CA Amends Data Broker Registration Law to Require More Details

California Governor Gavin Newsom recently signed Senate Bill 361 (SB 361), which (among other provisions) requires a data broker to disclose, as part of the annual registration, additional detail concerning the information that it collects from consumers and whether it sold or shared consumer data to a generative AI developer, law enforcement, government, or foreign actor.

California statute defines a “data broker” as a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, subject to certain exceptions.  Currently, the data broker registration law requires a data broker to register annually with the California Privacy Protection Agency and provide the agency with certain information, including whether the data broker collects the personal information of minors, consumers’ precise geolocation, or consumers’ reproductive health care data.

SB 361 will require a data broker to disclose at annual registration whether it collects any of the following information on consumers:

• Names, dates of birth, ZIP Codes, email addresses, or phone numbers
• Account login or account number in combination with any required security code, access code, or password that would permit access to a consumer’s account with a third party
• Drivers’ license number, California identification card number, tax identification number, social security number, passport number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual
• Mobile advertising identification numbers, connected television identification numbers, or vehicle identification numbers (VIN)
• Citizenship data, including immigration status
• Union membership status
• Sexual orientation status
• Gender identity and gender expression data
• Biometric data.

SB 361 will also require a data broker to disclose at annual registration whether it has shared or sold consumers’ data with any of the following entities in the past year:

• A foreign actor
• The federal government
• Other state governments
• Law enforcement, unless that data was shared pursuant to a subpoena or court order
• A developer of artificial intelligence that can generate derived synthetic content, including text, images, video, and audio, that emulates the structure and characteristics of the system’s training data.

These amendments become effective on January 1, 2026.