California data broker registration: requirements, fees and deadlines
Every data broker doing business in California registers each year. Who has to, the deadline, the cost, and the penalty for skipping it.
- Register by January 31 after each year you meet the definition of a data broker.
- The fee is $6,000 for 2026 and $9,500 from 2027, plus card processing fees.
- Not registering costs $200 per day, plus the unpaid fees and investigation costs.
Who has to register?
Any business that meets California's definition of a data broker: one that knowingly collects and sells to third parties the personal information of consumers it doesn't have a direct relationship with (Civil Code § 1798.99.80). There's no minimum business size. Some businesses covered by federal or state privacy laws are excluded. See is my company a data broker?
When is the deadline?
On or before January 31 following each year in which your business met the definition (§ 1798.99.82). For brokers that operated in 2025, the 2026 registration window ran from January 1 to January 31, 2026.
If you start operating as a data broker partway through a year, you still need a DROP account and pay a first-time access fee before you start (see fees below).
What does registration ask for?
Registration is an annual form plus a set of disclosures. Among other things, you provide:
- your business name, any trade names, and contact details;
- metrics on the requests you received and how you handled them;
- whether you collect personal information about minors, precise geolocation, reproductive health care data, biometric data, government ID numbers and other sensitive categories;
- whether you shared data with foreign actors, government agencies, law enforcement or developers of generative AI systems;
- a link to a page on your website explaining how consumers can exercise their privacy rights, without dark patterns.
Registrations are published in CalPrivacy's public data broker registry.
How much does it cost?
| Year | Annual registration fee | Notes |
|---|---|---|
| 2026 | $6,000 | Plus up to 2.99% card processing. Non-refundable, not prorated. |
| 2027 onward | $9,500 | Approved by CalPrivacy's board in 2026. For new brokers, the access fee drops by $792 for each month after January. |
New brokers that start mid-year in 2026 pay a first-time access fee that falls month by month, from $6,000 in January to $500 in December. Payment is by credit card inside DROP.
What happens if you don't register?
CalPrivacy can bring an administrative action for:
- $200 for each day you fail to register;
- an amount equal to the fees that were due while you weren't registered;
- the agency's reasonable investigation and administration costs.
That's § 1798.99.82(c). Separately, failing to process deletion requests carries its own fine of $200 per request per day. See Delete Act fines.
After you register: DROP
Registered brokers also have to process consumer deletion requests through DROP at least every 45 days. Start with how to log in and get your API key, then the 45-day checklist.
Check every record against DROP with one API call
Purgepath keeps your DROP list current daily and tells you exactly what to delete. Unlimited scrubs by API or CSV upload, $500/month.
Sources
This article is general information as of October 5, 2026, not legal advice. Rules and fees can change; check the sources above and talk to counsel about your situation.