Summary
The California Privacy Protection Agency's upcoming board meeting brings two interconnected developments that could dramatically expand who qualifies as a data broker under California law. An announced enforcement sweep on unregistered data brokers signals the CPPA's intent to actively enforce existing registration requirements. But the larger shift is proposed rule language that would classify any company purchasing or licensing third-party data—and then selling it—as a data broker, regardless of whether that company also has a direct first-party relationship with consumers.
The implications for ordinary brands are significant. Retailers and other consumer-facing businesses that supplement their customer data with licensed third-party data could now be classified as data brokers with respect to that externally sourced data. Under this interpretation, registration and compliance obligations historically limited to companies in the data brokerage business would extend to virtually any company engaged in common data enrichment or digital advertising practices. Most of these companies do not think of themselves as data brokers—and may not have taken steps to register.
The Delete Act compounds this risk further. If a consumer submits a deletion request through California's centralized mechanism, all registered data brokers—including newly classified brand registrants—must comply. That requires companies to identify precisely which data in their systems was sourced from third parties versus collected directly from consumers, maintain records of that distinction, and honor deletion requests accordingly. This is a data governance and provenance challenge that most brands have not yet begun to address, and the timeline to compliance is short.
