CPPA Settles With First Set of Data Brokers
SACRAMENTO – The Enforcement Division of the California Privacy Protection Agency (CPPA) has reached settlements with two data brokers, Growbots, Inc. and UpLead LLC for failing to register and pay an annual fee as required by Senate Bill 362. The CPPA’s Board voted unanimously to approve the settlements during a closed session of its November 8, 2024 meeting.
The settlements come on the heels of the Enforcement Division’s investigative sweep of data broker registration compliance, announced on October 30.
Growbots will pay $35,400 to resolve the Enforcement Division’s claims that the company failed to register between February 1 and July 26, 2024. UpLead will pay $34,400 to resolve the Enforcement Division’s claims that the company failed to register between February 1 and July 21, 2024. In addition to the fines, both companies agreed to injunctive terms, including agreeing to pay the Enforcement Division’s attorney fees and costs resulting from any non-compliance.
The Delete Act imposes fines of $200 per day for failing to register by the deadline. It was authored by Senator Josh Becker and signed into law by Governor Gavin Newsom in 2023.
“Data brokers come in all shapes and sizes, but they have one thing in common: they present extraordinary risk to our privacy by buying and selling our personal information,” said CPPA’s head of enforcement, Michael Macko. “California law doesn’t allow these businesses to operate in the shadows. Our team will continue to enforce the law vigorously.”
"Today’s settlements mark a significant victory for Californians' right to privacy,” stated Senator Josh Becker. “By holding these data brokers accountable, we are sending a clear message that companies must respect people’s right to control their personal information. This is a critical step in enforcing the Delete Act and protecting individuals from unwanted tracking and data exploitation. I applaud the California Privacy Protection Agency for its work to get privacy back in the hands of California residents.”
The Delete Act requires data brokers to register and pay an annual fee that funds the California Data Broker Registry which is hosted at https://cppa.ca.gov/data_broker_registry/. The fees also fund development of the first-of-its-kind deletion mechanism, called the Data Broker Requests and Opt-Out Platform (DROP), that will allow a consumer to direct all data brokers to delete their personal information in a single request. DROP will be available to consumers in 2026 via the CPPA website.
“In today’s hyperpolarized climate, the potential harm that can arise from the surreptitious abuse of personal information is greater than ever,” said CPPA’s Executive Director Ashkan Soltani. “Data brokers expose Californians to significant risks and it’s imperative that businesses that broker in consumer’s most private information register with the agency and give consumers the necessary transparency contemplated by the Delete Act. I’m incredibly grateful to the Enforcement Division for investing the resources to ensure the registry works as intended.”
About Us
The California Privacy Protection Agency (CPPA) is committed to promoting the education and awareness of consumers’ privacy rights and businesses’ responsibilities under the California Consumer Privacy Act.
Individuals can visit privacy.ca.gov to access helpful and up-to-date information on how to exercise their rights and protect their personal information. In addition, the Agency’s website provides important information about CPPA board meetings, announcements, and the rulemaking process.