The California Delete Act and B2B data

What is a data broker under California law?

A data broker is "a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship" (Cal. Civ. Code 1798.99.80(c)). Three terms in that sentence take their meaning from the California Consumer Privacy Act (CCPA).

• Business. A for-profit company that does business in California and meets one of three tests: more than $25 million in annual gross revenue (adjusted for inflation), buying, selling or sharing the personal information of 100,000 or more consumers or households a year, or getting 50% or more of its annual revenue from selling or sharing consumers' personal information (Cal. Civ. Code 1798.140(d)). The third test has no size floor, so a small company whose main product is contact data can qualify.
• Consumer. "A natural person who is a California resident" (1798.140(i)). The definition doesn't distinguish home life from work.
• Personal information. Information that identifies or could reasonably be linked with a particular consumer, including a real name, postal address and email address, and "professional or employment-related information" (1798.140(v)(1)).

The statute excludes entities to the extent they are covered by the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or California's Insurance Information and Privacy Protection Act, and certain health-data processing that the CCPA already exempts (1798.99.80(c)). There is no exclusion for business-to-business data.

Why B2B contact data is covered

B2B contact data is covered because the people in it are consumers under the CCPA. From 2020 to 2022, the CCPA held back most of its obligations for personal information "reflecting a written or verbal communication or a transaction" between a business and a person acting for another company, such as an employee, owner or contractor (Cal. Civ. Code 1798.145(n)). That subdivision, and the matching one for employee data, became inoperative on 1 January 2023 by their own terms. The California Attorney General's CCPA page says both exemptions "expired on December 31, 2022" (California AG, FAQ 11).

Here is how that applies to common kinds of rows:

• Sole proprietors and solo practitioners. A one-dentist practice's name, address, phone and email can be the dentist's own, so a row about the office is also data about a person.
• Named contacts at larger businesses. A practice manager's name or a named inbox such as jane@practice.com is personal information about that person, even though it's used only for work.
• Shared inboxes at organizations. An address such as office@ at a multi-dentist group is harder to link to one person. Whether it is personal information depends on the facts.

The CCPA also says personal information doesn't include "publicly available information", which it defines to include information lawfully made available from government records and information a business has a reasonable basis to believe the consumer lawfully made available to the general public (1798.140(v)(2)). How far that exclusion reaches for a list compiled from registers and websites is a question for counsel, not something this guide settles.

What the Delete Act requires of data brokers

Under the registration law as amended by the Delete Act (SB 362, 2023) and SB 361 (in force from 1 January 2026), a data broker has five duties.

Two details matter for B2B sellers. When a DROP request can't be verified, the broker must still treat it as an opt-out of sale or sharing within 45 days. And the broker must tell its service providers and contractors to delete the same data (1798.99.86(c)(1)).

Key dates and fees

The dates below come from the statute and the agency's data broker page, both read on 3 October 2026.

Fines are set in the statute: $200 for each day a broker fails to register, plus the unpaid fees and the agency's costs, and $200 for each deletion request for each day a broker fails to delete as required (1798.99.82(c) and (d)). The agency publishes the current registry of data brokers on its data broker page.

How much of a provider register is about individuals

Most of the US register that healthcare lists start from describes individual people, not companies. In the CMS NPPES file of 2026-09-14, active dental and physician registrations split like this:

An individual registration (a Type 1 NPI) belongs to a person: a dentist or doctor registers under their own name, often at the practice address. Organization registrations belong to practices, groups and clinics. The California column counts distinct practice addresses in the register, including stale and duplicate ones, so it is an upper bound on offices. The exact counts are in dentists-register-2026-10.csv and physicians-register-2026-10.csv.

What these numbers don't show. A registration count isn't a count of people on any list, and an organization registration can still lead to one person when the practice is solo. They show that a list built from this register starts from records about individuals. Whether a given list's rows are personal information depends on what each row holds, so ask the vendor which columns can identify a person.

What to ask a list vendor

If you buy B2B contact data that includes Californians, ask the vendor these questions before you pay.

1. Does the file include data about individuals? Ask which columns can identify a person: names, named inboxes, mobile numbers, or an identifier like an NPI that belongs to a person.
2. Where does each record come from? A source per record, such as a register file date or the URL where an email was published, lets you check it and answer a complaint.
3. How do you handle DROP and other deletion requests? Since 1 August 2026, a registered broker must process DROP lists at least every 45 days. Ask how often they do it and whether deleted people are suppressed in every later file.
4. Is the suppression list applied to my order? Data built weeks ago can include someone who has since asked to be deleted. Ask whether deletions are applied when your file is built.
5. Will you tell me about deletions after delivery? Ask whether the vendor passes on deletion requests for records you already received, and what you must do with them.
6. Can I check the registration myself? Look the company up in the agency's data broker registry rather than relying on a claim.

The registration and DROP duties fall on brokers, the businesses that sell. Buying a list to contact prospects doesn't, by itself, match the definition's "sells to third parties". Reselling it is different. Under the CCPA, a third party may not sell or share personal information that was sold to it "unless the consumer has received explicit notice and is provided an opportunity to exercise the right to opt-out" (Cal. Civ. Code 1798.115(d)). If your company is itself a CCPA business, the personal information you buy is covered by your own CCPA obligations.

How nodilist handles removal requests

Anyone can ask us to remove a practice, a name or an email, from any state, free and without ID, through data removal. Each row of our lists will be one office. The dentist list will carry the emails offices publish on their own websites, which are shared inboxes such as office@ and, where a practice publishes one, a named inbox at the practice's own domain. It will have no column for a person's name, and each email will carry the URL of the page where it was published. For a solo practice, the office name or NPI can be the practitioner's own.

A removal goes on a suppression list. Every file we build will be checked against that list, so a removed record stays out even if it reappears in NPPES or on a website. If a buyer already received the record, we tell them to delete it. The details are on the data removal page and in our privacy policy.

What this guide can't tell you

• Whether a particular company is a data broker. That depends on its revenue, what it sells and to whom, and how the "publicly available" exclusion applies to its data.
• What other states require. Several states have their own data broker or privacy laws with different definitions, and this guide covers California only.
• Future fees and dates. The agency sets registration and access fees each year, and the legislature amended the law in 2025. Check the agency's data broker page for current figures.

This is general information, not legal advice.