A Shifting Data Landscape
Data accelerates modern businesses, driving everything from revenue growth to market dominance. Whether your company works in sales and marketing, the investment space or anything in between, leveraging data gives you a powerful edge.
But with California’s recent regulatory changes, the landscape for data-driven businesses has started to change. Many companies that never considered themselves “data brokers” may now fall under these more expansive regulations; and non-compliance can come with real consequences.
Are You Now Considered a Data Broker?
In November 2024,
California expanded its definition on which companies are considered to be data brokers under new rules made from the
California Delete Act. Additionally, Maryland has a bill pending that would widen the definition of data brokers even further to include 1000s of new businesses. The decades-old data broker definition is changing: if your company shares personal data with others, even indirectly, you may now be subject to new compliance requirements. Sharing data in your product or with partners may make you a data broker.
This regulatory change impacts companies and industries that rely on personal data, including
- CRMs: Platforms that manage customer data and interactions
- Expert Networks: Businesses connecting professionals with industry experts
- Lead Generation Tools: Tools that help companies find and engage with new customers
- Recruiting Platforms: Companies helping job seekers and employers connect more effectively
- Audience Generation Solutions: Services that enable targeted marketing and advertising
- and more
If your company uses personal data, now is the time to assess and ensure compliance.
Why This Matters for Your Business
California has already shut down one unregistered data broker and fined many more. For companies included under these expanded regulations, this change represents both a risk and an opportunity:
- The Risk: Failure to register as a data broker in California could mean fines, lawsuits and reputational damage. As additional states like Texas have also begun to follow California’s lead, the state is already saying notable companies like HubSpot and Apollo.io (ZenLeads) are non-compliant.
- The Opportunity: Proactively aligning with regulations isn’t just about avoiding penalties, it’s also a chance to stand out from competitors who are scrambling to catch up. It’s a chance to revisit and refine exactly which customer problems you want to solve and not broker data for the rest. Companies that demonstrate compliance and transparency win customer trust, avoid legal headaches, and future-proof their data strategy.
How to Stay Ahead
Instead of reacting when it’s too late, take control of your data compliance now:
- Assess Your Business Model: Do you collect, share, or sell data that might qualify your company as a data broker? Getting consent from users is no longer enough. If you share or sell data you didn’t get directly from the consumer (e.g. did you enrich data or infer attributes?) you may be a broker now.
- Register if needed: If you meet the criteria, register with the California Privacy Protection Agency (CPPA). You can check if your company is registered here.
- Audit Your Data Partners: Who are you sourcing data from? Who are you sharing it with? Have you checked to see if they are registered too? If they’re non-compliant, you are exposing your company to audits, fines, and brand risks.
- Prioritize Transparency: Clear, responsible data practices aren’t just about compliance, they are also about building lasting trust with customers and partners.
The Future of Data-Driven Business
At
People Data Labs, we believe that data is one of the most powerful growth levers available to any business. As regulations and market landscapes continue to evolve, businesses that prioritize compliance and transparency will outperform those that don’t.
If you’re looking for a partner to help build your data strategy or are just unsure about how these new regulations might impact your business,
let’s talk!
Make a Privacy Request
