California's data broker registry, explained
Every data broker must register with CalPrivacy by 31 January each year. The 2026 registry, for brokers active in 2025, lists 603 businesses, and anyone can search or download it.1, 2, 3
Checked 29 October 2026 against CalPrivacy's registry and the statute.
How to search it
The registry is at cppa.ca.gov/data_broker_registry, last updated 29 July 2026.1
- Filter the table.One filter narrows brokers by the data they say they collect, such as precise geolocation or minors' data. The other narrows them by who they sold or shared data with, such as law enforcement or a developer of a generative AI system.1
- Select View on a row.It shows the broker's contact details and its consumer request metrics.1
- For everything, download the file.Download Registration Information gives every answer each broker submitted, as a spreadsheet. Files for 2020 to 2023, 2024 and 2025 are linked under the table.1
What the 603 brokers say
Counts of brokers that answered yes in the 2026 file. The answers are the brokers' own.2
| Answered yes to | Brokers |
|---|---|
| Collects precise geolocation | 115 |
| Collects gender identity and gender expression data | 69 |
| Sold or shared data with the federal government in the past year | 55 |
| Sold or shared data with other state governments in the past year | 54 |
| Collects government ID numbers used to verify identity | 42 |
| Sold or shared data with a developer of a generative AI system in the past year | 32 |
| Sold or shared data with law enforcement in the past year, except when required by subpoena or court order | 28 |
| Sold or shared data with a foreign actor in the past year | 26 |
| Collects personal information of minors | 18 |
| Collects sexual orientation status | 18 |
| Collects biometric data | 12 |
| Collects reproductive health care data | 8 |
What the registry is and isn't
A list of who must register
The law defines a data broker as a business that knowingly collects and sells to third parties the personal information of consumers it has no direct relationship with. Businesses to the extent they are covered by laws such as the Fair Credit Reporting Act are excluded.3 A broker that fails to register faces a fine of $200 for each day.3
Not a removal tool
To ask registered brokers to delete your data, Californians use DROP, which reaches all active brokers, including those in the registry.1 Elsewhere, use each site's own opt-out.
This page describes a public record and is not legal advice.
Questions people ask
What must a broker report when it registers?
Its name and addresses, its consumer request metrics, and yes or no answers on the kinds of data it collects and who it sold or shared data with, among other items. It also pays a registration fee set by CalPrivacy.3
Are the request numbers checked?
They are what each broker submitted. CalPrivacy publishes the information submitted during registration after the registration period ends.1
Do other states have a registry?
Yes. CalPrivacy says California is one of four states, with Oregon, Texas and Vermont, that require data brokers to register.4 See the other three registries.
How do I report a broker that isn't registered?
CalPrivacy's site has a File a Complaint page.1
Sources 4
- California Data Broker Registry, 2026 registry, last updated 29 July 2026, California Privacy Protection Agency (CalPrivacy). Read 29 October 2026.
- 2026 registration file (registry.csv), CalPrivacy, 603 entries. Downloaded and counted 29 October 2026.
- Data Broker Registry / Delete Act, Civil Code sections 1798.99.80 to 1798.99.89, effective 1 January 2026 with the SB 361 update, posted by CalPrivacy in December 2025. Read 29 October 2026.
- About DROP and the Delete Act, CalPrivacy, undated. privacy.ca.gov refused our browser, so we read it through a fetch service. Read 29 October 2026.
Every count comes from CalPrivacy's own file. How we check