Is Your B2B Company a Data Broker? 3 Questions to Ask

A question came up in the comments on one of my LinkedIn posts: “How would a B2B company know if it counts as a data broker?” It’s a good one, because the honest answer is that being B2B doesn’t get you out of it. Neither does being based somewhere other than California.

I’m not a lawyer, and this is general information, not legal advice. But California’s definition breaks down into questions that are easy to walk through.

The three questions

California defines a data broker as a business that knowingly collects and sells to third parties the personal information of a consumer it has no direct relationship with. That breaks into three questions:

Do you collect personal information about California residents? The Delete Act borrows the CCPA’s definitions, and under them a “consumer” is a natural person who is a California resident. Names, work emails, phone numbers, and job titles tied to a real person can all be personal information, and California’s temporary carve-out for B2B contact data expired on January 1, 2023.
Do you sell it to third parties? California’s definition of “sell” is broad: it covers renting, releasing, disclosing, or otherwise making a consumer’s personal information available to a third party in exchange for money or other valuable consideration. Lead lists and contact databases are the typical cases, but whether a particular arrangement counts is a question for a privacy attorney.
Is some of that data about people you don’t have a direct relationship with? The CPPA’s regulations add a twist: a business that does have a direct relationship with someone can still be a data broker if it also sells information about that person that it didn’t collect from them directly.

One clarification: “consumer” in the statute describes the person the information is about, not the buyer. A B2B company sells data about individuals to other businesses, and that is the kind of situation the definition can cover, so having only business customers doesn’t by itself take you out of it.

Who’s excluded

The statute excludes entities covered by the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, and California’s Insurance Information and Privacy Protection Act, plus certain health-related entities (the statute cites § 1798.146). Each exclusion applies only to the extent the entity is actually covered by that law (statute text).

Does it matter where you’re based?

Not in the way you might expect. What matters is whether you collect and sell the personal information of California residents, not where your office is. Legal commentary notes that the definition may apply to entities outside of California, and the same report says the CPPA has already targeted out-of-state brokers that sell California consumers’ information, even ones that tried to screen Californians out of their data. So if your reasoning is that your company isn’t in California and this doesn’t apply to you, that’s worth checking with an attorney before you rely on it.

California isn’t the only state with a registry, either. Texas and Oregon passed their own data broker registration laws, joining California and Vermont. The definitions differ: California and Vermont require that a business “knowingly” collect and sell data, while Texas and Oregon do not. Each state runs its own registry, so registering in one doesn’t register you in another.

What registration involves in California

A business that met the definition during the previous year must register with the CPPA by January 31, and the penalty for missing the deadline is $200 per day. Registration asks for more than 20 categories of information, including whether the broker collects minors’ data, reproductive healthcare data, or precise geolocation. There’s also an annual fee, and the amount changes, so check the CPPA’s data broker regulations page, which links to the fee regulation for each registration period.

Being a data broker also comes with ongoing duties. As of August 1, 2026, brokers must check DROP at least every 45 days and delete within 45 days of a deletion request, and independent audits begin on January 1, 2028.

This has already happened to B2B companies

In 2024, the CPPA settled with Growbots for $35,400 and with UpLead for $34,400, both to resolve the CPPA Enforcement Division’s claims that they failed to register. Growbots is an outbound sales platform, and UpLead is a business-to-business data provider.

Why this matters even if you’re not a business owner

California’s DROP platform lets a consumer send one deletion request to all registered data brokers, which is why registration matters: a broker that isn’t registered isn’t on that list. A B2B broker that never markets to consumers is the kind you’d never think to look for. The CPPA’s registry is public, so you can see who’s on it. I wrote about this pattern in my post on the SalesIntel fine.

If you want to know where your own information shows up, I offer a free scan, and the results come to you by email.

This post is general information, not legal advice. If you run a business and aren’t sure whether you qualify, talk to a privacy attorney.

Sources

Definition, exclusions, and “direct relationship”

B2B data under the CCPA

CCPA employee and B2B exemptions expired Jan. 1, 2023 (Presencis)

Out-of-state brokers and other states

Registration, penalties, enforcement

Is Your B2B Company a Data Broker? Three Questions to Ask