The California Privacy Protection Agency's (CPPA) new data broker regulations took effect on December 27, 2024. They are now in effect during the CPPA's annual data broker registration period, which lasts from January 1 to January 31, 2025. Any business that operated as a data broker in 2024 is required to register during this period.
California law defines a data broker as a "business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship." As we previously reported, the new regulations expand the definition of a "direct relationship," which could require some consumer-facing businesses that collect personal information from third-party sources and sell that data to third parties to register as data brokers.
California regulations typically take effect quarterly, with at least one month between the date the Office of Administrative Law (OAL) files a regulation with the Secretary of State and the effective date, pursuant to California Government Code 11343.4(a). However, the CPPA's regulations went into effect the day after they were filed with the Secretary. According to information obtained from the OAL and CPPA, the CPPA petitioned OAL to make the regulations effective earlier by demonstrating good cause (pursuant to Cal. Gov't Code § 11343.4(b)(3)).
In the CPPA's request to OAL for an earlier effective date, the CPPA cautioned that if the regulations were implemented according to OAL's quarterly schedule, "the benefits provided by implementing the statute through these regulations will not be realized until the 2026 registration period." Rather, the CPPA petitioned to implement the new regulations "so that they are in effect for the entire 2025 registration period."
Click here for CPPA's directions on registering as a data broker.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
