Commentary Addressing Risks and Opportunities Through the Life Cycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

As with many other areas of privacy law, it is not surprising that California continues to lead the nation in regulating data brokers – from promulgating new regulations to issuing a cluster of recent settlements. Therefore, it is crucial for companies to confirm whether they are subject to the Delete Act and pay careful attention to the registration and other regulatory requirements.

core/paragraph

In addition, with the Delete Act’s requirements related to the DROP (<a href="https://cppa.ca.gov/meetings/materials/20250306_07_item6_presentation.pdf" target="_blank" rel="noreferrer noopener">Delete Request and Opt-out Platform</a>) mechanism coming into effect on Jan. 1, 2026, companies need to begin preparing now to intake requests.

core/heading

Since 2019, California has required data brokers to register with the attorney general. In 2023, the Delete Act was passed, modifying the data broker registration law and imposing additional requirements. Specifically, the Delete Act requires data brokers to (1) provide additional information regarding their collection of three highly sensitive data types (minors’, precise geolocation and reproductive healthcare), (2) compile and provide metrics regarding opt-out requests received, and (3) participate in a new deletion mechanism. This mechanism will allow consumers to submit an opt-out request to all registered data brokers simultaneously.

Effective Jan. 1, 2024, the Delete Act also shifted the responsibility of maintaining and administering, as well as rulemaking authority over, the California data broker registry to the California Privacy Protection Agency (CPPA).

As of March 10, the Enforcement Division of the CPPA has announced six different data broker settlements as part of the ongoing investigatory sweep <a href="https://cppa.ca.gov/announcements/2024/20241030.html" target="_blank" rel="noreferrer noopener">announced last October</a>. At that time, former CPPA Executive Director Ashkan Soltani had forewarned: “It’s crucial for data brokers to register with our agency so the public can be informed and empowered to exercise their rights. And starting in 2026, these rights will be even stronger with the new deletion mechanism.”

All the settlements to date have focused on a failure to timely register; however, <a href="https://cppa.ca.gov/announcements/2025/20250227.html" target="_blank" rel="noreferrer noopener">the latest settlement</a>, approved on Feb. 26<a>,</a> included additional findings and involved a data broker, Background Alert, that allegedly drew inferences from public records to identify people who “may somehow be associated with” a searched-for individual and identified patterns to generate profiles about consumers. While this is the first time “inferences” has been the subject of a settlement by the CPPA, the interpretation that “inferences” could be personal information – even if derived from publicly available information – is not new. This categorization is consistent with <a href="https://oag.ca.gov/system/files/opinions/pdfs/20-303.pdf" target="_blank" rel="noreferrer noopener">previous guidance</a> from California Attorney General Rob Bonta regarding disclosing inferences in response to a right-to-know request. Significantly, as part of the settlement, Background Alert must cease operating as a data broker for three years – the most severe penalty to date in this recent string of data broker enforcement actions.

Along with the slew of settlements, the CPPA has been busy proposing amendments to the Delete Act’s regulations. These changes include:

New definition of “direct relationship.” The latest draft amendments to the regulations removed the three-year lookback period and added language stating that a business has a direct relationship if the consumer intends to interact with the business. An example provided during the March 7 CPPA board meeting described intent in the context of a consumer shopping online for shoes. Specifically, the CPPA provided an example outlining the difference in intent when a consumer is interacting with a shoe business versus when the consumer is interacting with cookies that the shoe business website may deploy. The consumer intends to buy a pair of shoes; however, the consumer does not necessarily intend to disclose their personal information to cookie providers. Under this example, the shoe business would be considered to have a direct relationship with the consumer, but the cookie providers would not.

core/list-item

New definition of “personal information associated with a matched identifier.” In line with the latest data broker settlement, the revised definition “does not include personal information that is subject to applicable exemptions, but includes inferences made from the personal information.”

core/list

During the CPPA board meeting, board members indicated that they were on track to meet the Jan. 1, 2026, rollout date for the <a href="https://cppa.ca.gov/meetings/materials/20250306_07_item6_presentation.pdf" target="_blank" rel="noreferrer noopener">DROP mechanism</a> and that the board was exploring using login.gov as the verification provider (the same verification provider for other California agencies, such as the Department of Motor Vehicles). Lastly, the CPPA board voted in favor of moving the latest Delete Act draft amendments to formal rulemaking.

On March 3, the CPPA released the <a href="https://cppa.ca.gov/data_broker_registry/" target="_blank" rel="noreferrer noopener">2025 data broker registry list</a>. Notably, the number of registered data brokers is slightly down compared to last year, due perhaps in part to the recent increase in the registration fee (previously $400, currently $6,600). During the CPPA board meeting, attorneys for the agency explained that businesses provided different possible reasons for no longer registering: (1) They sold or shuttered that part of their business, (2) they no longer broker personal information in California, or (3) they had originally registered out of an abundance of caution but reevaluated their position in light of the fee increase.

At the Annual California Lawyer’s Association Privacy Law Summit (CLA Privacy Summit) held Feb. 27 and 28 and during the March 7 CPPA board meeting, commentators raised scrutiny and discussion about the higher registration fee (which agency attorneys assert is necessary to fund development of the DROP mechanism). In particular, public comments and CLA Privacy Summit panelists echoed concerns that (1) data brokers cannot necessarily afford such a high fee, and (2) the broad definition of “data broker” ensnares a variety of businesses, including companies that purchase data and further sell that data downstream, that would not traditionally be viewed as data brokers.

Data brokers will continue to receive scrutiny from both regulators and consumers. Businesses should determine whether they need to register as a data broker, register as a data broker (if applicable) or document why they are not required to register, and take steps to prepare for compliance with the DROP mechanism.

More Scrutiny of California Data Brokers