for information rather than legal advice:

1. Ask the relationship question first. The definition turns on selling the data of people you have no direct relationship with. Your own customers, subscribers and site visitors are a direct relationship. A list of strangers you compiled or bought and then sell on is not. Selling and sharing your own customers’ data is still regulated, by the CCPA rather than the Delete Act: see what the CCPA covers.
2. Read the carve-outs as partial. The definition leaves out an entity only to the extent the FCRA, the GLBA or California’s IIPPA covers it, or its processing is exempt under the CCPA’s health-data section. A company with a credit-reporting line can still be a broker for the rest of its data.
3. If you are a broker, the calendar is fixed. Register on or before 31 January for each year you met the definition, keep a DROP account, access DROP at least once every 45 days from 1 August 2026, and plan for an independent audit from 1 January 2028. The CPPA also says brokers must post their request metrics in the privacy policy by 1 July following their first year as a broker. The CPPA’s data broker page has the registration steps.
4. If you buy data, check the seller. Search your data vendors in the table above. A vendor selling Californians’ data with no direct relationship to them, and not on the CPPA’s list, is a question to put to the vendor before you renew. Keep the answer in your vendor records next to the contract.

Questions