California Adopts New Data Broker Definition

Earlier this month, the Board of the California Privacy Protection Agency (“CPPA”) voted to adopt new regulations regarding data broker registration requirements. The proposed regulations are now with the Office of Administrative Law for review, and, if approved, will take effect on January 1, 2025.

The adopted regulations clarify provisions in the Delete Act, which requires data brokers to register with the CPPA. The regulations include provisions that:

Require data brokers to disclose specific information about their exempt data collection practices
Define the terms “direct relationship,” “minor,” and “reproductive health care”
Set out application procedures
Set out procedures for registration changes

Of note within the new regulations is the expanded scope of businesses that are deemed to be data brokers.

The Delete Act recognizes data brokers as businesses that collect or sell the data of consumers with whom it does not have a “direct relationship.” Under the existing regulations, Section 1798.99.80(c) exempts from the definition of “data broker” businesses that have a “direct relationship” with consumers. The proposed regulations define “direct relationship” to mean “that a consumer intentionally interacts with a business for the purpose of obtaining information about, accessing, purchasing, using, or requesting the business’s products or services within the preceding three years.” The proposed regulations clarify that in order to rely on this exemption moving forward, a business will need to have had recent interactions with a consumer – within the preceding three years.

The regulations also clarify that businesses with direct consumer relationships can still be considered a broker if the business “also sells personal information about the consumer that the business did not collect directly from the consumer.”

Finally. data brokers will need to disclose how their activities are regulated by other laws (e.g., GLBA), including:

The types of personal information collected and sold under these laws
The specific products or services covered by these laws
The proportion of data collected and sold that is subject to these laws, compared to the business’s overall data collection practices