California's 2026 data broker registry lists 603 brokers: what they disclosed and how to look one up

The 2026 California Data Broker Registry lists 603 data brokers in the state's official file, last updated July 29, 2026. In that file, 115 brokers said they collect consumers' precise geolocation. Asked about the past year, 55 said they shared or sold consumers' data to the federal government, 32 to a developer of a generative AI system or model, 28 to law enforcement outside a subpoena or court order, and 26 to a foreign actor. We counted every answer in the file on October 11, 2026.

Figures above were counted from CalPrivacy's registry file (registry.csv, labeled "Last Updated: 7/29/2026" on the registry page) on 2026-10-11. See sources.

What the 2026 registry is

The registry is published by the California Privacy Protection Agency, which now uses the name CalPrivacy. Under California's Delete Act, a business that operated as a data broker during a year must register with the agency between January 1 and January 31 of the next year, pay a fee and answer a set of disclosure questions. The fee for the 2026 registration was $6,000, plus a third-party fee of up to 2.99% for processing electronic payments. The registry page says: "The businesses in this registry operated as data brokers in 2025."

The law defines a data broker as "a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship." A business is outside that definition to the extent it is covered by the federal Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, California's Insurance Information and Privacy Protection Act, or the health-information exemption in Civil Code section 1798.146.

Under the agency's regulations, the person who registers a broker must certify under penalty of perjury that the answers are true and correct to the best of their knowledge, and a broker must give "only true and correct responses". A broker that fails to register as required is liable for a fine of $200 for each day, plus unpaid fees and the agency's costs.

This is the first registry with the questions added by SB 361 in 2025, such as whether a broker collects sexual orientation, union membership or citizenship data, and whether it shared data with foreign actors, law enforcement or developers of generative AI systems. The 2025 file has 67 columns and none of those questions; the 2026 file has 77. CalPrivacy says California is "one of four states (also Oregon, Texas, and Vermont) who require data broker registration."

Every yes/no answer, counted

95 of the 603 brokers answered Yes to at least one of the five "shared or sold" questions in columns V to Z; the other 508 did not answer Yes to any of them. 351 brokers did not answer Yes to any collection or sharing question in columns L to Z. One entry, Alphonso Inc., left the federal government question blank.

What the request numbers cover

Columns AU to BX hold each broker's count of consumer requests received, complied with in whole, complied with in part and denied, plus the mean and median number of days to respond, for five types of request. These counts are for 2024, not 2025. CalPrivacy's page for data brokers says: "Please note that data brokers will need to report these metrics from 2024 to the Agency when they register in January 2026." The response-time headers say the same, for example "Requests to delete - The number of days to respond substantively to a request to delete in 2024 - Mean". The Delete Act requires each broker to compile the previous calendar year's counts by July 1 and post them with its privacy policy (Civil Code section 1798.99.85).

Every request cell in the file holds a number except three: Solar Connect, LLC left its deletion total and one deletion sub-count blank, and Voxtur Data Services left one deletion sub-count blank. 461 brokers reported at least one request of some type; 142 reported zero, or left the total blank, for all five types. The largest deletion total in the file is 26,285,436 requests, reported by Cuebiq Group, LLC.

The totals are self-reported, and some related companies reported identical figures. Five entries (Austin Consolidated Holdings, Inc., Equifax Information Services LLC, Equifax Workforce Solutions LLC, IXI Corporation and Knowledge Works, Inc.) each reported 685 requests to delete and 1,732,143 requests to opt out. Some brokers also say their counts go beyond California; Epsilon Data Management, LLC wrote in its comment field: "The consumer request metrics cover requests from all U.S. residents, not just Californians." A column total therefore cannot be read as a count of distinct California consumers.

How to look up a company

The registry page shows every broker in a searchable table with two filter panels: Data Collection Includes, which uses columns L to U of the file, and Data Sold / Shared To, which uses columns V to Z. Selecting View on a row opens that broker's contact details and request counts. The Download Registration Information button on the same page downloads the full file with all 77 columns.

In the file, column A holds the registered business name, column B the trade name (DBA), column C the website, and column K the page where the broker says California consumers can exercise their privacy rights. Many consumer-facing sites are listed under a parent or legal name, so a search of columns B and C finds entries that a search of names alone misses.

A site that appears nowhere in the file has no entry in this registry. The file does not say why a business is absent, and whether a business has to register depends on the legal definition above. The registry page also says that inside DROP, the state's deletion platform, California residents can see "a list of all active data brokers that will be required to process deletion requests." How that platform works is covered in our page on DROP.

The same page links the 2020-2023 registries, which the California Department of Justice kept, and CalPrivacy's 2024 and 2025 files. The 2025 file has 543 entries, and so does the 2024 file.

What the public file leaves out

Some registration answers are collected but not published. The law says: "Information provided by a data broker pursuant to subparagraphs (D), (G), and (T) of paragraph (2) of subdivision (b) of Section 1798.99.82 shall not be made accessible to the public on the California Privacy Protection Agency’s internet website." Those three items are whether the broker collects names, dates of birth, ZIP codes, email addresses or phone numbers; whether it collects mobile advertising IDs, connected TV IDs or vehicle identification numbers; and, for a broker that does not collect the information in those two groups, up to three of its most common types of personal information.

The file also does not name who received data. A Yes in column W does not say which federal agency, and no column gives the number of people or records involved.

Answers can change after the file is posted

CalPrivacy says the registry "is updated periodically." An Internet Archive copy of the same file captured on July 17, 2026 has 581 entries, the number CalPrivacy announced on June 2, 2026, when it called it "the highest number of registrants since the registry was established in 2020." Between that copy and the July 29 file, 22 brokers were added and none removed, and none of the 581 earlier entries changed a Yes or No answer. The 22 added entries are AppLovin Corporation; Captiv8 Inc.; Chartboost, LLC; Cox Automotive, Inc.; DealMachine Operations Inc.; Fog Data science LLC; Kind Skiptracing, Inc; LEAD ENHANCE LLC; Monocl AB; Networx Systems Inc.; Onfocus SAS; Populi LLC; Quorum Data, Inc; R.L. Polk & Co.; Social Catfish, LLC; Sojern, Inc; Solar Connect, LLC; Sprout Social, Inc.; VIZIO Services, LLC; Voxtur Data Services; WURL, LLC; and Ziff Davis LLC.

Earlier changes were larger. The Electronic Privacy Information Center (EPIC) reported on March 25, 2026 that 33 brokers had answered Yes to the foreign actor question when California released the 2026 registry on March 24, and later added that seven of them had told EPIC their entries were inaccurate. In the July 29 file, 11 of EPIC's 33 answer No: AggKnowledge Inc.; Bachmanity, Inc.; Clarivate; Clay Labs, Inc.; Command Precision Inc.; DR Decision Resources, LLC; Irys, Inc; Media.net Advertising FZ, LLC; Veeva Systems Inc.; Warmly, Inc.; and WINR Data Pty Ltd.

For three of them, CalPrivacy Board decisions dated June 24, 2026 record that each company told the agency its Yes was a mistake. The decisions fined Clarivate Analytics (US), LLC and D/R Decision Resources, LLC $10,800 each and WINR Data Pty Ltd $12,200, and directed the agency to re-process their 2026 registrations with a No answer. As of October 11, 2026, the Board decisions page lists no decision about the other eight changes.

CalPrivacy's Enforcement Advisory 2026-01, issued September 3, 2026, states: "Failure to provide true and correct information violates the law, triggering a $200 fine for each day the incorrect information appears in the registry."

What we could not confirm

• The registry file as first posted in March 2026. We found no archived copy; the earliest 2026 version we could compare is the Internet Archive copy from July 17, 2026. The March 24 release date and the March count of 33 foreign actor answers come from EPIC's report, not from CalPrivacy.
• How or when the eight other foreign actor answers changed. We checked CalPrivacy's Board decisions page and its newsroom.
• The exact wording of the registration form. It sits inside DROP's accounts for data brokers and is not public; the questions described here come from the file's column headers and the statute.
• Why the file lists 603 brokers while CalPrivacy's October 6, 2026 DROP FAQ refers to "over 650 registered data brokers". CalPrivacy's rules say a business that began brokering in 2026 must open a DROP account and pay an access fee, and registers for the first time in January 2027; we found no statement that reconciles the two numbers.
• Whether each broker's request counts cover only California consumers. The comment column shows that at least some do not.

Sources

• California Data Broker Registry page - CalPrivacy (cppa.ca.gov), read 2026-10-11
• 2026 registry file, registry.csv (last updated July 29, 2026) - CalPrivacy, downloaded and counted 2026-10-11
• 2025 registry file - CalPrivacy, downloaded 2026-10-11
• 2024 registry file - CalPrivacy, downloaded 2026-10-11
• Copy of registry.csv captured July 17, 2026 - Internet Archive, read 2026-10-11
• Information for Data Brokers - CalPrivacy (cppa.ca.gov), read 2026-10-11
• Delete Act, Civil Code sections 1798.99.80-1798.99.89, effective January 1, 2026 (SB 361 update) - CalPrivacy PDF, read 2026-10-11
• Data broker registration and DROP regulations, 11 CCR sections 7600-7622, effective January 1, 2026 - CalPrivacy PDF, read 2026-10-11
• Account creation, fees, and annual registration - privacy.ca.gov, read 2026-10-11
• About DROP and the Delete Act - privacy.ca.gov, read 2026-10-11
• Announcement of June 2, 2026 (581 registered brokers) - privacy.ca.gov, read 2026-10-11
• DROP FAQ: 10 Common Questions about DROP, October 6, 2026 - privacy.ca.gov, read 2026-10-11
• Enforcement Advisory No. 2026-01, Accuracy of Data Broker Registration Information, September 3, 2026 - CalPrivacy PDF, read 2026-10-11
• Board decisions list - privacy.ca.gov, read 2026-10-11
• Decision and stipulated final order, Clarivate Analytics (US), LLC and D/R Decision Resources, LLC, June 24, 2026 - CalPrivacy PDF, read 2026-10-11
• Order and stipulated final order, WINR Data Pty Ltd, June 24, 2026 - CalPrivacy PDF, read 2026-10-11
• Reported by EPIC: The Data Brokers Selling US Data to Foreign Actors, According to California, March 25, 2026, updated March 27 - epic.org, read 2026-10-11

Source links are not affiliate links. This page is general information, not legal advice; how these rules apply depends on the facts and the state.