Lead Generation Companies: Are You a Data Broker Under California Law?
Why Lead Gen Companies Are Prime Targets
Lead generation is at the center of the data broker definition. If your business model involves collecting consumer information from one source and selling or sharing those leads with another business, you are almost certainly a data broker under California law. The key legal test is straightforward: you collect personal information about consumers with whom you do not have a direct relationship and you sell or share that information with third parties. Lead generation businesses do this by design.
Common Lead Gen Scenarios That Trigger Registration
Purchasing consumer contact lists from data vendors and reselling curated subsets to clients makes you a data broker. Operating a lead form on a website where consumers think they are contacting one company but their information is actually sold to multiple buyers makes you a data broker. Scraping or aggregating publicly available consumer information and packaging it for sale makes you a data broker. Using data append services to enrich leads before distributing them makes you a data broker. If any of these describe your operations, registration and DROP compliance are mandatory.
The Multi-Buyer Problem
Lead generation creates a unique compliance challenge because a single consumer's data may be sold to multiple buyers. When a deletion request comes through the DROP portal, you must not only delete the data from your own systems but also notify every buyer who received that lead. This requires maintaining a detailed record of which leads were sent to which buyers, a so-called Master Suppression List or downstream tracking system. Without this tracking, you cannot fulfill the downstream notification requirement.
Compliance Strategies for Lead Gen Agencies
Start by auditing your data flows end to end. Document every source of consumer data, every system it touches, and every buyer or partner it is shared with. Implement a Master Suppression List that is checked before every lead distribution to prevent re-sharing data for consumers who have submitted deletion requests. Update your contracts with both data suppliers and lead buyers to include DELETE Act compliance clauses. Set up automated processes to check the DROP portal regularly and cross-reference new deletion requests against your lead distribution records.
Get the industry-specific Lead Gen DROP Compliance SOP in our complete kit.