CalPrivacy Launches Data Broker Enforcement Strike Force

News:

SACRAMENTO — The California Privacy Protection Agency (CalPrivacy) is creating a Data Broker Enforcement Strike Force within its Enforcement Division to investigate privacy violations by the data broker industry. The Enforcement Division will be reviewing the industry for compliance with the data broker registration requirement in the Delete Act, as well as for compliance with the state’s comprehensive privacy law, the California Consumer Privacy Act (CCPA)

The Strike Force builds upon the Agency’s 2024 investigative sweep into data broker compliance with the Delete Act’s registration requirement. The investigative sweep has led to a record-setting number of enforcement actions and remains ongoing, but the Strike Force will provide additional resources to combat potential violations and will empower the Agency to pursue additional investigations.

“For decades, strike forces have been a mainstay at U.S. Attorney offices and state Attorney General offices across the United States. We intend to bring the same level of intensity to our investigations into the data broker industry,” said Michael Macko, CalPrivacy’s head of enforcement.

“Data brokers pose unique risks to Californians through the industrial-scale collection and sale of our personal information. The widespread availability of digital dossiers makes it easier for our personal information to be weaponized against us, and even well-meaning data brokers can be victims of data breaches that leave all of us vulnerable,” said Tom Kemp, CalPrivacy’s executive director. “We must do everything we can to reduce these risks, bring transparency, and hold data brokers accountable to their obligations under the CCPA and Delete Act.”

The Delete Act requires data brokers to register and pay an annual fee that funds the California Data Broker Registry. The fees also fund the development of the first-of-its-kind deletion mechanism, called the Delete Request and Opt-Out Platform (DROP), that will allow consumers to direct all data brokers to delete their personal information in a single request. DROP will be available to consumers in January 2026.

CalPrivacy’s Recent Enforcement Actions to Protect Californians

CalPrivacy is actively enforcing California's cutting-edge privacy laws. Recent actions include:

  • Issuing a decision requiring Tractor Supply Company, the nation’s largest rural lifestyle retailer, to pay a $1.35M fine and change its business practices for CCPA violations.
  • Issuing a decision requiring a nationwide clothing retailer, Todd Snyder, Inc., to change its business practices and pay a $345,178 fine for CCPA violations.
  • Issuing a decision requiring American Honda Motor Co. to change its business practices and pay a $632,500 fine for CCPA violations.
  • Securing a settlement agreement requiring data broker Background Alert — which promoted its ability to dig up “scary” amounts of information about people – to shut down or pay a steep fine.
  • Ordering Washington-based data broker Accurate Append, Inc., to pay a fine for failing for register with the Agency.
  • Bringing nearly a half-dozen enforcement actions against additional unregistered data brokers.
  • Launching the bipartisan Consortium of Privacy Regulators to collaborate with states across the country to implement and enforce privacy laws nationwide.
  • Partnering with the data protection authorities in Korea, France, and the United Kingdom to share information and advance privacy protections for Californians.

ABOUT US

The California Privacy Protection Agency (CalPrivacy) is committed to promoting the education and awareness of consumers' privacy rights and businesses' responsibilities under the California Consumer Privacy Act and the Delete Act.

Individuals can visit Privacy.ca.gov to access helpful and up-to-date information on how to exercise their rights, protect their personal information, and learn about the Delete Request and Opt-out Platform (DROP). In addition, CalPrivacy’s website provides important information about Board Meetings, announcements, and the rulemaking process.