California's Revised Data Broker Regulations Took Effect On December 27

The California Privacy Protection Agency's (CPPA) new data broker regulations took effect on December 27, 2024. They are now in effect during the CPPA's annual data broker registration period, which lasts from January 1 to January 31, 2025. Any business that operated as a data broker in 2024 is required to register during this period.

California law defines a data broker as a "business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship." As we previously reported, the new regulations expand the definition of a "direct relationship," which could require some consumer-facing businesses that collect personal information from third-party sources and sell that data to third parties to register as data brokers.