Am I a data broker?
Six questions, three minutes, and nothing you answer leaves your browser. This walks the actual elements of California's Delete Act definition. It can tell you whether the statute is worth a closer look, but it can't make the call for you. Only counsel can do that.
-
Does your business sell, share, license, or trade consumer personal information to other companies for anything of value?
'Sale' is broad in California: money, services, data swaps, revenue shares all count.
-
Did you collect ALL of that information directly from the consumers themselves (your own customers, your own forms, your own site)?
Buying, appending, scraping, or aggregating other people's data means no.
-
Do you know the data relates to real, identifiable consumers?
Names, emails, phones, device IDs all count.
-
Is ALL of that data handled under the Fair Credit Reporting Act (consumer reports for credit, employment, tenant screening)?
FCRA work by a background screener is carved out, but only to that extent.
-
Is ALL of it financial-institution customer data covered by Gramm-Leach-Bliley?
-
Is the data sold as part of a larger product or service (audience segments inside a marketing platform, appended fields inside a CRM product)?
This is the 'we're a marketing firm, not a data broker' trap.
Question 1 of 6
The statute is likely worth a close look.
You sell, share, license, or trade consumer personal information to other companies, and at least some of that information is about consumers you don't have a direct relationship with. You didn't collect all of it yourselves, and you know it's tied to real, identifiable people. That combination is the core of California's data broker definition: a seller of third-party data about consumers you don't know directly.
Selling data inside a larger product changed nothing for ROR Partners. CalPrivacy's decision fining the marketing firm $56,600 put it plainly: "A sale is a sale."
This is general information, not a legal determination. Whether you are a data broker is a question for your counsel, and if you don't have privacy counsel, we can point you to some. Nothing here creates any professional relationship.
This one's genuinely close.
Close calls on the broker definition are exactly what counsel is for. A 20-minute conversation can at least tell you what to ask them.
This is general information, not a legal determination. Whether you are a data broker is a question for your counsel, and if you don't have privacy counsel, we can point you to some. Nothing here creates any professional relationship.
The Delete Act probably isn't your problem.
Careful, though: those carve-outs apply only "to that extent." If you run a second data line that isn't covered by FCRA or GLBA, that line (and possibly your whole answer here) could change.
This is general information, not a legal determination. Whether you are a data broker is a question for your counsel, and if you don't have privacy counsel, we can point you to some. Nothing here creates any professional relationship.