The question at hand
California's privacy legislation puts data brokers in a tough spot: comply with state registration requirements now or wait for potential federal laws. This decision impacts your compliance budget, litigation risk, and whether you're building lasting infrastructure or just temporary fixes.
The debate involves two main views. One side sees California's rules as a baseline, suggesting early compliance builds strong practices. The other side warns that investing in state-specific requirements could lead to wasted resources if federal laws change the standards. Both perspectives involve real costs and risks.
The case for immediate California compliance
California accounts for about 12% of the U.S. population and includes many high-value consumers. If you're handling data on Californians, you're already under CCPA obligations, registered or not. Registering makes your operations visible to the Attorney General, which can be beneficial. It shows good-faith compliance when the California Privacy Protection Agency starts enforcement.
Building technical infrastructure for California compliance isn't wasted. Systems for handling deletion requests, mapping data processing, and managing consent are essential under any privacy law. Whether federal law overrides California or adopts its framework, you'll need these systems. Building them now means you're prepared for enforcement.
Website tracking litigation is a warning. Companies that delayed implementing consent mechanisms face lawsuits over wiretapping and deceptive practices. Retrofitting consent infrastructure under pressure is costly. Data broker registration follows the same logic: the longer you delay, the more expensive compliance becomes.
The case for strategic delay
The wait-and-see approach focuses on managing resources amid uncertainty. Federal privacy legislation has been "imminent" for years, with several bills proposing a national framework that might override state laws. Building California-specific systems now could mean redoing everything if federal laws change.
Registration requirements differ across states. California's definition of "data broker" might not match those in Vermont or Oregon. Building compliance around California's rules could lead to work that doesn't apply elsewhere. A federal law harmonizing these definitions would make that work unnecessary.
Registration involves detailed disclosures about data sources, purposes, and third-party recipients. Keeping these updated as partnerships change is a significant burden. If federal laws eliminate this requirement, that effort is wasted.
Some organizations are taking a middle path: setting up core consumer rights systems but delaying registration until enforcement patterns are clearer. This approach respects privacy obligations while staying flexible for federal requirements. It's a calculated risk that federal action will come before state enforcement intensifies.
Where practitioners actually land
In reality, most data brokers aren't choosing one path. They're tailoring their compliance based on data volume, processing sensitivity, and litigation risk. High-volume brokers with significant California exposure are registering and building full compliance systems. Smaller operations with less California activity are setting up consumer rights systems but delaying registration.
Litigation risk often outweighs regulatory risk. Website tracking litigation acts as a secondary enforcement mechanism. If your activities involve web tracking or Behavioural Advertising, the risk of class actions likely surpasses the cost of California compliance.
Organizations already complying with GDPR find California's requirements less challenging. The systems for data access requests, purpose limitation, and consent management align with CCPA obligations. For these teams, California compliance is an incremental cost.
Our take
Register now if you're handling significant California data, and consider federal preemption a bonus, not a certainty. The infrastructure you build for California compliance supports any privacy regime. Assuming federal law will differ significantly from California's is risky, given California's influence on national privacy debates.
The real risk isn't wasted compliance investment; it's being unprepared when enforcement or litigation hits. Data brokers not registering are betting they'll avoid detection until federal preemption arrives. That's a risky bet: if you're wrong, you'll face penalties, litigation costs, and rushed remediation.
Build the infrastructure. Register if you meet the threshold. Document your compliance decisions. If federal law simplifies your obligations, you'll have overcomplied temporarily. If not, you'll avoid the penalties of late compliance. The cost of being early is manageable. The cost of being late compounds.
