Am I a data broker?
Under California's Delete Act (SB 362), a data broker is a business that knowingly sells, shares, licenses, or trades the personal information of consumers with whom it has no direct relationship. Six questions, three minutes, and nothing you answer leaves your browser: this walks the actual elements of that definition. It can tell you whether the statute is worth a closer look, but it can't make the call for you. Only counsel can do that.
-
Does your business sell, share, license, or trade consumer personal information to other companies for anything of value?
'Sale' is broad in California: money, services, data swaps, revenue shares all count.
-
Did you collect ALL of that information directly from the consumers themselves (your own customers, your own forms, your own site)?
Buying, appending, scraping, or aggregating other people's data means no.
-
Do you know the data relates to real, identifiable consumers?
Names, emails, phones, device IDs all count.
-
Is ALL of that data handled under the Fair Credit Reporting Act (consumer reports for credit, employment, tenant screening)?
FCRA work by a background screener is carved out, but only to that extent.
-
Is ALL of it financial-institution customer data covered by Gramm-Leach-Bliley?
-
Is the data sold as part of a larger product or service (audience segments inside a marketing platform, appended fields inside a CRM product)?
This is the 'we're a marketing firm, not a data broker' trap.
Question 1 of 6
The statute is likely worth a close look.
You sell, share, license, or trade consumer personal information to other companies, and at least some of that information is about consumers you don't have a direct relationship with. You didn't collect all of it yourselves, and you know it's tied to real, identifiable people. That combination is the core of California's data broker definition: a seller of third-party data about consumers you don't know directly. If that's you, the obligations that come with it are laid out in what California now requires of registered data brokers.
Selling data inside a larger product changed nothing for ROR Partners. CalPrivacy's decision fining the marketing firm $56,600 put it plainly: "A sale is a sale."
This is general information, not a legal determination. Whether you are a data broker is a question for your counsel, and if you don't have privacy counsel, we can point you to some. Nothing here creates any professional relationship.
This one's genuinely close.
Close calls on the broker definition are exactly what counsel is for. A 20-minute conversation can at least tell you what to ask them. Skip tracing is one of the clearest examples of a close call: see is skip tracing considered data brokering in California? for how that specific boundary gets analyzed.
This is general information, not a legal determination. Whether you are a data broker is a question for your counsel, and if you don't have privacy counsel, we can point you to some. Nothing here creates any professional relationship.
The Delete Act probably isn't your problem.
Careful, though: those carve-outs apply only "to that extent." If you run a second data line that isn't covered by FCRA or GLBA, that line (and possibly your whole answer here) could change.
This is general information, not a legal determination. Whether you are a data broker is a question for your counsel, and if you don't have privacy counsel, we can point you to some. Nothing here creates any professional relationship.