Personal information and data brokers

Data brokers

A data broker is a business that gathers and sells consumer information that the consumer didn’t give them directly.

Data brokers collect and sell personal information and sensitive personal information, including:

• Social security number
• Precise geolocation
• Browsing history
• Email addresses
• Phone numbers
• Interests
• Health-related information
• Shopping habits
• And more

When the data is processed, some data brokers can infer a lot about you, including:

• Information about your political views
• Your health data history (e.g., searches you have made about conditions such as pregnancy and reproductive health, cancer, diabetes, etc.)
• Your family and relationship details (e.g., whether or not you have children, your marital status, and more)
• Your financial habits and status (e.g., debt, creditworthiness, or even predictions about how much you’d be willing to pay for a given product)

These inferences are also considered personal information subject to deletion by data brokers who match your information in their records.

What data brokers do with your information

Data brokers package, trade, and sell information to various organizations, including ones you’ve never heard of before. 

Buyers may include:

• Advertisers and marketers
• Employers and recruiters
• Political campaigns
• Retail companies
• Landlords
• Debt collectors

Data brokers may also sell information to buyers with malicious intent, such as hate groups, hostile foreign governments, and scammers.

How data brokers obtain your information

Data brokers often collect information from businesses you interact with directly. For example: 

• Music streaming services may collect your playlists
• Grocery stores, clothing retailers, or other apps may collect your purchase history
• Video streaming services may collect your viewing history

Information that you provide to a business directly, for example, when you sign up for a new subscription or create an account for a new service, is not subject to deletion by DROP. However, if this information was then purchased by a data broker, it is subject to deletion by DROP.

DROP and your personal information

When we collect your data, we immediately encrypt it.

This means your data is:

• secure and private
• encrypted before we store it
• only used to complete your request

Data brokers match you to their records based on the data you submit through DROP. It may take just one piece of data for them to delete and stop selling the information they have about you.

Different data brokers may have different information about you.

The more you submit, the higher the likelihood data brokers will find you and delete your data.

Hashing data

DROP uses hashing so data brokers can match your data without exposing the original information. Once the data has been hashed, it’s almost impossible to turn back into the original data.

Here’s what hashed data looks like.

• What you enter: emailaddress@email.com
• What you see: e###s@e###m
• What data brokers see: IokUeTFtxXZQdmjolr4Kn//apUY5a6J8sVdHyiWqqUk=

There are cases where data brokers may keep some of your data.

Exempted — These data brokers have data about you but haven’t deleted it because it’s exempt under the law. Examples include:

• Public records, like vehicle or real estate ownership or voting records
• Responding to a criminal or civil investigation

Some data is protected under other privacy laws.

• Sensitive patient health information (governed under HIPAA laws)
• Information that affects your credit score (Fair Credit Reporting Act)
• Financial information that would affect your ability to get a loan (Gramm-Leach-Bliley Act)

Review Additional protections for more details.

Opted-out of sale — These data brokers couldn’t find an exact match using the information you provided. Try updating your request with more information. For example, you may share an email account with multiple people. If data brokers aren’t able to match that email to a single person, they will stop selling or sharing the information of everyone using that email.

Record not found — These data brokers didn’t find you. This could be because they:

• Don’t currently have any information about you.
• Can’t find you based on what you provided in DROP.

Try updating your request with more details.

Partial deletions — Some data brokers also collect information directly from you. For example, if you buy something from them or sign up for their newsletter. Through DROP, they must delete information they got from other sources, but not information you provided directly. However, you can still request they delete that information through a privacy request.

If data brokers don’t follow the law

Data brokers may face fines if they do not comply with the law.

• Failure to register — $200 per day plus unpaid fees and enforcement costs
• Failure to delete consumer personal information — $200 per day, per consumer plus enforcement costs

CalPrivacy is responsible for maintaining DROP and the California Data Broker Registry. You may notice that the number of data brokers listed in each system is different.

The Data Broker Registry is a record of businesses that operated as data brokers at any point in the previous calendar year.

DROP reflects businesses that have active accounts and, in most cases, are operating as data brokers and processing deletion requests right now.

These systems look at different periods of time and update on different schedules, so their lists will not always match.

Data brokers that begin operating this calendar year won’t be listed in the Data Broker Registry until next year.

Businesses that stop operating can deactivate their DROP account. When a business deactivates, they lose access to deletion requests and will no longer appear in DROP. They will remain on the registry, however, since they were acting as a data broker for at least some portion of the prior year.

To see a live list of current data brokers, visit your DROP dashboard and select the Data broker list tab.

If you have not completed a DROP request, you can also download the list of data brokers in DROP. Note this list is not live and only updated periodically.

To view information from data brokers that registered for activities in 2025, visit the California Data Broker Registry.