California Actively Enforcing its Delete Act against Data Brokers

By: Nicole Kardell

If you are a data broker and you are not registered in California, you may face sanctions, including fines and possible shut down of operations.  The California Privacy Protection Agency is actively enforcing the state’s Delete Act, legislation that was enacted in 2023. The Delete Act requires entities that qualify as data brokers under the law to register annually with the CPPA and pay the associated fee.

In October 2024, the CPPA announced that it would start a sweep to investigate and penalize data brokers that failed to comply.  Making good on its promise, the agency recently released a statement that it settled with a data broker, Background Alert, Inc., for failing to register.  The settlement requires the company to shut down its operations through 2028 or pay a $50,000 fine.

The CPPA’s action against Background Alert, Inc. is not a one-off. The agency has settled with five other data brokers and recently initiated another enforcement action as a part of its sweep.

Some Details On the Delete Act:

Who Must Comply: A data broker is defined under the Delete Act as a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.  Exempted from the definition are entities that fall under the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, California’s Insurance Information and Privacy Protection Act, or are otherwise exempt under the CCPA.

What Does Registration Entail:  Data brokers can access information about registration at the CPPA’s website at https://cppa.ca.gov/data_broker_registry/.  The registration process includes providing details on a CPPA-generated form about the business and paying an annual fee of $6,600 (plus processing fees).

What Happens If You Fail to Register: Data brokers who fail to register face penalties of $200 per day and possible enforcement action by the CPPA.

Important Future Requirements: Data brokers will also need to prepare for future compliance requirements that go into effect at future dates:

• July 1, 2025: data brokers will be required to collect and report specific information on their website’s privacy policy, including specific details about consumers rights requests that they received, complied with, and denied (metrics will be reportable at the next annual registration).
• August 1, 2026: data brokers must access the deletion mechanism (the Delete’s Act’s Data Broker Requests and Opt-Out Platform, which will be implemented at a future date) at least once every 45 days and process all deletion requests, subject to limited exceptions.
• January 1, 2028, and every 3 years thereafter: data brokers will be required to undergo an audit by an independent third party to determine compliance with the law’s requirements and submit the audit report to the CPPA upon its written request.
• January 1, 2029: registered data brokers will be required to disclose whether they have undergone the audit.