What is Data Broker?
Definition
A data broker is a business that knowingly collects and sells to third parties the personal information of consumers with whom it does not have a direct relationship. Under CCPA/CPRA, data brokers must register with the California Attorney General and comply with heightened consumer rights requirements.
In Depth
Data brokers occupy a unique position in the privacy landscape because they aggregate personal information from public records, commercial sources, and other data providers to create detailed consumer profiles sold for marketing, risk assessment, and people search purposes. Under California law (Civil Code Section 1798.99.80), data brokers must register annually with the Attorney General and pay a registration fee. CPRA introduced the California Delete Act (SB 362), which created a one-stop deletion mechanism allowing consumers to request that all registered data brokers delete their personal information through a single request. Data brokers face additional obligations including heightened transparency about their data practices, restrictions on selling data of consumers who have opted out, and potential penalties for failing to register or comply with deletion requests. For organizations that share data with data brokers, CCPA requires that these relationships be disclosed in privacy notices and that opt-out mechanisms cover data flows to brokers. The evolving regulatory landscape suggests increasing scrutiny of data broker practices, making compliance in this area particularly important.
Related Frameworks
Related Terms
Do Not Sell
Do Not Sell refers to the CCPA/CPRA requirement for businesses to provide a clear and conspicuous link titled "Do Not Sell or Share My Personal Information" on their website homepage. This mechanism enables California consumers to exercise their right to opt-out of data sales and sharing.
Right to Opt-Out
The right to opt-out under CCPA/CPRA allows California consumers to direct businesses to stop selling or sharing their personal information with third parties. Businesses must honor opt-out requests and provide a clear "Do Not Sell or Share My Personal Information" link on their website.
Right to Delete
The right to delete under CCPA/CPRA allows California consumers to request that a business delete any personal information it has collected about them. Businesses must comply within 45 days, with limited exceptions for legal obligations, security, and completing transactions.
California Privacy Rights Act
The California Privacy Rights Act (CPRA) is a ballot initiative approved by California voters in November 2020 that significantly amended and expanded the CCPA. It created the California Privacy Protection Agency, introduced new consumer rights, and established requirements for sensitive personal information, effective January 1, 2023.
Generate compliance docs with PoliWriter
Stop reading about compliance and start achieving it. PoliWriter generates audit-ready policies customized to your organization in hours.
Get Started Free